- cypherpunks-legacy - lists.cpunks.org

RE: Schneier: Why Digital Signatures are not Signatures (was Re:CRYPTO-GRAM, November 15, 2000)
by None 06 Jul '18

06 Jul '18

The Word example actually has other worrying problems not mentioned. A Word document contains a lot of hidden information, including other versions. It would be quite easy to sign a Word document that, when you viewed it, looks significantly different then it could be displayed without violating the signature. This is due to numerous problems, the most basic of which is that we often don't sign what we view but instead some binary that we _believe_ represents what we viewed but often does not. This is not just theoretical nor esoteric, but quite easy as the Word example shows. In effect we have absolutely no idea what we are signing most of the time even without comprimise of keys, programs and all that good stuff. > -----Original Message----- > From: owner-cryptography(a)c2.net [mailto:owner-cryptography@c2.net]On > Behalf Of R. A. Hettinga > Sent: Wednesday, November 15, 2000 10:51 PM > To: dcsb(a)ai.mit.edu; Digital Bearer Settlement List; > cryptography(a)c2.net; cypherpunks(a)cyberpass.net > Subject: Schneier: Why Digital Signatures are not Signatures (was > Re:CRYPTO-GRAM, November 15, 2000) > > > At 5:58 PM -0600 on 11/15/00, Bruce Schneier wrote: > > > > Why Digital Signatures Are Not Signatures > > > > > >

1 0

RE: Schneier: Why Digital Signatures are not Signatures (was Re:CRYPTO-GRAM, November 15, 2000)
by None 06 Jul '18

06 Jul '18

The Word example actually has other worrying problems not mentioned. A Word document contains a lot of hidden information, including other versions. It would be quite easy to sign a Word document that, when you viewed it, looks significantly different then it could be displayed without violating the signature. This is due to numerous problems, the most basic of which is that we often don't sign what we view but instead some binary that we _believe_ represents what we viewed but often does not. This is not just theoretical nor esoteric, but quite easy as the Word example shows. In effect we have absolutely no idea what we are signing most of the time even without comprimise of keys, programs and all that good stuff. > -----Original Message----- > From: owner-cryptography(a)c2.net [mailto:owner-cryptography@c2.net]On > Behalf Of R. A. Hettinga > Sent: Wednesday, November 15, 2000 10:51 PM > To: dcsb(a)ai.mit.edu; Digital Bearer Settlement List; > cryptography(a)c2.net; cypherpunks(a)cyberpass.net > Subject: Schneier: Why Digital Signatures are not Signatures (was > Re:CRYPTO-GRAM, November 15, 2000) > > > At 5:58 PM -0600 on 11/15/00, Bruce Schneier wrote: > > > > Why Digital Signatures Are Not Signatures > > > > > >

1 0

RE: Schneier: Why Digital Signatures are not Signatures (was Re:CRYPTO-GRAM, November 15, 2000)
by None 06 Jul '18

06 Jul '18

The Word example actually has other worrying problems not mentioned. A Word document contains a lot of hidden information, including other versions. It would be quite easy to sign a Word document that, when you viewed it, looks significantly different then it could be displayed without violating the signature. This is due to numerous problems, the most basic of which is that we often don't sign what we view but instead some binary that we _believe_ represents what we viewed but often does not. This is not just theoretical nor esoteric, but quite easy as the Word example shows. In effect we have absolutely no idea what we are signing most of the time even without comprimise of keys, programs and all that good stuff. > -----Original Message----- > From: owner-cryptography(a)c2.net [mailto:owner-cryptography@c2.net]On > Behalf Of R. A. Hettinga > Sent: Wednesday, November 15, 2000 10:51 PM > To: dcsb(a)ai.mit.edu; Digital Bearer Settlement List; > cryptography(a)c2.net; cypherpunks(a)cyberpass.net > Subject: Schneier: Why Digital Signatures are not Signatures (was > Re:CRYPTO-GRAM, November 15, 2000) > > > At 5:58 PM -0600 on 11/15/00, Bruce Schneier wrote: > > > > Why Digital Signatures Are Not Signatures > > > > > >

1 0

Re: Seagate announces hardware FDE for laptop and desktop machines
by travis+ml-cryptography＠subspacefield.org 06 Jul '18

06 Jul '18

Reading really old email, but have new information to add. On Wed, Oct 03, 2007 at 02:15:38PM +1000, Daniel Carosone wrote: > Speculation: the drive always encrypts the platters with a (fixed) AES > key, obviating the need to track which sectors are encrypted or > not. Setting the drive password simply changes the key-handling. > > Implication: fixed keys may be known and data recoverable from factory > records, e.g. for law enforcement, even if this is not provided as an > end-user service. There was an interesting article in 2600 recently about ATA drive security. It's in Volume 26, Number 1 (Spring 2009). Sorry that I don't have an electronic copy. The relevant bit of it is that there are two keys. One key is for the user, and one (IIRC, it is called a master key) is set by the factory. IIRC, there was a court case recently where law enforcement was able to read the contents of a locked disk, contrary to the vendor's claims that nobody, even them, would be able to do so. The man in question had his drives sized by the FBI and they read the drives, uncovering emails between the man and his lawyer. He was suing the manufacturer for false advertising. Here are the links from the 2600 article: http://tinyurl.com/atapwd http://tinyurl.com/cmrrse http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml hdparm -security-erase-enhanced in Linux http://www.deadondemand.com/ http://www.vogon-investigation.com/password-cracker.htm -- Obama Nation | My emails do not have attachments; it's a digital signature that your mail program doesn't understand. | http://www.subspacefield.org/~travis/ If you are a spammer, please email john(a)subspacefield.org to get blacklisted. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[osint] Assassination Plans Found On Internet
by Tefft, Bruce 06 Jul '18

06 Jul '18

http://www.homelandsecurityus.com/ 1 June 2004 - U.K. armed services raise threat level to "severe" According to a report by Air Security, U.K. armed services officials raised the threat level for U.K. military installations to "severe" after receiving intelligence that terrorists with links to al-Qaeda are planning to stage suicide truck bomb attacks against a U.K. military base within the next two months. Military officials stated that terrorists are planning to drive a truck packed with explosives into military headquarters. The intelligence indicated London is a particular target, as are upcoming D-Day celebrations. 1 June 2004 - Assassination Plans Found On Internet ASSASINATION PLANS AGAINST SAUDI ARABIA'S MINISTER OF THE INTERIOR Prince Nayif Bin-Abd-al-Aziz were discovered by Northeast Intelligence Network analysts and submitted to the appropriate authorities. As first reported on The Roth Show, a syndicated radio program based in Spokane, Washington, the highly detailed plans are calling for the operation to take place this Friday, June 4, 2004 using rocket propelled grenades while the Prince is in transit. The plans, authored by Abu Hajar Abdel Aziz al-Moqrin, the leader of al Qaeda in Saudi Arabia and the man who claimed responsibility for the attack on the residential complex in Saudi Arabia last Saturday, outlined Prince Nayif's itinerary, manner and route of travel, personal security, and planned method of attack using rocket propelled grenades. The detailed plans were found in Issue 11 of Camp al Battar, a well known military-style training manual referenced by terrorists and published regularly on an elusive Internet forum. The translated communication can be found at www.homelandsecurityus.com in addition to the audio statement of Abu Hajar Abdel Aziz al-Moqrin claiming responsibility for the attack at APICORP in Khobar, Saudi Arabia. Translated from Arabic: The target: Nayef Bin Abdul Aziz. He will attend a reception of external security personel in a secret visit of the queen at King Khaled International Airport. Specification of the target: Nayef Bin Abd Al-Aziz Al Saud . Personal information: Name: Nayef Bin Abd Al-Aziz Al Saud . Age: 71 years born in 1933. Position: the Saudi Minister of Interior. Residence address: the Gardens - several palaces (the present palace in Arqa, also the Mother's palace, and several other palaces that he frequents). Daily routine: He goes to sleep shortly before dawn, and goes to the ministry some days at 7 o'clock at night until eight thirty, resting in the evenings, and attending parties, and private meetings. Number of guards: 8 persons Typed of armament: light . The guards can be targeted as they descend from the care; they are near but not too close. The movement of the procession: it blocks off the roads, and they drive the target car in the midst of the procession with similar cars possibly to provide a camouflage procession. The guarding crew breaks up any surveillance. The guarding crew varies the route at times.. The number of guarding cars in the procession: (not less than ten cars and their job is to opened the highway). The first car, with the oscillation light, then the cars for personal protection, then the cars in which the targets are found which are probably similar in color and model and without numbers or with similar numbers to the protection cars, then the patrol cars that close the procession. Sometimes there is a smaller procession without the target that moves in side streets. The target changes its car. Mostly uses the same car, which is not easy to approach since the highways are closed. Route information: From Arqa palace to the airport, 40 kilos. Route Description: From Arqa, take the western circular, then the northern circular, then the airport highway, with the probability of moving onto other roads: (Arqa - Khris highway, Jabber Alsabah's highway, the northern circular, the airport highway). (Arqa - Ad Dir Iyah, Alamaria parting, then move in an easterly direction and return to the specialize route to the airport highway ). Schedule The time of departure for the reception: on 15 / 4 / 1425 AH The departure time: at six at night . The arrival time: 25 minutes after 6 . The side streets: many sides streets come from the circular exits ( 4 - 5 - 6 - 7 ) and from them (the western gates of King Saud University) (Prince Abdullah Highway ) . The bridges: the field linking between the northern circular and the circular extension east of the Airport Highway. Places where the cars can park, and deserted places: there are none. There are many turns: Among them the turn of the circular on the western meeting the northern circular, and the turn of the circular northern meeting to the eastern, and there are moderately thick trees and gardens and football playing fields. There is a high building of several floors belonging to the Sabk company, and the Imam University buildings, and there are trees in the moderate island separating between the two ways, which are good for the invisibility and ambushes and at the entrance to the airport highway there is a gate which can be closed. After the target has been specified, the command began issuing orders to the concerned leaders, dividing the operation into several stages: The first stage: the specification of the target. This stage is complete. The second stage: the collection of the information. This stage is complete also. The third stage: Determining the way of killing (the explosives), and it will be with the explosions in the procession during the passing of the procession at the bottom of the bridge linking the northern circular and the eastern one, and on the sides of the highway at the turn, beginning with the emergence of the group of confirmation and the destruction, with the assurance of killing them, or it may be carried out with the use of anti-armament missiles. At this point, it is impossible to determine if this is an actual assassination plan, or some sort of hoax. The fact that it was published in issue 11 of Al Battar, a known Al Qaeda publication that has proved credible in the past, and that it was written by Abu Hajar Abdel Aziz Al Moqrin (see article below) certainly lends a degree of urgency to this information. The level of detail of the information in the "plan" is very high and shows the results of extensive surveilance of the individual named as the target. However, it must also be taken into consideration that Abu Hajar has changed pertinant details prior to publication. It is possible that the target of the attack is a different member of the Saudi royal family. A posting on the Al Qal'ah forum this morning refers to a "big surprise" coming in the next week for Saudi Prince Mohamed Bin Fahd, son of the current Saudi king. The Al Battar article specifies the date of June 4, 2004, for the attack. Since that is just a few days away, we are posting the relevant material in hopes that the attack will be thwarted by authorities. Law enforcement, diplomatic, and other security personnel who need access to the original documents we translated should contact our director at dhagmann(a)adelphia.net. -------------------------------------------- 1 June 2004 - Who is Abu Hajar Abdel Aziz al Moqrin Throughout the past few months, a new Al Qaeda militant has emerged to the forefront in the Kingdom of Saudi Arabia. Abu Hajar Abdel Aziz al Moqrin is widely recognized as the leader of Al Qaeda operations in Saudi Arabia. He has claimed responsibility for this weekend's attack on the Oasis residential complex in Khobar, and for the attack on the Yanbo petroleum facility a few weeks ago. But little has been published about this militant. What exactly is known about him? Abu Hajar, or Hajar's father, first made his public appearance on the scene in the Badr al Riyadh videos, released by Al Qaeda in the winter of 2004, and commemorating the Ramadan attacks in Riyadh in November of 2003. According to the semi-official biography published by Al Qaeda, Abu Hajar has spent the last 16 years of his life in the service of Al Qaeda. Abu Hajar, who is reportedly 33 years old, has "served" in combat in Bosnia, Algeria, and Somalia, before assuming the reins of the operation in Saudi Arabia. Abu Hajar was sentenced to four years of prison in Saudi Arabia, and was released after 2 years, with the sentence reduced for "good behavior". He assumed control of the Saudi operations after the death of the previous leader in a shootout last year. Moqrin dropped out of school at the age of 17, and went to Afghanistan, purportedly to join in the fight against the Soviet Union. He apparently received his paramilitary jihad training in the Al Qaeda training camps of Afghanistan. According to reports, he was in Afghanistan for four years, from 1990 - 1994. While in Afghanistan, he was responsible for training operations in the "Governor's Camp" near the city of Khost, Afghanistan, and was also involved in numerous combat operations. He left Afghanistan in 1994 to move to Algeria, to help train the Islamic insurgents in that country. After leaving Algeria, Abu Hajar went to Bosnia and Herzegovina, where he again was active in the training of militants as well as in combat operations. He returned to Saudi Arabia, then made his way through Yemen, and on to Somalia where he fought with the militant groups against the Ethiopian forces. He was arrested in Somalia, and extradited to Saudi Arabia, where he was sentenced to four years in prison. He was released after two years on "good behavior". A month after his release, he made his way back to Yemen, and then to Afghanistan in 2001.There he joined combat operations with the Taliban against the American troops. After the fall of the Taliban, he returned to Saudi Arabia, to his home in the Swedish district of Riyadh. He immediately became involved in the establishment of jihad training camps in the middle and western regions of Saudi Arabia. When Khaled Al Bin Al Haj was killed on March 15 in a shootout with the Saudi security forces, Abu Hajar assumed leadership of Al Qaeda in the Arabian Peninsula. Abu Hajar was raised in the city of Riyadh. He is a high school dropout. He was married at the age of 19, and has one child (currently 10 years old) with this wife. According to the biography, Abu Hajar remarried without the knowledge of his family, and had a second child, who died before the age of 2. ------------------------ Yahoo! Groups Sponsor --------------------~--> Yahoo! Domains - Claim yours for only $14.70 http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[gsc] e-gold = treason... Well not officially...
by The Phoenix Dollar 06 Jul '18

06 Jul '18

This is the run of the mill propaganda piece relating to e-gold and western express which then leads to a neat little piece where he tells us 40% of all us people will have to telecommute since they will be sick with pandemic flu at some unknown date in the future. I did not know western express ran a digital currency? Is that a mistake or are they referring to Goldage? They spent most of the time paving the way to make e-gold look entirely evil and they also mention that they will be conducting investigations offshore to finish the clean up job. I guess that goes right in line with the kidnapping UK people thing that got press recently. I don't think anyone is safe offshore. I never did actually. Remember, this is treason! ahhhhh They seem to want to force crime offshore. That makes no sense since it already is offshore and the attacks on US banks will continue from offshore. So they are essentially taking credit for an existing phenomenon as if they pushed cyber crime offshore when in reality it was "offshore" always. These people can't even stop a syn- flood. ugggh. Politics butting up against cyber anything is entirely too interesting to miss! http://www.dhs.gov/xnews/releases/pr_1197409593155.shtm Remarks of Assistant Secretary of Cybersecurity and Communications Greg Garcia at the New York Metro Infragard Alliance Security Summit Release Date: December 11, 2007 New York, NY (Remarks as prepared) New York is such a fitting place to hold a security summit. With its storied history and thousands of financial institutions, it is the world's financial nucleus. All of you, as leaders in your respective companies and organizations, understand the full weight of your responsibilities to New York City itself, the nation, and quite honestly, the world. Because as Wall Street goes, so does the rest of the world. That is quite a responsibility to shoulder. Yet you have continuously demonstrated your understanding and commitment to upholding this reputation. Time and again, whether facing a natural disaster or terrorist attack, you have found ways to ensure that roughly five and a half trillion dollars flows unabated through our financial systems each and every day. That's five and a half trillion dollars a day in activities that are critical to our citizens' basic needs and our Nation's economy. It's the delivery of paychecks, utility bill payments, ATM withdrawals, and the over $733 million of Internet sales that occurred this past cyber Monday -- the first Monday after Thanksgiving, which is considered the most active online shopping day of the year. As New Yorkers know, our adversaries will stop at nothing to destroy the infrastructures we have all worked so hard to build and protect. Whether they are cyber criminals, hacktivists, or nation states, our adversaries are pursuing ever more sophisticated and determined cyber attacks on U.S. government and private sector networks. I'm watching as companies household names with huge market capitalization and seemingly tremendous resources expose their networks and data to infiltration and information theft. I'm seeing the same with government agencies on a regular basis. So we're all at risk, and we're all responsible. We have made some progress but there is much more we all have to do to protect our critical systems. So let me tell you what we're doing at DHS to make the United States the most difficult and dangerous place in the world to conduct cyber crime. I think you will see that you each have a very important role to play in helping to make this happen. Let me start with an overview of the threats as we see them at DHS. As you all know, the threats are real. Hackers are becoming more sophisticated and focused in their efforts. Criminal computer code is now written at the PhD level, and sold cheaply on the Internet. Hackers are making massive efforts to compromise computer systems on a global scale. What was once a nuisance committed by various individuals years ago has now progressed into organized efforts by highly skilled professionals. Today's professional hackers develop and sell malware toolkits to other criminals on the black market. In turn, the buyers of these toolkits can conduct online scams and spread malware more proficiently than ever before. Why do they do this? Because cyber crime is big business. The number of hackers attacking banks worldwide jumped 81 percent over the past year. Botnets, spear phishing, key loggers, and other attacks make up the more-than-$100 billion global market for cyber-crime , surpassing drug trafficking from a monetary perspective. Worst of all, the money obtained through cyber crime can be used to finance terrorism. The numbers don't lie. From October 1, 2006, through September 30, 2007, our US-CERT which I'll describe in more detail in a momenthandled more than 37,000 incidents, compared with almost 24,000 the year before. This increase can be attributed to not only more attacks on our public and private networks, but also better situational awareness levels and reporting rates. I'll tell you now: many of these malicious attacks are designed to steal information and disrupt, deny access to, degrade or destroy critical federal or private sector information systems. Our adversaries are also seeking our intellectual capital and proprietary information, which we have spent years and billions of dollarsdeveloping. Unfortunately, none of this will dissipate if we do not have the same level of organization and coordination that our adversaries are using against us. This dynamic underscores the absolute necessity for IT security and the importance of a nationwide call to secure cyberspace. It's something we can't afford not to do. Our mission is clear. Securing the systems that maintain and operate critical infrastructures is vital to national security, public safety, and economic prosperity. How do we do this? Collaboration and information sharing. It's a common theme in many of the speeches you hear because public/private partnerships, like InfraGard and the Financial Services and Multi-State Information Sharing and Analysis Centers (ISACs), are essential to protecting our critical infrastructures. Let's be realistic. Private industry owns and operates more than 85 percent of the United States' critical infrastructures. That means the Federal Government cannot address cyber threats alone. Obviously, if a cyber attack occurs, the larger percentage of potential immediate victims will also be in the private sector. This includes the financial services industry. So not only does it make sense to collaborate with each other, it is an absolute necessity. At DHS, one of our best information sharing mechanisms is the United States Computer Emergency Readiness Team, or US-CERT. The nation's cyber watch and warning center, US-CERT coordinates the defense against and response to cyber attacks in coordination with the private sector. It also analyzes and reduces cyber threats and vulnerabilities, disseminates cyber threat warning information, and manages incident response activities with a wide range of stakeholders. US-CERT's activities allow us to see potential trends and coordinate appropriate deterrence and response activities across sectors. A prime example of this occurred just last month when the US-CERT served as the key data gathering and distribution center for a potential cyber threat to both government and private sector systems maintaining critical infrastructures. By taking advantage of its information-sharing relationships, US-CERT distributed a notice defining the malicious activity and addressing how partners could detect and prevent it from affecting their networks. This directly strengthened the security and resilience of our nation's critical infrastructures. The key lesson here is that by sharing our knowledge, we can better protect our nation. But we also know that this information sharing relationship is not as mature yet as it can be. The feedback we received from our private sector partners after this information notice was, overall, very positive and appreciative. But it included a reminder that such notices would be more useful if DHS could provide more threat-based context that is, what is the nature of these attacks? Where do they come from? What is their intent? Well, we continue to be limited in what we can share with partners who don't have appropriate security clearances, (indeed that's an issue within the U.S. government agencies as well). And we have to find better, quicker ways to get you relevant information that you can act on. And, from our perspective, when we provide you information you already have, we realize both sides need to better calibrate our exchange of information so we make most effective use of our limited time and resources. So we're learning, and we're working to improve our information sharing. That's one of InfraGard's key tenets and the ultimate goal for all our actions. As we move into the discussion portion of this event, I'm very interested to hear your ideas about other ways we can share useful and relevant information between sectors. In addition to sharing information with its public and private partners, one of US-CERT's most important responsibilities is increasing the Federal Government's awareness of its own network activity. We know from our friends in law enforcement that situational awareness is the primary method a beat cop uses to protect a neighborhood. As I'm sure Joe can recall from his days on the force, a veteran officer works to deter crime wherever possible and catches criminals by understanding their environment, watching for trends and patterns, and knowing the rhythms of the community. We know the same is true for cyber first responders. So we created an early warning system that watches for malicious patterns in network traffic and notes irregular activity. Just as in neighborhood policing, out-of-the-ordinary events or activities can tip off agency cyber responders to potential trouble. EINSTEIN, as it is known, is that early warning system. It monitors participating agencies' network gateways for traffic patterns that indicate the presence of computer worms or other unwanted traffic. By collecting this information, EINSTEIN gives our analysts a big-picture view of potentially malicious activity on federal networks. Prior to EINSTEIN, it took cyber security responders four to five days to gather and share critical data on federal government computer security risks. Today, we can produce that information in as little as four to five hours. By analyzing network traffic for potential cyber threats before they can exploit vulnerabilities, EINSTEIN makes it more difficult, more time consuming, and more expensive for cyber criminals to reach and impact their intended targets. EINSTEIN provides us with unique traffic pattern analysis that US- CERT, as appropriate, can share with its partners. Now another program that exemplifies knowledge sharing in action is the National Vulnerability Database. Sponsored by my office and the National Institute of Standards and Technology (NIST), the National Vulnerability Database or NVD puts the more than 28,000 known cyber security vulnerabilities into a single publicly available resource. NIST analysts then score them according to the severity of their risk. Accessed at a rate of 48 million hits a year, the NVD's data enables all organizations to automate their vulnerability management, security measurement, and compliance activities through a series of security checklists and metrics. Recently, your colleagues in the payment card industry recognized the value of the database to their cyber risk management efforts. Last June, the industry's data security standards required that all credit card processing vendors use the National Vulnerability Database to evaluate the security of their payment systems. Essentially, it says that vendors must ensure that their systems do not include vulnerabilities that score higher than a pre-determined NVD number. This greatly enhances the security of every credit card transaction, prevents disruptions of key operating systems, and protects consumer information. The value of the NVD is not limited to the credit card processing industry. If you haven't investigated the potential beneficial uses of this program in your companies, I strongly encourage you to do so immediately. You can access it by going to US-CERT's homepage (www.USCERT.gov) and searching for NVD. The NVD is a wonderful example of an industry-lead adoption of a valuable government tool. And it also underscores our role in the federal government, to provide resources that help all of you do your jobs more effectively. Let's move to another example of collaboration and information sharing. You know, in many ways, the enemy is already at the gate. So if we are going to secure cyberspace, we must marshal our defenses, learn from each other, and work together as never before. I'm a true believer in the phrase, you play how you train. This is why exercises are critical to our national and financial security. InfraGard members already understand this. The Vermont InfraGard is a key planner in the state of Vermont's first ever cyber exercise, which my office is helping to design and implement. The lessons learned from next month's exercise will aid in the development of a cyber annex to the state of Vermont's emergency operations plan. At the national level, we are actively planning for the March 2008 national cyber exercise, Cyber Storm II, which follows the highly successful cyber storm I held in February 2006. This exercise examines our response and coordination mechanisms against a simulated cyber event affecting international, federal, state, and local governments, and the private sector. By organizing and executing an exercise such as cyber storm, DHS is able to test our planning, information sharing and response to attack scenarios, assess our strengths and weaknesses in those areas, and learn how to improve response capabilities. I am thrilled that the financial services sector, through the financial services ISAC, is once again fully engaged in the planning and execution of the cyber storm exercise. Their participation in the exercise demonstrates their firm commitment to cyber preparedness and I hope sends a signal to other sectors that cyber security measures need to be taken seriously. Throughout the country, at every level of government and within the private sector, people are dedicating themselves to ending cyber crime. To do this at CS&C it's necessary for my office to engage in robust collaboration and information sharing with our law enforcement partners. We do this through a liaison office in the US-CERT, which houses liaison officers from the U.S. Secret Service and FBI. For example, maintaining the necessary division of authorities, US- CERT and the FBI worked closely together to identify and investigate cyber criminals and threats during Operation Bot Roast II. An ongoing and coordinated initiative, Operation Bot Roast finds and captures the criminals that overtake people's computers to conduct criminal activities. Since it began last June, the FBI, with US-CERT's technical input, captured eight individuals responsible for infecting over one million compromised computers. We estimate the economic loss to be at more than $20 million to date. As the investigation continues, I have no doubt those numbers will increase. At DHS, we know that online payment systems are profitable money makers for criminals. A recent 24-month Secret Service investigation of e-gold, an online payment system favored by criminals, resulted in the seizure of over $16 million. In Miami, a Secret Service's cyber crime fraud investigation recovered more than 200,000 stolen credit card account numbers at a potential loss exceeding $75 million. And here in New York, a Secret Service investigation with the Manhattan District Attorney's office led to the indictment of 17 people and a company called Western Express, a digital currency transmittal service. The defendants are facing charges related to global trafficking in stolen credit card numbers, cyber crime, and identity theft. Based on the over 1.3 terabytes of digital evidence it obtained from search warrants and subpoenas, the Secret Service estimates that approximately $15 million flowed through Western Express' digital currency accounts. Additional judicial action is ongoing with respect to targets identified overseas. We're starting to really hurt the criminals. Eventually, they are going to realize that it is just too expensive both financially and in potential jail time to conduct business in the United States. In addition to catching the criminals, my office also works closely with the Departments of Justice and Defense to prepare for and, if necessary, respond to a national-level cyber incident. As co-chairs of the National Cyber Response Coordination Group (NCRCG), we work with 19 different federal agencies, including the FBI and the Secret Service, to ensure that the full range and weight of the Federal Government's cyber capabilities are deployed in a coordinated and effective fashion. For example, the NCRCG recently convened to address and respond to the denial of service attack against the government of Estonia, a NATO ally. Additionally, the NCRCG will be an active participant in Cyber Storm II. Effective cyber and communications risk management requires us to be prepared for a national crisis beyond those caused by terrorists or criminals. Now, I've talked a lot about cyber viruses. But we still have to contend with the more traditional biological virus that is, the potential effects of a public health crisis, such as an outbreak of pandemic flu. The spread of pandemic disease across the U.S. will be rapid and unpredictable. We estimate that as much as 40 percent of the workforce will be unable to report to work during peak periods of an outbreak and you don't get to pick which 40 percent that could be. Naturally, telecommuting will be a key mechanism to keeping our businesses and government operational during a pandemic flu. Preparing for the increase in telecommuting is a demonstration of public-private collaboration in action. A working group led by my one of my components the National Communications Systemand including experts from the Federal Reserve Board, the Department of the Treasury, the Financial and Banking Information Infrastructure Committee, and the Financial Services Sector Coordinating Council, meets monthly to plan for the potential communications consequences of a pandemic influenza. What the working group found is that, while the telecommunications backbone is unlikely to experience congestion, the so-called last mile to the home and the enterprise could experience disruptive congestion. But it concluded that this disruption could be mitigated if certain safeguards and practices are implemented by enterprises and telecommuters. In collaboration with major internet service providers (ISPs), telecommunications carriers, and equipment and service vendors, the working group developed the following best practices that we strongly encourage businesses and government agencies to consider: 1. Limit remote access to users critical to maintaining business continuity; 2. Limit access to business critical services through the enterprise connection; 3. Adjust or retime automatic desktop backup software and software updates for telecommuters; 4. Obtain a telecommunications service priority (TSP) for enterprise; 5. Subscribe to government emergency telecommunications service (GETS) cards and/or wireless priority service (WPS) capabilities for critical it staff; and 6. Enhance your cyber security posture due to increased reliance on communications and it, reduced support staff, and increased threat of cyber attack. Implementing these practices will help reduce significant impacts on our nation's economy. All of us must do everything possible to keep our nation operating and delivering critical services under even the most challenging circumstances. I consider everyone in this room today a key partner in the effort to strengthen our nation's cyber infrastructure. You understand that the Internet, and the many enterprise networks that depend on it, is one of the central platforms for business operations, supply chain management, and business continuity. However, I'm more concerned about the people who aren't in this room because, as a recent business roundtable report suggests, they don't understand that this is a matter of their own business survival. Cyberspace is a profitable marketplace and enabler of market activity. But if businesses, whether in the financial services sector or otherwise, haven't made the investment in the people, processes, and technologies that will keep them operational in a crisis, our economy, in fact our very way of life, is at stake. We can't let this happen. So here's what we all need to do. First, memorize US-CERT's website address www.USCERT.gov and give it to everyone who needs it. Tell your partner organizations and businesses to sign up for the cyber security alerts and to report any potential cyber incident, threat, or attack they find. uWe can only act upon the information we know about. The information our partners provide increases our understanding and awareness of the health of the overall cyber infrastructure and improves our response and protective measures. Second, encourage your partners to participate in public-private partnerships like InfraGard and the financial services ISAC. These collaborations act as force multipliers for increasing awareness of cyber security challenges as well as implementing actionable and enduring solutions. Additionally, they serve as an easily accessible mechanism to educate people on how cyber vulnerabilities can have real world consequences to our physical infrastructures. Finally, encourage your colleagues to make security a part of their everyday business operations. It doesn't take long for cyber events to have real world consequences. Have them look at every step of their business lifecyclefrom system configuration to in-house software developmentto see if common security practices are being followed and that response plans are prepared accordingly. Help them realize that when they build a culture of security within their organizations they make great strides in ensuring the resilience of their business operations. Laws such as Sarbanes-Oxley, the Gramm-Leach-Bliley Act, and the Health Insurance Portability and Accountability Act (HIPAA) place a fiduciary responsibility on them to ensure the security of their customers' information and their systems. However, in reality, these recommendations are simply the right thing to do for their companies, their customers, their fellow citizens, and the nation as a whole. So let's work together to make it happen. Before I close, I would like to make one last comment. Thank you for your commitment to cyber security and your active participation in InfraGard. I have had a chance to work with members across the country and know what an important role you all play in our cyber security awareness efforts. I urge you to use the time at this meeting to learn as much as you can, and then share your knowledge with your colleagues, professional networks, friends and families. Cyber security is a complex problem, yes, but the dangers are easily understood, and the solution is simple: you can't guard all of cyberspace, but you can protect your piece of it.

1 0

Re: Seagate announces hardware FDE for laptop and desktop machines
by travis+ml-cryptography＠subspacefield.org 06 Jul '18

06 Jul '18

Reading really old email, but have new information to add. On Wed, Oct 03, 2007 at 02:15:38PM +1000, Daniel Carosone wrote: > Speculation: the drive always encrypts the platters with a (fixed) AES > key, obviating the need to track which sectors are encrypted or > not. Setting the drive password simply changes the key-handling. > > Implication: fixed keys may be known and data recoverable from factory > records, e.g. for law enforcement, even if this is not provided as an > end-user service. There was an interesting article in 2600 recently about ATA drive security. It's in Volume 26, Number 1 (Spring 2009). Sorry that I don't have an electronic copy. The relevant bit of it is that there are two keys. One key is for the user, and one (IIRC, it is called a master key) is set by the factory. IIRC, there was a court case recently where law enforcement was able to read the contents of a locked disk, contrary to the vendor's claims that nobody, even them, would be able to do so. The man in question had his drives sized by the FBI and they read the drives, uncovering emails between the man and his lawyer. He was suing the manufacturer for false advertising. Here are the links from the 2600 article: http://tinyurl.com/atapwd http://tinyurl.com/cmrrse http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml hdparm -security-erase-enhanced in Linux http://www.deadondemand.com/ http://www.vogon-investigation.com/password-cracker.htm -- Obama Nation | My emails do not have attachments; it's a digital signature that your mail program doesn't understand. | http://www.subspacefield.org/~travis/ If you are a spammer, please email john(a)subspacefield.org to get blacklisted. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tahoe-dev] switching from introducers to gossip?
by Zooko O'Whielacronx 06 Jul '18

06 Jul '18

On Sun, Jul 1, 2012 at 9:51 PM, Brian <warner(a)lothar.com> wrote: > ... snipping out a lot of useful, clearly written details about the new introduction and accounting mechanisms ... > I think we can probably accomodate that. I'm optimizing for our two main use cases: friendnet and paid-service. > > In the friendnet, nearly all nodes are both a client *and* a server. This is not true of the grid I'm most familiar with: volunteergrid2. In that grid almost every node is either a client or a server -- almost no nodes act as both. (I think. This is just judging from reading the volunteergrid2-l mailing list.) Maybe we need two different names, one for the "p2p style" friendnet that you describe in your letter (partially quoted below) and the other for the "sysadmins offering one another access to their servers" friendnet, such as volunteergrid2. > The main question is whether nodes which are both clients and servers should have a single key, or two separate keys (I prefer a single key, because it makes reciprocal storage-permission grants easier). I don't understand enough to have an opinion on that specific question, but in general I think there is a growing tension between "p2p style" and "client/server style", and the above smells like baking "p2p style" into the introduction protocol. > What I really want is to make it super-easy for a new user to get their node running and connected to their friend's existing grid. And, more importantly, for that *first* friend to set up that grid. ... > The first friend (Alice) hears about Tahoe from her favorite blog, and installs it with her favorite package manager. ... > She hits the "Invite A Friend" button, ... > All grid members get a control panel where they can see who else is using their storage, allow/deny access, and control where their own node places shares. By default, anyone who gets invited to join the grid gets full access to storage on all members' servers, but access can be revoked at any time. I think that's great! I love the idea! I hope you keep working on it, and I will endeavour to help. If we succeed, it will be the long-awaited reincarnation of the Mojo Nation dream. But, it is rather different in deployment/management from what our current users do with our current software. Maybe it won't work out. It requires engineering effort to implement and maintain, makes the behavior of the software harder to predict, and introduces more complex failure modes. If possible, I would like to support people continuing to use Tahoe-LAFS as service administered by diligent sysadmins even while extending it to be deployable by inattentive end users as you've envisioned. I think not too far down this path there might come a time to split Tahoe-LAFS into separate packages targeted at different deployment scenarios. Note that the i2p folks appear to have already forked it for this reason -- in order to maintain different deployment features! Also note that you, Brian, have published some experimental forks/variants focused on different deployment patterns. If you want "user friendly p2p software", then you probably want: b" Which services? Each node operates, by default, multiple services -- storage server, storage client == web gateway, introducer/gossiper, and in the future other services like relay server (to help get around incomplete connectivity of the underlying network -- #445). b" Which IP addresses? Nodes automatically detect their own IP addresses, such as by inspecting the output of "/sbin/ifconfig" or "route.exe", or opening a TCP connection to some helpful STUNT/ICE server and asking that server what IP address your packets appear to be coming from (#50). b" Which connections? Nodes advertise multiple IP addresses / DNS names (possibly including those auto-discovered as above, plus any that were manually entered by the user (#754), plus 127.0.0.1 or any globally-non-routeable IP addresses revealed by ifconfig, and possibly in the future including indirection through a relay server), peers attempt to connect to nodes on all advertised IP addresses / DNS names in parallel, then use whichever connections succeeded. b" How to handle NAT/firewall/inconveniently-behaving-router? Nodes utilize the latest and greatest Romulan packet technology, such as UPnP (#49), "NAT hole punching" techniques (#169) or even B5TP (#1179) or relay service (#445) to breeze through such impediments as though they weren't even there. b" Reverse connections? If a TCP connection is established from node A to node B, then B can use that in the "reverse direction" to make requests of A, just as well as A can use it to make requests of B. This means that if A is behind a firewall which allows outgoing but not incoming connections to be established, and A established an outgoing connection to B, then B can use A as a server, but C, which for some reason didn't get a connection from A, cannot use A as a server. (#1086) If you want "sysadmin-friendly software" then you probably want the opposite of all these features! b" Which services? Each node operates, by default, only the services that the operator manually configured it to run. Even better you can install the software sufficient to run a specific kind of node, e.g. a storage server, without installing the software that would let it run other servers, such as introducers or storage clients (#1694). b" Which IP addresses? Nodes do not automatically detect their own IP addresses, but instead use only the IP address that their sysadmin manually told them to use. This is especially important for tor and i2p people where any auto-discovered IP address threatens the user's safety (#517). b" Which connections? You try to establish the prescribed TCP connection(s) to your server. If that fails, you log/announce failure. In the future you might even be able to configure it to run exclusively over HTTP(S) and then pass all of its connections through your HTTP proxies and Web Services tools (#510, #1007). (Although sysadmins may actually like the "try to connect to multiple IP/DNS addresses at once" feature, if it is sufficiently understandable and controllable to them. It would ease some headaches provided by the Amazon Web Services EC2 TCP/DNS infrastructure, for example.) b" How to handle NAT/firewall/inconveniently-behaving-router? If you can't establish a TCP connection to your prescribed target, then obviously you should not talk to it. Either some wise sysadmin doesn't want you to (firewall) or some stupid sysadmin has screwed up the network config and needs to fix it. In either case you should log failure and give up immediately. b" Reverse connections? Clients connect to servers. Servers do not connect to clients, clients do not connect to other clients, and servers do not connect to other servers (#344). To violate this principle means you will receive a visit from your keen-eyed sysadmin who will want to know what the hell you are doing B9. Don't get me wrong -- I think the p2p style, which foolscap already implements part of -- is sweet. I'd like to improve it, in the interests of making Tahoe-LAFS deployment more automatic for end-users. However, we should probably pay attention to the fact that many of our current users do not use those features, and some of them are actively requesting the ability to turn off those features. Maybe some kind of friendly fork or more targeted packaging would help us manage these diverging deployment scenarios? Regards, Zooko B9 https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1010#comment:18 https://tahoe-lafs.org/trac/tahoe-lafs/ticket/49# UPnP https://tahoe-lafs.org/trac/tahoe-lafs/ticket/50# STUNT/ICE https://tahoe-lafs.org/trac/tahoe-lafs/ticket/169# tcp hole-punching! https://tahoe-lafs.org/trac/tahoe-lafs/ticket/344# more client-vs-server refactoring: servers-only shouldn't subscribe to storage announcements https://tahoe-lafs.org/trac/tahoe-lafs/ticket/445# implement relay: allow storage servers behind NAT https://tahoe-lafs.org/trac/tahoe-lafs/ticket/510# use plain HTTP for storage server protocol https://tahoe-lafs.org/trac/tahoe-lafs/ticket/517# make tahoe Tor- and I2P-friendly https://tahoe-lafs.org/trac/tahoe-lafs/ticket/754# merge manually specified tub location with autodetected tub location https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1007# HTTP proxy support for node to node communication https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1086# servers should attempt to open connections to clients https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1179# use N<TP https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1694# package client and server separately _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

RE: Schneier: Why Digital Signatures are not Signatures (was Re:CRYPTO-GRAM, November 15, 2000)
by None 06 Jul '18

06 Jul '18

The Word example actually has other worrying problems not mentioned. A Word document contains a lot of hidden information, including other versions. It would be quite easy to sign a Word document that, when you viewed it, looks significantly different then it could be displayed without violating the signature. This is due to numerous problems, the most basic of which is that we often don't sign what we view but instead some binary that we _believe_ represents what we viewed but often does not. This is not just theoretical nor esoteric, but quite easy as the Word example shows. In effect we have absolutely no idea what we are signing most of the time even without comprimise of keys, programs and all that good stuff. > -----Original Message----- > From: owner-cryptography(a)c2.net [mailto:owner-cryptography@c2.net]On > Behalf Of R. A. Hettinga > Sent: Wednesday, November 15, 2000 10:51 PM > To: dcsb(a)ai.mit.edu; Digital Bearer Settlement List; > cryptography(a)c2.net; cypherpunks(a)cyberpass.net > Subject: Schneier: Why Digital Signatures are not Signatures (was > Re:CRYPTO-GRAM, November 15, 2000) > > > At 5:58 PM -0600 on 11/15/00, Bruce Schneier wrote: > > > > Why Digital Signatures Are Not Signatures > > > > > >

1 0

[osint] Assassination Plans Found On Internet
by Tefft, Bruce 06 Jul '18

06 Jul '18

http://www.homelandsecurityus.com/ 1 June 2004 - U.K. armed services raise threat level to "severe" According to a report by Air Security, U.K. armed services officials raised the threat level for U.K. military installations to "severe" after receiving intelligence that terrorists with links to al-Qaeda are planning to stage suicide truck bomb attacks against a U.K. military base within the next two months. Military officials stated that terrorists are planning to drive a truck packed with explosives into military headquarters. The intelligence indicated London is a particular target, as are upcoming D-Day celebrations. 1 June 2004 - Assassination Plans Found On Internet ASSASINATION PLANS AGAINST SAUDI ARABIA'S MINISTER OF THE INTERIOR Prince Nayif Bin-Abd-al-Aziz were discovered by Northeast Intelligence Network analysts and submitted to the appropriate authorities. As first reported on The Roth Show, a syndicated radio program based in Spokane, Washington, the highly detailed plans are calling for the operation to take place this Friday, June 4, 2004 using rocket propelled grenades while the Prince is in transit. The plans, authored by Abu Hajar Abdel Aziz al-Moqrin, the leader of al Qaeda in Saudi Arabia and the man who claimed responsibility for the attack on the residential complex in Saudi Arabia last Saturday, outlined Prince Nayif's itinerary, manner and route of travel, personal security, and planned method of attack using rocket propelled grenades. The detailed plans were found in Issue 11 of Camp al Battar, a well known military-style training manual referenced by terrorists and published regularly on an elusive Internet forum. The translated communication can be found at www.homelandsecurityus.com in addition to the audio statement of Abu Hajar Abdel Aziz al-Moqrin claiming responsibility for the attack at APICORP in Khobar, Saudi Arabia. Translated from Arabic: The target: Nayef Bin Abdul Aziz. He will attend a reception of external security personel in a secret visit of the queen at King Khaled International Airport. Specification of the target: Nayef Bin Abd Al-Aziz Al Saud . Personal information: Name: Nayef Bin Abd Al-Aziz Al Saud . Age: 71 years born in 1933. Position: the Saudi Minister of Interior. Residence address: the Gardens - several palaces (the present palace in Arqa, also the Mother's palace, and several other palaces that he frequents). Daily routine: He goes to sleep shortly before dawn, and goes to the ministry some days at 7 o'clock at night until eight thirty, resting in the evenings, and attending parties, and private meetings. Number of guards: 8 persons Typed of armament: light . The guards can be targeted as they descend from the care; they are near but not too close. The movement of the procession: it blocks off the roads, and they drive the target car in the midst of the procession with similar cars possibly to provide a camouflage procession. The guarding crew breaks up any surveillance. The guarding crew varies the route at times.. The number of guarding cars in the procession: (not less than ten cars and their job is to opened the highway). The first car, with the oscillation light, then the cars for personal protection, then the cars in which the targets are found which are probably similar in color and model and without numbers or with similar numbers to the protection cars, then the patrol cars that close the procession. Sometimes there is a smaller procession without the target that moves in side streets. The target changes its car. Mostly uses the same car, which is not easy to approach since the highways are closed. Route information: From Arqa palace to the airport, 40 kilos. Route Description: From Arqa, take the western circular, then the northern circular, then the airport highway, with the probability of moving onto other roads: (Arqa - Khris highway, Jabber Alsabah's highway, the northern circular, the airport highway). (Arqa - Ad Dir Iyah, Alamaria parting, then move in an easterly direction and return to the specialize route to the airport highway ). Schedule The time of departure for the reception: on 15 / 4 / 1425 AH The departure time: at six at night . The arrival time: 25 minutes after 6 . The side streets: many sides streets come from the circular exits ( 4 - 5 - 6 - 7 ) and from them (the western gates of King Saud University) (Prince Abdullah Highway ) . The bridges: the field linking between the northern circular and the circular extension east of the Airport Highway. Places where the cars can park, and deserted places: there are none. There are many turns: Among them the turn of the circular on the western meeting the northern circular, and the turn of the circular northern meeting to the eastern, and there are moderately thick trees and gardens and football playing fields. There is a high building of several floors belonging to the Sabk company, and the Imam University buildings, and there are trees in the moderate island separating between the two ways, which are good for the invisibility and ambushes and at the entrance to the airport highway there is a gate which can be closed. After the target has been specified, the command began issuing orders to the concerned leaders, dividing the operation into several stages: The first stage: the specification of the target. This stage is complete. The second stage: the collection of the information. This stage is complete also. The third stage: Determining the way of killing (the explosives), and it will be with the explosions in the procession during the passing of the procession at the bottom of the bridge linking the northern circular and the eastern one, and on the sides of the highway at the turn, beginning with the emergence of the group of confirmation and the destruction, with the assurance of killing them, or it may be carried out with the use of anti-armament missiles. At this point, it is impossible to determine if this is an actual assassination plan, or some sort of hoax. The fact that it was published in issue 11 of Al Battar, a known Al Qaeda publication that has proved credible in the past, and that it was written by Abu Hajar Abdel Aziz Al Moqrin (see article below) certainly lends a degree of urgency to this information. The level of detail of the information in the "plan" is very high and shows the results of extensive surveilance of the individual named as the target. However, it must also be taken into consideration that Abu Hajar has changed pertinant details prior to publication. It is possible that the target of the attack is a different member of the Saudi royal family. A posting on the Al Qal'ah forum this morning refers to a "big surprise" coming in the next week for Saudi Prince Mohamed Bin Fahd, son of the current Saudi king. The Al Battar article specifies the date of June 4, 2004, for the attack. Since that is just a few days away, we are posting the relevant material in hopes that the attack will be thwarted by authorities. Law enforcement, diplomatic, and other security personnel who need access to the original documents we translated should contact our director at dhagmann(a)adelphia.net. -------------------------------------------- 1 June 2004 - Who is Abu Hajar Abdel Aziz al Moqrin Throughout the past few months, a new Al Qaeda militant has emerged to the forefront in the Kingdom of Saudi Arabia. Abu Hajar Abdel Aziz al Moqrin is widely recognized as the leader of Al Qaeda operations in Saudi Arabia. He has claimed responsibility for this weekend's attack on the Oasis residential complex in Khobar, and for the attack on the Yanbo petroleum facility a few weeks ago. But little has been published about this militant. What exactly is known about him? Abu Hajar, or Hajar's father, first made his public appearance on the scene in the Badr al Riyadh videos, released by Al Qaeda in the winter of 2004, and commemorating the Ramadan attacks in Riyadh in November of 2003. According to the semi-official biography published by Al Qaeda, Abu Hajar has spent the last 16 years of his life in the service of Al Qaeda. Abu Hajar, who is reportedly 33 years old, has "served" in combat in Bosnia, Algeria, and Somalia, before assuming the reins of the operation in Saudi Arabia. Abu Hajar was sentenced to four years of prison in Saudi Arabia, and was released after 2 years, with the sentence reduced for "good behavior". He assumed control of the Saudi operations after the death of the previous leader in a shootout last year. Moqrin dropped out of school at the age of 17, and went to Afghanistan, purportedly to join in the fight against the Soviet Union. He apparently received his paramilitary jihad training in the Al Qaeda training camps of Afghanistan. According to reports, he was in Afghanistan for four years, from 1990 - 1994. While in Afghanistan, he was responsible for training operations in the "Governor's Camp" near the city of Khost, Afghanistan, and was also involved in numerous combat operations. He left Afghanistan in 1994 to move to Algeria, to help train the Islamic insurgents in that country. After leaving Algeria, Abu Hajar went to Bosnia and Herzegovina, where he again was active in the training of militants as well as in combat operations. He returned to Saudi Arabia, then made his way through Yemen, and on to Somalia where he fought with the militant groups against the Ethiopian forces. He was arrested in Somalia, and extradited to Saudi Arabia, where he was sentenced to four years in prison. He was released after two years on "good behavior". A month after his release, he made his way back to Yemen, and then to Afghanistan in 2001.There he joined combat operations with the Taliban against the American troops. After the fall of the Taliban, he returned to Saudi Arabia, to his home in the Swedish district of Riyadh. He immediately became involved in the establishment of jihad training camps in the middle and western regions of Saudi Arabia. When Khaled Al Bin Al Haj was killed on March 15 in a shootout with the Saudi security forces, Abu Hajar assumed leadership of Al Qaeda in the Arabian Peninsula. Abu Hajar was raised in the city of Riyadh. He is a high school dropout. He was married at the age of 19, and has one child (currently 10 years old) with this wife. According to the biography, Abu Hajar remarried without the knowledge of his family, and had a second child, who died before the age of 2. ------------------------ Yahoo! Groups Sponsor --------------------~--> Yahoo! Domains - Claim yours for only $14.70 http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0