July 2018 - cypherpunks-legacy

None
by Jim Salters 06 Jul '18

06 Jul '18

*** Feb/March Project Update *** Since our last update, 22 companies have committed to participate and launch the Image Quality and Usability Assurance: Phase I project. Also, we completed the SVPCo/FSTC Black and White vs. Gray-Scale in Bank Operations project in February, and SVPCo is now utilizing that report as a key component of its planning. Lastly, our Minimum Required Practices for Global Sourcing project has issued a call for participation, and commitments are being made by both financial institutions and technology partners. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing projects, we provide our colleagues this periodic project update. As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Business Continuity: Technology Best Practices Expertise Center (launched Nov 2003) 2. Survivability of Check Security Features in an Imaged Environment (launched Oct 2003) 3. Image Quality and Usability Assurance: Phase I (launching March 2004) Projects in Formation: 1. Minimum Required Practices for Global Sourcing (call for participation issued) 2. Phishing and Financial Services 3. eBilling Self Service through Federated Identity 4. Biometrics in Financial Services: Assessment and Action 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) 6. A Federated Identity Implementation Framework for Secure Email (on hold) 7. Transformation to Open Mission Critical Systems ______________ ACTIVE PROJECTS: 1. Business Continuity: Technology Best Practices Expertise Center http://fstc.org/projects/dr-bestpractices/ The Technology Best Practices Expertise Center Phase I initiative has brought industry leaders together to jointly develop consolidated, industry-vetted best practices and actionable recommendations for technology recovery in post-outage, remote recovery. Regulatory compliance will be a key requirement considered by the team. The resulting documentation will define best practices, identify key challenges and gaps in available solutions, and identify recommendations for further actions (such as testing) in future efforts. The objective is to enable participating companies to recover in a cost-effective manner, to validate and compare their own recovery strategies with their peers, and to address regulatory compliance in an industry forum. The project launched on November 5, 2003 in New York, and is expected to conclude in April 2004. Project participants include: Bank One, Bank of America, Comerica, JPMorgan Chase, Huntington, RBC Financial, US Bank, Wachovia, and IBM. This initiative originated in our Business Continuity SCOM. (http://fstc.org/advisory/business-continuity.cfm) ______________ 2. Survivability of Check Security Features in an Imaged Environment http://fstc.org/projects/new.cfm#securityfeatures In this project, participating financial institutions and partner technology companies are selecting current and proposed (next-generation) check security features. Working with participating industry partners and financial institutions, the project will test the survivability of these check security features in high-speed and low-speed capture, in both gray scale and black & white imaged environments. The result will be an independent indication as to the viability of current and proposed next-generation check security features in a truncated (imaged) environment. This project launched in October 2003, held its first in-person meeting November 18th in Charlotte, hosted by IBM, and is expected to conclude in the April 2004 timeframe. Project participants include Bank of America, Canadian Payments Association, Comerica, Federal Reserve, First Citizens, JPMorgan Chase, US Treasury, Wachovia, Wells Fargo, and Zions Bank; ASD Corp, Cheque Guard, Clarke American, Deluxe, Fiserv, Harland, IBM, and SQN Banking Systems. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) ______________ 3. Image Quality and Usability Assurance: Phase I http://fstc.org/projects/new.cfm#imagequality A group of FSTC member institutions and technology companies convened January 13th in Atlanta to develop an initial set of objectives and deliverables for a Phase I FSTC image quality initiative. The goal is to bring financial institutions together with key technology partners to better understand the current industry activities in the area of image quality, identify critical challenges yet to be addressed, and leverage the FSTC project environment as a place to undertake key collaborative development, testing, prototyping, and specification required to ultimately ensure minimum image quality assessment capabilities in centralized and distributed capture points, regardless of vendor or institution. The ultimate objective is to prevent unusable check images (and their financial exposure) from entering the payment system. A call for participation was issued February 4, and since then 22 companies have committed to pariticpate. The first in-person project meeting will be held April 2nd in San Francisco, following the FSTC/ABA/Federal Reserve/SVPCo Image Assurance and Security event March 31-April 1 at the Fairmont (http://fstc.org/meetings/next.cfm) The project is expected to run for 90 days, and conclude in June 2004. ______________ PROJECTS IN FORMATION: 1. Minimum Required Practices for Global Sourcing http://fstc.org/projects/new.cfm#offshore This primary objective of this initiative is to develop a comprehensive set of tactical minimum required practices for both financial institutions and vendors, as a baseline for the industry. With increasing regulatory interest, and a desire to collaborate to improve the overall strength of the financial industry, FSTC members have defined a series of activities for 2004 that address key gaps and opportunities shared by FSTC member institutions. Areas of interest include data privacy, business continuity, governance, safeguarding intellectual property, and others. An in-person meeting was held February 26th in Orlando, bringing our core group together with a broader industry audience to share the group's vision, as well as further refine the scope, objectives, and next steps. A call for participation has been issued, and a number of financial institutions and technology partners have committed to participate. Please contact Zach Tumin (zachary.tumin(a)fstc.org) for more information. ______________ 2. Phishing in Financial Services FSTC member-institutions have expressed an interest in understanding and addressing, at a technical level, the complex problem of phishing via both email and web sites. A core group is developing a strawman statement of financial institution requirements regarding phishing that will address issues of ease of use and acceptance, effectiveness, cost and complexity of implementation, and required industry coordination. When validated with a larger group of financial institutions and technology providers, it is the intention of these members to inventory and evaluate current vendor solutions against the set of known threat models and financial institution requirements, and to work with industry groups to prove/test/validate those solutions. For more information, please contact Zach Tumin (zachary.tumin(a)fstc.org) An FI-only project definition session is being held March 24th in New York to begin this process. ______________ 3. eBilling Self Service Through Federated Identity This proposed project would seek to bring FSTC members together to define an implementation framework for using federated identity standards such as SAML to link financial institution sites with biller self-service sites. The proposition for billers is reduced identity management costs and increased adoption, while financial institutions benefit from increased online traffic, stronger customer service, and increased use of online services. Customers will benefit from having a consolidated access point for disparate billing sites and fewer usernames and passwords to remember. A core group of financial institutions and technology companies are currently developing this concept, and developing an initial set of use cases. Also, these companies are talking to billers and banks who might participate in a pilot. We expect to be able to share more information about this project soon. ______________ 4. Biometrics in Financial Services: Assessment and Action Using as a basis the internal control objectives and practices of the ANSI Standard X9.84 - 2003, Security and Management of Biometric Data, a core group of interested FSTC members is developing a project concept to assist financial institutions in determining the viability of biometric technologies in several financial institution-specific use cases, including account openings. As currently conceived, this effort will culminate in the assessment of the current state (2004) and desired future state of biometric standardization, technologies, and business process efforts, and produce a statement of financial institution requirements and recommendations on issues of interoperability, security and management, and customer service for critical business processes. The requirements for institutions to utilize data in a standardized and privacy-aware fashion will be a important performance metric. Ultimately, the project may include the development of a reference implementation and the deployment of a pilot system to validate the reference implementation. ______________ 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) http://fstc.org/projects/new.cfm#tsi As a potential Phase II following the previous Web Services for Corporate Cash Management effort, a core group of FSTC institutions and technology companies have defined key business objectives and deliverables for a discovery phase, and subsequent pilot-level project utilizing Web Services in the Treasury Services / Cash Management area. The project, as it currently stands, will seek to further develop the Phase I set of web services and associated definitions to create new and open-standards-based connectivity options between banks, and between banks and their customers. The business goals are to enable standards-based "plug-and-play" integration capabilities between institutions and customer platforms, whether ERP, Treasury Work Station (TWS), or desktop. A core group of financial institutions and technology companies has committed to launching this initiative in the second half of 2004. This project is considered on-hold until later this year. ______________ 6. A Federated Identity Implementation Framework for Secure Email (on hold) Coming from discussions in the FSTC Advisory Council Security and Infrastructure Standing Committee (SCOM) (http://fstc.org/advisory/security.cfm) FSTC members are putting plans together to create a federated identity implementation framework, with the primary application being secure email. The primary business objectives are to create interoperability for shared customers and business partners, as well as to reduce the cost of managing identity databases internally within institutions. The project would deliver a set of technical, business, and legal/regulatory definitions to create a framework for the industry to utilize in secure email and ultimately other applications. An in-person session was held January 8th in Boston, hosted by Fidelity. A revised proposal was developed coming out of this meeting, however, given the relative immaturity of secure email technology and solutions that have been selected and implemented within FSTC member institutions, the team agreed that this project should be put on hold while those decisions are made. It is expected that later in the year, a discussion about enhancing secure email through federation will be started up again. ______________ 7. Transformation to Open Mission Critical Systems The transformation of systems from higher cost or proprietary delivery to open systems is one of the most hotly debated and discussed topics in financial services IT. While there is great promise in the flexibility and efficiencies gained, there is also risk and cost. An FSTC project will soon form up to determine answers to such key questions as, "Are those transformations viable?" and "What are the costs and processes by which a successful transformation program will be run?" The vision of this initiative is to bring together financial institutions to investigate the needs, processes, best practices, technology issues, risk factors, organizational issues and lessons-learned for transformation projects which move core business processes from legacy IT assets to open systems. We will provide additional details shortly. If you are interested in joining an interest group around this topic, please contact us. ______________ ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Jim Salters 06 Jul '18

06 Jul '18

*** Feb/March Project Update *** Since our last update, 22 companies have committed to participate and launch the Image Quality and Usability Assurance: Phase I project. Also, we completed the SVPCo/FSTC Black and White vs. Gray-Scale in Bank Operations project in February, and SVPCo is now utilizing that report as a key component of its planning. Lastly, our Minimum Required Practices for Global Sourcing project has issued a call for participation, and commitments are being made by both financial institutions and technology partners. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing projects, we provide our colleagues this periodic project update. As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Business Continuity: Technology Best Practices Expertise Center (launched Nov 2003) 2. Survivability of Check Security Features in an Imaged Environment (launched Oct 2003) 3. Image Quality and Usability Assurance: Phase I (launching March 2004) Projects in Formation: 1. Minimum Required Practices for Global Sourcing (call for participation issued) 2. Phishing and Financial Services 3. eBilling Self Service through Federated Identity 4. Biometrics in Financial Services: Assessment and Action 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) 6. A Federated Identity Implementation Framework for Secure Email (on hold) 7. Transformation to Open Mission Critical Systems ______________ ACTIVE PROJECTS: 1. Business Continuity: Technology Best Practices Expertise Center http://fstc.org/projects/dr-bestpractices/ The Technology Best Practices Expertise Center Phase I initiative has brought industry leaders together to jointly develop consolidated, industry-vetted best practices and actionable recommendations for technology recovery in post-outage, remote recovery. Regulatory compliance will be a key requirement considered by the team. The resulting documentation will define best practices, identify key challenges and gaps in available solutions, and identify recommendations for further actions (such as testing) in future efforts. The objective is to enable participating companies to recover in a cost-effective manner, to validate and compare their own recovery strategies with their peers, and to address regulatory compliance in an industry forum. The project launched on November 5, 2003 in New York, and is expected to conclude in April 2004. Project participants include: Bank One, Bank of America, Comerica, JPMorgan Chase, Huntington, RBC Financial, US Bank, Wachovia, and IBM. This initiative originated in our Business Continuity SCOM. (http://fstc.org/advisory/business-continuity.cfm) ______________ 2. Survivability of Check Security Features in an Imaged Environment http://fstc.org/projects/new.cfm#securityfeatures In this project, participating financial institutions and partner technology companies are selecting current and proposed (next-generation) check security features. Working with participating industry partners and financial institutions, the project will test the survivability of these check security features in high-speed and low-speed capture, in both gray scale and black & white imaged environments. The result will be an independent indication as to the viability of current and proposed next-generation check security features in a truncated (imaged) environment. This project launched in October 2003, held its first in-person meeting November 18th in Charlotte, hosted by IBM, and is expected to conclude in the April 2004 timeframe. Project participants include Bank of America, Canadian Payments Association, Comerica, Federal Reserve, First Citizens, JPMorgan Chase, US Treasury, Wachovia, Wells Fargo, and Zions Bank; ASD Corp, Cheque Guard, Clarke American, Deluxe, Fiserv, Harland, IBM, and SQN Banking Systems. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) ______________ 3. Image Quality and Usability Assurance: Phase I http://fstc.org/projects/new.cfm#imagequality A group of FSTC member institutions and technology companies convened January 13th in Atlanta to develop an initial set of objectives and deliverables for a Phase I FSTC image quality initiative. The goal is to bring financial institutions together with key technology partners to better understand the current industry activities in the area of image quality, identify critical challenges yet to be addressed, and leverage the FSTC project environment as a place to undertake key collaborative development, testing, prototyping, and specification required to ultimately ensure minimum image quality assessment capabilities in centralized and distributed capture points, regardless of vendor or institution. The ultimate objective is to prevent unusable check images (and their financial exposure) from entering the payment system. A call for participation was issued February 4, and since then 22 companies have committed to pariticpate. The first in-person project meeting will be held April 2nd in San Francisco, following the FSTC/ABA/Federal Reserve/SVPCo Image Assurance and Security event March 31-April 1 at the Fairmont (http://fstc.org/meetings/next.cfm) The project is expected to run for 90 days, and conclude in June 2004. ______________ PROJECTS IN FORMATION: 1. Minimum Required Practices for Global Sourcing http://fstc.org/projects/new.cfm#offshore This primary objective of this initiative is to develop a comprehensive set of tactical minimum required practices for both financial institutions and vendors, as a baseline for the industry. With increasing regulatory interest, and a desire to collaborate to improve the overall strength of the financial industry, FSTC members have defined a series of activities for 2004 that address key gaps and opportunities shared by FSTC member institutions. Areas of interest include data privacy, business continuity, governance, safeguarding intellectual property, and others. An in-person meeting was held February 26th in Orlando, bringing our core group together with a broader industry audience to share the group's vision, as well as further refine the scope, objectives, and next steps. A call for participation has been issued, and a number of financial institutions and technology partners have committed to participate. Please contact Zach Tumin (zachary.tumin(a)fstc.org) for more information. ______________ 2. Phishing in Financial Services FSTC member-institutions have expressed an interest in understanding and addressing, at a technical level, the complex problem of phishing via both email and web sites. A core group is developing a strawman statement of financial institution requirements regarding phishing that will address issues of ease of use and acceptance, effectiveness, cost and complexity of implementation, and required industry coordination. When validated with a larger group of financial institutions and technology providers, it is the intention of these members to inventory and evaluate current vendor solutions against the set of known threat models and financial institution requirements, and to work with industry groups to prove/test/validate those solutions. For more information, please contact Zach Tumin (zachary.tumin(a)fstc.org) An FI-only project definition session is being held March 24th in New York to begin this process. ______________ 3. eBilling Self Service Through Federated Identity This proposed project would seek to bring FSTC members together to define an implementation framework for using federated identity standards such as SAML to link financial institution sites with biller self-service sites. The proposition for billers is reduced identity management costs and increased adoption, while financial institutions benefit from increased online traffic, stronger customer service, and increased use of online services. Customers will benefit from having a consolidated access point for disparate billing sites and fewer usernames and passwords to remember. A core group of financial institutions and technology companies are currently developing this concept, and developing an initial set of use cases. Also, these companies are talking to billers and banks who might participate in a pilot. We expect to be able to share more information about this project soon. ______________ 4. Biometrics in Financial Services: Assessment and Action Using as a basis the internal control objectives and practices of the ANSI Standard X9.84 - 2003, Security and Management of Biometric Data, a core group of interested FSTC members is developing a project concept to assist financial institutions in determining the viability of biometric technologies in several financial institution-specific use cases, including account openings. As currently conceived, this effort will culminate in the assessment of the current state (2004) and desired future state of biometric standardization, technologies, and business process efforts, and produce a statement of financial institution requirements and recommendations on issues of interoperability, security and management, and customer service for critical business processes. The requirements for institutions to utilize data in a standardized and privacy-aware fashion will be a important performance metric. Ultimately, the project may include the development of a reference implementation and the deployment of a pilot system to validate the reference implementation. ______________ 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) http://fstc.org/projects/new.cfm#tsi As a potential Phase II following the previous Web Services for Corporate Cash Management effort, a core group of FSTC institutions and technology companies have defined key business objectives and deliverables for a discovery phase, and subsequent pilot-level project utilizing Web Services in the Treasury Services / Cash Management area. The project, as it currently stands, will seek to further develop the Phase I set of web services and associated definitions to create new and open-standards-based connectivity options between banks, and between banks and their customers. The business goals are to enable standards-based "plug-and-play" integration capabilities between institutions and customer platforms, whether ERP, Treasury Work Station (TWS), or desktop. A core group of financial institutions and technology companies has committed to launching this initiative in the second half of 2004. This project is considered on-hold until later this year. ______________ 6. A Federated Identity Implementation Framework for Secure Email (on hold) Coming from discussions in the FSTC Advisory Council Security and Infrastructure Standing Committee (SCOM) (http://fstc.org/advisory/security.cfm) FSTC members are putting plans together to create a federated identity implementation framework, with the primary application being secure email. The primary business objectives are to create interoperability for shared customers and business partners, as well as to reduce the cost of managing identity databases internally within institutions. The project would deliver a set of technical, business, and legal/regulatory definitions to create a framework for the industry to utilize in secure email and ultimately other applications. An in-person session was held January 8th in Boston, hosted by Fidelity. A revised proposal was developed coming out of this meeting, however, given the relative immaturity of secure email technology and solutions that have been selected and implemented within FSTC member institutions, the team agreed that this project should be put on hold while those decisions are made. It is expected that later in the year, a discussion about enhancing secure email through federation will be started up again. ______________ 7. Transformation to Open Mission Critical Systems The transformation of systems from higher cost or proprietary delivery to open systems is one of the most hotly debated and discussed topics in financial services IT. While there is great promise in the flexibility and efficiencies gained, there is also risk and cost. An FSTC project will soon form up to determine answers to such key questions as, "Are those transformations viable?" and "What are the costs and processes by which a successful transformation program will be run?" The vision of this initiative is to bring together financial institutions to investigate the needs, processes, best practices, technology issues, risk factors, organizational issues and lessons-learned for transformation projects which move core business processes from legacy IT assets to open systems. We will provide additional details shortly. If you are interested in joining an interest group around this topic, please contact us. ______________ ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Bulk of 2004's virus infections pinned on one man
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Bulk of 2004's virus infections pinned on one man
by Randall 06 Jul '18

06 Jul '18

(And he may even be guilty!) http://news.com.com/Bulk+of+year%27s+PC+infections+pinned+to+one+man/ 2100-7349_3-5287664.html?tag=st.pop Bulk of year's PC infections pinned to one man By Munir Kotadia Special to CNET News.com http://news.com.com/2100-7349-5287664.html Story last modified July 28, 2004, 2:08 PM PDT Sven Jaschan, self-confessed author of the Netsky and Sasser viruses, is responsible for 70 percent of virus infections in 2004, according to a six-month virus roundup published Wednesday by antivirus company Sophos. The 18-year-old Jaschan was taken into custody in Germany in May by police who said he had admitted to programming both the Netsky and Sasser worms, something experts at Microsoft confirmed. (A Microsoft antivirus reward program led to the teenager's arrest.) During the five months preceding Jaschan's capture, there were at least 25 variants of Netsky and one of the port-scanning network worm Sasser. Graham Cluley, senior technology consultant at Sophos, said it was staggering that one person could be responsible for so many infections. Richard Starnes, president of security industry group ISSA UK, was also impressed: "Is he going to put this on his CV?" he asked. Cluley said there is still a chance that others may be implicated in the Netsky virus, although so far no one else has been arrested. "The full story of the Netsky gang isn't known yet. We know some of his fellow students have been questioned, but the real motives are not fully known," said Cluley. According to Sophos, the Sasser worm came out on top with 26.1 percent of infections, while Netsky.p, Netsky.b and Netsky.d take second, third and fourth places respectively. The only non-Jaschan viruses in the top 10 are MyDoom.a (fifth place), Zafi.b (sixth place), Sober.c (ninth place) and Bagle.a (tenth place). "Sasser may have taken top spot, but six of the biggest viruses of the last six months were Netsky and Bagle variants--these caused a continued nuisance for PC users the world over as their authors entered into a very public game of virus writing one-upmanship," said Cluley. Starnes said that although Jaschan has been arrested, there are always other people willing to step into his shoes. "Virus writers tend to grow out of the hobby, but hackers do not tend to stop. There is a high turnover rate in the virus-writing community. There will always be somebody there to step in to fill the gap," he said. Cluley agreed, but pointed out that organized criminals are increasingly getting involved in virus writing and are less likely to be caught because they tend to be more careful. "There is a greater criminal element in virus writing than ever before. If you are an organized gang making money out of viruses and hacking, you don't go around bragging or having a playground scuffle that results in one of your number grassing you up to Microsoft," said Cluley. Munir Kotadia of ZDNet UK reported from London. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Tor 0.1.1.17-rc is out
by Roger Dingledine 06 Jul '18

06 Jul '18

This is the third release candidate for the 0.1.1.x series. It fixes several major bugs for clients and servers. It also adds a fourth authoritative directory server (finally). http://tor.eff.org/download.html Changes in version 0.1.1.17-rc - 2006-03-28 o Major fixes: - Clients and servers since 0.1.1.10-alpha have been expiring connections whenever they are idle for 5 minutes and they *do* have circuits on them. Oops. With this new version, clients will discard their previous entry guard choices and avoid choosing entry guards running these flawed versions. - Fix memory leak when uncompressing concatenated zlib streams. This was causing substantial leaks over time on Tor servers. - The v1 directory was including servers as much as 48 hours old, because that's how the new routerlist->routers works. Now only include them if they're 20 hours old or less. o Minor fixes: - Resume building on irix64, netbsd 2.0, etc. - On non-gcc compilers (e.g. solaris), use "-g -O" instead of "-Wall -g -O2". - Stop writing the "router.desc" file, ever. Nothing uses it anymore, and it is confusing some users. - Mirrors stop caching the v1 directory so often. - Make the max number of old descriptors that a cache will hold rise with the number of directory authorities, so we can scale. - Change our win32 uname() hack to be more forgiving about what win32 versions it thinks it's found. o New features: - Add lefkada.eecs.harvard.edu as a fourth authoritative directory server. - When the controller's *setconf commands fail, collect an error message in a string and hand it back to the controller. - Make the v2 dir's "Fast" flag based on relative capacity, just like "Stable" is based on median uptime. Name everything in the top 7/8 Fast, and only the top 1/2 gets to be a Guard. - Log server fingerprint on startup, so new server operators don't have to go hunting around their filesystem for it. - Return a robots.txt on our dirport to discourage google indexing. - Let the controller ask for GETINFO dir/status/foo so it can ask directly rather than connecting to the dir port. Only works when dirport is set for now. o New config options rather than constants in the code: - SocksTimeout: How long do we let a socks connection wait unattached before we fail it? - CircuitBuildTimeout: Cull non-open circuits that were born at least this many seconds ago. - CircuitIdleTimeout: Cull open clean circuits that were born at least this many seconds ago. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: TLS Man-In-The-Middle Vulnerability
by Marcus Griep 06 Jul '18

06 Jul '18

The ITEF Network Working Group has already begun drafting a new extension to TLS: Renegotiation Indication. https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegoti… -- Marcus Griep bb NN:N1N:N9N1 WW*.ON?B4, 3B0 On Thu, Nov 5, 2009 at 2:10 PM, Marcus Griep <tormaster(a)xpdm.us> wrote: > Don't know if any one else has seen or taken a look at this. I don't know > if this affects Tor, though I believe that we do use certificate > renegotiation in the protocol, and that is the entry vector for this > particular vulnerability: > > "TLS Man-in-the-middle on renegotiation vulnerability made public" > http://isc.sans.org/diary.html?storyid=7534 > -- > Marcus Griep > bb > NN:N1N:N9N1 WW*.ON?B4, 3B0 > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: TLS Man-In-The-Middle Vulnerability
by Marcus Griep 06 Jul '18

06 Jul '18

The ITEF Network Working Group has already begun drafting a new extension to TLS: Renegotiation Indication. https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegoti… -- Marcus Griep bb NN:N1N:N9N1 WW*.ON?B4, 3B0 On Thu, Nov 5, 2009 at 2:10 PM, Marcus Griep <tormaster(a)xpdm.us> wrote: > Don't know if any one else has seen or taken a look at this. I don't know > if this affects Tor, though I believe that we do use certificate > renegotiation in the protocol, and that is the entry vector for this > particular vulnerability: > > "TLS Man-in-the-middle on renegotiation vulnerability made public" > http://isc.sans.org/diary.html?storyid=7534 > -- > Marcus Griep > bb > NN:N1N:N9N1 WW*.ON?B4, 3B0 > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Jim Salters 06 Jul '18

06 Jul '18

*** Feb/March Project Update *** Since our last update, 22 companies have committed to participate and launch the Image Quality and Usability Assurance: Phase I project. Also, we completed the SVPCo/FSTC Black and White vs. Gray-Scale in Bank Operations project in February, and SVPCo is now utilizing that report as a key component of its planning. Lastly, our Minimum Required Practices for Global Sourcing project has issued a call for participation, and commitments are being made by both financial institutions and technology partners. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing projects, we provide our colleagues this periodic project update. As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Business Continuity: Technology Best Practices Expertise Center (launched Nov 2003) 2. Survivability of Check Security Features in an Imaged Environment (launched Oct 2003) 3. Image Quality and Usability Assurance: Phase I (launching March 2004) Projects in Formation: 1. Minimum Required Practices for Global Sourcing (call for participation issued) 2. Phishing and Financial Services 3. eBilling Self Service through Federated Identity 4. Biometrics in Financial Services: Assessment and Action 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) 6. A Federated Identity Implementation Framework for Secure Email (on hold) 7. Transformation to Open Mission Critical Systems ______________ ACTIVE PROJECTS: 1. Business Continuity: Technology Best Practices Expertise Center http://fstc.org/projects/dr-bestpractices/ The Technology Best Practices Expertise Center Phase I initiative has brought industry leaders together to jointly develop consolidated, industry-vetted best practices and actionable recommendations for technology recovery in post-outage, remote recovery. Regulatory compliance will be a key requirement considered by the team. The resulting documentation will define best practices, identify key challenges and gaps in available solutions, and identify recommendations for further actions (such as testing) in future efforts. The objective is to enable participating companies to recover in a cost-effective manner, to validate and compare their own recovery strategies with their peers, and to address regulatory compliance in an industry forum. The project launched on November 5, 2003 in New York, and is expected to conclude in April 2004. Project participants include: Bank One, Bank of America, Comerica, JPMorgan Chase, Huntington, RBC Financial, US Bank, Wachovia, and IBM. This initiative originated in our Business Continuity SCOM. (http://fstc.org/advisory/business-continuity.cfm) ______________ 2. Survivability of Check Security Features in an Imaged Environment http://fstc.org/projects/new.cfm#securityfeatures In this project, participating financial institutions and partner technology companies are selecting current and proposed (next-generation) check security features. Working with participating industry partners and financial institutions, the project will test the survivability of these check security features in high-speed and low-speed capture, in both gray scale and black & white imaged environments. The result will be an independent indication as to the viability of current and proposed next-generation check security features in a truncated (imaged) environment. This project launched in October 2003, held its first in-person meeting November 18th in Charlotte, hosted by IBM, and is expected to conclude in the April 2004 timeframe. Project participants include Bank of America, Canadian Payments Association, Comerica, Federal Reserve, First Citizens, JPMorgan Chase, US Treasury, Wachovia, Wells Fargo, and Zions Bank; ASD Corp, Cheque Guard, Clarke American, Deluxe, Fiserv, Harland, IBM, and SQN Banking Systems. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) ______________ 3. Image Quality and Usability Assurance: Phase I http://fstc.org/projects/new.cfm#imagequality A group of FSTC member institutions and technology companies convened January 13th in Atlanta to develop an initial set of objectives and deliverables for a Phase I FSTC image quality initiative. The goal is to bring financial institutions together with key technology partners to better understand the current industry activities in the area of image quality, identify critical challenges yet to be addressed, and leverage the FSTC project environment as a place to undertake key collaborative development, testing, prototyping, and specification required to ultimately ensure minimum image quality assessment capabilities in centralized and distributed capture points, regardless of vendor or institution. The ultimate objective is to prevent unusable check images (and their financial exposure) from entering the payment system. A call for participation was issued February 4, and since then 22 companies have committed to pariticpate. The first in-person project meeting will be held April 2nd in San Francisco, following the FSTC/ABA/Federal Reserve/SVPCo Image Assurance and Security event March 31-April 1 at the Fairmont (http://fstc.org/meetings/next.cfm) The project is expected to run for 90 days, and conclude in June 2004. ______________ PROJECTS IN FORMATION: 1. Minimum Required Practices for Global Sourcing http://fstc.org/projects/new.cfm#offshore This primary objective of this initiative is to develop a comprehensive set of tactical minimum required practices for both financial institutions and vendors, as a baseline for the industry. With increasing regulatory interest, and a desire to collaborate to improve the overall strength of the financial industry, FSTC members have defined a series of activities for 2004 that address key gaps and opportunities shared by FSTC member institutions. Areas of interest include data privacy, business continuity, governance, safeguarding intellectual property, and others. An in-person meeting was held February 26th in Orlando, bringing our core group together with a broader industry audience to share the group's vision, as well as further refine the scope, objectives, and next steps. A call for participation has been issued, and a number of financial institutions and technology partners have committed to participate. Please contact Zach Tumin (zachary.tumin(a)fstc.org) for more information. ______________ 2. Phishing in Financial Services FSTC member-institutions have expressed an interest in understanding and addressing, at a technical level, the complex problem of phishing via both email and web sites. A core group is developing a strawman statement of financial institution requirements regarding phishing that will address issues of ease of use and acceptance, effectiveness, cost and complexity of implementation, and required industry coordination. When validated with a larger group of financial institutions and technology providers, it is the intention of these members to inventory and evaluate current vendor solutions against the set of known threat models and financial institution requirements, and to work with industry groups to prove/test/validate those solutions. For more information, please contact Zach Tumin (zachary.tumin(a)fstc.org) An FI-only project definition session is being held March 24th in New York to begin this process. ______________ 3. eBilling Self Service Through Federated Identity This proposed project would seek to bring FSTC members together to define an implementation framework for using federated identity standards such as SAML to link financial institution sites with biller self-service sites. The proposition for billers is reduced identity management costs and increased adoption, while financial institutions benefit from increased online traffic, stronger customer service, and increased use of online services. Customers will benefit from having a consolidated access point for disparate billing sites and fewer usernames and passwords to remember. A core group of financial institutions and technology companies are currently developing this concept, and developing an initial set of use cases. Also, these companies are talking to billers and banks who might participate in a pilot. We expect to be able to share more information about this project soon. ______________ 4. Biometrics in Financial Services: Assessment and Action Using as a basis the internal control objectives and practices of the ANSI Standard X9.84 - 2003, Security and Management of Biometric Data, a core group of interested FSTC members is developing a project concept to assist financial institutions in determining the viability of biometric technologies in several financial institution-specific use cases, including account openings. As currently conceived, this effort will culminate in the assessment of the current state (2004) and desired future state of biometric standardization, technologies, and business process efforts, and produce a statement of financial institution requirements and recommendations on issues of interoperability, security and management, and customer service for critical business processes. The requirements for institutions to utilize data in a standardized and privacy-aware fashion will be a important performance metric. Ultimately, the project may include the development of a reference implementation and the deployment of a pilot system to validate the reference implementation. ______________ 5. Treasury Services Integration: Data Exchange and Customer Connectivity through Web Services (on hold) http://fstc.org/projects/new.cfm#tsi As a potential Phase II following the previous Web Services for Corporate Cash Management effort, a core group of FSTC institutions and technology companies have defined key business objectives and deliverables for a discovery phase, and subsequent pilot-level project utilizing Web Services in the Treasury Services / Cash Management area. The project, as it currently stands, will seek to further develop the Phase I set of web services and associated definitions to create new and open-standards-based connectivity options between banks, and between banks and their customers. The business goals are to enable standards-based "plug-and-play" integration capabilities between institutions and customer platforms, whether ERP, Treasury Work Station (TWS), or desktop. A core group of financial institutions and technology companies has committed to launching this initiative in the second half of 2004. This project is considered on-hold until later this year. ______________ 6. A Federated Identity Implementation Framework for Secure Email (on hold) Coming from discussions in the FSTC Advisory Council Security and Infrastructure Standing Committee (SCOM) (http://fstc.org/advisory/security.cfm) FSTC members are putting plans together to create a federated identity implementation framework, with the primary application being secure email. The primary business objectives are to create interoperability for shared customers and business partners, as well as to reduce the cost of managing identity databases internally within institutions. The project would deliver a set of technical, business, and legal/regulatory definitions to create a framework for the industry to utilize in secure email and ultimately other applications. An in-person session was held January 8th in Boston, hosted by Fidelity. A revised proposal was developed coming out of this meeting, however, given the relative immaturity of secure email technology and solutions that have been selected and implemented within FSTC member institutions, the team agreed that this project should be put on hold while those decisions are made. It is expected that later in the year, a discussion about enhancing secure email through federation will be started up again. ______________ 7. Transformation to Open Mission Critical Systems The transformation of systems from higher cost or proprietary delivery to open systems is one of the most hotly debated and discussed topics in financial services IT. While there is great promise in the flexibility and efficiencies gained, there is also risk and cost. An FSTC project will soon form up to determine answers to such key questions as, "Are those transformations viable?" and "What are the costs and processes by which a successful transformation program will be run?" The vision of this initiative is to bring together financial institutions to investigate the needs, processes, best practices, technology issues, risk factors, organizational issues and lessons-learned for transformation projects which move core business processes from legacy IT assets to open systems. We will provide additional details shortly. If you are interested in joining an interest group around this topic, please contact us. ______________ ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Bulk of 2004's virus infections pinned on one man
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Bulk of 2004's virus infections pinned on one man
by Randall 06 Jul '18

06 Jul '18

(And he may even be guilty!) http://news.com.com/Bulk+of+year%27s+PC+infections+pinned+to+one+man/ 2100-7349_3-5287664.html?tag=st.pop Bulk of year's PC infections pinned to one man By Munir Kotadia Special to CNET News.com http://news.com.com/2100-7349-5287664.html Story last modified July 28, 2004, 2:08 PM PDT Sven Jaschan, self-confessed author of the Netsky and Sasser viruses, is responsible for 70 percent of virus infections in 2004, according to a six-month virus roundup published Wednesday by antivirus company Sophos. The 18-year-old Jaschan was taken into custody in Germany in May by police who said he had admitted to programming both the Netsky and Sasser worms, something experts at Microsoft confirmed. (A Microsoft antivirus reward program led to the teenager's arrest.) During the five months preceding Jaschan's capture, there were at least 25 variants of Netsky and one of the port-scanning network worm Sasser. Graham Cluley, senior technology consultant at Sophos, said it was staggering that one person could be responsible for so many infections. Richard Starnes, president of security industry group ISSA UK, was also impressed: "Is he going to put this on his CV?" he asked. Cluley said there is still a chance that others may be implicated in the Netsky virus, although so far no one else has been arrested. "The full story of the Netsky gang isn't known yet. We know some of his fellow students have been questioned, but the real motives are not fully known," said Cluley. According to Sophos, the Sasser worm came out on top with 26.1 percent of infections, while Netsky.p, Netsky.b and Netsky.d take second, third and fourth places respectively. The only non-Jaschan viruses in the top 10 are MyDoom.a (fifth place), Zafi.b (sixth place), Sober.c (ninth place) and Bagle.a (tenth place). "Sasser may have taken top spot, but six of the biggest viruses of the last six months were Netsky and Bagle variants--these caused a continued nuisance for PC users the world over as their authors entered into a very public game of virus writing one-upmanship," said Cluley. Starnes said that although Jaschan has been arrested, there are always other people willing to step into his shoes. "Virus writers tend to grow out of the hobby, but hackers do not tend to stop. There is a high turnover rate in the virus-writing community. There will always be somebody there to step in to fill the gap," he said. Cluley agreed, but pointed out that organized criminals are increasingly getting involved in virus writing and are less likely to be caught because they tend to be more careful. "There is a greater criminal element in virus writing than ever before. If you are an organized gang making money out of viruses and hacking, you don't go around bragging or having a playground scuffle that results in one of your number grassing you up to Microsoft," said Cluley. Munir Kotadia of ZDNet UK reported from London. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0