- cypherpunks-legacy - lists.cpunks.org

Safe Personal Computing (was Re: CRYPTO-GRAM, December 15, 2004)
by R.A. Hettinga 15 Dec '04

15 Dec '04

At 11:41 PM -0600 12/14/04, Bruce Schneier wrote: > Safe Personal Computing > > ><http://www.schneier.com/blog/archives/2004/12/safe_personal_c.html> > >I am regularly asked what average Internet users can do to ensure their >security. My first answer is usually, "Nothing--you're screwed." > >But that's not true, and the reality is more complicated. You're >screwed if you do nothing to protect yourself, but there are many >things you can do to increase your security on the Internet. > >Two years ago, I published a list of PC security recommendations. The >idea was to give home users concrete actions they could take to improve >security. This is an update of that list: a dozen things you can do to >improve your security. > >General: Turn off the computer when you're not using it, especially if >you have an "always on" Internet connection. > >Laptop security: Keep your laptop with you at all times when not at >home; treat it as you would a wallet or purse. Regularly purge >unneeded data files from your laptop. The same goes for PDAs. People >tend to store more personal data--including passwords and PINs--on PDAs >than they do on laptops. > >Backups: Back up regularly. Back up to disk, tape or CD-ROM. There's >a lot you can't defend against; a recent backup will at least let you >recover from an attack. Store at least one set of backups off-site (a >safe-deposit box is a good place) and at least one set >on-site. Remember to destroy old backups. The best way to destroy >CD-Rs is to microwave them on high for five seconds. You can also >break them in half or run them through better shredders. > >Operating systems: If possible, don't use Microsoft Windows. Buy a >Macintosh or use Linux. If you must use Windows, set up Automatic >Update so that you automatically receive security patches. And delete >the files "command.com" and "cmd.exe." > >Applications: Limit the number of applications on your machine. If >you don't need it, don't install it. If you no longer need it, >uninstall it. Look into one of the free office suites as an >alternative to Microsoft Office. Regularly check for updates to the >applications you use and install them. Keeping your applications >patched is important, but don't lose sleep over it. > >Browsing: Don't use Microsoft Internet Explorer, period. Limit use of >cookies and applets to those few sites that provide services you >need. Set your browser to regularly delete cookies. Don't assume a >Web site is what it claims to be, unless you've typed in the URL >yourself. Make sure the address bar shows the exact address, not a >near-miss. > >Web sites: Secure Sockets Layer (SSL) encryption does not provide any >assurance that the vendor is trustworthy or that its database of >customer information is secure. > >Think before you do business with a Web site. Limit the financial and >personal data you send to Web sites--don't give out information unless >you see a value to you. If you don't want to give out personal >information, lie. Opt out of marketing notices. If the Web site gives >you the option of not storing your information for later use, take >it. Use a credit card for online purchases, not a debit card. > >Passwords: You can't memorize good enough passwords any more, so don't >bother. For high-security Web sites such as banks, create long random >passwords and write them down. Guard them as you would your cash: >i.e., store them in your wallet, etc. > >Never reuse a password for something you care about. (It's fine to >have a single password for low-security sites, such as for newspaper >archive access.) Assume that all PINs can be easily broken and plan >accordingly. > >Never type a password you care about, such as for a bank account, into >a non-SSL encrypted page. If your bank makes it possible to do that, >complain to them. When they tell you that it is OK, don't believe >them; they're wrong. > >E-mail: Turn off HTML e-mail. Don't automatically assume that any >e-mail is from the "From" address. > >Delete spam without reading it. Don't open messages with file >attachments, unless you know what they contain; immediately delete >them. Don't open cartoons, videos and similar "good for a laugh" files >forwarded by your well-meaning friends; again, immediately delete them. > >Never click links in e-mail unless you're sure about the e-mail; copy >and paste the link into your browser instead. Don't use Outlook or >Outlook Express. If you must use Microsoft Office, enable macro virus >protection; in Office 2000, turn the security level to "high" and don't >trust any received files unless you have to. If you're using Windows, >turn off the "hide file extensions for known file types" option; it >lets Trojan horses masquerade as other types of files. Uninstall the >Windows Scripting Host if you can get along without it. If you can't, >at least change your file associations, so that script files aren't >automatically sent to the Scripting Host if you double-click them. > >Antivirus and anti-spyware software: Use it--either a combined program >or two separate programs. Download and install the updates, at least >weekly and whenever you read about a new virus in the news. Some >antivirus products automatically check for updates. Enable that >feature and set it to "daily." > >Firewall: Spend $50 for a Network Address Translator firewall device; >it's likely to be good enough in default mode. On your laptop, use >personal firewall software. If you can, hide your IP address. There's >no reason to allow any incoming connections from anybody. > >Encryption: Install an e-mail and file encryptor (like >PGP). Encrypting all your e-mail or your entire hard drive is >unrealistic, but some mail is too sensitive to send in the >clear. Similarly, some files on your hard drive are too sensitive to >leave unencrypted. > >None of the measures I've described are foolproof. If the secret >police wants to target your data or your communications, no >countermeasure on this list will stop them. But these precautions are >all good network-hygiene measures, and they'll make you a more >difficult target than the computer next door. And even if you only >follow a few basic measures, you're unlikely to have any problems. > >I'm stuck using Microsoft Windows and Office, but I use Opera for Web >browsing and Eudora for e-mail. I use Windows Update to automatically >get patches and install other patches when I hear about them. My >antivirus software updates itself regularly. I keep my computer >relatively clean and delete applications that I don't need. I'm >diligent about backing up my data and about storing data files that are >no longer needed offline. > >I'm suspicious to the point of near-paranoia about e-mail attachments >and Web sites. I delete cookies and spyware. I watch URLs to make >sure I know where I am, and I don't trust unsolicited e-mails. I don't >care about low-security passwords, but try to have good passwords for >accounts that involve money. I still don't do Internet banking. I >have my firewall set to deny all incoming connections. And I turn my >computer off when I'm not using it. > >That's basically it. Really, it's not that hard. The hardest part is >developing an intuition about e-mail and Web sites. But that just >takes experience. > >Others have disagreed with these recommendations: ><http://www.getluky.net/archives/000145.html> ><http://www.berylliumsphere.com/security_mentor/2004/12/heres-another-re >ally-good-twelve.html> or <http://makeashorterlink.com/?Z3772560A> > >My original essay on the topic: ><http://www.schneier.com/crypto-gram-0105.html#8> > >This essay previously appeared on CNet: ><http://news.com.com/Who+says+safe+computing+must+remain+a+pipe+dream/20 >10-1071_3-5482340.html> or <http://makeashorterlink.com/?V6872560A> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Done the crime, now it's Mitnick's time
by InfoSec News 15 Dec '04

15 Dec '04

http://www.theage.com.au/news/Next/Done-the-crime-now-its-Mitnicks-time/200… By Patrick Gray December 14, 2004 Next After a five-month delay, the Department of Immigration has granted the world's most notorious convicted cyber-criminal, Kevin Mitnick, a visa to travel to Australia next year to consult to local companies, accept speaking engagements and promote his new book, scheduled for release in March. It will be Mitnick's first visit to Australia and one of his few trips outside the US and Europe. Mitnick spent more than five years in jail for his exploits, which included hacking into Motorola, Novell, Fujitsu, Sun Microsystems and Nokia to steal software code. Since his release in 2000, he has worked as a security consultant and written two books, The Art of Deception [1] and The Art of Intrusion [2]. Mitnick will fly to Melbourne on March 2 to deliver a keynote speech to an as yet unnamed company. He will fly back to the US the following week to start a book tour, returning to Australia in April to conduct a workshop. Mitnick is best known for his uncanny ability to trick employees into revealing sensitive information, a technique called "social engineering". He cites the theft of two customs computers from Sydney International Airport by three men in August last year as one example of a social engineering attack in Australia. "A lot of companies in Australia are vulnerable," Mitnick says. "That was a pure social engineering attack. We all know they weren't after the hardware, they were after the data." Both of Mitnick's books are about security but many people will be more eager to read the one he plans to start writing on January 21, 2007, when a court order that stops him from profiting from his crimes expires. "I'm definitely doing an autobiography," he says. "It's going to focus on the adventure, the things I did when I was a fugitive, how I lived my life and what was going through my head, the close calls nobody knows about. It will be the Catch Me If You Can of cyberspace." Catch Me If You Can [3] was an autobiography written in 1980 by Frank Abagnale jnr, a con man who passed himself off as a Pan Am pilot while forging $US2.5 million in fake cheques. There have been books written about Mitnick's exploits, most famously Takedown, written by New York Times journalist John Markoff and Tsutomo Shimomura, one of Mitnick's victims, which was made into a movie. But Mitnick says the real story hasn't been told. He has been portrayed as the "Osama bin-Mitnick of the internet", he says, and he wants to set the record straight. Mitnick launched a legal action against the producers of the Takedown movie, which was settled out of court. Although Mitnick spent two years on the run from the FBI in the US living under assumed names, he doesn't expect law enforcement to take much interest in his travels these days. "The only time they call me is when they need my help," Mitnick says. "They don't contact me because they're suspicious I'm doing anything wrong." Mitnick has just finished a vulnerability assessment of a US credit union. Much of his work involves technical testing and doesn't rely on his mastery of social engineering. "I'm doing vulnerability penetration tests, I'm going into companies and hardening their systems and network," he says. "It's all technical, no social engineering." A penetration test is work well suited to Mitnick's talents. Similar to the fictional hackers in the 1992 movie, Sneakers, for a fee, he breaks into companies' networks, submitting a report detailing security weaknesses and vulnerabilities. Before his release, Mitnick had never been out of the US, with the exception of Canada and Mexico. As much as he enjoys seeing the world, Mitnick confesses he is afraid of flying. "I hate to fly, man, I hate it. I have to get some sleeping pills to knock me out." [1] http://www.amazon.com/exec/obidos/ASIN/076454280X/c4iorg [2] http://www.amazon.com/exec/obidos/ASIN/0764569597/c4iorg [3] http://www.amazon.com/exec/obidos/ASIN/0767905385/c4iorg _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Done the crime, now it's Mitnick's time
by InfoSec News 15 Dec '04

15 Dec '04

http://www.theage.com.au/news/Next/Done-the-crime-now-its-Mitnicks-time/200… By Patrick Gray December 14, 2004 Next After a five-month delay, the Department of Immigration has granted the world's most notorious convicted cyber-criminal, Kevin Mitnick, a visa to travel to Australia next year to consult to local companies, accept speaking engagements and promote his new book, scheduled for release in March. It will be Mitnick's first visit to Australia and one of his few trips outside the US and Europe. Mitnick spent more than five years in jail for his exploits, which included hacking into Motorola, Novell, Fujitsu, Sun Microsystems and Nokia to steal software code. Since his release in 2000, he has worked as a security consultant and written two books, The Art of Deception [1] and The Art of Intrusion [2]. Mitnick will fly to Melbourne on March 2 to deliver a keynote speech to an as yet unnamed company. He will fly back to the US the following week to start a book tour, returning to Australia in April to conduct a workshop. Mitnick is best known for his uncanny ability to trick employees into revealing sensitive information, a technique called "social engineering". He cites the theft of two customs computers from Sydney International Airport by three men in August last year as one example of a social engineering attack in Australia. "A lot of companies in Australia are vulnerable," Mitnick says. "That was a pure social engineering attack. We all know they weren't after the hardware, they were after the data." Both of Mitnick's books are about security but many people will be more eager to read the one he plans to start writing on January 21, 2007, when a court order that stops him from profiting from his crimes expires. "I'm definitely doing an autobiography," he says. "It's going to focus on the adventure, the things I did when I was a fugitive, how I lived my life and what was going through my head, the close calls nobody knows about. It will be the Catch Me If You Can of cyberspace." Catch Me If You Can [3] was an autobiography written in 1980 by Frank Abagnale jnr, a con man who passed himself off as a Pan Am pilot while forging $US2.5 million in fake cheques. There have been books written about Mitnick's exploits, most famously Takedown, written by New York Times journalist John Markoff and Tsutomo Shimomura, one of Mitnick's victims, which was made into a movie. But Mitnick says the real story hasn't been told. He has been portrayed as the "Osama bin-Mitnick of the internet", he says, and he wants to set the record straight. Mitnick launched a legal action against the producers of the Takedown movie, which was settled out of court. Although Mitnick spent two years on the run from the FBI in the US living under assumed names, he doesn't expect law enforcement to take much interest in his travels these days. "The only time they call me is when they need my help," Mitnick says. "They don't contact me because they're suspicious I'm doing anything wrong." Mitnick has just finished a vulnerability assessment of a US credit union. Much of his work involves technical testing and doesn't rely on his mastery of social engineering. "I'm doing vulnerability penetration tests, I'm going into companies and hardening their systems and network," he says. "It's all technical, no social engineering." A penetration test is work well suited to Mitnick's talents. Similar to the fictional hackers in the 1992 movie, Sneakers, for a fee, he breaks into companies' networks, submitting a report detailing security weaknesses and vulnerabilities. Before his release, Mitnick had never been out of the US, with the exception of Canada and Mexico. As much as he enjoys seeing the world, Mitnick confesses he is afraid of flying. "I hate to fly, man, I hate it. I have to get some sleeping pills to knock me out." [1] http://www.amazon.com/exec/obidos/ASIN/076454280X/c4iorg [2] http://www.amazon.com/exec/obidos/ASIN/0764569597/c4iorg [3] http://www.amazon.com/exec/obidos/ASIN/0767905385/c4iorg _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[i2p] Threat model (fwd from tkaitchuck@comcast.net)
by Eugen Leitl 15 Dec '04

15 Dec '04

----- Forwarded message from Tom Kaitchuck <tkaitchuck(a)comcast.net> -----

1 0

Hollywood fights illegal downloads by targeting servers
by R.A. Hettinga 14 Dec '04

14 Dec '04

<http://www.reuters.co.uk/printerFriendlyPopup.jhtml?type=entertainmentNews&…> Reuters News Article Hollywood fights illegal downloads by targeting servers Tue Dec 14, 2004 08:29 AM ET By Jesse Hiestand LOS ANGELES (Hollywood Reporter) - Hollywood's major studios intend to escalate their battle against illegal movie downloading by targeting the popular BitTorrent network and those who operate its servers, the movie industry's lobbying arm is set to announce. The civil suits against server operators marks the next step in the Motion Picture Assn. of America's (MPAA) anti-piracy campaign, which started last month with lawsuits against individuals who shared movies on peer-to-peer services. In addition to civil lawsuits filed in the United States, a news conference at the MPAA's offices in Washington on Tuesday also will detail how international law enforcement has aided these anti-piracy efforts. Further details of the event were not available. MPAA president and CEO Dan Glickman is set to make the announcement along with Travis Kalanick, CEO of Red Swoosh, which develops private P2P networks, and Mark Ishikawa, CEO of BayTSP, which offers file-branding and -tracking applications. BitTorrent can rapidly transfer large files among many people, leading to interest among legitimate users who recognize the technology's efficiency and speed. While it is among the fastest-growing P2P networks, BitTorrent is different from its predecessors in several respects. Unlike other networks, where users can search for a file, BitTorrent users must go to a Web site to get a "torrent file" and connect to a server to find other users who have the file. The network relies on these "tracker" servers to manage users' downloads by knowing who has the file and connecting users for uploading and downloading. Because downloaders swap portions of a file with one another, the file-trading functions like a collective swarm rather than a series of individual connections to a single server. Sources say the MPAA is not necessarily going after BitTorrent's developer, Bram Cohen, only the server operators. The major motion picture studios filed their first round of civil lawsuits in mid-November, initially targeting about 200 people who allegedly made movies available on P2P services. The record industry, through the RIAA, pioneered this practice and has now filed about 7,000 civil cases, most of which have been settled for a few thousand dollars. The MPAA estimates that the studios lose about $3.5 billion annually to physical piracy like bootlegged DVDs but does not have a ready figure for Internet-related losses. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Police given computer spy powers
by Anonymous Sender 14 Dec '04

14 Dec '04

Police given computer spy powers http://smh.com.au/news/National/Police-given-computer-spy-powers/2004/12/12… ("smhguy/pass" to access) By Rob O'Neill December 13, 2004 Federal and state police now have the power to use computer spyware to gather evidence in a broad range of investigations after legal changes last week. The Surveillance Devices Act allows police to obtain a warrant to use software surveillance technologies, including systems that track and log keystrokes on a computer keyboard. The law applies to the Australian Federal Police and to state police investigating Commonwealth offences. Critics have called the law rushed and imbalanced, saying police will be able to secretly install software to monitor email, online chats, word processor and spreadsheets entries and even bank personal identification numbers and passwords. Irene Graham, executive director of watchdog Electronic Frontiers Australia, said the law went too far in allowing police surveillance. "The legislation has been passed without the proper scrutiny and the ALP is too afraid to stick to their guns and oppose it," she said. Ms Graham also believed the act could override parts of the Telecommunications Interception Act, which tightly regulated telecommunications monitoring. AdvertisementAdvertisement A spokesperson for the federal Attorney-General, Philip Ruddock, denied this, saying the act specifically said it should not be read to override the Telecommunications Interception Act. The spokesperson said there were protections in the legislation, including reporting to Parliament and allowing reviews by the Ombudsman. In addition to redefining the kinds of surveillance devices that can be used, the Surveillance Devices Act allows surveillance for offences far less serious than those allowed under the Telecommunications Interception Act. Warrants to intercept telecommunications can only be obtained to investigate offences carrying a maximum jail term of seven years or more. However, Surveillance Devices Act warrants can be obtained for offences carrying a maximum sentence of three years. Ms Graham said the three-year benchmark was too low and the act went too far in setting out circumstances in which police could use surveillance devices. A warrant could be obtained under the act if an officer had reasonable grounds to suspect an offence had been or might be committed and a surveillance device was necessary to obtain evidence. They can also be obtained in child recovery cases. The act also has secrecy provisions making it an offence to publish information on an application for, or the existence of, a surveillance warrant. The Government said the act would consolidate and modernise the law. Mr Ruddock said the power of Commonwealth law enforcement using surveillance devices lagged behind what technology made possible and what was permitted in other jurisdictions. However, Electronic Frontiers is concerned that key-logging software can even record words written and then deleted or changed and thoughts that are not intended for communication.

1 0

Re: Insurrectionist covers
by Steve Thompson 14 Dec '04

14 Dec '04

--- Justin Guyett <justin(a)soze.net> wrote: > On 2004-12-11T08:10:27-0500, Steve Thompson wrote: > > [snip] > > This is what happens when one picks up ideas from people who present > them > > second-hand (or at even greater distances from their origin) and who > do > > not make proper footnotes. > > That's just a symptom of the problem that there's no clear line past > which ideas must be cited. How infrequently do you have to see an idea > in print, and how novel must it be, before a citation is appropriate? Depends, I suppose, on a number of factors. > Ideas are a continuum. Plagiarism is an artificial notion constructed > as a result of the need to measure individuals' progress in higher > education, as well as to protect intellectual property (which didn't > really exist before the invention of the printing press). People used > to have scribes copy books. They were treated as tomes of knowledge, > not as property. Now that they are property, people have more books > than ever before, and are reading them less carefully than ever before. Well, previously there was more importance put towards knowledge, and less on making money with same. Today the emphasis is somewhat different. > Even Dawkins and Hobbes picked up ideas and used them without explicit > citation. Hobbes didn't arrive at his conception of the State of Nature > in a void. He got those ideas in reaction against Greek history, > Descartes, and several other people. Everybody does that, or at least those who create knowledge either as a process of study and synthesis, or as a result of original research. Some ideas are prevalent to the extent that it is obvious as to their origin. Ideally, someone who presents an idea as his or her own will take some pains to indicate the fact, and will distinguish their sources by way of appropriate references. > Which brings up an interesting thought relating to entropy. Does it > matter whether a prior author breaks up a subject into N pieces, proving > N-1 pieces unworkable but leaving the "last" unaddressed? Someone who Now you're talking about SLAC. > takes those ideas and writes a defense of the "last" piece might be > copying the prior author's ideas, even though they were not written > anywhere. Intellectual property and ideas are often traceable directly, > but sometimes they are not. Requiring citations for ideas often results > in incorrect citations or citations to secondary or tertiary (or worse) > sources. Theft of IP is a complicated endeavour these days. > Hijacking that thought a bit, lack of citations is one of my pet peeves. Me too. > Nobody makes proper footnotes or citations these days; it's particularly > noticeable in quote collections. There are fake quotes from the > founders floating around, as well as fake quotes from Marcus Aurelius > ("Times are bad; children no longer obey their parents, and everyone is > writing a book.") as well as from all sorts of other historical figures. Opinion: It seems there is a new trend towards guild-like protection of scientific and scientific-like diciplines. People who like the idea of guilds are working towards making participation contingent upon membership. Membership may eventually only be granted to individuals who submit to arbitrary rules. And note that I am not referring to ethical restrictions in this instance. Ethics -- good ones that dicate a minimum of racism and like discrimination, for instance -- are becoming somehwat rare. Regards, Steve ______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca

4 5

[i2p] weekly status notes [dec 14] (fwd from jrandom@i2p.net)
by Eugen Leitl 14 Dec '04

14 Dec '04

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Gait advances in emerging biometrics
by Sunder 14 Dec '04

14 Dec '04

Original URL: http://www.theregister.co.uk/2004/12/14/alt_biometrics/ Gait advances in emerging biometrics By John Leyden (john.leyden at theregister.co.uk) Published Tuesday 14th December 2004 15:07 GMT "Great Juno comes; I know her by her gait." William Shakespeare, The Tempest Retinal scans, finger printing or facial recognition get most of the publicity but researchers across the world are quietly labouring away at alternative types of biometrics. Recognition by the way someone walk (their gait), the shape of their ears, the rhythm they make when they tap and the involuntary response of ears to sounds all have the potential to raise the stock of biometric techniques. According to Professor Mark Nixon, of the Image Speech and Recognition Research Group at the University of Southampton, each has unique advantages which makes them worth exploring. <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

2 1

punkly current events
by Major Variola (ret) 13 Dec '04

13 Dec '04

Someone should have commented here, so I will, that some judges (earning hanging) basically said that anonymity is not a right. This in the context of mask-wearing in public. If the Klan doesn't have a right to wear pillowcases what makes you think mixmaster will survive?

8 11