- cypherpunks-legacy - lists.cpunks.org

WH = FBI = VP
by John Young 13 Oct '01

13 Oct '01

VisualRoute shows that pinging whitehouse.gov produces exactly the same path as pinging fbi.gov, both ending in Los Angeles. Is that where Cheney is holed up in the Getty Combustible Bunker? Sniff the LA impure air, is that La Brea tar or Halliburton grease? Pinging the WH is will shortly be a terrorist act warns Patriot, so better hurry before the bush hammers john henry. Anthrac, quack, quack.

2 3

Paper tigers II
by osama_ben-laden＠hushmail.com 13 Oct '01

13 Oct '01

The angel of vengeance will enter from the source many Americans hold most dear.

6 6

RE: .INFO is now live
by DotInfoCentral.com 13 Oct '01

13 Oct '01

Dear Internet user, It's official! The new .INFO domain extension has officially been launched and real-time submissions are now being accepted for the first time at: http://www.DotInfoCentral.com The next Internet gold rush has just started with the introduction of the first new generic domain name on the Internet since 1984. Experts expect that millions of new domain names will be registered over the next few months as existing .com registrants and the general public find out about this exciting, new extension. Since real-time registration just started on October 01, 2001, there are still a lot of very good names available. The time to act is now! Visit: http://www.DotInfoCentral.com immediately to secure your name. "While .com names hold the most prestige, the next frontier is the new suffixes -.info, .biz, and .pro likely to become available later this year..." -BUSINESSWEEK MAGAZINE, April 16, 2001. DotInfoCentral.com is one of the leading .INFO registration services and is currently informing members of the Internet community of this important, landmark event. If you know of anyone who currently owns a .com name but has not registered for the .info equivalent yet, please advise them as soon as possible. DotInfoCentral.com also offers easy 3-step pre-registration services for the upcoming .BIZ, .NAME, and .PRO domains which are scheduled for launch very soon. ####################################################################### We strongly oppose the continued sending of unsolicited email and do not want to send email to anyone who does not wish to receive our special mailings. As a result, we have retained the services of an independent 3rd party to administer our list management and removal services http://www.autoemailremoval.com/cgi-bin/remove.pl This is not SPAM. If you do not wish to receive further mailings, please click this link. The removal administrator can then preclude your email address from future mailings. Auto Email Removal Company. Ref# 011005 #######################################################################

1 0

bush wheels out the nukes
by cpaul 13 Oct '01

13 Oct '01

Begin forwarded message:

6 9

Half Price Cigarettes ! Guaranteed Delivery !!
by ISPService＠another.com 13 Oct '01

13 Oct '01

Hi, We are in a unique position to be able to offer you unlimited internet access from just �9.99 per month. You will soon be able to browse the web 24 hours a day 7 days a week cheaper than anybody else. For more details about this offer please email us at ISPServ(a)another.com. We very much look forward to hearing from you. Yours sincerely Chris Scott Marketing Director

1 0

Safeweb to Hotmail Loop
by anon go 13 Oct '01

13 Oct '01

Yes, our RIAA leaker used a Safeweb to Hotmail loop to send the messages, as shown with this sample. The technique appears common: Hotmail lists a slew of Hotmail nyms with variations on Safeweb and Anongo which can be seen by trying to sign up with either nym. It could be Safeweb and Anongo have reserved all of them but probably not likely, merely that a number of folks have already figured out what I'm just learning. One unexpected oddity: I signed up with the nym "unsafeweb" but the nym on messages sent from this account is, as shown, "anon go," or was on a previous test message. What will happen on this message remains to be seen. Perhaps that is a feature, but my source for the RIAA allegations did not have "anon go" as a nym. Let me disclose another clue: the final loop was through a yahoo account, which resolved to Safeweb. How many loops occurred in the full chain is yet to be determined. _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

FBI myopia == crypto/steganography?
by citizenq＠hushmail.com 13 Oct '01

13 Oct '01

Perhaps just more evidence that the problem has been enough meat-based intelligence to understand the shit that's just sitting around in plain sight. The biggest contribution to the disaster of 9/11 was "Intelligence" ineptness, and the 2nd biggest threat to this country is "Intelligence" blaming it on our 'freedom' (disintegrating though it may be.) >To: cypherpunks(a)lne.com >Subject: NPR Story Yesterday > >A writer for the Voice ( if I heard it correctly ) talked about a >computer captured in Manila that was supposedly used by Ramzi Yousef. He >said that there were documents that described hijacking planes and >flying them into prominent buildings. > >This information was turned over to the FBI in 1995 or 1996. > >I hope with expanded powers for surveillance and searches that they can >gather better information and shorten the analysis period.

2 1

re: Paper tigers II
by osama_ben-laden＠hushmail.com 13 Oct '01

13 Oct '01

>Shaddap you idiot. Weren't you were the one claiming the Anthrax attacks were a hoax a few days ago. No. "It will be revealed that he who used biologicals to attack the press was not acting in our name."

1 0

L.A. Sony Pictures employee hospitalized; anthrax exposure suspected
by Xeni Jardin 13 Oct '01

13 Oct '01

(CNN) -- California is the latest state to report a possible case of anthrax exposure. http://www.cnn.com/2001/HEALTH/conditions/10/13/anthrax/index.html An employee of Sony Pictures in Culver City has been admitted to the hospital after opening an envelope containing a white powdery substance, a local law enforcement official said. (Full story) "When he opened it, he took an item out and got a white powdery substance on his hands," Culver City Police Lt. Dave Tankenson said. The man, whose name was not released, was being examined at Brotman Medical Center on Friday, Tankenson said. Tankenson said officials were discussing the possibility the powder was anthrax but could not be sure until test results were completed. "We're treating it as a serious incident until we learn otherwise," he said. (...)

1 0

Re: RIAA Safeweb Proxy ID
by mikecabot＠fastcircle.com 13 Oct '01

13 Oct '01

For anyone interested, Squid is basically just an HTTP/FTP cache.... similar to what AOL uses, for instance, and many satellite-based Net ISPs (Starband, DirecPC) use to maximize bandwidth utlization. Black Helicopter alert: Squid is based on an ARPA-funded project called "Harvest".... a project that investigated "harversting" of data across large, presumably public, networks, for archiving and "study" :) Squid itself is opensource.... if you're interested, check out http://www.squid-cache.org This is totally off-topic, but consider this: the way that a Proxy cache works (not just Squid, any cache) is that it stores all of the requested objects (web pages and files, in this case) on a series of local servers. Then, when a user requests them, it serves them off of ITS pages -- that way, it doesn't have to fetch them from the "public" Internet. Now, what do you have? Yep... a complete archive on SafeWeb's local servers of all pages requested by their users. Not being a conspiracy nut, I won't connect the last dot.... but you see the value of this to someone like the CIA -- besides an opportunity to create a voyeur-google, you can also control selected pages' contents (be replacing them with your own contents and disabling HTTP refresh of the page through the cache). To get back to the RIAA point, though: What you're looking at are HTTP headers (what you'd see if you Telnet'ed to port 80 on Safeweb's web servers). Again, this won't get you any closer to identifying the path that someone took to get to Safeweb, and therefore, you cannot identify a target via this type of information. (The more interesting point would be: can Safeweb do so? The answer is "you bet." The only thing they would have to do is classic log/connection-time synchronization analysis, and that would tell them the connection details of the user in question. But this can only be done by Safeweb or someone with access to Safeweb logs.) Mike > Original Message from Sat, 13 Oct 2001 05:32:03 -0700:> > Thanks to SC: > > [SC's IP address replaced by xxx.xxx.xxx.xxx] > > ----- > > I've tuned in late to the riaa/safeweb thing, but I'm chiming in > with my bit. > > Tracing from safeweb is an interesting exercise; the geography is > very typical of the internet backbone and the router hops packets > take. > > I wrote a script to mail all possible headers from a connecting > browser to myself. I installed it on my server > > http://xxx.xxx.xxx.xxx:8140, > > and then connected from Safeweb. > > This anonymizer uses a caching proxy server, listening for > connections on several IPs; it preserves client headers while > obviously changing the IP of the originating connection; it preserves > many of the originating headers; it adds some new headers. > > Here's the output: > > GATEWAY_INTERFACE..........CGI/1.1 > > REMOTE_ADDR..........64.124.150.136 > > DATE_LOCAL..........Saturday, 13-Oct-2001 01:22:45 EDT > > REQUEST_METHOD..........GET > > QUERY_STRING.......... > > DOCUMENT_URI........../index.html > > HTTP_ACCEPT..........image/gif, image/x-xbitmap, image/jpeg, > image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms- excel, > application/msword, */* > > REMOTE_PORT..........2513 > > SERVER_ADDR..........142.204.119.75 > > HTTP_ACCEPT_LANGUAGE..........en-us > > HTTP_CACHE_CONTROL..........max-age=259200 > > REDIRECT_STATUS..........200 > > HTTP_ACCEPT_ENCODING..........gzip > > SERVER_NAME..........xxx.xxx.xxx.xxx > > HTTP_X_FORWARDED_FOR..........127.0.0.1 > > SERVER_PORT..........8140 > > DOCUMENT_NAME..........index.html > > HTTP_IF_MODIFIED_SINCE..........Sat, 13 Oct 2001 05:15:44 GMT; > length=853 > > REDIRECT_URL........../ > > DATE_GMT..........Saturday, 13-Oct-2001 05:22:45 GMT > > SERVER_PROTOCOL..........INCLUDED > > HTTP_REFERER..........http://xxx.xxx.xxx.xxx > > HTTP_USER_AGENT..........Mozilla/4.0 (compatible; MSIE 6.0; Windows > NT 5.0) > > HTTP_CONNECTION..........keep-alive > > REQUEST_URI........../ > > HTTP_HOST..........xxx.xxx.xxx.xxx:8140 > > HTTP_VIA..........1.0 anongo.com:3128 (Squid/2.3.STABLE3) > > The last one in the list is the flavour of proxy they use: > > Squid/2.3.stable3 > > And the DNS name of the source box for the HTTP request > is anongo.com, which I don't believe showed up in your trace > logs. > > Basically a caching proxy server's header set. > > The authoritative name servers for anongo.com are > > ns3.above.net > > > www.anongo.com redirects to Safeweb. The boxes are standard > unix/apache with ssl. They have written scripts to replace the > originating address header and keep track of the connection, receive > requested files to their cache, and then serve from that cache to > your browser. > > The machines would absolutely be configured to do sophisticated > logging; there is no free lunch on the net. While they appear to do a > nice job, their server logs would be a goldmine. Everyone who uses a > commercial web browser agrees to have their information gathered the > first time they use that browser - do you want to continue? When you > say yes, you mean it! > > ----- > > > > _______________________________________________________________________________ WANT YOUR OWN FREE AND SECURE WEB EMAIL ADDRESS? Visit http://www.fastcircle.com

4 3