precedence: bulk Subject: Risks Digest 21.75 RISKS-LIST: Risks-Forum Digest Monday 19 November 2001 Volume 21 : Issue 75 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at and by anonymous ftp at ftp.sri.com, cd risks . Contents: [Big backlog. Another issue tomorrow to catch up.] Feds make record counterfeit software seizure (NewsScan) Google freely giving out your phone number and home address (Derek Ziglar) Researchers probe Net's 'dark address space' (Kevin Poulsen via Dewayne Hendricks and David Farber) A large risk of national ID cards (Adam Shostack) Re: Programming error scrambles election results (Hamish Marson, Phil Kos) Re: DoS attack on Mac OS9 (Erann Gat) IP: Announcing URIICA - For the Sake of Internet Users Everywhere (PGN) REVIEW: "Internet and Computer Ethics for Kids", Winn Schwartau (Rob Slade) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Mon, 19 Nov 2001 08:04:38 -0700 From: "NewsScan" Subject: Feds make record counterfeit software seizure California law enforcement officials made the largest seizure of counterfeit software in U.S. history, estimated to be worth about $100 million. The products, which originated in Taiwan, included about 31,000 high-quality copies of Microsoft's Windows Millennium Edition and 2000 Professional operating systems and tens of thousands of copies of Symantec security software. "They look so good that the purchaser would not know it was counterfeit," said Los Angeles County Sheriff Lee Baca. Some of the bogus discs even carried the "Do not make illegal copies of this disc" warning. Authorities have arrested three people on bribery conspiracy and smuggling charges, and another has been charged with state violations of counterfeiting a registered trademark. [AP 16 Nov 2001; NewsScan Daily, 19 Nov 2001 http://news.excite.com/news/ap/011116/20/counterfeit-software] ------------------------------ Date: Tue, 13 Nov 2001 09:24:58 -0500 From: "Derek Ziglar" Subject: Google freely giving out your phone number and home address If you are in the USA, try searching in Google for your name, followed by your city, state or zip code--such as: Bob Smith Alaska. The first results you get may well be your home phone number, home address, and a link to a map (in some cases with a satellite photo of your house, too). The RISKS are staggering that this type of personal information is being automatically given out to people that weren't even asking for it. Sure, they were looking for some information about you. But cross linking data across purposes (web search versus telephone lookup) is one of the biggest privacy risks of the modern connected database age. It rapidly becomes one-stop shopping for everything anyone would want to know about you--whether they were asking for all that detail or not! In addition, Google does not provide any obvious mechanism to request removal from this telephone listing. Derek Ziglar (city and state withheld for obvious reasons) dziglar@yahoo.com ------------------------------ Date: Thu, 15 Nov 2001 15:53:54 -0500 From: David Farber Subject: Researchers probe Net's 'dark address space' (From Dave's IP) >From: Dewayne Hendricks Researchers probe Net's 'dark address space' By Kevin Poulsen Posted: 15/11/2001 at 02:30 GMT Broadband customers and US military systems are the most common victims of an online phenomenon researchers have dubbed "dark address space," which leaves some 100 million hosts completely unreachable from portions of the Internet. For a variety of reasons ranging from contract disputes among network operators to simple router mis-configuration, over five percent of the Internet's routable address space lacks global connectivity, according to the results of a three-year study by researchers at Massachusetts-based Arbor Networks, to be released Tuesday. "Popular belief holds that the Internet represents a completely connected graph," says Craig Labovitz, Arbor Networks' director of network architecture. "It turns out that's just not true." Anecdotal evidence has long hinted at the existence of dark address space, but the researchers shed light on the subject by continuously gathering and analyzing core routing tables for three years. In the end, they found that for much of the Internet, the shortest path between two points doesn't exist. The most common factors contributing to dark address space: aggressive route filtering by network operators seeking to ease the load on equipment, and accidental mis-configuration. US military sites frequently fall into the shadow zone because they often occupy neglected 'Milnet' address blocks dating back to the Internet's stone age. Why cable modem customers also top the list remains one of the unsolved mysteries in the project, says Labovitz, who describes the research findings as preliminary. Murky Crime Despite the large number of hosts that fall into the partitioned space, the phenomenon is generally not noticeable to average Internet users because most Netizens only use a tiny portion of the Net. "Most people access five or ten web sites," Labovitz says. The study was conducted by Labovitz, Michael Bailey and Abha Ahuja. [...] [For IP archives see: http://www.interesting-people.org/archives/interesting-people/] ------------------------------ Date: Mon, 12 Nov 2001 09:58:12 -0500 From: Adam Shostack Subject: A large risk of national ID cards (In response to http://www.csl.sri.com/neumann/insiderisks.html) I believe that there is an important risk, that of reliance, that will accompany a high-tech national ID card. Every terrorist commits their first act of terrorism at some time in their life, and before that time, they cannot be any database of known terrorists. Once you start issuing cards, people will start relying on 'identity verification' rather than threat management. We'll see people relying on background checks [1] rather than xrays. We'll see special lines for frequent fliers, who are 'known trustworthy.' They differ from pilots and flight crew in that they don't run into co-workers who can notice and react to strange behavior before the flight. If you want to keep knives and guns off of planes, the answer lies in xrays, magnetometers, and other searching technology, not in believing that you know who's who. Many of the national id card risks come from a layer of indirection from the real problem, which is not "Is Alice trusted," but, "Is the person in front of me trusted?" National ID cards not only do nothing to solve this problem, they distract us from attempting to solve it. [1] See the last para of http://www.spectrum.ieee.org/WEBONLY/special/sept01/idcards.html ------------------------------ Date: Mon, 12 Nov 2001 14:37:21 +0000 From: Hamish Marson Subject: Re: Programming error scrambles election results (RISKS-21.74) The question remains. why oh why do companies insist on believing that the programmer is the best person to check, test and validate a piece of software that THEY have written. Not withstanding blatant bugs in the implementation of the logic, a tester will only test (Baring bugs in their testing of course :) what they anticipate the inputs to be. If the same people do the testing that did the programming, you are potentially missing out on whole swathes of input, because the same person doesn't realise they should be testing something they never thought of in the first place... Personally I like to think that anything I written isn't ready for prime time until at least one other person who UNDERSTANDS THE PROBLEM BEING SOLVED has had a chance to throw their data at it & verify if valid data comes out the other end. ------------------------------ Date: Fri, 16 Nov 2001 18:20:02 -0800 From: Phil Kos Subject: Re: Programming error scrambles election results (RISKS-21.74) > .... a veteran county employee claimed to have tested his code, but > apparently had not actually done so. Is it just me, or has anyone else noted that the two primary RISKs here are developers "testing" their own code and managers who think that software development is that trivial? I don't care how experienced a developer is, nobody (not even I! ;) can be relied on to find their own bugs. I would have certainly chastised the developer for not doing his job well enough, but I wouldn't had fired him. Instead I would have fired the people above him in the county bureaucracy who feel that critical software doesn't need to be tested--they're the truly dangerous ones here, and they're presumably still conducting business as usual now that they've sacrificed their scapegoat. [Testing by other folks is of course not sufficient. But even more critical, design and code reviews are also useful in trying to detect Trojan horses, trapdoors, etc., placed intentionally by developers with the expectation that they would facilitate rigging elections. PGN] ------------------------------ Date: Mon, 12 Nov 2001 14:14:53 -0800 (PST) From: Erann Gat Subject: Re: DoS attack on Mac OS9 (RISKS-21.73-74) Another masterful display of editorial subtlety from our esteemed moderator: From: "William Kucharski" > The risk in MacOS 9 is not surprising, and not really a RISK. Not > unless you're expecting the Multiple Users feature of MacOS 9 to provide > anything more than rudimentary security. From: Carl Maniscalco > In my opinion, anyone who leaves a computer unattended in that state in > an insecure environment probably deserves whatever he gets. So on the one hand the security is so weak that the only risk is that users might be foolish enough to think that the feature is something more than a simple facade, but on the other hand the security is so strong that we are justified in blaming the victims of maliciousness or, more to the point, typos, for not being able to log in to their own machines any more. I really don't want to belabor this, but both of these respondents seem to have missed the point: I never meant to suggest that the OS9 multiple users feature should be taken seriously as a security measure. That's why the subject of my post was "DoS attack on Mac OS9" and not "Security weakness in Mac OS9". The problem is not that security is weak (well, that's a problem too, but not the one I was talking about) but that the password can be changed without knowing the old password and without confirming the new password (which is, of course, not echoed on the screen). I'll grant that in reality attacks from malicious users are probably not a major concern, but if there's only one account on your machine and you decide to change its password then you had better type it in very, very carefully. Erann Gat ------------------------------ Date: Wed, 14 Nov 2001 07:55:43 -0500 From: "Peter G. Neumann" Subject: IP: Announcing URIICA - For the Sake of Internet Users Everywhere Announcing "URIICA" - Union for Representative International Internet Cooperation and Analysis http://www.uriica.org Lauren Weinstein Peter G. Neumann David J. Farber November 13, 2001 An Open Letter to the Global Internet Community == Executive Summary == The Internet has become too important for its development, management, security, and other critical aspects to continue largely on an ad hoc basis. Internet-related issues, which now impact our world and lives in a vast number of ways, are usually approached in isolation from one another by existing organizations, and often in parochial and non-representative ways. We submit that a new organization is needed, created specifically to provide guidance relating to Internet functions and issues on an international and truly representative basis. Such an organization could also help establish confidence that the Internet exists to benefit people everywhere, not merely commercial and other special interests. We offer URIICA -- Union for Representative International Internet Cooperation and Analysis -- as a possible first step towards building such a future. ------------------------- URIICA - Union for Representative International Internet Cooperation and Analysis - http://www.uriica.org In the more than thirty years since its genesis, the technology of the Internet has evolved from a little-known experiment to a major part of the world's infrastructures, with massive impacts throughout nearly every aspect of our cultures and lives -- from government to commerce, and from education to entertainment. Over the decades, innumerable individuals and informal groups have labored to make the Internet what it is today. Formal organizations have also played crucial roles, including ISOC, IETF, and ICANN, to name only three among many. But while the technical evolution of the Internet has been extraordinary in many respects, the ways in which the Internet is "managed" appear to be increasingly ill-suited in terms of overall planning, coordination, security, reliability, privacy, and numerous other key attributes. Of equal concern is the perception that Internet development has become largely hostage to well-heeled, vested interests. There are few and ever-decreasing opportunities for meaningful input on Internet issues from nonprofit organizations or ordinary Internet users without significant financial resources. These problems have been exacerbated by the historically isolated nature of many organizations working on Internet issues. There is a tendency for each such group to concentrate mainly on their own interests, with little coordination with other groups or persons who may have different points of view. There are also indications that some organizations have moved to extend their influence beyond their true competencies, and that those who have come to wield de facto power over controversial Internet-related issues may do so without a due consideration of international concerns, true representation, or even ordinary fairness. In the People For Internet Responsibility (PFIR) "Statement on Internet Policies, Regulations, and Control" [1], and "PFIR Proposal for a Representative Global Internet Policy Organization" [2], it has been suggested that the creation of a new international organization specifically to address these issues is a necessary step to successfully bring the Internet out of the age of turf wars and amateur theatrics into its appropriate role as a critical resource for the *entire* world and *all* of its peoples. Of course, moving from theory to practice is often difficult, particularly when dealing with the founding of organizations that must tackle controversial issues. However, the rising importance of the Internet and the continuing decline in public confidence regarding its operations suggest that action is urgently needed now. It is with this in mind that we offer "URIICA" - Union for Representative International Internet Cooperation and Analysis (http://www.uriica.org). The name may be long, but its premise and goal is basically simple: The Internet should be dedicated to the needs and well-being of people all over the world, in a truly representative and fair manner. We offer URIICA as a forum for discussion, planning, and for building a framework towards accomplishing this goal, by bringing together in a *representative* manner an *international* group of diverse persons, organizations, and other groups who have commitments to the future of an open Internet. These participants will not only encompass commercial interests, but also a wide range of nonprofit organizations, educational institutions, government agencies, individual Internet users, and anyone else who is willing to sit down and work for the common good. We visualize URIICA as being a very big tent indeed, with a structure created from the ground up to encompass both domestic and international concerns, based upon balanced, fair representation for everyone involved. We do not present URIICA as a fait accompli. There are innumerable details to be considered. But we hope URIICA will be a useful vehicle to bring together many persons and organizations for the work, debate, and serious long-term planning that is desperately needed. The Internet needs vision and dedication to be a beacon of hope for the future, and not merely a hi-tech mediocrity. If you're interested in helping, or have other comments, we'd very much appreciate hearing from you. General comments and questions can be e-mailed to: uriica@uriica.org Please also feel free to call Lauren Weinstein on +1 (818) 225-2800 (M-F 9:30 AM - 5:30 PM Pacific Time) if you wish to discuss this effort. If you'd like to join a (low-volume) e-mail list dedicated to URIICA and these issues, please send the message text: subscribe as the first text in the body of a message (the "Subject" field doesn't matter) to: uriica-request@uriica.org Over two millennia ago, the Greek mathematician Archimedes exclaimed "Eureka!" ("I have found it!") when he solved a vexing mathematical problem. We hope that URIICA can be of value in helping us all move towards solving many of the important problems of the Internet that we face both today and tomorrow. Thank you, and our best wishes to you all. [1] PFIR Statement on Internet Policies, Regulations, and Control http://www.pfir.org/statements/policies [2] PFIR Proposal for a Representative Global Internet Policy Organization http://www.pfir.org/statements/proposal Sincerely, Lauren Weinstein lauren@pfir.org or lauren@vortex.com or lauren@privacyforum.org Tel: +1 (818) 225-2800 Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, Fact Squad - http://www.factsquad.org Co-Founder, URIICA - Union for Representative International Internet Cooperation and Analysis - http://www.uriica.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Peter G. Neumann neumann@pfir.org or neumann@csl.sri.com or neumann@risks.org Tel: +1 (650) 859-2375 Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, Fact Squad - http://www.factsquad.org Co-Founder, URIICA - Union for Representative International Internet Cooperation and Analysis - http://www.uriica.org Moderator, RISKS Forum - http://risks.org Chairman, ACM Committee on Computers and Public Policy http://www.csl.sri.com/neumann David J. Farber farber@cis.upenn.edu Tel: +1 (610) 304-9127 Member of the Board of Trustees EFF - http://www.eff.org Member of the Advisory Board -- EPIC - http://www.epic.org Member of the Advisory Board -- CDT - http://www.cdt.org Member of Board of Directors -- PFIR - http://www.pfir.org Co-Founder, URIICA - Union for Representative International Internet Cooperation and Analysis - http://www.uriica.org Member of the Executive Committee USACM http://www.cis.upenn.edu/~farber (Affiliations shown for identification only.) ------------------------------ Date: Thu, 15 Nov 2001 08:03:15 -0800 From: Rob Slade Subject: REVIEW: "Internet and Computer Ethics for Kids", Winn Schwartau BKINCMEK.RVW 20010815 "Internet and Computer Ethics for Kids", Winn Schwartau, 2001, 0-9628700-5-6, U$15.95/C$24.95 %A Winn Schwartau www.nicekids.net winns@gte.net %C 11511 Pine St. N., Seminole, FL 33772 %D 2001 %G 0-9628700-5-6 %I Inter.Pact Press %O U$15.95/C$24.95 727-393-6600 fax: 727-393-6361 %P ~150 p. %T "Internet and Computer Ethics for Kids" Computer ethics can be a very frustrating field. Professional organizations appear to have abandoned the area: they seem to have given up on the idea of "codes of ethics" and now prefer to write "codes of conduct." "Values education" has progressed very little in the last thirty years. All of us seem to be the disciples of Kohlberg, and assume that by sitting around discussing ethics, moral dilemmas, and scenarios, we will all somehow become moral individuals. And that's for the adults. For kids, the task is even more important, and much more difficult. Maybe it's impossible. But it is good to see that someone has at least given it a try. I don't agree with everything Winn has done, but he has produced a valuable and helpful tool. I hope that a great many people try it out, and, if it needs tuning, feed ideas back to improve it. This volume is a tool, and must be seen as such to be valued. Schwartau has, probably wisely, not attempted to provide a full examination of ethical theories or systems. The chapters are all very short: they are introductions, not expositions. (As Blaise Pascal famously noted, it takes much longer, and much more work, to write a short piece than a long one.) The text is generally possible for the sixth grade reader, and is backed up with a short section on relevant ideas from the law, topics to think about and discuss, and resources for further study and research. Unfortunately, the work starts out weakly. The introduction is vague. Seemingly the book is addressed to everyone. The preface also states that the book has questions, but no answers. A second introduction is more personal, but no clearer as to the intent of the text. Chapter one states that there are no rules, and then lays out some rules. Aside from the contradiction, which may be too subtle for the younger end of the audience, but which will probably be picked up by the later teens, relativism makes it difficult to discuss ethics at all. To the question of what ethics are, chapter two has little explanation except to say that they are the "little voices." A brief Internet history is probably supposed to point out that the Internet has grown too fast for formal regulation, in chapter three. Chapter four starts out by raging against stereotypes of all kinds, and then stereotypes the media. The text also tersely outlines various types of hackers. Chapter five is a scenario, a rather simplistic story of a young person who is very clearly dealt with unfairly by "the Establishment," whose only possible recourse is to make unauthorized alteration of data on a computer. The material starts to get stronger as it becomes more specific. Passwords, and the needs for strong ones, are discussed in chapter six. Graffiti is equated with web page defacement in chapter seven. Phone phreaking, war dialing, and anonymity are defined in eight to ten. Malware, viruses and trojan horse programs, are covered in chapters eleven and twelve. Chapters thirteen and fourteen deal with spoofing and spam. Chapter fifteen points out that you have no idea whether what is said on the net is true, which leads to discussions of scams, online business, and rumours in sixteen to eighteen. Stealing, in chapter nineteen, leads to examinations of software piracy and plagiarism. Chapters twenty two to twenty five look at the more ambiguous topics of social engineering, flaming, meeting people, and stalking. Technical subjects, digital special effects and eavesdropping, get a brief look in chapters twenty six and twenty seven. The topics get harder as chapter twenty eight deals with pornography, then two chapters on privacy, another on monitoring, and ratting on others. Although the topics could be presented in various sequences, it might have been better to place chapter thirty three, discussing ethics and the law, closer to chapter two. But it is also a good lead-in to civil disobedience and hacktivism, in chapter thirty four. The review of personal responsibility, in chapter thirty five, is very good. "Computer Police," in thirty six, deals mostly with law enforcement concerns, with a brief mention of vigilantism. An interesting juxtaposition with chapter thirty seven, on getting caught. Chapter thirty eight, asks who makes the rules, but deals primarily with the home and who is in charge. Again, making ethical decisions, in thirty nine, is good, but should be related to two and thirty three. Although it finishes off the book, chapter forty, and cyber-parenting, is the introduction for parents and teachers. It is quite realistic and balanced. A final set of pages is probably an important part of the book. A set of lined pages, they are important exercises for self-examination, headed with "My Personal CyberEthics," "My Family's CyberRules," "My Friends' CyberEthics," "CyberRules at My Friends' House," "CyberRules at School," "What My Parents Need to Learn," "What My Teachers Need to Learn," "My Company's CyberEthics and Rules," and "What I think I Need to Learn." I won't give this book to my grandchildren, even though the oldest would probably be able to read a good part of it. But I will give it to their mothers. Not being a marketroid, I will not say that this book is a "must have" for anyone with kids. Unlike many other books, and like many computer technologies, it must be used to be of any value. Parents can't simply present it to their children and forget it: to do so would be to teach that ethics are not important. If you want to get anything out of this work, you will have to read it with your kids, or give it to them to read, and discuss it with them. It can be read in an afternoon, but shouldn't be. The material should be taken a chapter at a time, perhaps once a week, perhaps at even longer intervals. It may take years to finish this slim volume (by which time all the URLs may be 404). As the adult you will have to be patient, and accept that the discussions may not proceed in straight lines, as you think they should. The end result, though, should be worth it. You'll have ethical kids. copyright Robert M. Slade, 2001 BKINCMEK.RVW 20010815 rslade@vcn.bc.ca rslade@sprint.ca slade@victoria.tc.ca p1@canada.com http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade ------------------------------ Date: 12 Feb 2001 (LAST-MODIFIED) From: RISKS-request@csl.sri.com Subject: Abridged info on RISKS (comp.risks) The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. Alternatively, via majordomo, send e-mail requests to with one-line body subscribe [OR unsubscribe] which requires your ANSWERing confirmation to majordomo@CSL.sri.com . [If E-mail address differs from FROM: subscribe "other-address " ; this requires PGN's intervention -- but hinders spamming subscriptions, etc.] Lower-case only in address may get around a confirmation match glitch. INFO [for unabridged version of RISKS information] There seems to be an occasional glitch in the confirmation process, in which case send mail to RISKS with a suitable SUBJECT and we'll do it manually. .MIL users should contact (Dennis Rears). .UK users should contact . => The INFO file (submissions, default disclaimers, archive sites, copyright policy, PRIVACY digests, etc.) is also obtainable from http://www.CSL.sri.com/risksinfo.html ftp://www.CSL.sri.com/pub/risks.info The full info file will appear now and then in future issues. *** All contributors are assumed to have read the full info file for guidelines. *** => SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line. => ARCHIVES are available: ftp://ftp.sri.com/risks or ftp ftp.sri.comlogin anonymous[YourNetAddress]cd risks [volume-summary issues are in risks-*.00] [back volumes have their own subdirectories, e.g., "cd 20" for volume 20] http://catless.ncl.ac.uk/Risks/VL.IS.html [i.e., VoLume, ISsue]. Lindsay Marshall has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r http://the.wiretapped.net/security/info/textfiles/risks-digest/ . http://www.planetmirror.com/pub/risks/ ftp://ftp.planetmirror.com/pub/risks/ ==> PGN's comprehensive historical Illustrative Risks summary of one liners: http://www.csl.sri.com/illustrative.html for browsing, http://www.csl.sri.com/illustrative.pdf or .ps for printing ------------------------------ End of RISKS-FORUM Digest 21.75 ************************