refractal http://blog.refractal.org tracing the network's resolution Mon, 17 Nov 2008 01:22:44 +0000 http://wordpress.org/?v=2.6.2 en The evolution of American counterintelligence http://blog.refractal.org/2008/11/16/the-evolution-of-american-counterintelligence/ http://blog.refractal.org/2008/11/16/the-evolution-of-american-counterintelligence/#comments Mon, 17 Nov 2008 01:19:22 +0000 marc http://blog.refractal.org/?p=613

The US Office of the National Counterintelligence Executive recently published a four-part reader as an accompaniment to the lectures they conduct:

Our reader’s three volumes cover counterintelligence’s past and present. Nevertheless they form a whole: the first volume provides material elucidating counter- intelligence’s antecedents from the American Revolution to World War II. Volume two focuses on World War II while volume three begins with the Atom Bomb spies and concludes with the latest espionage cases. History is more than background; it is the framework of the present.

We have taken material from official government documents, indictments from several espionage cases, and articles written by professors, scholars and counterintelligence officers. We have abridged some selections while trying not to change the sense of the original but we have not altered the original usage of the English language.

Each chapter in the three volumes has an introduction, which sketches out the main trends and characteristics of the period in question. There is a chronology with each chapter for volumes one and three, but volume two only has one chronology to cover the entire period. At the end of each chapter is a selected bibliography. We hope this will help you get a sense of the period as a whole. The reader is not all-inclusive and people may disagree with our selections, but at least we hope to have provided sufficient material to entice our colleagues to do further research.

Counterintelligence is a fascinating and challenging discipline. Our response to these challenges is determined, not by the requisites of the immediate situation but by our historical legacy. Thus we urge that the materials presented in the three volumes be read, not as background to the present, but as part of the present itself.

A fourth volume covers recent spying successes, failures, programs and reports.

Cryptome ZIP of PDFs

NCIX Site

]]> http://blog.refractal.org/2008/11/16/the-evolution-of-american-counterintelligence/feed/ The economics of a botnet http://blog.refractal.org/2008/11/14/the-economics-of-a-botnet/ http://blog.refractal.org/2008/11/14/the-economics-of-a-botnet/#comments Fri, 14 Nov 2008 11:52:56 +0000 marc http://blog.refractal.org/?p=604

Schneier on Security linked to an excellent paper on the economics of spam. Interestingly, the authors were able to infiltrate the Storm worm network and monitored its doings in the course of their study.

After 26 days, and almost 350 million e-mail messages, only 28 sales resulted — a conversion rate of well under 0.00001%. Of these, all but one were for male-enhancement products and the average purchase price was close to $100. Taken together, these conversions would have resulted in revenues of $2,731.88 — a bit over $100 a day for the measurement period or $140 per day for periods when the campaign was active. However, our study interposed on only a small fraction of the overall Storm network — we estimate roughly 1.5 percent based on the fraction of worker bots we proxy. Thus, the total daily revenue attributable to Storm’s pharmacy campaign is likely closer to $7000 (or $9500 during periods of campaign activity). By the same logic, we estimate that Storm self-propagation campaigns can produce between 3500 and 8500 new bots per day.Under the assumption that our measurements are representative over time (an admittedly dangerous assumption when dealing with such small samples), we can extrapolate that, were it sent continuously at the same rate, Storm-generated pharmaceutical spam would produce roughly 3.5 million dollars of revenue in a year. This number could be even higher if spam-advertised pharmacies experience repeat business. A bit less than “millions of dollars every day,” but certainly a healthy enterprise.

Of course, the authors point out that it’s dangerous to make these sorts of generalizations:

We would be the first to admit that these results represent a single data point and are not necessarily representative of spam as a whole. Different campaigns, using different tactics and marketing different products will undoubtedly produce different outcomes. Indeed, we caution strongly against researchers using the conversion rates we have measured for these Storm-based campaigns to justify assumptions in any other context. [link]

]]> http://blog.refractal.org/2008/11/14/the-economics-of-a-botnet/feed/ Anatomy of a trojan hack http://blog.refractal.org/2008/11/13/anatomy-of-a-trojan-hack/ http://blog.refractal.org/2008/11/13/anatomy-of-a-trojan-hack/#comments Thu, 13 Nov 2008 10:28:42 +0000 marc http://blog.refractal.org/?p=594

An analyst at Websense Security Labs did a study of the “wolfteeth bot catcher”, a tool coming out of China that allows a user to specify a particular range of IP addresses and then search for and exploit the MS08-067 bug in Windows, installing any malicious code they may choose. Careful though! It seems the authors of this program included a backdoor so that installing it also pulls you into their botnet. Here is the link for the disection, an interesting bit of thick texture even if the details are lost on you.

]]> http://blog.refractal.org/2008/11/13/anatomy-of-a-trojan-hack/feed/ A hidden chronicle of horrific destruction http://blog.refractal.org/2008/11/12/a-hidden-chronicle-of-horrific-destruction/ http://blog.refractal.org/2008/11/12/a-hidden-chronicle-of-horrific-destruction/#comments Wed, 12 Nov 2008 16:23:34 +0000 marc http://blog.refractal.org/?p=588 A rather entrancing article, published originally in the Guardian, meditates on the hidden images of America’s “last good war.” Following the surrender of Japan in WWII, the US issued a strict writ of censorship stating that “nothing shall be printed which might, directly or by inference, disturb public tranquility.” Consequently, the atomic bombings in Japan have become, as the novelist Mary McCarthy wrote in 1946, “a kind of hole in human history,” unaccompanied by much of a visual record. The article follows the discovery of an amazing cache of photographs, previously unseen to the public, taken by the US Military’s Physical Damage Division at the end of the war:

One rainy night eight years ago, in Watertown, Massachusetts, a man was taking his dog for a walk. On the curb, in front of a neighbor’s house, he spotted a pile of trash: old mattresses, cardboard boxes, a few broken lamps. Amidst the garbage he caught sight of a battered suitcase. He bent down, turned the case on its side and popped the clasps.

He was surprised to discover that the suitcase was full of black-and-white photographs. He was even more astonished by their subject matter: devastated buildings, twisted girders, broken bridges — snapshots from an annihilated city. He quickly closed the case and made his way back home.

At the kitchen table, he looked through the photographs again and confirmed what he had suspected. He was looking at something he had never seen before: the effects of the first use of the Atomic bomb. The man was looking at Hiroshima. [link]

]]> http://blog.refractal.org/2008/11/12/a-hidden-chronicle-of-horrific-destruction/feed/ Links for 2 November 2008: http://blog.refractal.org/2008/11/02/links-for-2-november-2008/ http://blog.refractal.org/2008/11/02/links-for-2-november-2008/#comments Mon, 03 Nov 2008 00:04:01 +0000 marc http://blog.refractal.org/?p=569 Links for the week of 2 November 2008:

]]> http://blog.refractal.org/2008/11/02/links-for-2-november-2008/feed/ Resolving the Golden Shield http://blog.refractal.org/2008/10/28/resolving-the-golden-shield/ http://blog.refractal.org/2008/10/28/resolving-the-golden-shield/#comments Tue, 28 Oct 2008 17:43:37 +0000 marc http://blog.refractal.org/?p=570

Throwing a bit dye into the geist, a group of programmers have developed a Firefox plugin that will route your websurfing through a Chinese server, thus allowing you to get sense of what sort of Internet the Chinese state security services have in mind for their citizens. [Link to the plugin project website]

The control that governments, and other interested parties, can exert over one’s websurfing can take a much more insidious form than simply block content. Through some form of packet injection, or server based cacheing, web pages can be changed en route to the web browser, thus allowing for the manipulation of the user’s trust and expectation.

For more information, The Atlantic published an interesting article during the 2008 Olympics about the limitations and scope of the system.

]]> http://blog.refractal.org/2008/10/28/resolving-the-golden-shield/feed/ Links for 25 October 2008: http://blog.refractal.org/2008/10/26/links-for-25-october-2008/ http://blog.refractal.org/2008/10/26/links-for-25-october-2008/#comments Sun, 26 Oct 2008 23:11:46 +0000 marc http://blog.refractal.org/?p=500 Links for the week of 25 October 2008:

]]> http://blog.refractal.org/2008/10/26/links-for-25-october-2008/feed/ Along what dimension is cyberspace? http://blog.refractal.org/2008/10/23/along-what-dimension-is-cyberspace/ http://blog.refractal.org/2008/10/23/along-what-dimension-is-cyberspace/#comments Thu, 23 Oct 2008 23:21:01 +0000 marc http://blog.refractal.org/?p=546 In 2001, Martin Dodge and Rob Kitchin published an Atlas of Cyberspace, described by Vint Cerf as “explor[ing] a remarkable universe of visual representations of the Internet’s diversity, structure and content.” The atlas locates cyberspace along many dimensions: geographic maps of core fiber optic back bones, logical maps of network organization and hierarchy, social maps showing the relationships between individual users in virtual worlds, hierarchy trees of web page design, world maps from 3-d shooters, etc. While some of the visualizations, designed to shock and awe through their graphical sophistication, have become curious artifacts in their own right, almost like a first generation iPod, harkening back to simpler times, the book itself promises not to disappoint. The good news is that it has been re-released under a Creative Commons license and can be downloaded here. There is a 20MB low-res version and a 200+MB high-res version.

Arpanet’s geographical configuration, 1975

Submarine fiber optic cables in the Caribbean

“Great Circle” map designed as a bit of marketing ephemera for the Cable and Wireless Company, showing the global connectivity of its telecommunications network, with Britain centered representing its position as “hub of the world”, 1945

The huge and dense mesh of connections shows the social geography of LambdaMOO, a multi-user dimension, by mapping how over half of the 4,800 or so players related to each other. LambdaMOO was a well-established and well-known virtual environment created at Xerox PARC in 1990. The map was created using social statistics gathered by Cobot, a software agent that “lived” in LambdaMOO, sitting in the “living room” and observing the social interactions of players. 2000

]]> http://blog.refractal.org/2008/10/23/along-what-dimension-is-cyberspace/feed/ Discrete circuits; or, Trojan architecture http://blog.refractal.org/2008/10/23/discrete-circuits-or-trojan-architecture/ http://blog.refractal.org/2008/10/23/discrete-circuits-or-trojan-architecture/#comments Thu, 23 Oct 2008 20:19:04 +0000 marc http://blog.refractal.org/?p=521 IEEE Spectrum published an article this past May about the growing concern within defense circles about the loss of oversight along the military hardware supply chain. With many of the semiconductor components manufactured in the People’s Republic of China, rumors and fears of maliciously implanted “backdoors” abound:

According to a U.S. defense contractor who spoke on condition of anonymity, a “European chip maker” recently built into its microprocessors a kill switch that could be accessed remotely. French defense contractors have used the chips in military equipment, the contractor told IEEE Spectrum. If in the future the equipment fell into hostile hands, “the French wanted a way to disable that circuit,” he said. Spectrum could not confirm this account independently, but spirited discussion about it among researchers and another defense contractor last summer at a military research conference reveals a lot about the fever dreams plaguing the U.S. Department of Defense (DOD)…

Vetting a chip with a hidden agenda can’t be all that tough, right? Wrong. Although commercial chip makers routinely and exhaustively test chips with hundreds of millions of logic gates, they can’t afford to inspect everything. So instead they focus on how well the chip performs specific functions. For a microprocessor destined for use in a cellphone, for instance, the chip maker will check to see whether all the phone’s various functions work. Any extraneous circuitry that doesn’t interfere with the chip’s normal functions won’t show up in these tests…

Nor can chip makers afford to test every chip. From a batch of thousands, technicians select a single chip for physical inspection, assuming that the manufacturing process has yielded essentially identical devices. They then laboriously grind away a thin layer of the chip, put the chip into a scanning electron microscope, and then take a picture of it, repeating the process until every layer of the chip has been imaged. Even here, spotting a tiny discrepancy amid a chip’s many layers and millions or billions of transistors is a fantastically difficult task, and the chip is destroyed in the process…

The Pentagon is now caught in a bind. It likes the cheap, cutting-edge devices emerging from commercial foundries and the regular leaps in IC performance the commercial sector is known for. But with those improvements comes the potential for sabotage. “The economy is globalized, but defense is not globalized,” says Coleman. “How do you reconcile the two?” [link]

With respect to recent news pertaining to electronic security and surveillance see also:

]]> http://blog.refractal.org/2008/10/23/discrete-circuits-or-trojan-architecture/feed/ Dreaming of the future at 11km per second http://blog.refractal.org/2008/10/22/dreaming-of-the-future-at-11km-per-second/ http://blog.refractal.org/2008/10/22/dreaming-of-the-future-at-11km-per-second/#comments Wed, 22 Oct 2008 15:30:53 +0000 marc http://blog.refractal.org/?p=505

India launched its first unmanned moon mission on Wednesday following in the footsteps of rival China, as the emerging Asian power celebrated its space ambitions and scientific prowess.

Chandrayaan-1 (Moon vehicle), a cuboid spacecraft built by the Indian Space Research Organisation (ISRO) blasted off from a southern Indian space centre shortly after dawn in a boost for the country’s ambitions to gain more global space business.

The project cost $79m, considerably less than the Chinese and Japanese probes in 2007 and ISRO says the moon mission will pave the way for India to claim a bigger chunk of the global space business.

The mission is also expected to carry out a detailed survey of the moon to look for precious metals and water.

Fresh on the steps of the confidence that comes to any nation that can launch a few thousand pounds of metal faster than the 11km/s velocity needed to escape the earth’s gravitational pull on towards the moon is the Indian culture industry. To be released this summer is what seems to be a Bollywood take on the intense, high budget, the future is now Hollywood sci-fi film.

But what would even the most Doc Brown, cyberpunk metropolis be with out an appropriate measure of dance sequences? (Answer? something to be rewritten with more song and dance sequences)

]]> http://blog.refractal.org/2008/10/22/dreaming-of-the-future-at-11km-per-second/feed/