NewsScan Daily, 21 April 2004 ("Above The Fold")

NewsScan Daily, 21 April 2004 ("Above The Fold")
***********************************************************
NewsScan Daily is underwritten by RLG, a world-class organization
making significant and sustained contributions to the effective
management and appropriate use of information technology. NSD is
written by John Gehl and Suzanne Douglas, [email protected].
***********************************************************

"ABOVE THE FOLD"
        Serious Flaw in TCP Found
        Lindows Set for IPO
        Palisade Launches File-Swapping Blocker
        Australian Banks Look at Linux Switch
        Sex.Com Saga Concludes

FEATURES
        Flash Card
        Honorary Subscriber: Archimedes
        Safe & Sound in the Cyber Age

SERIOUS FLAW IN TCP FOUND
      Computer security experts in the U.S. and Britain have identified an 
inherent design flaw in the transmission control protocol (TCP) that could 
make it easy for hackers to disrupt Internet activities worldwide. Paul 
Watson, the security researcher who sounded the alarm over the flaw, warns 
it could be used to disable Internet routers -- the complex machines that 
direct most Internet traffic -- by tricking them into resetting themselves. 
Apparently, security experts have known for years about the basic 
vulnerability, but discounted its threat because attackers would have to 
successfully guess several specific sets of information in order to exploit 
it -- something that many thought would take several years using powerful 
computers. Watson appears to have discovered a shortcut that makes it 
possible to complete that task in just a few minutes. U.S. Homeland 
Security cybersecurity director Amit Yoran says despite the seriousness of 
the problem, most of the world's major Internet service providers have 
already quietly taken steps to protect themselves: "It's important to note 
that this is a significant discovery, but it's also important to provide a 
fair degree of assurance that the sky is not falling." (Washington Post 20 
Apr 2004)
http://www.washingtonpost.com/wp-dyn/articles/A27890-2004Apr20.html

LINDOWS SET FOR IPO
      Lindows Inc. has filed for a so-called Dutch-auction-style initial 
public offering in an effort to raise up to $57.5 million. In a 
Dutch-auction IPO, investors bid on shares and help set the offering price. 
Lindows, which markets a version of Linux software for personal computers, 
was founded by Michael L. Robertson, the entrepreneur who also founded 
MP3.com. Lindows has locked horns with Microsoft, which has filed lawsuits 
alleging that the Lindows name violates Microsoft trademarks on the Windows 
operating system. In response, Lindows changed the name of its software to 
Linspire last week. (Wall Street Journal 21 Apr 2004)
http://online.wsj.com/article/0,,SB108150238193388647,00.html (sub req'd)

PALISADE LAUNCHES FILE-SWAPPING BLOCKER
      Palisade Systems is launching software that can identify and block 
copyrighted songs from being traded online. The software, created by 
Audible Magic, has received support from the recording industry as well as 
the interest of some higher education institutions who are seeking to gain 
control over the file-swapping activities of their students. "They want to 
take the position of not filtering out all peer-to-peer (traffic), stopping 
copyrighted works but not the other content," says Palisade founder Doug 
Jacobson. The Audible Magic technology will be included as an option in the 
newest version of Palisade's PacketHound network-management services. The 
technology sits inside a network and checks e-mails and other peer-to-peer 
transfers for audio "fingerprints" that match its database of copyrighted 
music files. If found, the technology blocks the file transfer midstream. 
(CNet News.com 21 Apr 2004)
http://news.com.com/2100-1027-5196218.html

AUSTRALIAN BANKS LOOK AT LINUX SWITCH
      Linux and open-source software have a big future - at Microsoft's 
expense - in at least two of Australia's four big banks. Westpac and the 
National Australia Bank are seriously considering open source, and the ANZ 
Bank has yet to show its cards. Meanwhile, the Commonwealth Bank has 
decided to stick with Microsoft products. Westpac and NAB are evaluating 
Linux on the desktop, as well as open-source alternatives for their 
back-end IT operations. That could lead to pockets of desktops running 
open-source software, perhaps in ATM or teller environments and many 
back-end systems, including internet-banking platforms running on Linux. 
(The Australian 20 Apr 2004)
http://australianit.news.com.au/articles/0,7204,9329324%5E15306%5E%5Enbv%5E,00.html

SEX.COM SAGA CONCLUDES
      The lengthy legal battle over the rightful ownership of the "sex.com" 
domain name has come to a conclusion with VeriSign's agreement to settle 
for terms that are rumored to be around $10 million. "This shows that the 
small guy can eventually beat a huge company. Hopefully, this leads to 
better care, custody and control over people's intellectual property," says 
Gary Kremen, who originally registered the name but found in 1995 that 
Network Solutions had turned the rights over to convicted forger Stephen 
Michael Cohen, who duped the Internet registrar into believing he had 
purchased it from Kremen. A federal court in 2001 ordered Cohen to pay 
Kremen $65 million, but Cohen skipped the country and is rumored to be 
living in Monte Carlo. Kremen then set his sights on VeriSign, which had 
purchased Network Solutions in 2000 and refused to admit any mistake had 
been made. The company is embroiled in nine other lawsuits over problems 
with domain-name registrations, according to the company's most recent 
annual filing with the SEC. (Los Angeles Times 21 Apr 2004)
http://www.latimes.com/technology/la-fi-sex21apr21,1,5242805.story?coll=la-headlines-technology

*****

FLASH CARD
      "Memo to the folks in Silicon Valley: You will have good jobs for 20 
more years. By 2020, though, computer chips will be cheaper than bubble-gum 
wrappers, and PCs will be in museums." (Physicist Michio Kaku)

HONORARY SUBSCRIBER: ARCHIMEDES
      Today's Honorary Subscriber is the famous ancient Greek mathematician 
and inventor Archimedes (287-212 BC.), whose contributions to science were 
not equaled until Sir Isaac Newton came on the scene some 1,800 years 
later. Archimedes proved the law of the lever and invented the compound 
pulley, demonstrating how heavy weights can be moved with a small force. He 
also discovered that every object has a center of gravity, the single point 
at which the force of gravity appears to act on an object. To convince 
skeptics, Archimedes reportedly once used a system of pulleys to move a 
ship fully loaded with passengers and freight. His surviving writings rank 
among the masterpieces of scientific literature, especially his work "On 
the Sphere and Cylinder."
      Archimedes was born in Syracuse, the largest Greek settlement in 
Sicily. He is thought to have studied under the disciples of Euclid in 
Alexandria, Egypt, at the time the chief center of Greek learning. Later he 
returned to Syracuse where he lived out the rest of his life, dying at the 
hands of a Roman soldier despite orders from Roman commander Marcellus to 
spare the citizens of Syracuse any harm. Legend has it that at the time of 
his death Archimedes was working on a geometry problem.
      A famous Archimedes story describes his detective work in proving 
that a goldsmith had cheated King Hiero by mixing silver in with the gold 
to make what was sold as a crown of pure gold. Archimedes was taking his 
bath when he figured out how to determine the goldsmith's guilt or 
innocence. Observing the water displaced from the tub when got into his 
bath, he realized he could compare the volume of water displaced by the 
crown to the volume displaced by an equal weight of pure gold. If the crown 
displaced more water, then it had to be fraudulent. As the story is told, 
he ran into the street without dressing, shouting "Eureka!" (I have found 
it!). Archimedes discovered other basic laws of hydrostatics, one of which 
was buoyancy -- the measure of the loss in weight an object seems to 
undergo when placed in a liquid, as compared to its weight in air. He 
observed that a fully or partly immersed object is buoyed upward by a force 
equal to the weight of the liquid it displaces. From this principle, he 
derived the principle that a floating object displaces an amount of liquid 
equal to its own weight.
      Among his important inventions was the Archimedean screw, a device 
still used today to drain and irrigate land in the Nile Valley. Archimedes 
also invented devices used to defend Syracuse against Roman attacks, such 
as cranes that could pull Roman ships out of the water and twirl them 
around, and catapults to heave rocks against attacking enemies. He 
foreshadowed the integral calculus by his method of exhaustion to determine 
the areas of figures bounded by curved lines or surfaces. His greatest 
mathematical discoveries, however, were the formulas for the surface and 
volume of a sphere. It is believed that Archimedes considered this work his 
most important accomplishment, because he requested that his tomb be 
inscribed with the figure of a cylinder circumscribing a sphere.

See 
http://www.amazon.com/exec/obidos/ASIN/0486420841//newsscancom/ref=nosim 
for "The Works of Archimedes" -- or look for it in your favorite library. 
(We donate all revenue from our book recommendations to adult literacy 
programs.)

SAFE & SOUND IN THE CYBER AGE
   "Warning: War Driver On Board"
    By Stephen Cobb and Chey Cobb
              ***
      Straying from our recent theme of protecting your computer when 
you're on the move, this column looks at the threats posed by some folks 
who are using mobile computers in a particular way, namely "war drivers." 
Some readers of NewsScan will be familiar with this term and the practice 
of "wardriving," but others may be wondering what it means, so a simple 
definition is in order: a war driver is someone who tries to detect 
wireless networks while moving from place to place.
      Let's examine a few of the concepts in this definition. In this 
context "wireless network" usually means a data network using the 802.11 
standard (which comes in a variety of flavors, such as 802.11b, 802.11g, 
sometimes collectively and confusingly referred to as Wi-Fi). Typically, 
this is the sort of local area network that you create by plugging a 
wireless access point into your Ethernet network, and a Wi-Fi card or 
adapter into each of your computers (although many new notebooks come with 
a built-in WiFi adapter).
      These WLANs, or wireless local area networks, are relatively cheap 
and easy to create since they don't require network cabling. That helps to 
explain why more than 60 million wireless cards and access points were sold 
last year and more than half of all U.S. companies use WLANs to some degree 
or other. But cheap WLANs come with hidden costs, namely security. And we 
don't just mean that the default, out-of-the-box configuration of these 
things is leaky as a sieve.
      Every WLAN operates, by its very nature, in loose-lips mode. In other 
words, they broadcast their traffic into the air, whence it may be 
overheard by someone with the right set of ears, namely, the war driver. 
This is not some big budget eavesdropper in the manner of "Enemy of the 
State." All you need is an old laptop, the right Wi-Fi card, an empty 
Pringles can, and some free software (the Pringles can--wired to the Wi-Fi 
card as an external antenna to boost reception--is optional).
      We recently set up a rig like this to prepare for a session at a 
security conference. We got in the car, turned on the laptop, ran the 
software (NetStumbler running on Windows 98) and started driving. Even 
though we live in a small town, we soon found more than a dozen networks. 
Try this in your town and chances are you'll see networks appear on the 
screen within the first few miles or, if you have turned on the audio 
feature in NetStumbler, you will hear networks appear (changes in tone 
indicate strength of signal). We would also like to point out that wireless 
sniffing programs like NetStumbler are FREE and require little time and 
effort to figure out how to use it. No wonder war driving has become so 
popular with kids and would-be hackers!
      The names of the networks may be things like "linksys" or "netgear," 
indicating that the owner of the network has not changed the default 
service set identifier or SSID, which tends to be the brand of the wireless 
access point (broadcast for the world to see unless the network owner turns 
this feature off). The name could also be a person or place or company, 
which helps war drivers figure out whose network they are picking up (like 
"SCHS" which we detected near the offices of Sample County Health 
Services). A program like NetStumbler will also tell you whether or not the 
network is using encryption (we wager most of the networks you see are not).
      Remember, a war driver is someone who "tries to detect wireless 
networks." Doing what we have described so far would not, in our humble, 
non-binding opinion, be breaking the law. The radio signals are in the 
public air and detecting them is no crime. But connecting to those networks 
without permission could well be a crime, and this is where things get 
tricky--even if you are not intentionally war driving--because your 
computer may try, all by itself, to connect to those networks. That's 
right, your shiny new Windows XP notebook with built-in wireless is, by 
default in most cases, constantly searching for wireless networks with 
which to communicate.
      Although networks on which you don't belong should--we think--refuse 
you access, they may not. However, if you proceed to use such a network, 
for example, to surf the Web or get your email, you do so a./ at your own 
risk (exposing to strangers your user names and passwords for email and Web 
sites, and possibly files in shared directories on your hard drive) and b./ 
in possible violation of the law.
      Which brings us back to those who intentionally war drive. What can 
they do with the data they are sucking out of the ether, besides steal 
bandwidth by surreptitiously surfing over an open connection? Most network 
and security magazines have run articles on how poor wireless security 
compromises sensitive data. For example, a war driver can use "sniffer" 
software--not NetStumbler--to view the traffic on the wireless network. If 
the data is encrypted with WEP, the Wireless Encryption Protocol, the war 
driver can capture data and analyze it to crack the encryption, then read 
the data.
      Awareness of the degree to which a wireless network can undermine the 
confidentiality of sensitive personal and corporate data is growing, but 
there are still many misconceptions. The first relates to "broadcasting the 
SSID." Like many experts, we recommend that WLAN operators turn this off, 
which means that anyone wanting to use your WLAN will need to know the name 
of the access point and enter it manually the first time they log on. This 
is somewhat inconvenient, but it buys you some security-by-obscurity. What 
it doesn't buy you is radio silence. In other words, your WLAN data is 
still flying through the ether, susceptible to eavesdropping. In our next 
column we'll suggest some further defensive measures to take, and discuss 
some of the less obvious attacks that a war driver might mount if he or she 
were to experience a serious lapse in ethics.
      [Chey Cobb, CISSP, the author of "Cryptography for Dummies" and 
"Network Security for Dummies," is a former senior technical security 
advisor to the NRO. She can be emailed as chey at aug dot com. Stephen 
Cobb, CISSP, is the author of "Privacy for Business" and can be emailed as 
scobb at cobb dot com.]

SUBSCRIPTION INFO FOR NEWSSCAN DAILY:
       To subscribe or unsubscribe to the text, html, or handheld versions 
of NewsScan Daily, send the appropriate subscribe or unsubscribe messages 
(i.e., with the word 'subscribe' or 'unsubscribe' in the subject line) to 
the addresses shown below:
       Text version: Send message to [email protected]
       HTML version: Send mail to [email protected]
       NewsScan-To-Go: http://www.newsscan.com/handheld/current.html

TELL YOUR FRIENDS ABOUT NEWSSCAN DAILY! Send them our little frog: 
http://www.newsscan.com/newsscan/newscup.html

***********************************************************
Please visit the site of RLG, the great organization that makes NewsScan 
Daily possible. (RLG has no influence over, nor any responsibility for, our 
editorial content.) Created in 1974 as the Research Libraries Group, RLG is 
a not-for-profit membership corporation of more than 160 universities, 
national libraries, archives, museums -- and other institutions with 
remarkable collections for research and learning. Its major initiatives are 
long-term retention of digital materials, resource sharing among member 
institutions, and improvement of researcher access to primary source 
material. RLG supplies online research resources worldwide. Visit RLG at 
http://www.rlg.org.

*********

To subscribe or unsubscribe to the TEXT version of NewsScan Daily, send an 
e-mail message to [email protected] with 'subscribe' or 'unsubscribe' 
in the subject line. To subscribe to our HTML version of NewsScan Daily, 
send mail to [email protected], with the word 'subscribe' as the 
subject. (Subscribing to the HTML version won't automatically unsubscribe 
you from the text version; please unsubscribe yourself as explained above.) 
Please note: To unsubscribe from an account to which you no longer have 
access, send mail to at [email protected].

*********

We call our news section "Above The Fold" to honor the tradition of the 
great "broadsheet" newspapers in which editors must decide which news 
stories are of such importance that they should be placed "above the fold" 
on the front page. The NewsScan Credo: Be informative, have fun, and get to 
the point! See http://www.newsscan.com/, and send us mail: John Gehl 
<[email protected]> and Suzanne Douglas <[email protected]>, or call 
770-704-7517.

*********

Get a free 6-week trial subscription to Innovation Weekly, an executive 
summary of trends, strategies and innovations in business and technology. 
Send mail to [email protected] with the word 'subscribe' in the 
subject line.

What customized news and information services do you need for your company? 
Get in touch with us at [email protected] or call 770-704-7517 to talk 
over the possibilities.

Copyright 2004. NewsScan Daily (R) is a publication of NewsScan Inc.
***********************************************************