Re: fyi: Storm Worm botnet numbers, via Microsoft

2007-10-23 Thread ' =JeffH '


[EMAIL PROTECTED] said:
 Detailed analysis of the Storm network, how it works, its size, etc is being
 activly worked on by several research groups

8^)


   Storm is nowhere near 50 million nodes and never was.


Good.  


 I will be presenting /some/ of this work at Toorcon in San Diego this
 Saturday:

 http://www.toorcon.org/2007/event.php?id=38


excellent, how'd it go? Anyone else present on Storm?



 The presentation is not academic paper quality and takes more of a
 code-monkey approach to the network.  Real (sane and substantiated) numbers,
 stats, and graphs will be presented.  To the best of my knowledge, it will be
 the first publicly released estimates of the size of the network with actual
 supporting data and evidence. 


are your slides now available?



=JeffH


-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]


Re: Commercial CAPTCHA-breakers for sale

2007-10-23 Thread Ali, Saqib
On 10/22/07, Ian G [EMAIL PROTECTED] wrote:
 Peter Gutmann wrote:
  http://www.lafdc.com/captcha/ is a site that sells commercial 
  CAPTCHA-breaking
  software.

The complexity of some the captchas shown on this web-site made me
think. We have gone to such extents to prevent against spammers. When
we should be prosecuting and hanging the spammers.

Remember
Men are not hanged for stealing horses, but that horses may not be
stolen George Savile

saqib
http://security-basics.blogspot.com/

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]


Fingerprint Firefox Plugin?

2007-10-23 Thread Arcane Jill
Can anyone tell me... is there a Firefox plugin which allows one to view the 
fingerprint of the SSL certificate of each page you visit (e.g. in the status 
bar or address bar or something)?


Better still if it can learn which ones you trust, but just being able to view 
them without having to jump through hoops would be a good start.


Arcane Jill

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]


NSA solicited illegal Qwest mass wiretaps right after Bush inauguration

2007-10-23 Thread John Gilmore
http://www.denverpost.com/business/ci_7230967?source=commented

Nacchio affects spy probe
His court filings point to government surveillance months before 9/11
By Andy Vuong
The Denver Post
Article Last Updated: 10/20/2007 11:38:08 PM MDT

  Extras

  Previously sealed documents filed by former Qwest chief executive Joe Nacchio 
in connection with his top-secret defense strategy, in which he argued that he 
was privy to classified information that led him to believe the company was in 
line to receive lucractive government contracts. The documents were released 
Wednesday at the request of The Denver Post.

  [Follow the link above to get the links to these court documents.  --gnu]
  * Read file 1, Sept. 29, 2006 (PDF, 46 pages).
  * Read file 2, Oct. 31, 2005 (PDF, 84 pages).
  * Read file 3, Jan. 4, 2007 (PDF, 10 pages).
  * Read file 4, Oct. 31, 2006 (PDF, 25 pages).
  * Read file 5, Jan. 22, 2007 (PDF, 3 pages).
  * Read file 6, Feb. 20, 2007 (PDF, 25 pages).
  * Read file 7, May 25, 2007 (PDF, 12 pages).

Recent revelations about former Qwest chief executive Joe Nacchio's 
classified-information defense, which went unheard during his insider-trading 
trial, are feeding the furor over the government's warrantless-wiretapping 
program.

Nacchio alleges the National Security Agency asked Qwest to participate in a 
program the phone company thought was illegal more than six months before the 
Sept. 11, 2001, terrorist attacks, according to court documents unsealed at the 
request of The Denver Post.

Nacchio also maintains that when he refused to participate, the government 
retaliated by not awarding lucrative contracts to Qwest.

Previously sealed transcripts released at the same time as the court documents 
indicate the government was prepared to counter Nacchio's claims.

Though specifics about the wiretapping program were redacted from the court 
documents, Nacchio's attorney Herbert Stern said in May 2006 that Nacchio 
rejected requests from the government for customers' phone records in fall 2001.

The recently unsealed documents push that time frame back to February 2001 and 
indicate the NSA may have also sought to monitor customers' Internet traffic 
and fax transmissions.

Nacchio's claims could affect President Bush's controversial efforts to grant 
legal immunity to large telecommunications companies such as ATT, which has 
been sued in connection with the surveillance program.

The Nacchio materials suggesting that the NSA had sought telco cooperation 
even before 9/11 undermines the primary argument for letting the phone 
companies off the hook, which is the claim that they were simply acting in good 
faith to help the president fight the terrorists after 9/11, said Kevin 
Bankston, a staff attorney for the Electronic Frontier Foundation, a 
civil-liberties group.

The fact that these materials suggest that cooperation with the program was 
tied to the award of certain government contracts also contradicts their (phone 
companies') claims that they were simply acting in good faith to help fight the 
terrorists when it appears that they may have been motivated by financial 
concerns instead, Bankston said.

Up to this point, discussions on Capitol Hill over telecom immunity have 
focused on government surveillance efforts spurred by the Sept. 11 terrorist 
attacks.

This is, sooner or later, going to be the stuff of congressional hearings 
because a new starting point has been established for this controversy. A new 
starting point seven months before 9/11, said Ron Suskind, author of The One 
Percent Doctrine, which reported examples of how companies worked with the 
government in its fight against terrorism after Sept. 11.

The idea that deals were getting cut between the government and telecom 
companies in secret in the early part of 2001 creates a whole new discussion as 
to intent, motivation and goals of the government, Suskind said.

Last week, Rep. John Conyers Jr., D-Mich., chairman of the House Judiciary 
Committee, asked federal intelligence officials for more information about 
Nacchio's allegations.

The extent to which this is true could shed light on the efficacy of this 
program and raise questions about the reasons behind its implementation, 
Conyers wrote on his blog.

For his part, Nacchio wanted to introduce the claims to show he didn't sell 
Qwest stock illegally in early 2001. The government alleged Nacchio dumped 
Qwest stock because he had inside information that the Denver company's 
financial health was deteriorating. He was convicted on 19 counts of insider 
trading in April after a month-long trial and sentenced to six years in prison.

He remains free on $2 million bond pending his appeal, which, among other 
charges, is challenging rulings U.S. District Judge Edward Nottingham made 
related to the classified-information defense.

Nacchio has maintained he was upbeat about Qwest because he had top-secret 
information that the company 

Re: fyi: Storm Worm botnet numbers, via Microsoft

2007-10-23 Thread Brandon Enright
On Mon, 22 Oct 2007 17:55:39 -0700 plus or minus some time ' =JeffH '
[EMAIL PROTECTED] wrote:
...snip...
  I will be presenting /some/ of this work at Toorcon in San Diego this
  Saturday:  
   
  http://www.toorcon.org/2007/event.php?id=38  
 
 excellent, how'd it go? Anyone else present on Storm?  

Things went pretty smooth.  Storm is a complicated and evolving beast so a
50 minute talk can't really go into the depth that is needed to really
understand how it works.  There weren't any other presentations at Toorcon
but it's a pretty hot topic so there should be more talks and papers coming
out from various researchers in the coming weeks and months.

It seems like whenever anyone says anything about Storm, the story gets
picked up by some news service and makes its way to Slashdot.

   
  The presentation is not academic paper quality and takes more of a
  code-monkey approach to the network.  Real (sane and substantiated)
  numbers, stats, and graphs will be presented.  To the best of my
  knowledge, it will be the first publicly released estimates of the size
  of the network with actual supporting data and evidence.   
 
 are your slides now available?  

They are:
http://noh.ucsd.edu/~bmenrigh/exposing_storm.ppt

The link to the historical trends of the network is here:
http://noh.ucsd.edu/~bmenrigh/storm_data.tar.bz2

It can be very hard to track the size of a botnet, even in the case of
Storm where I'm crawling the network.  Technologies like NAT can
significantly complicate things.

See
http://www.usenix.org/events/hotbots07/tech/full_papers/rajab/rajab_html/
for a discussion on tracking the size of botnets.

 
 =JeffH
   

My slides should provide adequate detail for someone to understand how to
interpret the graphs and data.  For specific questions, feel free to email
me directly.

Brandon


-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]