- cypherpunks-legacy - lists.cpunks.org

Children of criminals to be 'targeted' and 'tracked'
by R. A. Hettinga 15 Aug '04

15 Aug '04

<http://news.independent.co.uk/low_res/story.jsp?story=551894&host=3&dir=62> The Independent Children of criminals to be 'targeted' and 'tracked' By Marie Woolf ,Chief Political Correspondent 16 August 2004 Children of criminals to be 'targeted' and 'tracked' Hazel Blears: Shedding new light on the old cops-and-robbers story Bruce Anderson: Blunkett and Howard are right to focus on the collapse of order and rising crime? Children of criminals are to be "targeted" and "tracked" from an early age by the Government to prevent them following their parents into a life of crime, as part of a campaign to tackle the next generation of offenders. In an offensive on youth crime, a programme to prevent 125,000 children whose fathers are in prison from joining them in jail, is being planned by the Home Office. In an interview with The Independent, Hazel Blears, the Policing minister, says she is optimistic that "tracking" and "targeting" can help prevent children becoming criminals like their parents. Studies showed that children with criminal fathers and "under-achievers" who grow up in local authority care have a significant chance of turning to crime themselves. "About 125,000 kids have got a dad in prison. That's a huge risk factor. Something like 65 per cent of those kids will end up in prison themselves," she said. "We need to track the children who are most at risk. We can predict the risk factors that will lead a child into offending behaviour." However, she is aware the plan, based on research showing children of criminals are far more likely to end up in jail than their peers, may lead to accusations they are being unfairly singled out. "I don't think it is stigmatising those children by targeting them," she said. "You can intervene at an early age and say 'your life can be different and we will help you and your parents make your life different.' Let's put the support in as early as we can." The Policing minister has been in talks with Margaret Hodge, the minister for Children, about an early intervention scheme to prevent children of burglars, muggers, and gangsters from breaking the law. She wants to use methods used in Labour's Sure Start programme for under-fives in deprived areas to give extra support to children from criminal backgrounds. Children would be tracked by the authorities from the time they are in nappies to their teenage years with extra support and help to nip disruptive behaviour in the bud. One study showed that the most violent offenders began to display bad behaviour as young as six. Another study which tracked children into adult life found "under-controlled" children who exhibited disruptive behaviour at the age of three were four times more likely to be convicted of violent offences. "If you can tackle the 125,000 kids with dads in jail by providing extra support and help there's a chance," Ms Blears said. Teenagers with criminal fathers would be monitored and offered extra support at school and by social services as well as being introduced to sport, drama and other after-school activities. "You can get the parents into parenting classes. We can get some of the older kids involved in arts, sports drama. Give them something to succeed at. If you go to school every day and everybody tells you you are rubbish you are never going to succeed," she said. Ms Blears also wants to see a crackdown on violence and bullying in schools. Studies show classroom bullies are more likely to be involved in muggings, car theft and attacks outside school. "I don't think you can afford to let it go. It's a bit like zero tolerance," she said. The judicial system should help offenders, including drug addicts who rob to fuel their habit, to change their ways. But if they refuse to change, the police should provide a "hostile environment" for them. "We will help you change your life but if you want to go back to robbing we will be on your doorstep," she said. Meanwhile, children up to the age of five are to be kept in prison with their mothers at Cornton Vale, near Stirling, it emerged yesterday. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Trust no one: backdoored CPUs
by Major Variola (ret) 15 Aug '04

15 Aug '04

We worried about compromized OSes, BIOSes, read last week about a PNG library bug that lets images run buffer exploits, now CPUs can be backdoored: >From Scheier's Crypto-gram: Here's an interesting hardware security vulnerability. Turns out that it's possible to update the AMD K8 processor (Athlon64 or Opteron) microcode. And, get this, there's no authentication check. So it's possible that an attacker who has access to a machine can backdoor the CPU. <http://www.realworldtech.com/forums/index.cfm?action=detail&PostNum=252 7&Thread=1&entryID=35446&roomID=11> or <http://tinyurl.com/43kod>

2 1

The New Digital Media: You Might Have It, But Not Really Own It
by R. A. Hettinga 15 Aug '04

15 Aug '04

Anyone who knows about cryptography quickly comes to the conclusion that if it's encrypted, and I have the key it's *my* property. It doesn't matter what the lawyers say -- or even the guys they hire with guns at your friendly local geographic force monopoly. :-). Now if we can figure out a way to pay for that property cheap enough that nobody *cares* who owns it, as long as they get paid... Cheers, RAH ------- <http://online.wsj.com/article_print/0,,SB109260940215891895,00.html> The Wall Street Journal August 16, 2004 PORTALS The New Digital Media: You Might Have It, But Not Really Own It By NICK WINGFIELD Staff Reporter of THE WALL STREET JOURNAL August 16, 2004 Buying music used to be simple: You coughed up $14 or so for a CD, and as long as you didn't bootleg it or charge crowds of people to listen to it, the music was yours. The Internet and other technologies are changing all that, opening up a slew of new options for purchasing entertainment, be it music or movies or games. That's a good thing. The not-so-good thing is that in the next few years, the sheer number and complexity of those new options are likely to bewilder many consumers. You may no longer be able to "own a movie" or "own a CD," at least in the sense those phrases have been used. Instead, you will merely have "rights" to the content, enforced by technology. Those rights might change over time, even at the whim of the music or movie company you get them from. The technology allowing all this is called digital-rights management, or DRM. It's a kind of invisible software lock securely bolted onto a song or movie. Being software, it's a very flexible sort of lock. A music label, for example, might let you download a song free and then listen to it for a day, but then require you to pay up to keep on listening. For a taste of what DRM might bring, check out Apple Computer's iTunes Music Store, which sells songs for 99 cents. ITunes comes with a DRM system that prevents customers from playing those songs on more than five computers, or burning more than seven identical lists of songs onto CDs. (Before you can play a song on a sixth computer, you need to use the DRM software to "de-authorize" it from one of the first five machines.) Of course, no such technical limits exist on normal music CDs, though recording companies, especially in Europe, are experimenting with restrictions. Some iTunes users are grumbling. In June, science-fiction writer Cory Doctorow gave a talk critical of DRM technology in which he related how he hit Apple's limit on the number of computers he could play his music on -- three machines at the time. One computer was in the shop, another was at his parents' house and a third was a defective machine he had returned to Apple -- without first remembering to de-authorize his music on it so he could play it on another machine. As a result, Mr. Doctorow said he was unable to listen to hundreds of dollars worth of music. Apple says such problems aren't common, especially since the company upped its computer limit to five in April. But that change itself was a lesson in the power of DRM: Apple's increase was retroactive, and applied to all songs, not just those purchased after the change took effect. In this case, Apple gave users more liberal rights. (It also curbed some types of CD burning, but the change didn't apply to previously purchased music.) However, there's nothing preventing Apple from making its DRM retroactively more restrictive -- though the company says that's unlikely. Apple set up the iTunes DRM as a way of getting the big labels -- badly burned by the original Napster -- comfortable with music online. It deserves credit for helping legalize digital music: iTunes has had more than 100 million downloads. And even with the restrictions, iTunes customers more or less "own" their music once they've bought it. By contrast, consumers only "rent" music at subscription services like RealNetworks's Rhapsody, which typically charge a $10 or so monthly fee for playing as much music as customers want. The catch: Rhapsody subscribers can play their songs only on their PCs, not portable audio players, and only as long as they keep paying their monthly bills. That's the main reason these "rental" sites haven't done as well as iTunes. (By the end of this year, a new version of Microsoft's DRM will allow subscription users to transfer content to portable players.) It's not just Internet music that's getting more complicated. Most of today's movie DVDs contain restrictions that prevent users from copying them, or playing them in a different geographic region from where they are bought. But Hollywood studios, along with technology and consumer electronic companies, are working on a new generation of DVDs that will, in addition to holding more data for high-definition movies, also have a much more flexible DRM. As a result, different studios might end up imposing different DVD restrictions. You may, for instance, be able to make a copy of the "Toy Story 4" DVD for your laptop -- but not do the same thing with "Charlie's Angels 5." Those variations will likely require some form of labeling on DVDs so consumers will know what they're getting, according to companies involved in planning them. Alan Davidson, associate director of the civil liberties group Center for Democracy and Technology, says he isn't opposed to DRM, but worries consumers may not understand what rights come with content they purchase. "DRM underscores the point that consumers are going to have to become a lot more sophisticated about what they're buying," he says. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cyberspace Gives Al Qaeda Refuge
by R. A. Hettinga 15 Aug '04

15 Aug '04

<http://news.yahoo.com/news?tmpl=story&cid=2026&u=/latimests/20040815/ts_lat…> Yahoo! Cyberspace Gives Al Qaeda Refuge Sun Aug 15, 7:55 AM ET By Douglas Frantz, Josh Meyer and Richard B. Schmitt Times Staff Writers ISTANBUL, Turkey - In December, Al Qaeda operatives posted a manifesto on the Internet calling for attacks inside countries allied with the United States in Iraq (news - web sites). Spain, with elections approaching, was singled out as a target. On March 11, terrorists set off bombs on four commuter trains in Madrid and killed 191 people. Three days later, Spanish voters replaced the pro-war government with a party whose leader had promised to withdraw the country's 1,300 troops from Iraq. The posting of the strategy and the timing of the Madrid bombings shocked even the most hardened Al Qaeda watchers recently when they reviewed the little-known manifesto. "It's quite extraordinary in that you have a group of people talking about influencing a political process and then having it happen," said a U.S. national security official who analyzed the 54-page posting and spoke on condition that his name not be used. "Reading through this thing, it is just mind-blowing." Since Osama bin Laden (news - web sites) and his followers were driven from their bases in Afghanistan (news - web sites), the Al Qaeda terrorist network has demonstrated an increasing ability to exploit the Internet as it reconfigures itself as a semi-leaderless global extremist movement far more elusive than the original incarnation. Websites run by Al Qaeda and its backers have become virtual classrooms for terrorists, offering instructions for activities such as kidnapping and using cellphones to set off bombs, like the ones used in Madrid. Independent Al Qaeda cells and the network's loose hierarchy use easily available encoding programs and simple techniques to exchange virtually undetectable messages between Internet cafes in Karachi and libraries in London. The Internet's importance to Al Qaeda was highlighted this month by the disclosure that Pakistani authorities had apprehended Mohammed Naeem Noor Khan, a suspected Al Qaeda computer engineer, and collected a wealth of electronic material. E-mail and other information from Khan's computers led to the arrests of 13 suspects in Britain and sent investigators scrambling to unravel electronic links among militants in Pakistan, Europe and the United States, British, U.S., and Pakistani authorities said. The discovery of files on financial institutions in New York and Washington among Khan's trove also played a role in prompting the Bush administration to issue a terrorist warning. Although it has long been known that Al Qaeda used the Internet to conduct reconnaissance on potential U.S. targets, the disks and hard drives taken from Khan disclose much about the resiliency and adaptability of a far-flung network hiding in plain sight, said U.S. and foreign intelligence officials and outside experts interviewed for this report. "The Internet allows the organization to become a virtual self-perpetuating and changing entity in cyberspace that provides technological guidance and moral inspiration to a new generation," said Magnus Ranstorp, a counter-terrorism expert at the University of St. Andrews in Scotland. Rather than the computer whizzes often described by government officials and the press, the Al Qaeda operatives are more often people with everyday skills who have harnessed the Internet in a campaign against the United States and its allies. Even Khan, whom senior U.S. officials describe as extremely computer savvy, used skills available to many people with computer training. Over time, they developed and shared techniques to avoid detection. An Al Qaeda survival manual warned adherents not to use the same Internet cafe too many times. Messages should be written on a word processor and pasted into an e-mail to avoid keeping the computer connected to the Internet for too long, it said. The result is a changing definition not only of Al Qaeda but also of the threat from what is known as cyber-terrorism. After Sept. 11, the biggest fear of terrorists using the Internet was their potential to disable air traffic control systems or disrupt the electric power grid of the United States. Billions were spent shoring up infrastructure defense. Although those concerns remain, authorities said no incident of cyber-terrorism has been recorded and worries have receded. Instead, the discovery of the December manifesto, the arrest in Pakistan last month and the accumulation of other evidence are leading to recognition that for now, at least, cyberspace is not a weapon for Al Qaeda, but a tool - one more difficult to counter than gunmen huddled in caves and tents. James Lewis, director of technology policy at the Center for Strategic and International Studies in Washington, said one clear advantage for Al Qaeda is that the Internet gives it a communications system that rivals that of a superpower without the accompanying risk. "There is no central headquarters," he said. "There is no central place you can knock out." U.S. and foreign authorities interviewed in recent days generally agreed with a report last spring by the U.S. Treasury and Justice departments, which concluded that the Internet poses tough challenges "because it is largely anonymous, geographically unbounded, unregulated and decentralized." Al Qaeda is not a newcomer to the Internet. In 2000, the group hacked into the e-mail and bank accounts of a U.S. diplomat in Saudi Arabia as part of an effort to track his movements and plot an assassination attempt, which was later abandoned, Ranstorp and a security official in the region said. In the final stages of planning the Sept. 11 attacks, hijacker Mohamed Atta sent a coded message over the Internet that said: "The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering." After the Sept. 11 attacks on the World Trade Center and Pentagon (news - web sites), the camps and safe houses in Afghanistan where Atta and his accomplices had once trained were destroyed in the U.S. air assaults. Thousands of Al Qaeda adherents fled to hiding places in the tribal areas along the Afghan-Pakistani border, to Pakistan and to dozens of other countries. They left behind computers with files on how to build nuclear bombs, diagrams of U.S. buildings and software for stealing passwords off the Internet. In the months that followed, key leaders were killed or captured. Bin Laden has remained so deeply hidden that most intelligence officials think he no longer exercises much control over the network. The U.S. and its allies worked with some success to shut down the flow of money to Al Qaeda through Saudi charities, wealthy benefactors and other means. Faced with this multi-pronged assault, Al Qaeda reinvented itself, with a new reliance on the Internet. Manuals from the training camps were posted on websites. Praise for the "holy war" and appeals for money to continue the fight started popping up. Information was shared among members, and alliances with local and regional extremist groups were formed through cyberspace. More recent Internet postings reflected the adaptations of the new Al Qaeda, with its independent cells and new, often untrained recruits scattered throughout the Middle East, Europe and Africa. In late May, a website linked to Al Qaeda in Saudi Arabia published detailed instructions for carrying out a kidnapping. Three weeks later, U.S. aerospace engineer Paul M. Johnson Jr. was kidnapped in Riyadh, the Saudi capital, and later beheaded. Saudi extremists have proved particularly adept at using the Internet to communicate with other Al Qaeda groups and to promote their aim to topple the royal family, security officials in the country said. But the posting that called for attacks on U.S. allies in Iraq - and its chilling effectiveness - has proved the most startling. "It shows that they are very strategic in what they are doing," the U.S. national security official said. The document was posted on a website run out of the Middle East. Its language, religious references and other telltale signs convinced U.S. experts that an Al Qaeda member wrote it, though they have not identified the author. Titled "Jihad in Iraq: Hopes and Dangers," the posting advocated attacking countries aligned with the U.S. that were most vulnerable to pressure to withdraw their troops from Iraq. Italy and Spain were singled out, with a special mention of Spain's approaching elections. "Withdrawal of Spanish or Italian forces would put immense pressure on the British presence in a way that Tony Blair (news - web sites) might not be able to bear," it said in one of several paragraphs underlined for emphasis. "In this way the dominoes will begin to fall quickly." At another point, the posting said, "We think that the Spanish government could not tolerate more than two, maximum three blows, after which it will have to withdraw as a result of popular pressure." The posting was available on one of the hundreds of Arabic-language websites that cater to extremists and moderates alike. Many of them are watched by intelligence and law enforcement agencies, but experts say there are far too many to monitor thoroughly. Evan Kohlmann, a Washington-based terrorism analyst who has been a consultant to the U.S. government, said he was monitoring an Internet chat room frequented by Islamic extremists last month when someone posted copies of the complete Windows desktop of a U.S. soldier serving in South Korea (news - web sites). The soldier had apparently installed a program to access his work computer through another computer and the hacker found a back door and took control of the machine by using simple techniques, Kohlmann said. Simplicity seems to work best. One common method of communicating over the Internet is essentially an e-mail version of the classic dead drop. Members of a cell are all given the same prearranged username and password for an e-mail account on an Internet service provider, or ISP, such as Hotmail or Yahoo, according to the recent joint report by the Treasury and Justice departments. One member writes a message, but instead of sending it, he puts it in the "draft" file and then logs off. Someone else can then sign onto the account using the same username and password, read the draft and then delete it. "Because the draft was never sent, the ISP does not retain a copy of it and there is no record of it traversing the Internet - it never went anywhere, its recipients came to it," the report said. Secure messages also can be transmitted using widely available encryption tools. Slightly more advanced methods allow messages to be embedded in image, sound or other files transferred over the Internet through a process called "steganography." The files cannot be distinguished without a decoding tool. The difficulty of intercepting and deciphering messages has given rise to a game of cyber cat and mouse, according to government and independent experts. In an effort to gather information on potential recruits and donors, U.S. law enforcement agencies operate websites that are set up to resemble extremist Islamic sites. Visitors leave an electronic trail when they enter the site. On the other side, Al Qaeda can transmit false information to determine whether its members are being monitored by law enforcement. The Internet offers stealth to its users, but authorities can get valuable information if they can get their hands on data stored in computers or on disks. U.S. and foreign investigators still are sifting through the material taken from Khan. By cross-referencing the data with old files on people, places and methods of attacks, they hope to get a new picture of the organization's operations and identify its operatives, senior U.S. law enforcement officials say. They also are getting a closer look at the role of the Internet in Al Qaeda's strategies - and a rare chance to turn the tables on the organization's computer prowess. "Al Qaeda relies on the Internet just like everyone else, and increasingly more so," a senior Justice Department (news - web sites) official said. "But that reliance could also come back to bite them." (BEGIN TEXT OF INFOBOX) Background: Mohammed Naeem Noor Khan Mohammed Naeem Noor Khan, right, a suspected Al Qaeda computer expert, was arrested July 15 in Pakistan. Khan reportedly has told his FBI (news - web sites) interrogators that the terrorist network has monitored top U.S. political officials so closely that its operatives know where they live and the names of their neighbors. Authorities believe Khan may have been a key link among Al Qaeda cells in Pakistan, Britain and the United States. He was arrested while uploading information to several Al Qaeda-affiliated websites at an Internet cafe in Karachi. He reportedly was in the process of sending an e-mail death threat to President Bush (news - web sites), claiming that it was from Al Qaeda. - Los Angeles Times -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

MSNBC - Terrorism: Leads From a Laptop
by R. A. Hettinga 15 Aug '04

15 Aug '04

<http://www.msnbc.msn.com/id/5709166/site/newsweek/print/1/displaymode/1098/> MSNBC.com Terrorism: Leads From a Laptop Newsweek Aug. 23 issue - As frightening as the recent terror warnings about attacks on the homeland have been, U.S. intelligence officials are still stumped by one key question: did any of the plots represent live threats or had Al Qaeda shelved the plans long ago? Raids in Pakistan and Britain over the past few weeks led to a windfall of intelligence about terrorist cells, operations and tradecraft. The major bonanza was a computer and related gear seized from captured Qaeda fixer Muhammed Neem Noor Khan-who, U.S. officials tell NEWSWEEK, was in at least indirect contact with Osama bin Laden. It was from Khan's computer disks that the Feds learned about plans to attack major financial targets in New York and Washington. But intel officials also revealed that the operatives cased the potential targets more than three years ago, suggesting the plot may not have been active. What they have not disclosed, NEWSWEEK has learned, was intelligence that strongly suggested terrorists were actively planning to strike somewhere in Britain. Sources say Khan and Babar Ahmad, a cousin in London who ran pro-bin Laden Web sites, had recently exchanged messages about such an operation. The plotters apparently researched numerous targets, but none in depth, suggesting they had not made any final decision or that, in the words of a senior U.S. law-enforcement official, "They were very flexible." (The method of attack is unclear.) Sources close to the case say that Ahmad-who was arrested by British authorities on a U.S. extradition warrant earlier this month-recently quit his job and moved to sell his house in South London, possibly in preparation for leaving the country. (Ahmad's lawyers failed to respond to requests for comment.) A British official acknowledged that authorities were aware of possible plots but said "there is no specific identification of targets-either individuals or locations." British authorities have spent nearly two weeks questioning several other suspects, one of whom is Esa al-Hindi, the high-level Qaeda operative who is believed to have written some of the surveillance reports of financial buildings in New York and Washington that were found in Khan's computer. U.S. officials say al-Hindi is the author of a jihad recruitment book published in Birmingham, England, which describes him as a Hindu convert who once served as an instructor in an Afghan training camp. A representative of the publisher told NEWSWEEK he met al-Hindi once, and that he was short and spoke with a London accent. U.S. officials, NEWSWEEK has learned, have photos of al-Hindi that they are eager to make public and show to employees in the cased buildings, hoping to jog memories, especially about possible accomplices. But they have so far been blocked from doing so by British authorities who say such premature publicity could blow their case. British law requires that al-Hindi and other suspects be released or charged early this week-at which time the photos are likely to be released. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cyber Fears On Fed's Web Plan
by R. A. Hettinga 15 Aug '04

15 Aug '04

<http://www.nypost.com/business/18671.htm> The New York Post CYBER FEARS ON FED'S WEB PLAN By HILARY KRAMER Email Archives Print Reprint August 15, 2004 -- With little fanfare, the Federal Reserve will begin transferring the nation's money supply over an Internet-based system this month - a move critics say could open the U.S.'s banking system to cyber threats. The Fed moves about $1.8 trillion a day on a closed, stand-alone computer network. But soon it will switch to a system called FedLine Advantage, a Web-based technology. Proponents say the system is more efficient and flexible. The current system is outdated, using DOS - Microsoft's predecessor to the Windows operating system. But security experts say the threat of outside access is too big a risk. "The Fed is now going to be vulnerable in two distinct ways. A hacker could break in to the Fed's network and have full access to the system, or a hacker might not have complete access but enough to cause a denial or disruptions of service," said George Kurtz, co-author of "Hacking Exposed" and CEO of Foundstone, an Internet security company. "If a security breach strikes the very heart of the financial world and money stops moving around, then our financial system will literally start to collapse and chaos will ensue." FedLine is expected to move massive amounts of money. Currently, Fedwire transfers large-dollar payments averaging $3.5 million per transaction among Federal Reserve offices, financial institutions and federal government agencies. Patti Lorenzen, a spokeswoman for the Federal Reserve, said the agency is taking every precaution. "Of course, we will not discuss the specifics of our security measures for obvious reasons," she said. "We feel confident that this system adheres to the highest standards of security. Without disclosing the specifics, it is important to note that our security controls include authentication, encryption, firewalls, intru sion detection and Federal Reserve conducted reviews." Ron Gula, president of Tenable Network Security and a specialist in government cyber security, said he's sure the Fed is taking every precaution. But no system is 100 percent foolproof. "If the motive was to manipulate the money transferring, there are Tom Clancy scenarios where there are ways to subvert underlying technologies," Gula said. "For example, a malicious programmer can put something in the Fed's network to cause the system to self-destruct or to wire them money." The biggest concern isn't the 13-year-old who hacks into the Fedwire and sends himself some money - it's terrorism. On July 22, the Department of Homeland Security released an internal report saying a cyber attack could result in "widespread disruption of essential services ... damag(ing) our economy and put(ting) public safety at risk." But the Fed's undertaking of this massive overhaul is considered a necessity. "Our strategy is to move to Web-based technology because there are inherent limitations with DOS based technology and our goal is to provide better and robust product offerings to meet our customers' needs," said Laura Hughes, vice president of national marketing at the Chicago Fed, which has spearheaded this program. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

How to Find Osama
by R. A. Hettinga 15 Aug '04

15 Aug '04

--- begin forwarded text

1 0

RPOW - Reusable Proofs of Work
by hal＠finney.org 15 Aug '04

15 Aug '04

I'd like to invite members of this list to try out my new hashcash-based server, rpow.net. This system receives hashcash as a Proof of Work (POW) token, and in exchange creates RSA-signed tokens which I call Reusable Proof of Work (RPOW) tokens. RPOWs can then be transferred from person to person and exchanged for new RPOWs at each step. Each RPOW or POW token can only be used once but since it gives birth to a new one, it is as though the same token can be handed from person to person. Because RPOWs are only created from equal-value POWs or RPOWs, they are as rare and "valuable" as the hashcash that was used to create them. But they are reusable, unlike hashcash. The new concept in the server is the security model. The RPOW server is running on a high-security processor card, the IBM 4758 Secure Cryptographic Coprocessor, validated to FIPS-140 level 4. This card has the capability to deliver a signed attestation of the software configuration on the board, which any (sufficiently motivated) user can verify against the published source code of the system. This lets everyone see that the system has no back doors and will only create RPOW tokens when supplied with POW/RPOW tokens of equal value. This is what creates trust in RPOWs as actually embodying their claimed values, the knowledge that they were in fact created based on an equal value POW (hashcash) token. I have a lot more information about the system at rpow.net, along with downloadable source code. There is also a crude web interface which lets you exchange POWs for RPOWs without downloading the client. This system is in early beta right now so I'd appreciate any feedback if anyone has a chance to try it out. Please keep in mind that if there are problems I may need to reload the server code, which will invalidate any RPOW tokens which people have previously created. So don't go too crazy hoarding up RPOWs quite yet. Thanks very much - Hal Finney

1 0

Re: yes, they look for stego, as a "Hacker Tool"
by Major Variola (ret) 15 Aug '04

15 Aug '04

At 02:43 AM 8/15/04 +0200, Thomas Shaddack wrote: >On Sat, 14 Aug 2004, Major Variola (ret) wrote: >> It was disturbing that, as the bottom fell out of telecom, and handsets >> became commoditized, faceplates and ringtones were highly profitable. >> Faceplates are at least made of atoms. There are several lessons there, >> from economic to sociobiological (if there's a difference), none of >> which are terribly pleasing in my aesthetic. > >Care to elaborate further, please? I found it troubling that the tech was becoming commoditized, since this disturbs the innovation that I find attractive. OTOH cheap products are nice. And commoditization is the end-game for tech anyway. Selling ringtones (static bits, not even a service) struck me as oldschool as selling music, enforced in this case by proprietary cellphone "standards". That "personalization" features were lucrative I found to be a comment on human nature. Or human-teens' nature. Since I tend to have an engineer's aesthetic, which I take to be fairly spartan/functional, as well as believing that personalization should be done by the person desiring it, I found mass-market faceplates kind of silly. But then I don't own any Nike baseball caps or Coke t-shirts to express myself. I am un-Amerikan, clearly. There is something I clearly don't "get". Herd mentality, perhaps. Besides, the phones should be covered in conformal photocells to trickle charge them. >> Fortunately the whole PDA vs. cell vs. camera vs GPS vs. smartcard vs >> MP3 player vs. email-pager etc bat-belt [1] frenzy will resolve in a few >> years, and perhaps some of the Linux based solutions will not be >> involuntary citizen-tracking devices and will support privacy of data >> stored, and in transit, including voice data. And free ring tones :-) >> All that's needed is one of the hardware-selling companies to start the >> process, making money off the atoms, and possibly Sharp's Zaurus (?) >> already has? > >Or buy an Enfora Enabler GSM/GPRS module, add a Gumstix module with >built-in bluetooth, slap in a suitable display and keyboard, eventually >add a GPS receiver, and we're set. All features and security modes we can >imagine, and then some. I liked the Handspring's modularity, but don't know how they did in the marketplace. I do think that the cell makers have a decent enough market share to take over the PDA/camera/email etc. market, and they know that and are working on it. I read recently that in 5 years only pros will own digital cameras that do nothing else. Similarly with GPS, PDAs, MP3 renderers & recorders, calculators, authentication tokens, smart cards, etc. How much extra does a hifi audio ADC or DAC cost than an 8 Khz telecom one? Why not let users see their location, even if its only triangulated and not satellite based? Non-volitile memory is only getting cheaper, smaller, with less power requirements or awkward properties like page-based access. >Preventing spatial tracking is difficult though, as we're dependent on the >cellular network for staying online. Though if the given area has wifi >mesh coverage, it could be easier. (And if the device becomes widely >popular, the handsets can serve as mesh nodes themselves - but that's a >song of rather far future.) Yes, but a nice Heinleinian corollary. >> Perhaps there's a biz model in buying a 3-D color prototyping machine >> for $40K and setting up a custom faceplate biz for the integrated gizmo >> of the near future. Hmm, with freedom-enabling software being >> distributed on the side, it sounds like a Heinlein novel... > >Why not? :) Isn't the main purpose of science-fiction (at least its >certain kinds) to be the inspiration for the future? > >On the other hand, perhaps it's cheaper to just get a bulk supply of >"blank" faceplates and hire an artist with an airbrush and a talent. > >It's also possibly easier (and cheaper) to make the parts in more >classical way, eg. by casting them from resin. The rapid prototyping >machines so far usually don't provide parts that are both nice-looking, >accurate, and with suitable mechanical properties at once. I was thinking there are too many models to keep the things in stock on a little beachside storefront; and you could add custom textures with a prototyping machine. Its also possible I'm enamoured of 3D printers which have no place right now in making consumer products. >> [1] Batman (tm) wore a belt with too many gizmos. Some widget-fetishist >> friends/early adopters are similarly afflicted. > >There is nothing like "too many" gizmos! (Well, you could call such >situation "almost enough", but never "too many".) Aesthetics and convenience. OTOH when your Everything Gizmo dies, you are seriously out of luck. Much like when your combo fax/printer/copier/scanner power supply dies, you have zero functionality, instead of the degraded functionality you'd have if each were a separate machine. And sometimes the integrated gizmo does nothing very well, eg early cell-phone cameras. But integration (done well, and reliably) does sell. My $50 prepaid cell phone does voice recognition. Its the 21st century, and I want my Dick Tracy watch now! And it better run Java, or Python, damnit! (I was impressed that the Zaurus PDA can be a web server, BTW.)

1 0

Websites, Passwords, and Consumers (Re: CRYPTO-GRAM, August 15, 2004)
by R. A. Hettinga 15 Aug '04

15 Aug '04

At 11:26 PM -0500 8/14/04, Bruce Schneier wrote: > Websites, Passwords, and Consumers > > > >Criminals follow the money. Today, more and more money is on the >Internet. Millions of people manage their bank accounts, PayPal >accounts, stock portfolios, or other payment accounts online. It's a >tempting target: if a criminal can gain access to one of these >accounts, he can steal money. > >And almost all these accounts are protected only by passwords. > >If you're reading this essay, you probably already know that passwords >are insecure. In my book "Secrets and Lies" (way back in 2000), I >wrote: "Over the past several decades, Moore's Law has made it >possible to brute-force larger and larger entropy keys. At the same >time, there is a maximum to the entropy that the average computer user >(or even the above-average computer user) is willing to >remember.... These two numbers have crossed; password crackers can now >break anything that you can reasonably expect a user to memorize." > >On the Internet, password security is actually much better than that, >because dictionary attacks work best offline. It's one thing to test >every possible key on your own computer when you have the actual >ciphertext, but it's a much slower process when you have to do it >remotely across the Internet. And if the website is halfway clever, >it'll shut down an account if there are too many -- 5?, 10? -- >incorrect password attempts in a row. If you shut accounts down soon >enough, you can even make four-digit PINs work on websites. > >This is why the criminals have taken to stealing passwords instead. > >Phishing is now a very popular attack, and it's amazingly >effective. Think about how the attack works. You get an e-mail from >your bank. It has a plausible message body, and contains a URL that >looks like it's from your bank. You click on it and up pops your bank >website. When asked for your username and password, you type it >in. Okay, maybe you or I are aware enough not to type it in. But the >average home banking customer doesn't stand a chance against this kind >of social engineering attack. > >And in June 2004, a Trojan horse appeared that captured passwords. It >looked like an image file, but it was actually an executable that >installed an add-on to Internet Explorer. That add-on monitored and >recorded outbound connections to the websites of several dozen major >financial institutions and then sent usernames and passwords to a >computer in Russia. Using SSL didn't help; the Trojan monitored >keystrokes before they were encrypted. > >The computer security industry has several solutions that are better >than passwords: secure tokens that provide one-time passwords, >biometric readers, etc. But issuing hardware to millions of electronic >banking customers is prohibitively expensive, both in initial cost and >in customer support. And customers hate these systems. If you're a >bank, the last thing you want to do is to annoy your customers. > >But having money stolen out of your account is even more annoying, and >banks are increasingly fielding calls from customer victims. Even >though the security problem has nothing to do with the bank, even >though the customer is the one who made the security mistake, banks are >having to make good on the customers' losses. It's one of the most >important lessons of Internet security: sometimes your biggest security >problems are ones that you have no control over. > >The problem is serious. In a May survey report, Gartner estimated that >about 3 million Americans have fallen victim to phishing >attacks. "Direct losses from identity theft fraud against phishing >attack victims -- including new-account, checking account and credit >card account fraud -- cost U.S. banks and credit card issuers about >$1.2 billion last year" (in 2003). Keyboard sniffers and Trojans will >help make this number even greater in 2004. > >Even if financial institutions reimburse customers, the inevitable >result is that people will begin to distrust the Internet. The average >Internet user doesn't understand security; he thinks that a gold lock >icon in the lower-right-hand corner of his browser means that he's >secure. If it doesn't -- and we all know that it doesn't -- he'll stop >using Internet financial websites and applications. > >The solutions are not easy. The never-ending stream of Windows >vulnerabilities limits the effectiveness of any customer-based software >solution -- digital certificates, plug-ins, and so on -- and the ease >with which malicious software can run on Windows limits the >effectiveness of other solutions. Point solutions might force >attackers to change tactics, but won't solve the underlying >insecurities. Computer security is an arms race, and money creates >very motivated attackers. Unsolved, this type of security problem can >change the way people interact with the Internet. It'll prove that the >naysayers were right all along, that the Internet isn't safe for >electronic commerce. > >Phishing: ><http://www.msnbc.msn.com/id/5184077/> ><http://www.internetweek.com/e-business/showArticle.jhtml?articleID=2210 >0149> or <http://tinyurl.com/54b4g> > >The Trojan: ><http://news.com.com/Pop-up+program+reads+keystrokes%2C+steals+passwords >/2100-7349_3-5251981.html> or <http://tinyurl.com/yqeoe> ><http://www.pcworld.com/news/article/0%2Caid%2C116761%2C00.asp> > >A shorter version of this essay originally appeared in IEEE Security >and Privacy: ><http://csdl.computer.org/comp/mags/sp/2004/04/j4088abs.htm> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0