- cypherpunks-legacy - lists.cpunks.org

SASSER Worm Dude
by Tyler Durden 14 May '04

14 May '04

"HANOVER, Germany -- German police have arrested an 18-year-old man suspected of creating the Sasser computer worm, believed to be one of the Internet's most costly outbreaks of sabotage." Note the language...an "18 year old MAN" and "sabotage"... So a HS kid, living with his parents, is able to write a worm that takes out millions and millions of computers throughout the world running the latest MS OS. Uh....shouldn't we arrest Bill Gates first? -TD _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/

5 4

NKS: Two Years Later
by Stephen Wolfram 14 May '04

14 May '04

Today marks the second anniversary of the release of A NEW KIND OF SCIENCE. And I'm very happy to be able to report that NKS is continuing to develop extremely well. A wonderful community is forming around the ideas of NKS. The pace of research and applications is steadily building--with an average of about one new paper now appearing every day (http://www.wolframscience.com/reference/bibliography.html) NKS classes and courses are being taught. And several times each week we hear about an ambitious new initiative based on NKS--in technology, or art, or business or somewhere else. We're trying to do our part to help. Earlier this year we released the online version of the complete book (http://www.wolframscience.com/nksonline) We launched the NKS Forum (http://forum.wolframscience.com) We just sponsored the second annual conference: NKS 2004 (http://www.wolframscience.com/conference/2004) And we're working hard to make http://www.wolframscience.com the best possible reference source and meeting place for the NKS community. At the end of June, I'm looking forward to our second NKS Summer School (http://www.wolframscience.com/summerschool/2004)--where I hope we'll educate another outstanding group of NKS pioneers. (We're still accepting applications this week at http://www.wolframscience.com/summerschool/application.cgi) And later this year we'll be starting an R&D fellowship program at our new facility near Boston. It's been exciting to see everything that's been happening with NKS over the past year. But it's now clearer than ever that this is just the beginning. Much of what's being done so far on NKS has focused on specific models, and specific conceptual conclusions. But ultimately the real power of NKS comes from its core: the basic science of "pure NKS"--and its methodology of systematically exploring and understanding what's out there in the computational universe. New methodologies generally spread slowly. But pure NKS is definitely gaining momentum. And this year we'll be announcing a major initiative that I think will be an important step in moving it forward. Years from now, pure NKS will no doubt be a mature field like physics or mathematics--with its own complete infrastructure for research, education and applications. But for now it is still wide open, and full of terrific opportunities for professionals, students and amateurs alike. I hope you've been able to spend time on NKS. It's always great to hear what people are doing with NKS, and I hope you'll let us know if you have something to share. -- Stephen Wolfram

1 0

Terrorism law applied to youth group
by Major Variola (ret) 14 May '04

14 May '04

Indictment against violent Bronx gang includes terrorism charges By Associated Press Friday, May 14, 2004 NEW YORK - Nineteen members of a street gang accused of menacing their neighborhood have been indicted on murder and other charges as acts of terror, believed to be the first use of the state's anti-terrorism law against a gang. http://news.bostonherald.com/national/view.bg?articleid=27881

1 0

Regulators Fine Riggs $25 Million
by R. A. Hettinga 14 May '04

14 May '04

<http://www.nytimes.com/2004/05/14/business/14bank.html?th=&pagewanted=print…> The New York Times May 14, 2004 Regulators Fine Riggs $25 Million By TIMOTHY L. O'BRIEN ederal regulators fined the Riggs National Corporation, the parent company of Riggs Bank, $25 million yesterday for failing to report suspicious activity, the largest penalty ever assessed against a domestic bank in connection with money laundering. The fine stems from Riggs's failure over at least the last two years to actively monitor suspect financial transfers through Saudi Arabian and Equatorial Guinean accounts held by the bank. The accounts are still being scrutinized as possible conduits for terrorist funds or for the proceeds of graft. Riggs, based in Washington, "did not collect or maintain sufficient information about its foreign private banking customers," regulators noted in a consent order signed by the bank. "As a result, the bank failed to identify approximately one-third of the accounts related to the country of Saudi Arabia and an unacceptably high number of accounts related to the country of Equatorial Guinea." "The bank omitted disclosure of several bank accounts in response to requests" from regulators, the consent order also noted. A spokesman for the Saudi Arabian Embassy has denied any involvement by Saudi officials in terrorist financing activities through Riggs. The Equatorial Guinean Embassy has not returned calls seeking comment. It is possible that additional fines may be levied against individual executives or directors at Riggs, as well as two former directors, according to two people briefed on the matter. The moves are the latest troubles for a storied institution that manages bank accounts for most of Washington's foreign embassies as well as American embassies and consulates overseas. Riggs agreed to pay the penalty without admitting or denying any wrongdoing, according to the consent order. A spokesman said last night that the regulatory environment since the Sept. 11, 2001, attacks has required all banks to act much more diligently in monitoring accounts. Regulators cited the bank for failure to comply with the Bank Secrecy Act, a law governing anti-money-laundering requirements. "The bank's management was ineffective in overseeing the bank's day-to-day compliance with the B.S.A. laws and its regulations, as evidenced by the numerous and substantial deficiencies in the program," the consent order said. A severe penalty had been expected against Riggs after it first disclosed in a securities filing in March that regulators were considering fining the bank for lax practices in combating money laundering. Federal regulators and investigators, as well as two Congressional committees, are investigating the bank's accounts. "Riggs Bank deserves every penny of this huge fine," said Senator Charles E. Grassley of Iowa, chairman of the Senate Finance Committee, which is examining the Riggs accounts. "When banks look the other way, they put our national security at risk. Whether it's through incompetence, negligence or greed, they are allowing terrorists to funnel their blood money through the system." "This fine is a shot across the bow for the board of directors, who should have taken more care to find out what was wrong with Riggs and get it fixed," Mr. Grassley added. "I'm not satisfied they've been held to account." The Financial Crimes Enforcement Network, an investigative arm of the Treasury Department, and the Office of the Comptroller of the Currency, a regulatory arm of the same agency, each imposed $25 million penalties against Riggs, but the bank will be allowed to pay them concurrently. The consent order stated that Riggs failed to report suspect transactions involving the withdrawal of tens of millions of dollars in cash and international drafts from accounts controlled by the Saudi Arabian Embassy and by Saudi Arabian officials. Accounts controlled by Prince Bandar bin Sultan, Saudi Arabia's ambassador to the United States, have been scrutinized in the investigation, according to federal investigators involved in the inquiry. The consent order also stated that Riggs had similar monitoring lapses involving the Equatorial Guinean accounts, including "millions of dollars deposited into a private investment company owned" by an official of that country. The order also cited "hundreds of thousands of dollars transferred from an account of the country of Equatorial Guinea to the personal account of a government official of the country" and more than $1 million transferred from an Equatorial Guinean account to a private investment company owned by Simon P. Kareri, a former senior Riggs manager. Mr. Kareri is the subject of a federal grand jury hearing examining possible criminal fraud. Mr. Kareri's lawyer has previously declined to comment on the hearing. He could not be reached for comment yesterday evening. Another major banking regulator, the Federal Reserve, is expected to designate Riggs and one of its Miami banking subsidiaries as being in "troubled condition," a move that will severely curtail the bank's autonomy, according to three people briefed on the matter. Among other things, the designation means that the bank must secure regulatory approval before naming new executives or directors. The Comptroller of the Currency already formally designated Riggs as a troubled institution last month. Riggs said last month that it planned to exit most of its embassy and international banking operations. Riggs also indicated in a securities filing last month that Joe L. Allbritton, its former chief executive and its biggest shareholder, would not stand for re-election to the board. Mr. Allbritton, who took control of the bank in 1981, is a vice chairman. Neither Mr. Allbritton nor Riggs has been charged with wrongdoing by federal law enforcement officials who are scrutinizing the bank's accounts. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

New puzzle for war code breakers
by R. A. Hettinga 13 May '04

13 May '04

<http://news.bbc.co.uk/2/low/uk_news/england/staffordshire/3703191.stm> The BBC Tuesday, 11 May, 2004, 09:50 GMT 10:50 UK New puzzle for war code breakers Experts from Bletchley Park are trying to crack a 250-year-old code rumoured to point the way to the Holy Grail. Specialists from the Buckinghamshire code-breaking centre hope to decipher words etched on a garden ornament at Shugborough in Staffordshire. The Shepherd's Monument in the grounds of the stately home displays an inscription that has never been solved. Second World War veterans using the celebrated Enigma machine are joining Bletchley's current team of experts. 'Unusual challenge' The code breakers are at Shugborough, the ancestral home of the Earls of Lichfield, on Tuesday. Christine Large, Bletchley Park's director, said: "This is such an unusual challenge that my colleagues and collaborators, who include veteran code breakers and modern day decoding experts from Bletchley Park's 'offspring' GCHQ, cannot resist." Shugborough's general manager, Richard Kemp, said: "The Anson family, who built the estate, commissioned the monument but it had unproven connections with the Knights Templars. "The inscription is rumoured to indicate the location of the Holy Grail, which must rank as one of the world's great mysteries." It is estimated that work carried out at The National Codes Centre at Bletchley Park in Milton Keynes helped to shorten the Second World War by two years. The site is now a popular tourist attraction. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Shoulder surfing for passwords by ear
by Sunder 13 May '04

13 May '04

Hmmm, sounds like we now need keystroke sound jammers. Shouldn't be too hard to implement if you have a good random noise generator, but it could get annoying if you play white/pink noise while a password prompt pops up. Of course, there's still the issue of the pinhole camera in the ceiling tiles aimed at your keyboard, but that's old hat. :) I wonder if different users hit the keys in a different enough way to make any difference... http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci9633… 'Whispering keyboards' could be next attack trend By Niall McKay, Contributing Writer 11 May 2004 | SearchSecurity.com OAKLAND -- Listen to this: Eavesdroppers can decipher what is typed by simply listening to the sound of a keystroke, according to a scientist at this week's IEEE Symposium of Security and Privacy in Oakland, Calif. Each key on computer keyboards, telephones and even ATM machines makes a unique sound as each key is depressed and released, according to a paper entitled "Keyboard Acoustic Emanations" presented Monday by IBM research scientist Dmitri Asonov. All that is needed is about $200 worth of microphones and sound processing and PC neural networking software. Today's keyboard, telephone keypads, ATM machines and even door locks have a rubber membrane underneath the keys. "This membrane acts like a drum, and each key hits the drum in a different location and produces a unique frequency or sound that the neural networking software can decipher," said Asonov. <SNIP>

3 2

Google Mail: Virtue Lies in the In-Box
by R. A. Hettinga 13 May '04

13 May '04

<http://www.nytimes.com/2004/05/13/technology/circuits/13stat.html?th=&pagew…> The New York Times May 13, 2004 STATE OF THE ART Google Mail: Virtue Lies in the In-Box By DAVID POGUE S Google's white-hot initial stock offering hogs the headlines, its rivals can only gnash their teeth and wonder: How did a couple of Stanford Ph.D. dropouts build an outrageously profitable billion-dollar-a-year company in only five years? Part of the answer is great Web-search technology. But another part is the company's motto: "Don't Be Evil." That credo explains why Google's home page is practically empty, because ads and graphics would slow dial-up modems. It also explains why Google's ads are clearly labeled and separate from search results. Slipping paid-placement links into your search results, as MSN and Yahoo do, would be evil. So six weeks ago, when Google described Gmail, the free e-mail service it is testing, the prevailing public reaction was shock. The company said that its software would place ads in your incoming messages, relevant to their contents. It appeared to many people that Google had gone way beyond evil into Big Brother land. What could be more sinister than snooping through private correspondence looking for advertising opportunities? Privacy advocates went ballistic. The Electronic Privacy Information Center called for Gmail to be shut down, describing it as "an unprecedented invasion into the sanctity of private communications." And a California state senator, Liz Figueroa, offered a bill that would make it illegal to scan the contents of incoming e-mail. (Never mind that such a bill would make it illegal for children's e-mail services to filter out pornographic material.) Those reactions, as it turns out, are a tad overblown. In fact, no human ever looks at the Gmail e-mail. Computers do the scanning - dumbly, robotically and with no understanding the words - just the way your current e-mail provider scans your messages for spam and viruses. The same kind of software also reads every word you type into Google or any other search page, tracks your shopping on Amazon, and so on. Besides, if you're that kind of private, Gmail is the least of your worries. You'd better make sure that the people at credit-card companies, mail-order outfits and phone companies aren't sitting in back rooms giggling at your monthly statements. Heck, how do you know that your current e-mail providers - or the administrators of the Internet computers that pass mail along - aren't taking an occasional peek? Still, you feel what you feel. If Gmail creeps you out, just don't sign up. That would be a shame, though, because you'd be missing a wonderful thing. Even in its current, early state, available only to a few thousand testers, Gmail appears destined to become one of the most useful Internet services since Google itself. Like Yahoo Mail and Hotmail, Gmail is a free, Web-based e-mail program, which means that you will be able to check or send e-mail from any computer on the Internet, wherever you go. Even if you already have a traditional e-mail account, a Web mail account makes a great backup. But otherwise, you wouldn't even peg Gmail as being from the same planet as Yahoo and Hotmail. The most important difference is the amount of storage: one gigabyte. That's 250 times the amount you get on a free Yahoo account, 500 times the amount on Hotmail. One gigabyte changes everything. You no longer live in terror that somebody will send you a photo, thereby exceeding your two-megabyte limit and making all subsequent messages bounce back to their senders. You're no longer neurotic about checking your mail twice a day just to keep the in-box cleaned out. You can let years' worth of e-mail pile up, complete with file attachments (maximum size: 10 megabytes each). One gigabyte means that Gmail can be a handy personal transfer disk. Send files to yourself and then retrieve them when you get to the office. Keep important pictures or documents in your Gmail account all the time, ready to forward when friends request them. In fact, Google argues that with so much storage, you should get out of the habit of deleting messages. Why risk throwing away something that you might need again someday? An Archive button moves a message out of the in-box, but it remains searchable. Actually deleting a message involves fussing with a pop-up menu. Of course, if you're going to keep all your e-mail around forever, you'd better have some pretty good tools for managing it. Fortunately, if anyone can tame a vast pile of data, it's Google. Its famous search command works brilliantly on your own e-mail, plucking one message out of 5,000 in a fraction of a second. Each message offers a hollow star icon that turns yellow when you click on it, to signify anything you like: "Deal with this," "Those darned in-laws," or whatever. Each row also displays the first line of the message in light-gray type, which is a time-saving bit of X-ray vision. Gmail doesn't have the usual mail folders. Instead, you can flag messages with labels of your own choosing. The advantage here is that you can apply different labels to a single message, in effect filing it under several categories at once. An extremely easy-to-use filter feature lets you flag incoming messages with certain labels automatically according to who sends them, what's in their subject line and so on. Yet another clever organizational feature is "conversations," known to computer geeks as threading. Back-and-forth messages on a single topic, even among several participants, appear as one entry in your in-box. When opened, the exchanges appear like file-folder tabs, which you can expand or collapse individually or all at once. And now, about those ads. They turn out to be a maximum of three text-only four-line affairs, clearly labeled and way off the to the right, just as on Google itself. In my e-mail, a message about Earth Day contained an ad for a computer-recycling company. A question about music players had two ads for stores selling the Apple iPod. In a press release for a computer show, a Linuxworld link appeared. You sometimes get Releated Links beneath the ads, too. Google doesn't get money for these; it offers them just to be friendly, and they can sometimes be useful indeed. For example, in a message about a coming family vacation, sent from my wife downstairs (yes, we're that sort of family), Google offered a link to a Web site of restaurant reviews in the resort town we were considering. Ads appear in fewer than half of my messages; in fact, they seem to appear primarily when a capitalized brand name appears in the message. If your correspondence is mostly personal stuff ("Miss you guys. How did Casey's toe surgery go? Went out to the new vegetarian steakhouse yesterday - great."), you may not see many at all. The ads are so subtle, so easily ignored, that it's hard to imagine anyone preferring the big, blinking, slow-loading graphic ads that appear every time you check for messages at the Hotmail and Yahoo Mail sites. Even more refreshing, Gmail doesn't turn you into an unpaid billboard for Yahoo or Microsoft (Hotmail's owner) by stamping ads on at the bottom of every outgoing message, no matter how sensitive the topic. Other Gmail features include an excellent spelling checker, a built-in address book, auto-complete for addresses, the ability to specify a Reply To address (a different e-mail address for replies to your messages), indicators (>>) that denote messages sent only to you, in-message photo display, online help and one-key shortcuts (C for Compose, R for reply, and so on) that let power users cruise through entire e-mail sessions without ever touching the mouse. The automatic spam-removal feature is adequate for the moment, but once thousands of people begin to use the Report Spam button, Google plans to harness the cumulative intelligence of its customers to refine its spam filters in innovative ways. Finally, Google promises that it won't shut down your account until you go nine months without using it. (Hotmail and Yahoo delete all your mail and recycle your address after only 30 days). Now that's not being evil. Google hasn't said when, exactly, Gmail's testing period will end and the service will go live. That's just as well, because there are a few items that should still be on its To Do list: compatibility with Apple's Safari browser (at the moment, it works on on the Mac, Windows and Linux versions of Mozilla, Firefox and Netscape 7.1, plus Internet Explorer for Windows ), for example, and a signature feature that stamps your name on each outgoing message. It would be nice if you could use regular e-mail readers like Outlook Express to check your Gmail, as you can withHotmail. A certain audience will miss the ability to format outgoing messages with fonts, styles and colors, too. Otherwise, Gmail is infinitely cleaner, faster, more useful, more efficient, less commercial and less limiting than other Web-based e-mail services. Once Gmail goes live, Hotmail and Yahoo won't know what hit them. The only population likely not to be delighted by Gmail are those still uncomfortable with those computer-generated ads. Those people are free to ignore or even bad-mouth Gmail, but they shouldn't try to stop Google from offering Gmail to the rest of us. We know a good thing when we see it. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Chinese youths trash Internet caf�
by R. A. Hettinga 13 May '04

13 May '04

<http://www.theregister.co.uk/2004/05/12/china_cybercafe/print.html> The Register Chinese youths trash Internet cafi By Tim Richardson (tim.richardson(a)theregister.co.uk) Published Wednesday 12th May 2004 11:40 GMT Staff at a Chinese Internet cafe have resigned after they were beaten up last week by a gang of 16 teenagers barred from entering the cybercafe. The gang of youths beat one worker with bins and fire extinguishers before trashing the Internet cafi. Earlier they threatened to beat up anyone who "dared to check identity cards" after being refused entry to the cybercafe. The attack is the latest in as series of assaults at an Internet chain in Xi'an, capital of Shaanxi Province in northwest China, and follows a recent Government crackdown to prevent minors from entering cybercafes. The Chinese Government is concerned the Net can corrupt the minds of youngsters. But the clampdown has only sought to enrage some whippersnappers, who, in one attack, even slashed bicycle tyres, according to Xinhuanet. In a separate incident, two cybercafe workers in Shanghai were killed over an argument about the use of computers. According to AP, around ten men chased the two workers before stabbing them to death. China has shut down more than 8,600 cybercafes over the last couple of months over fears that they can affect the "mental health of teenagers" while spreading "unhealthy online information". As part of China's bid to protect youngsters, authorities also ruled that Internet cafes are not to operate in residential areas or within 200 metres of primary and high schools. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

We're jamming, we're jamming, we hope you like jammin too
by Major Variola (ret) 13 May '04

13 May '04

At 03:09 PM 5/11/04 +0200, Eugen Leitl wrote: >The second covers a "hacking the system" concept. I'd considered >something similar myself, though different in approach. Rather than >finding RFID chips and "redistributing" them, why not create >programmable RFID broadcasters which could spoof other chips, and >distribute these. The idea being to pollute any RFID detectors with a >vast spew of superfluous data. RFID jamming should be very easy and a quite amusing DoS attack on commercial targets. Easy because its not frequency hopping, low power, and relatively low frequency. Particularly cute would be transmitting sex-toy codes intermittently. ASK any Elmer you happen to see, what's the best jamming, RFID.. (With apologies to the tuna industry and those too young to know the jingle. Or to know the RF double meanings.)

5 4

Re: We're jamming, we're jamming, we hope you like jammin too
by Major Variola (ret) 12 May '04

12 May '04

>> ASK any Elmer you happen to see, >> what's the best jamming, RFID.. >> (With apologies to the tuna industry and those too young to >> know the jingle. Or to know the RF double meanings.) >Interesting cultural reference that goes entirely above my head with a >cute swooshing sound. >Care to explain, please? :) I hope the subject line was not too obscure, mon. ASK = amplitude shift keying, which I believe is the RFID modulation Elmer = guru/wizard/elder in HAMspeak Jingle: Ask any mermaid you happen to see, what's the best tuna? Chicken of the sea. Ie, fish in cans. Sorry Charlie. Charlie don't surf, but that's because tuna cans don't give enough forward gain. Tying knots in the cultural web, MV

1 0