- cypherpunks-legacy - lists.cpunks.org

Seld-defeating US foreign policy
by Tyler Durden 20 Oct '04

20 Oct '04

Well, when push comes to shove I have to admit Mr Donald doesn't mince words. Guess that's what Cypherpunks is for! However... >The US government should expose and condemn these objectionable >practices, subvert moderately objectionable regimes, and >annihilate more objectionable regimes. The pentagon should >deprive moderately objectionable regimes of economic resources, >by stealing their oil, destroying their water systems, and >cutting off their trade and population movements with the >outside world. As was stated elesewhere, there is sfirst of all the problem of -who- determines the meaning of objectionable. Is it the latest DC regime? You make it seem like you espouse a philosophy that makes it easy and obvious to see what's objectionable. More than that, however, this may be completely self-defeating. Most governments are not static entities. Some will evolve or die via relatively Darwinian processes, and interference really ends up being self-defeating, or possibly far worse. I won't belabor my favorite example of China--Vietnam--Cambodia, but it's clear to me things could have been completely different had the US not espoused blatantly aggressive policies towards China in particular. In this context a very strong case can be made that the US caused the Khmer Rouge to come to power, precisely by performing in a way similar to what you espouse. We also had opportunities to ally with China early on, and let's remember we were allies with Ho Chi Min during WWII. But all we did is blindly pursue a policy that ended up devliering precisely OPPOSITE to what you would seem to espouse. And we're doing the same thing in the middle east. -TD _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 1

Re: Airport insanity
by Bill Stewart 20 Oct '04

20 Oct '04

At 12:18 PM 10/18/2004, James A. Donald wrote: >http://washingtontimes.com/national/20041018-124854-2279r.htm >: : Despite gaining their freedom by signing pledges to >: : renounce violence, at least seven former prisoners >: : of the United States at Guantanamo Bay, Cuba, have >: : returned to terrorism, at times with deadly >: : consequences. >: : >: : At least two are believed to have died in fighting >: : in Afghanistan, and a third was recaptured during a >: : raid of a suspected training camp in Afghanistan, >: : Lt. Cmdr. Flex Plexico, a Pentagon spokesman, said >: : last week. Others are at large. > >: : Additional former detainees have expressed a desire >: : to rejoin the fight, be it against U.N. peacekeepers >: : in Afghanistan, Americans in Iraq or Russian >: : soldiers in Chechnya. None of those things sound like terrorism to me, just basic military violence, though certainly the American and Russian militaries aren't the only ones engaging in terrorist activities in South Asia and some of these ~146 people may be among them. But most of the Warlord-vs-Warlord fighting in Afghanistan isn't terrorism, and most of the Iraqi Resistance isn't either, and I'd have expected that a staunch anti-communist like James wouldn't mind people shooting at Russian soldiers even though they're no longer Soviets. At 11:38 AM 10/18/2004, James A. Donald wrote: >Tyler Durden > > Let's just state the obvious: September 11th occurred not > > because we had a few "crazy Muslim fundamentalists" out there > > that decided they "hate our freedoms". The struck us because > > we've been fuckin' over a large swath of the Muslim (not only > > Arab) world for 100 years or so > >And the reason they are murdering Iraqi Christians, Filipinos, >Ambionese and Timorese is? While the ones murdering Iraqi Christians may be doing it out of religious hatred as well as the perception that the Americans are running a Christian crusade against the Muslim world, the Indonesian invasions of their neighbors such as East Timor are just good old nationalist expansion - the US has been funding the Indonesian military for ~40 years because they're our Anti-Communist buddies, and who cares about their human rights records. You didn't expect that behaviour to stop just because there were no longer any Commies around, did you?

5 6

test
by Riad S. Wahby 20 Oct '04

20 Oct '04

This is a test. Please disregard. [1] -- Riad S. Wahby rsw(a)jfet.org

1 0

[ISN] Worldwide Phishing Attacks May Stem from Few Sources
by R.A. Hettinga 20 Oct '04

20 Oct '04

--- begin forwarded text

1 0

[ISN] NZ jails Aussie bank hacker
by R.A. Hettinga 20 Oct '04

20 Oct '04

--- begin forwarded text

1 0

[ISN] 2-Fingerprint Border ID System Called Inadequate
by R.A. Hettinga 20 Oct '04

20 Oct '04

--- begin forwarded text

1 0

[ISN] Worldwide Phishing Attacks May Stem from Few Sources
by InfoSec News 20 Oct '04

20 Oct '04

http://www.eweek.com/article2/0,1759,1679953,00.asp By Dennis Fisher October 19, 2004 Research from an e-mail security provider suggests that a handful of people are responsible for the vast majority of the phishing attacks on the Internet and the perpetrators are using a rotating series of zombie networks to launch them. Researchers at CipherTrust Inc. analyzed more than four million e-mails collected from the company's customers during the first two weeks of October and found that nearly a third of all of the zombie machines sending the phishing messages are based in the United States. That's twice as many as the 16 percent that are found in South Korea. However, these findings do not mean that these attacks are originating from inside these countries. The global nature of the Internet allows attackers anywhere in the world to compromise machines in any location. In fact, many experts believe that the majority of phishers are in some way connected to organized crime groups in Russia or Eastern Europe and that most such attacks begin there. The most surprising conclusion of the research is that the attackers sending out the phishing messages are using zombie networks of only about 1,000 PCs. "That's a pretty small bot network for the volume of stuff that these guys are doing," said Dmitri Alperovitch, the research engineer at Atlanta-based CipherTrust Inc. who conducted the study. "But the trick is that they rotate to a different set of compromised machines each day. They don't keep going to the same ones each time." Crackers for years have been accumulating large networks of machines compromised with small programs that give them the ability to control the PCs remotely. They routinely sell or trade access to the networks to others in the cracker underground and the PCs typically are used either for launching DDoS (distributed denial of service attacks). But as authorities began cracking down on spammers in recent years, the spammers have begun relying on these networks to send out their messages, too. Now, phishers have gotten into the game. Alperovitch said that there are fewer than five operators in control of the zombie networks that he identified in his research. And, even though they're generating thousands of fraudulent e-mails every day, their output was still a tiny fraction.less than one percent--of the four million messages CipherTrust examined. Phishers seem to be concentrating their efforts on a few high-profile targets, as well. In the sample CipherTrust looked at, 54 percent of the phishing messages used CitiGroup's Citibank name to entice recipients. Another 13 percent use Citigroup Global Markets Inc.'s Smith Barney's brand and eBay Inc. is the victim in about four percent of the scams. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Worldwide Phishing Attacks May Stem from Few Sources
by InfoSec News 20 Oct '04

20 Oct '04

http://www.eweek.com/article2/0,1759,1679953,00.asp By Dennis Fisher October 19, 2004 Research from an e-mail security provider suggests that a handful of people are responsible for the vast majority of the phishing attacks on the Internet and the perpetrators are using a rotating series of zombie networks to launch them. Researchers at CipherTrust Inc. analyzed more than four million e-mails collected from the company's customers during the first two weeks of October and found that nearly a third of all of the zombie machines sending the phishing messages are based in the United States. That's twice as many as the 16 percent that are found in South Korea. However, these findings do not mean that these attacks are originating from inside these countries. The global nature of the Internet allows attackers anywhere in the world to compromise machines in any location. In fact, many experts believe that the majority of phishers are in some way connected to organized crime groups in Russia or Eastern Europe and that most such attacks begin there. The most surprising conclusion of the research is that the attackers sending out the phishing messages are using zombie networks of only about 1,000 PCs. "That's a pretty small bot network for the volume of stuff that these guys are doing," said Dmitri Alperovitch, the research engineer at Atlanta-based CipherTrust Inc. who conducted the study. "But the trick is that they rotate to a different set of compromised machines each day. They don't keep going to the same ones each time." Crackers for years have been accumulating large networks of machines compromised with small programs that give them the ability to control the PCs remotely. They routinely sell or trade access to the networks to others in the cracker underground and the PCs typically are used either for launching DDoS (distributed denial of service attacks). But as authorities began cracking down on spammers in recent years, the spammers have begun relying on these networks to send out their messages, too. Now, phishers have gotten into the game. Alperovitch said that there are fewer than five operators in control of the zombie networks that he identified in his research. And, even though they're generating thousands of fraudulent e-mails every day, their output was still a tiny fraction.less than one percent--of the four million messages CipherTrust examined. Phishers seem to be concentrating their efforts on a few high-profile targets, as well. In the sample CipherTrust looked at, 54 percent of the phishing messages used CitiGroup's Citibank name to entice recipients. Another 13 percent use Citigroup Global Markets Inc.'s Smith Barney's brand and eBay Inc. is the victim in about four percent of the scams. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] 2-Fingerprint Border ID System Called Inadequate
by InfoSec News 20 Oct '04

20 Oct '04

http://www.washingtonpost.com/wp-dyn/articles/A43276-2004Oct18.html By Robert O'Harrow and Jr. Scott Higham Washington Post Staff Writers October 19, 2004 Terrorists who alter their fingerprints have about an even chance of slipping past U.S. border watch-list checks because the government is using a two-fingerprint system instead of one that relies on all 10 prints, a lawmaker said in a letter he made public yesterday to Homeland Security Secretary Tom Ridge. Rep. Jim Turner (D-Tex.) wrote that a study by researchers at Stanford University concluded the two-finger system "is no more than 53 percent effective in matching fingerprints with poor image quality against the government's biometric terrorist watch-list." Turner said the system falls far short of keeping the country secure. "It's going to be a coin toss as to whether we can identify terrorists," Turner, the ranking member of the House Select Committee on Homeland Security, said in an interview yesterday. "It's a 50-50 chance, and that's not good enough." Turner's Oct. 15 letter comes as government officials supervising the burgeoning border security system, known as US-VISIT, have been touting their use of fingerprints for identifying people crossing the border and checking them against watch lists of suspected terrorists. The US-VISIT program aims to create a "virtual border" using computer networks, databases, fingerprints and other biometric identifiers. The program requires foreign visitors to register their names before traveling to the United States and have their fingerprints checked when they arrive and depart. Officials estimate the system could cost up to $10 billion and take a decade to build. The border security program is relying on technology first developed for a program at the former Immigration and Naturalization Service called IDENT. Government officials have known for years that IDENT did not work well with the identification system used by the Justice Department, a 10-fingerprint system called the Integrated Automated Fingerprint Identification System. That system is known for producing good results, even with poor-quality fingerprint images, Turner's letter said. But homeland security officials have told Congress they decided to use the IDENT system for the first phase of US-VISIT as a way to quickly improve security at the borders, and move to a 10-fingerprint system later. "It was a logistical issue we had to deal with," said Robert A. Mocny, deputy director of US-VISIT. "It will get better. . . . It's a matter of what we can do right now." Turner's letter said the Department of Homeland Security ignored numerous warnings from the "government's top biometric scientists" that the "two-fingerprint system could not accurately perform watch list searches and the ten-fingerprint system was far preferable." The letter quotes Stanford researcher Lawrence M. Wein, who said his study found that at best, with a software fix, the two-finger system would properly identify only about three of four people. Two weeks ago, Wein told the Homeland Security Committee that the "implications of our findings are disturbing." Turner accused homeland security officials of failing to be "more forthcoming" about the limitations of their approach. Turner asked Ridge to direct homeland security officials to "preserve all documents and electronic communications" relating to their decision on fingerprints. "I understand your desire to deploy biometric screening at our borders as quickly as possible," Turner said in his letter. "But more than three years after the 9/11 attacks, we have invested more than $700 million in an entry-exit system that cannot reliably do what the Department so often said it would: Use a biometric watch-list to keep known terrorists out of the country." A spokesman for the Republican-controlled Homeland Security Committee, Ken Johnson, said the release of Turner's letter was driven by election-year politics. Johnson acknowledged that there are "some concerns" with the current system, but he said US-VISIT continues to evolve. "In a perfect world, where money is not an issue, and people wouldn't mind spending countless hours or days at the border, the 10-fingerprint system would be preferable. But that's not reality," Johnson said. "They're playing politics with some very sensitive issues." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] 2-Fingerprint Border ID System Called Inadequate
by InfoSec News 20 Oct '04

20 Oct '04

http://www.washingtonpost.com/wp-dyn/articles/A43276-2004Oct18.html By Robert O'Harrow and Jr. Scott Higham Washington Post Staff Writers October 19, 2004 Terrorists who alter their fingerprints have about an even chance of slipping past U.S. border watch-list checks because the government is using a two-fingerprint system instead of one that relies on all 10 prints, a lawmaker said in a letter he made public yesterday to Homeland Security Secretary Tom Ridge. Rep. Jim Turner (D-Tex.) wrote that a study by researchers at Stanford University concluded the two-finger system "is no more than 53 percent effective in matching fingerprints with poor image quality against the government's biometric terrorist watch-list." Turner said the system falls far short of keeping the country secure. "It's going to be a coin toss as to whether we can identify terrorists," Turner, the ranking member of the House Select Committee on Homeland Security, said in an interview yesterday. "It's a 50-50 chance, and that's not good enough." Turner's Oct. 15 letter comes as government officials supervising the burgeoning border security system, known as US-VISIT, have been touting their use of fingerprints for identifying people crossing the border and checking them against watch lists of suspected terrorists. The US-VISIT program aims to create a "virtual border" using computer networks, databases, fingerprints and other biometric identifiers. The program requires foreign visitors to register their names before traveling to the United States and have their fingerprints checked when they arrive and depart. Officials estimate the system could cost up to $10 billion and take a decade to build. The border security program is relying on technology first developed for a program at the former Immigration and Naturalization Service called IDENT. Government officials have known for years that IDENT did not work well with the identification system used by the Justice Department, a 10-fingerprint system called the Integrated Automated Fingerprint Identification System. That system is known for producing good results, even with poor-quality fingerprint images, Turner's letter said. But homeland security officials have told Congress they decided to use the IDENT system for the first phase of US-VISIT as a way to quickly improve security at the borders, and move to a 10-fingerprint system later. "It was a logistical issue we had to deal with," said Robert A. Mocny, deputy director of US-VISIT. "It will get better. . . . It's a matter of what we can do right now." Turner's letter said the Department of Homeland Security ignored numerous warnings from the "government's top biometric scientists" that the "two-fingerprint system could not accurately perform watch list searches and the ten-fingerprint system was far preferable." The letter quotes Stanford researcher Lawrence M. Wein, who said his study found that at best, with a software fix, the two-finger system would properly identify only about three of four people. Two weeks ago, Wein told the Homeland Security Committee that the "implications of our findings are disturbing." Turner accused homeland security officials of failing to be "more forthcoming" about the limitations of their approach. Turner asked Ridge to direct homeland security officials to "preserve all documents and electronic communications" relating to their decision on fingerprints. "I understand your desire to deploy biometric screening at our borders as quickly as possible," Turner said in his letter. "But more than three years after the 9/11 attacks, we have invested more than $700 million in an entry-exit system that cannot reliably do what the Department so often said it would: Use a biometric watch-list to keep known terrorists out of the country." A spokesman for the Republican-controlled Homeland Security Committee, Ken Johnson, said the release of Turner's letter was driven by election-year politics. Johnson acknowledged that there are "some concerns" with the current system, but he said US-VISIT continues to evolve. "In a perfect world, where money is not an issue, and people wouldn't mind spending countless hours or days at the border, the 10-fingerprint system would be preferable. But that's not reality," Johnson said. "They're playing politics with some very sensitive issues." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0