- cypherpunks-legacy - lists.cpunks.org

GNFC launches Indian Digital Certification services
by R.A. Hettinga 10 Feb '05

10 Feb '05

Gujarat Narmada Valley Fertilizer Company??? ;-) Cheers, RAH ------- <http://www.deepikaglobal.com/ENG5_sub.asp?newscode=92273&catcode=ENG5&subca…> deepikaglobal.com - Business News Detail Thursday, February 10, 2005 Good Evening to you Business News GNFC launches nationwide Digital Certification services Mumbai, Feb 9 (UNI) Gujarat Narmada Valley Fertilizer Company (GNFC) promoted (n)Code Solutions today launched its nationwide services for providing ''Digital certificates to individuals and organisations aimed at boosting efforts for implementation of e-governance and e-commerce in the country''. Digital certificates can be explained as digital passports that help in authentication of the bearer on the net, while maintaining privacy and integrity of the net-based transactions. It is accorded the same value as paper-based signatures of the physical world by the Indian IT Act 2000 and each of these transactions help bring trust in the Internet-based transactions. Launching the services, Nasscom President Kiran Karnik said, ''The presence of a large number of credible public sector organisation in this domain will futher boost the efforts for implementation of e-governance in the country.'' He said that the safety and security of net-based transactions would enable to usher in higher levels of exellence at lower costs. Having carved an enviable reputation for itself in managing large and complex projects successfully, Mr Karnik said ''GNFC will duplicate its success in this IT venture as well.'' A K Luke, Managing Director of GNFC and another state-PSU Gujarat State Fertiliser Corporation, on this occasion, said ''The (n)Code Solutions infrastructure, set up for the purpose is at par with the best in the world.'' He said the GNFC was committed to diversifications in the emerging fields of IT like e-security. (n)Code Solutions has put in motion a nation-wide machinery to support different market segments like banking and financial institutions, public and private sector enterprises besides State and Central Government organisations, he added. He said the IT company of GNFC had simultaneously released a suite of applications like (n)Procure, (n)Sign, (n)Form and (n)Pay that make use of digital signatures to ensure safety and security in the virtual world in various ways. Mr Luke said these applications will address a wide spectrum of needs of the internet-dependent business world, ranging from online procurement to signing and sending web forms and enabling online payments to securing web servers or VPN devices. GNFC is a Rs 1800 crore fertiliser and chemicals company of the Gujarat Government. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Precedent for Warrantless Net Monitoring Set
by Eugen Leitl 10 Feb '05

10 Feb '05

>From the somebody-needs-killing dept. Link: http://slashdot.org/article.pl?sid=05/02/10/0044214 Posted by: samzenpus, on 2005-02-10 05:40:00 from the only-bad-people-need-privacy dept. highcon writes "According to this editorial from SecurityFocus, a recent case of a drug dog which pushed the limits of "reasonable search" may have [1]implications for Internet communications in the U.S. This Supreme Court case establishes a precendent whereby "intelligent" packet filters may be deployed which, while scanning the contents of network traffic indiscriminently, only "bark" at communication indicative of illegal activity." References 1. http://www.securityfocus.com/columnists/297 ----- End forwarded message ----- Of Dog Sniffs and Packet Sniffs Why a Supreme Court decision on canine-assisted roadside searches opens the door to a new regime of Internet surveillance. By Mark Rasch Feb 08 2005 11:21AM PT Click here for Core Impact! The Fourth Amendment to the U.S. Constitution is supposed to be the one that protects people and their "houses, places and effects" against "unreasonable searches." Forty-two years ago, the U.S. Supreme Court held that attaching a listening device to a public pay phone violated this provision because the Constitution protects people, not places, and because the Fourth Amendment prohibits warrantless searches without probable cause if the target enjoys a reasonable expectation of privacy. Last month the U.S. Supreme Court effectively decimated this principle in a case that could have a profound impact on privacy rights online. The case, decided by the court on January 24th, had nothing to do with the Information Superhighway, but rather an ordinary interstate highway in Illinois. Roy Caballes was pulled over by the Illinois State Police for speeding. While one officer was writing him a ticket, another officer in another patrol car came by with a drug sniffing dog. There was absolutely no reason to believe that Caballes was a drug courier -- no profile, no suspicious activity, no large amounts of cash. The driver could have been a soccer mom with a minivan filled with toddlers. Under established Supreme Court precedent, while the cops could have looked in the window to see what was in "plain view," the officers had neither probable cause nor reasonable suspicion to search Caballes' car, trunk, or person. Well, you know what happened next -- the dog "sniff" indicated that there might be drugs in the trunk, which established probable cause to open the trunk, where the cops found some marijuana. The government may soon deploy "intelligent" packet search filters that will seek out only those communications that relate to criminal activity. Now here is where things get dicey for the Internet. In upholding the dog's sniff-search of the trunk, the Supreme Court held that it did not "compromise any legitimate interest in privacy." Why? Because, according to the court, "any interest in possessing contraband cannot be deemed 'legitimate.'" The search was acceptable to the court because it could only reveal the possession of contraband, the concealment of which "compromises no legitimate privacy interest." The expectation "that certain facts will not come to the attention of the authorities" is not the same as an interest in "privacy that society is prepared to consider reasonable," the court wrote. In other words, the search by the dog into, effectively, the entire contents of a closed container inside a locked trunk, without probable cause, was "reasonable" even though the driver and society would consider the closed container "private" because the search only revealed criminal conduct. The same reasoning could easily apply to an expanded use of packet sniffers for law enforcement. Currently, responsible law enforcement agencies limit their warrantless Internet surveillance to the "wrapper" of a message, i.e., e-mail addresses or TCP/IP packet headers, unless they have a court order permitting a more intrusive search. Looking at the "outside" of the communication has been treated as similar to looking at the outside of a vehicle -- and maybe peering into the window a bit. To peek inside the communication -- read the content -- required that you first get someone in a black robe involved. The experiences of Mr. Caballes (the soccer mom, or me or you ) changed all that. The government is practically invited to peek inside Internet traffic and sniff out evidence of wrongdoing. As long as the technology -- like a well-trained dog -- only alerts when a crime is detected, it's now legal. As context-based search technology improves, the government may soon have the ability to take Carnivore one better and deploy "intelligent" packet search filters that will seek out only those communications that relate to criminal activity. They may already have it. Although these packet sniffing dogs sniff the packets of sinner and saint alike, they only bark at the sinner's e-mails. Thus, according to the new Supreme Court precedent, the sinner has no privacy rights, and the saint's privacy has not been invaded. In fact, the saint would not even know the search had taken place -- Internet surveillance is less noticeable than a dog sniff. I think Sun Microsystems' president Scott McNealy was only slightly ahead of his time when he said, "You already have zero privacy, get over it." We could pass a aconstitutional amendment to protect our privacy rights, but I thought we did that on Dec 15th, 1791 when the Bill of Rights was ratified. Hopefully, this case will be limited to a dark dessert highway, and not find its way onto the Infobahn. But somehow I doubt it. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: What is a cypherpunk?
by Major Variola (ret) 10 Feb '05

10 Feb '05

At 10:38 PM 2/9/05 -0600, Shawn K. Quinn wrote: >On Wed, 2005-02-09 at 09:09 -0800, James A. Donald wrote: >> There is nothing stopping you from writing your own operating >> system, so Linus did. > >Linus Torvalds didn't write the GNU OS. He wrote the Linux kernel, which >when added to the rest of the existing GNU OS, written by Richard >Stallman among others, allowed a completely free operating system. >Please don't continue to spread the misconception that Linus Torvalds >wrote the entire (GNU) operating system. Who gives a fuck? RMS was fermenting in his own philosophical stew, to put it politely. The shame is that BSD didn't explode like L*nux did, and that all that work had to be re-done, and with a nasty ATT flavor to boot (no pun intended).

1 0

Cryptography Research to Provide Patented Security Technology to Raytheon
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://biz.yahoo.com/prnews/050209/sfw072_1.html?printer=1> Yahoo! Finance Press Release Source: Cryptography Research, Inc. Cryptography Research to Provide Patented Security Technology to Raytheon Wednesday February 9, 9:03 am ET Defense and Aerospace Systems Supplier Licenses CRI's Differential Power Analysis Countermeasures SAN FRANCISCO, Feb. 9 /PRNewswire/ -- Cryptography Research, Inc., a worldwide leader in security systems, today announced that it has licensed its Differential Power Analysis (DPA) countermeasure technologies to Raytheon Company (NYSE: RTN - News). In addition, Raytheon also purchased a tool suite and training for its personnel to establish an internal group focused on DPA countermeasures. "DPA can be used to break implementations of almost any symmetric or asymmetric cryptography algorithm, including proprietary and heavily modified industry standard algorithms. The widespread use of strong cryptography in both software and hardware has given DPA attacks and countermeasures an increased importance," said Paul Kocher, president and chief scientist of CRI. "We are pleased to be working with Raytheon Company, and that they selected CRI for its leading-edge countermeasure technologies," said Kit Rodgers, vice president of licensing. About Cryptography Research, Inc. Cryptography Research, Inc. provides technology to solve complex security problems. In addition to security evaluation and applied engineering work, CRI is actively involved in long-term research in areas including tamper resistance, content protection, network security and financial services. The company has a broad portfolio of patents covering countermeasures to differential power analysis and other vulnerabilities, and is committed to helping companies produce secure smart cards and other tamper resistant devices. Security systems designed by Cryptography Research engineers annually protect more than $100 billion of commerce for wireless, telecommunications, financial, digital television and Internet industries. For additional information or to arrange a consultation with a member of the technical staff, please contact Jen Craft at 415-397-0123, ext. 329 or visit www.cryptography.com. About Raytheon Company Raytheon Company, with 2003 sales of $18.1 billion, is an industry leader in defense and government electronics, space, information technology, technical services, and business and special mission aircraft. With headquarters in Waltham, Mass., Raytheon employs 78,000 people worldwide. Source: Cryptography Research, Inc. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Tester claims 90% of VPNs open to hackers
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.computerweekly.com/print/ArticlePrinterPage.asp?liArtID=136571&l…> Printed from ComputerWeekly.com IT Management: Security by Antony Savvas Tuesday 8 February 2005 Tester claims 90% of VPNs open to hackers Security testing company NTA Monitor has claimed that 90% of virtual private networks are open to hackers. Over a three-year period of testing VPNs at large companies, NTA Monitor said 90% of remote access VPN systems have exploitable vulnerabilities, even though many companies, including financial institutions, have in-house security teams. Flaws include "user name enumeration vulnerabilities" that allow user names to be guessed through a dictionary attack because they respond differently to valid and invalid user names. Roy Hills, NTA Monitor technical director, said, "One of the basic requirements of a user name/password authentication is that an incorrect log-in attempt should not leak information as to whether the user name or password is incorrect. However, many VPN implementations ignore this rule." The fact that VPN user names are often based on people's names or e-mail addresses makes it relatively easy for an attacker to use a dictionary attack to recover a number of valid user names in a short period of time, said Hills. Passwords can also be made harder to crack by deploying a mixture of characters and numbers. Hills said a six-character password can be cracked in about 16 minutes using standard "brute force" cracking software. However, a six-character password combining letters and numbers could take two days to crack. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Hold the Phone, VOIP Isn't Safe
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.wired.com/news/print/0,1294,66512,00.html> Wired News Hold the Phone, VOIP Isn't Safe By Elizabeth Biddlecombe? Story location: http://www.wired.com/news/technology/0,1282,66512,00.html 02:00 AM Feb. 07, 2005 PT In recognition of the fact that new technologies are just as valuable to wrongdoers as to those in the right, a new industry group has formed to look at the security threats inherent in voice over internet protocol. The VOIP Security Alliance, or VOIPSA, launches on Monday. So far, 22 entities, including security experts, researchers, operators and equipment vendors, have signed up. They range from equipment vendor Siemens and phone company Qwest to research organization The SANS Institute. They aim to counteract a range of potential security risks in the practice of sending voice as data packets, as well as educate users as they buy and use VOIP equipment. An e-mail mailing list and working groups will enable discussion and collaboration on VOIP testing tools. VOIP services have attracted few specific attacks so far, largely because the relatively small number of VOIP users doesn't make them a worthwhile target. (A report from Point Topic in December counted 5 million VOIP users worldwide.) But security researchers have found vulnerabilities in the various protocols used to enable VOIP. For instance, CERT has issued alerts regarding multiple weaknesses with SIP (session initiation protocol) and with H.323. Over the past year, experts have repeatedly warned that VOIP abuse is inevitable. The National Institute of Standards and Technology put out a report last month urging federal agencies and businesses to consider the complex security issues often overlooked when considering a move to VOIP. NIST is a member of VOIPSA. "It is really just a matter of time before it is as widespread as e-mail spam," said Michael Osterman, president of Osterman Research. Spammers have already embraced "spim" (spam over instant messaging), say the experts. Dr. Paul Judge, chief technology officer at messaging-protection company CipherTrust, says 10 percent of instant-messaging traffic is spam, with just 10 to 15 percent of its corporate clients using IM. "It is where e-mail was two and a half years ago," said Judge. To put that in perspective, according to another messaging-protection company, FrontBridge Technologies, 17 percent of e-mail was spam in January 2002. It put that figure at 93 percent in November 2004. So the inference is that "spit" (spam over internet telephony) is just around the corner. Certainly, the ability to send out telemarketing voicemail messages with the same ease as blanket e-mails makes for appealing economics. Aside from the annoyance this will cause, the strain on network resources when millions of 100-KB voicemail messages are transmitted, compared with 5- or 10-KB e-mails, will be considerable. But the threat shouldn't be couched solely within the context of unlawful marketing practices. Users might also see the audio equivalent of phishing, in which criminals leave voicemails pretending to be from a bank, said Osbourne Shaw, whose role as president of ICG, an electronic forensics company, has led him to try buying some of the goods advertised in spam. In fact, according to David Endler, chairman of the VOIP Security Alliance and director of digital vaccines at network-intrusion company TippingPoint, there are many ways to attack a VOIP system. First, VOIP inherits the same problems that affect IP networks themselves: Hackers can launch distributed denial of service attacks, which congest the network with illegitimate traffic. This prevents e-mails, file transfers, web-page requests and, increasingly, voice calls from getting through. Voice traffic has its own sensitivities, which mean the user experience can easily be degraded past the point of usability. Furthermore, additional nodes of the network can be attacked with VOIP: IP phones, broadband modems and network equipment, such as soft switches, signaling gateways and media gateways. Endler paints a picture in which an attack on a VOIP service could mean people would eavesdrop on conversations, interfere with audio streams, or disconnect, reroute or even answer other people's phone calls. This is a concern to the increasing number of call centers that put both their voice and data traffic on a single IP network. It is even more of a concern for 911 call centers. But Louis Mamakos, chief technology officer at broadband telephony provider Vonage, says he and his team "spend a lot of time worrying about security" but the problems the company has seen so far have centered on "more pedestrian" threats like identity theft. Vonage has not yet signed up for the VOIP Security Alliance, said Mamakos, and employees already spend a lot of time working on security issues with technology providers. "I'm not sure if (VOIPSA) is a solution to a problem we don't have yet," he said. "We need to judge what the incremental value is in working with another organization." He also talked about how hard it would be to break into Vonage's service. Access to Vonage's signaling traffic requires authentication. The infrastructure is much more distributed than the websites that have been taken offline by denial of service attacks. And anyone wanting to eavesdrop on a Vonage phone conversation would have to be physically very close to the broadband connection leading to the target, as the farther away the eavesdropper is, the more commingled the target's voice traffic will be with other traffic on the network. Meanwhile Kelly Larrabee, a spokeswoman for the peer-to-peer VOIP provider Skype, noted that Skype users control what information about themselves is available and who can contact them. She also said end-to-end encryption is used to protect voice conversations. The only vulnerability so far, aside from uncertified third-party applications, is through file transfers -- and again, this is under user control. But these words could be like a red rag to a bull. As one commentator put it, a continuous duel is going on between network users and abusers, and spammers and hackers could well be reading this article. This poses the question of whether a group like the VOIP Security Alliance should refrain from announcing its efforts in the media and from making its membership and e-mail list free and open to all. In response, said VOIPSA's Endler, "The people we really have to worry about are already thinking about (how to misuse VOIP)." Today's effort is to ensure that VOIP systems are reinforced "before it gets to the point that there are easily available tools for the script kiddies to use," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RSA Conference, and BA Cypherpunks
by Trei, Peter 09 Feb '05

09 Feb '05

Once again, the RSA Conference is upon us, and many of the corrospondents on these lists will be in San Francisco. I'd like to see if anyone is interested in getting together. We've done this before. At past conferences, we've had various levels of participation, from 50 down to 3. Since the BAC Physical Meetings seem to have pretty well died out, I'd like to propose that those of us who are interested get together for lunch or dinner at some point. I'll be arriving on site Monday afternoon, and leaving Friday morning. Thursday night, at least, is already spoken for. At the moment, it looks like Monday or Tuesday night may be the best, though a lunch is also possible. Any takers? Peter Trei ptrei(a)rsasecurity.com RSA Data Security Conference Dates: Feb 14-18 2005 Place: Moscone Center, San Francisco http://www.rsaconference.com While the full conference is rather expensive, note that you can get a free Expo pass if you register online by 5pm Feb 14th.

3 2

Standards for Efficient Cryptography Group (SECG) Announce New Initiatives
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://www.newswire.ca/en/releases/archive/February2005/09/c2130.html?view=…> Canada NewsWire Group CERTICOM CORP. Attention Business Editors: Standards for Efficient Cryptography Group (SECG) Announce New Initiatives Elliptic Curve Cryptography protocol test site and test certificate authority to promote interoperability and facilitate faster time to-market MISSISSAUGA, ON, Feb. 9 /CNW/ - Two new initiatives being spearheaded by the Standards for Efficient Cryptography Group (SECG) will help developers quickly and effectively test elliptic curve cryptography (ECC)-based implementations to facilitate faster time-to-market, according to Certicom, a founding member of SECG. Announced today, an ECC protocol test site and certificate authority (CA) will be available to SECG members in the spring of 2005. The SECG, an industry consortium, was founded in 1998 to develop commercial standards that facilitate the adoption of efficient cryptography and interoperability across a wide range of computing platforms. Where standards already exist, SECG may promote a refined, peer-reviewed profile of the broader standard to promote adoption and interoperability. The SECG also provides guidance to governments and organizations that are developing cryptographic standards. The initiatives announced today include: - ECC protocol test site: developers will be able to vet their protocol implementations against reference implementations to test interoperability. Each test - such as Transport Layer Security (TLS) and S/MIME protocols - has been peer-reviewed by the leading ECC and protocol authorities. - ECC-based certificate authority: the group will issue free ECC-based certificates for testing and prototyping. "SECG's role is to make it easier to use ECC by promoting practical standards, interoperability and by providing mechanisms to test implementations and prototypes," said William Lattin, chair of SECG. "Recent developments, such as advances in the cryptographic world and U.S. government security initiatives, have elevated the need for ECC and for resources like ours." "The work of SECG is valuable resource for companies committed to ECC," says Gloria Navarre, senior architect, Unisys Global Security Practice. "As Unisys develops next-generation ECC applications, such as our solutions to help banks embrace image exchange in check processing, and transform payments operations as a whole, we can take advantage of the expertise, interoperability and testing standards that SECG offers to provide new levels of security to our clients and their customers." "SECG enables access to proven and effective algorithms and protocols to secure a communication channel between computers. It is particularly important when communicating computers have limiting computational resources and when the bandwidth of the channel has limiting capacity. This is the case of important mailing applications where Pitney Bowes has established a strong leadership position worldwide. In addition SECG allows to have a common foundation for all communication security needs regardless of the limiting factors. This in turn enables interoperability between a broad variety of applications," said Dr. Leon Pintsov, Pitney Bowes Fellow and vice president, International Standards and Advanced Technology. ECC, a computationally efficient form of cryptography, is used in a growing number of sectors ranging from consumer electronics, embedded devices and semiconductors to government and financial services. Several changes have spurred the adoption of ECC. The first is the need for a stronger public-key cryptosystem that doesn't affect performance. For example, a high security encryption algorithm like the Advanced Encryption Standard (AES) demands equivalent security for the accompanying digital signatures and key exchanges. To achieve this level of security without overwhelming the processors of most mobile devices, developers would need ECC, which offers equivalent security to other competing technologies but with much smaller key sizes. The second is the National Security Agency's recent decision to name ECC the public-key cryptosystem needed to meet the new, stronger security requirements under its crypto modernization program. The SECG is open to all interested parties who are willing to contribute to the ECC standards development process. To become a member of the SECG, simply send an email to the SECG mailing list (secg-talk-request(a)lists.certicom.com) with the word "SUBSCRIBE" in the subject line. To find out more about SECG and to download the latest standards, visit www.secg.org, or visit us at the RSA conference, in the Certicom booth No. 430, February 14-18, Moscone Center, San Francisco. About SECG The Standards for Efficient Cryptography Group (SECG) is an industry consortium for the development of standards based upon Elliptic Curve Cryptography (ECC). It was chartered to develop commercial standards that specify the basis for creating interoperable, cost-effective security solutions across a wide range of computing platforms. The SECG was founded in 1998 by Certicom and currently includes member companies such as: Entrust, Fujitsu, Pitney Bowes, Unisys and Visa International. Visit www.secg.org. About Certicom Certicom Corp. (TSX: CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Visit www.certicom.com. About Pitney Bowes Pitney Bowes is the world's leading provider of integrated mail and document management systems, services and solutions. The $5 billion company helps organizations of all sizes efficiently and effectively manage their mission-critical mail and document flow in physical, digital and hybrid formats. Its solutions range from addressing software and metering systems to print stream management, electronic bill presentment and presort mail services. With approximately 33,000 employees worldwide, Pitney Bowes serves more than 2 million businesses through direct and dealer operations. For more information about Pitney Bowes please visit http://www.pb.com. About Unisys Unisys is a worldwide information technology services and solutions company. Our people combine expertise in consulting, systems integration, outsourcing, infrastructure and server technology with precision thinking and relentless execution to help clients, in more than 100 countries, quickly and efficiently achieve competitive advantage. For more information, visit www.unisys.com. Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder NSE and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. %SEDAR: 00003865E For further information: please contact: Tim Cox, Zing Public Relations, (650) 369-7784, tim(a)zingpr.com; Brendan Ziolo, Certicom Corp., (613) 254-9267, bziolo(a)certicom.com CERTICOM CORP. CERTICOM CORP. - More on this organization Quotes & Charts News Releases (79) Webcast Company Earnings CIC.(TSX) STANDARDS FOR EFFICIENT CRYPTOGRAPHY GROUP STANDARDS FOR EFFICIENT CRYPTOGRAPHY GROUP - More on this organization News Releases (1) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Group Aims to Make Internet Phone Service Secure
by R.A. Hettinga 09 Feb '05

09 Feb '05

<http://online.wsj.com/article_print/0,,SB110790485798349353,00.html> The Wall Street Journal February 9, 2005 TELECOMMUNICATIONS Group Aims to Make Internet Phone Service Secure Alliance of Tech Companies Looks for Ways To Head Off Attacks by Hackers, Viruses By RIVA RICHMOND DOW JONES NEWSWIRES February 9, 2005; Page D4 A group of more than 20 technology companies and computer-security organizations has gone on the offensive to protect the burgeoning Internet telephone service from hackers, viruses and other security problems. The VOIP Security Alliance, which was announced earlier this week, will focus on uncovering security problems and promoting ways to reduce the risk of attack for voice over Internet protocol, or VOIP, technology. The group, known as VOIPSA, includes companies such as 3Com Corp., Alcatel SA, Avaya Inc., Siemens AG, Symantec Corp. and Ernst & Young LLP. Other members include the National Institute of Standards and Technology, a federal government agency; the SANS Institute, a research organization for network administrators and computer-security professionals; and several universities. The group's goal is to help make VOIP as secure and reliable as traditional telephone service. VOIP breaks voice into digital information and moves it over the Internet. That can make phone service much cheaper, but it also opens the door to the kind of security woes that have come to plague the Internet. VOIP enthusiasts worry that security and privacy problems could hamper adoption of the technology. "VOIP has a lot of great value propositions, but in order for it to be successful, it has to be secured" and offer service quality that's on par with the current phone system, said David Endler, chairman of the alliance and an executive at TippingPoint, a security company that recently was acquired by 3Com. "VOIPSA is a first step in doing that." Internet telephone service is expected to be rolled out rapidly to consumers and business customers, starting this year. Mr. Endler said many network operators don't realize they need to alter their security strategies when they add Internet phone service. For instance, traditional firewalls cannot police VOIP traffic, he said, and so networks will need to be upgraded with newer security technologies. There's little understanding of what security problems VOIP might introduce and what kind of defensive measures need to be taken. VOIPSA intends to improve that situation by sponsoring research, uncovering vulnerabilities, disseminating information about threats and security measures, and providing open-source tools to test network-security levels. Because VOIP will be dependent on the Internet, there's little hope that security troubles can be avoided, said Alan Paller, director of research at the SANS Institute, though early action by technology makers to address problems is positive and welcome. "It's not a lightweight problem," he said. "How well would you do with no phone?" If Internet attacks can disrupt phone service, "you radically expand the number of victims," he said. "VOIP networks really inherit the same cyber-security threats that data networks are today prone to, but those threats take greater severity in some cases," Mr. Endler said. For instance, a life-or-death emergency call to 911 might not get through if a network is crippled by a hacker attack. Worse, a broad assault on the phone system could become a national security crisis that causes economic damage. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

LA Times on brinworld, complete with nothing to hide quote
by Major Variola (ret) 08 Feb '05

08 Feb '05

Article Published: Sunday, February 06, 2005 - 7:14:24 PM PST Who's got an eye on you? Secret cameras are everywhere By Andrea Cavanaugh, Staff Writer Smile! If you're making your way around Los Angeles -- or any metropolitan area in America these days -- there's a good chance your movements are being recorded by a surveillance camera. Once limited mostly to banks and convenience stores, the beady eye of the surveillance camera has appeared nearly everywhere over the past decade. Cheaper surveillance systems and heightened fears of terrorist attacks have created a world that is increasingly captured on camera. "If you're outside doing anything, you're being recorded 50 percent of the time," said Paul Ramos, vice president of sales and marketing for Fairfax Electronics, a Los Angeles company that sells security systems. "If you're shopping or attending an event, it goes up to 90 percent. Yes, Big Brother is there, and Big Brother is strong." Perched on rooftops and under eaves, cameras discreetly rake shopping centers, stadiums, office buildings and parking lots. Police say surveillance cameras, whether installed by businesses, homeowners or local governments, act as a powerful law-enforcement tool and crime deterrent. Law-abiding people have nothing to worry about, said Lt. Paul Vernon of the Los Angeles Police Department. "When people start talking about Big Brother, I say, 'I've got nothing to hide.' Those cameras aren't looking into my home, and if they were, it would be pretty boring." Although law-enforcement agencies hail the technology as a labor-saving device that allows them to patrol much larger areas with fewer sets of eyes, many civil libertarians view surveillance cameras as a creeping erosion of privacy rights. "How would you like to be followed around by a slimy guy in a raincoat who records everything you do? It's a technological version of a slimy guy in a raincoat," said privacy expert Lauren Weinstein, who is producing a radio series about technology's impact on society. "The difference is, you can't see it, you don't know what it's pointed at, or how long the images are going to be stored." The mostly unregulated recording takes place with a tacit nod from the U.S. Supreme Court, which has indicated again and again that people have no reasonable expectation of privacy in public places. Government agencies across the United States are installing cameras in as many public areas as possible, but they are still behind the curve compared with European cities, Ramos said. In Los Angeles, surveillance devices increasingly are used by government to patrol public places. Several recently installed cameras along Hollywood Boulevard scan stretches popular with tourists and criminals alike. And, buoyed by the success of a surveillance program at crime-plagued MacArthur Park west of downtown, the LAPD recently unveiled a camera system capable of scanning thousands of license plates per hour and employing controversial facial-recognition software to pinpoint known criminals. Once clunky and obtrusive, some surveillance devices are now so small they're nearly undetectable. And the days of scratchy, black-and-white images recorded on videotape are long gone. Advances in technology mean crystal-clear digital pictures that can be reviewed in real time -- as they occur. "These are beautiful tools," said Ramos, whose company sells 20 to 30 surveillance systems each month. "It's the ability to be anywhere in the world and see what's going on, and also review what happened yesterday, or last week, or last month." Although the cameras raise the hackles of privacy advocates, most people don't mind being recorded everywhere they go, said A. Michael Noll, a communications professor at the University of Southern California. Graduate students polled about privacy issues routinely rank surveillance cameras nearly at the bottom of a long list of concerns, he said. "Most people just don't care about being on camera," Noll said. "In Los Angeles, they probably enjoy it. They probably see it as a screen test." Northridge resident Rochelle Matthews sees it as an invasion of privacy. The 37-year-old insurance agent said she doesn't like being under constant scrutiny. "What are they looking for? I don't think everything needs to be patrolled. People need and deserve privacy." Chatsworth resident Leanne Vince said she doesn't mind being recorded when she ventures out in public. Only criminals need to worry about being under surveillance, the 35-year-old music company executive said. "It doesn't bother me at all because I'm not doing anything wrong," she said. "If I'm at the grocery store and they're following me, so what? It's technology. You take the good with the bad." But Weinstein cautioned that constant surveillance can cause the shadow of suspicion to fall on the innocent when innocuous activities are misinterpreted. "A lot of people don't care, but they haven't thought about it," he said. "The dark side of this stuff isn't discussed." The benefits of surveillance cameras, such as capturing Oklahoma City bomber Timothy McVeigh on film just before he picked up the rental truck used in the bombing, far outweigh the privacy concerns, Noll said. And the concerns of those "screaming about Big Brother" may be overblown, Noll said. "If someone were tracking me down the street, I might care," he said. "But there aren't enough people at the other end to be watching all this surveillance." Armed with that knowledge, experts are now developing software that alerts authorities when certain types of behavior are detected. Weinstein cautioned that the practice of recording people in nearly every public place could escalate out of control. "It's always a balancing act," he said. "It's not to say you have a total expectation of privacy in public places, but there shouldn't be none. "Unless we want to live in a pervasive surveillance society where all of your moves are tracked and recorded, we'd better start putting rules in place."

1 0