software development, security, opinion
Safeweb is a Fed Front. An enterprising Cryptome reader has discovered that the vaunted web privacy provider (already known to have CIA funding) Safeweb utilizes a Department of Defense server(s?) (anongo.com) as a proxy for user requests. [kuro5hin.org]
New York Times:
Attacks Expose Telephone’s Soft Underbelly
[via Slashdot]
Fog Creek President Michael Pryor figured out a brilliant trick which makes it so that you see new topics, and topics that have followups you haven’t read, in blue. If you’ve read the entire topic, it will be purple. And it’s all done without keeping any state on the server.
Robert Fleck, Cigital: Wireless insecurity + ARP Poisoning (pdf) (FAQ)
Observations:
Related article:
DowJones: Security Experts Are on Alert Over Wireless-Hacking Technique. Quicken.com Oct 15 2001 6:32AM ET
“Mr. Fleck of Cigital combined those wireless vulnerabilities with an attack that has been identified and addressed in most wired networks. Known as ARP poisoning, from the acronym for address resolution protocol, the attack manipulates software in the circuit boards that connect computers to corporate networks. That software contains addresses of other connected machines; a skilled hacker can fool the software to make it seem like his machine has an authorized address to receive data packets on the network. An attacker who understood both techniques, Mr. Fleck said, could use a laptop with a wireless connection to enter a company’s wireless network, and then effectively tell machines on the wired portion of the network to pass all data packets through his laptop.
“The most obvious solution to the problem is to segregate the gateway device that acts as the front door for machines making wireless connections to a network. That can be done using routing devices or filtering programs known as firewalls.”
[via Moreover Computer security news]
Here’s one of those good ideas you’re glad someone else implemented. “When you find a page on the web whose address is too long to paste into an email or other document, you can use our free service to generate a shorter, simpler address.” Let’s give it a try. Here’s a pointer to Stewart Alsop’s article on Fortune through the shorterlink service. 
[Scripting News]
Yahoo:
Demonstrators hold up a poster of terrorist suspect Osama bin Laden during a pro Bin Laden rally in Dhaka, Bangladesh Monday, Oct. 8, 2001. Within the poster, at center right, is a printed image of “Sesame Street” children’s television character “Bert.”
Azad Products, who manufactures the poster was not aware of the appearance of Bert in one of the collaged images that make up the poster. “We got the images through e-mails and off the internet. We did not give the pictures a second look or realize what they signified until you pointed it to us,” Mostafa Kamal, production manager, told The Associated Press. Sesame Street or Bert are hardly known in Bangladesh. (AP Photo/Pavel Rahman)
Previously covered in http://www.lindqvist.com/bert.php.
| Terror isn’t only something that is done to people. It’s also what makes people to do terrible, terrifying things. I was one of the Taliban’s torturers: I crucified people is the brief story of Hafiz Sadiqulla Hassani, an accountant who committed hideous atrocities as a member of the Taliban secret police and finally as a bodyguard for Mullah Omar, the Taliban’s leader. The story is apocolyptic, right out of Conrad’s Heart of Darkness, or the more familiar Apocalypse Now, with Osama bin Laden playing Col. Kurtz. Consider this narrative, which begins with a profile of Omar: |
| “He’s medium height, slightly fat, with an artificial green eye which doesn’t move, and he would sit on a bed issuing instructions and giving people dollars from a tin trunk,” said Mr Hassani. “He doesn’t say much, which is just as well as he’s a very stupid man. He knows only how to write his name `Omar’ and sign it. |
| “It is the first time in Afghanistan’s history that the lower classes are governing and by force. There are no educated people in this administration – they are all totally backward and illiterate. |
| “They have no idea of the history of the country and although they call themselves mullahs they have no idea of Islam. Nowhere does it say men must have beards or women cannot be educated; in fact, the Koran says people must seek education.” |
| He became convinced that the Taliban were not really in control. “We laughed when we heard the Americans asking Mullah Omar to hand over Osama bin Laden,” he said. “The Americans are crazy. It is Osama bin Laden who can hand over Mullah Omar – not the other way round.” |
| While stationed in Kandahar, he often saw bin Laden in a convoy of Toyota Land Cruisers all with darkened windows and festooned with radio antennae. “They would whizz through the town, seven or eight cars at a time. His guards were all Arabs and very tall people, or Sudanese with curly hair.” |
| He was also on guard once when bin Laden joined Mullah Omar for a bird shoot on his estate. “They seemed to get on well,” he said. “They would go fishing together, too – with hand grenades.” |
| This time, however, we don’t seem to be sending a Willard up the river to “terminate the Colonel’s command.” But when it’s over, if it ever is, how do we save this hell from itself? |
USA ACT (PDF):
SEC. 217. INTERCEPTION OF COMPUTER TRESPASSER COM-
MUNICATIONS.
Chapter 119 of title 18, United States Code, is
amended—
(1) in section 2510—
(A) in paragraph (17), by striking ‘‘and’’
at the end;
(B) in paragraph (18), by striking the pe-
riod and inserting a semicolon; and
(C) by inserting after paragraph (18) the
following:
‘‘(19) ‘protected computer’ has the meaning set
forth in section 1030; and
‘‘(20) ‘computer trespasser’—
‘‘(A) means a person who accesses a pro-
tected computer without authorization and thus
has no reasonable expectation of privacy in any
communication transmitted to, through, or from
the protected computer; and
‘‘(B) does not include a person known by
the owner or operator of the protected computer
to have an existing contractual relationship with
the owner or operator of the protected computer
for access to all or part of the protected com-
puter.’’; and
(2) in section 2511(2), by inserting at the end
the following:
‘‘(i) It shall not be unlawful under this chapter for
a person acting under color of law to intercept the wire
or electronic communications of a computer trespasser,
if—
‘‘(i) the owner or operator of the protected com-
puter authorizes the interception of the computer
trespasser’s communications on the protected com-
puter;
‘‘(ii) the person acting under color of law is
lawfully engaged in an investigation;
‘‘(iii) the person acting under color of law has
reasonable grounds to believe that the contents of
the computer trespasser’s communications will be
relevant to the investigation; and
‘‘(iv) such interception does not acquire commu-
nications other than those transmitted to or from
the computer trespasser.’’.
