Technology

Last night while looking for something else, I came across my copy of the September 1996 issue of Internet Underground, a short-lived glossy magazine promoting interesting things on the Internet. This issue featured an article I wrote for them about skepticism on the Internet, which I present for your enjoyment below. If I had to update it today, I’d need to add information about blogs (like Science Blogs), podcasts, and various online forums that have come into existence in the last eleven and a half years or so (including IIDB, its offshoots like Freethought Forum and Heathen Hangout, and skeptical forums like those of the James Randi Educational Foundation and Richard Dawkins), but everything I described below is still around, despite some name and domain changes (I’ve updated the links) and diminishing significance of Usenet. I’m not sure how I missed the Skeptics Dictionary or Snopes.com, which were both around at the time. You can see a PDF of the article in its original format here. 403 Forbidden: Skeptics Seek the Cold Hard Truth By Jim LippardThe Internet is a place where world views collide. Christianity meets atheist, conventional wisdom meets conspiracy theory, fringe belief meets orthodox science. While most Usenet newsgroups promote particular views and are populated mostly by their purveyors, the critics make up the majority on sci.skeptic. These critics who refer to themselves as “skeptics” have only a tenuous connection to the skepticism of the ancient Greeks, such as Pyrrho, who denied the possibility of knowledge of any kind. Instead, they tend to hold that while knowledge is quite possible, it must be grounded in scientific inquiry and rational investigation. Doubt is valued as a means to reliable knowledge rather than an end in itself. Skeptics often share an interest in the unusual, bizarre, and the seemingly impossible with the denizens of newsgroups such as alt.paranormal, alt.astrology, alt.alien.visitors, and alt.forteana.misc. There are plenty of fans of The X-Files to be found among skeptics. Where skeptics differ from “believers” is with regard to what are acceptable standards of evidence and what constitutes reasonable methods of investigation. A commonly touted skeptical aphorism is “Extraordinary claims require extraordinary evidence,” and testimonials, feelings and handwaving are not considered extraordinary enough to carry the weight. ...

In January 2008 the film “Untraceable," starring Diane Lane, will be released. It looks awful. The premise is that a serial killer is killing people live on the Internet, via an “untraceable website” that is connected to contraptions that kill his victims as more people visit the site. The whole concept of an “untraceable website” or the idea that such a thing would be unstoppable by ISPs and law enforcement is absurd–the immediate upstream provider of the site would merely need to null route the IP address(es) where the website is hosted, and traffic stops. They’d also be able to quickly identify the customer who owns the server in question. Even if that server was compromised and being used to reverse proxy or redirect traffic to other servers, it would still be a relatively simple matter to track that backwards, though it would be somewhat more difficult than stopping the traffic. Even if the domain name pointed to a new server on a compromised host every second, it would still be possible to contact the domain name registrar and get the domain name shut down. If users can get to it, it can be seen how and what they’re getting to, even if that’s only the front end in a chain of successive proxies. If it has a domain name, that provides another path to shutting off access. UPDATE (January 2, 2008): I came across the script online while searching for information about the writers. Let’s just say that my opinion above is not nearly negative enough. In the first 16 pages are at least six or seven scenes that really bring on the stupid. For example, FBI Agent Jennifer Marsh, who works in the FBI’s cyber division, is monitoring machines that are being compromised by hackers (honeypots, essentially, though the script doesn’t use the word). One of her machines gets compromised and she sees that it copies her files including fake financial information. It then accesses eBay to use a stolen credit card to purchase a watch. In reality, the stolen financial information wouldn’t be likely to be used from the same machine, it would be sold to another player in the underground economy. Marsh then types commands to look for the IP address of the connecting host–but if they’ve already got honeypots or honeynets in operation, that should already be logged. She then does the usual CSI-style conversion of an IP address into a name and address without issuing a subpoena to an ISP, and discovers that it’s a home belonging to a 56-year-old woman. She immediately concludes that the actual criminal must be a neighbor using her wireless connection, despite the fact that she has no evidence that the woman has a wireless access point and isn’t just another victim with a compromised machine being used as a proxy. Without doing any more verification, she arranges to get a warrant to knock the door of the neighbor down, and it turns out to be a teenage kid. On p. 16 appears this nice quote: “She types several commands into a unix shell. Trace routing algorithms begin to run. A different screen shows possible IP addresses. The list begins growing, from ten to hundreds to thousands…. Marsh shakes her head at the futility.” There are multiple methods of performing traceroutes and even of adding fake hops to a traceroute, but traceroute is unnecessary to find out the IP address of a website–it’s only useful for finding the path traffic takes to get to that website, e.g., for finding the upstream provider. But getting a list of upstream providers is better done by looking at routing tables rather than doing traceroutes, anyway. The real investigative steps would be to look at the DNS information for the domain, get the IP address or addresses from the authoritative name server (and check to see if those are changing with a short TTL), then find the upstream providers. Funniest exchange I’ve seen so far in the script (p. 26) is this marvel of self-contradiction: [FBI agent] GRIFFIN: I traced it to a Georgetown sophomore named Andrew Kinross. But then I looked closer and saw the post didn’t actually originate from his computer. MARSH: Our guy got into his computer and posted it from there. GRIFFIN: That would be my guess. MARSH: So let’s go after the originating computer’s IP. And so far, I’ve not mentioned how the hacker mastermind hacks into the FBI agent’s car (which features the fictional “NorthStar” instead “OnStar”)–in the preview, the hacker apparently is able to control the steering of her car. I suspect drive-by-wire steering will come soon in the future of the automobile, but I don’t believe it exists today. (Turns out the preview gives a misleading impression of what the script says is happening–the hacker doesn’t actually control the steering, but remotely shuts off the car’s electrical systems and power steering.) ...

Some nice high-definition video images have been taken by the Japanese lunar orbiter “Kaguya," showing the earth setting behind the moon’s surface.

The full source code to the last official release of the Multics operating system has been released to the general public (though full source was always made available to all customers, except for specific “unbundled” applications). Multics, the predecessor system to Unix (and in a number of ways still its superior), was a general purpose commercial operating system best known for its security. That release, Multics MR12.5 (MR = “Multics Release”), was released to customers in November 1992. The last Multics system was shut down in 2000. The software can be downloaded from a website at MIT, though it requires specialized hardware to run on, so don’t expect to be able to run it. My name appears a few times throughout the software, as I worked as a Multics software developer from 1983 to 1988. The MIT site incorrectly states that Multics development was ended by Bull in 1985–that may have been the time when Bull decided to pull the plug, but there was still development (though primarily bug fixing) going on in 1988 when I left. One of the pieces I wrote was a rewrite of the interactive message facility, in some ways a predecessor of instant messaging (except that it operated on a single timesharing host rather than over a network between hosts). Most of the software is in the “ldd” hierarchy (for library directory directory, the directory of directories of libraries). The software is in Multics “archive” format which is similar to Unix tar files. The message facility software is in /ldd/sss/source/bound_msg_facility_.s.archive. Kudos to Group Bull, the copyright holder of Multics, for making the software open source. Bull purchased Multics as part of its acquisition of Honeywell’s Large Computer Products Division in the mid-eighties. ...

Tom Ptacek at Matasano Chargen has a rundown on the new security features in Mac OS X Leopard, which are still not quite up to snuff with what’s in Windows Vista or OpenBSD. Here’s a followup with more details.

From metafilter: When Ron Paul email spam started hitting inboxes in late October, UAB Computer Forensics Director Gary Warner published findings on the spam’s textual patterns and the illicit botnet used to spread it – findings which were picked up by media outlets and tech websites like Salon, Ars Technica, and Wired Magazine’s “Threat Level” blog, the latter in a set of followup posts by writer Sarah Stirland: 1, 2, 3. The Ron Paul fan response was swift and decisive: clearly the botnet was the work of anti-Ron Paul hackers trying to discredit his campaign, and Rudy Giuliani had paid Stirland (and not UAB Computer Forensics) to do a smear piece – as claimed by a YouTube video pointing to posts on RudyGiulianiForum.com. Thus proving, once again, that the Ron Paul campaign’s greatest liability is not so much his far-right conspiracy-driven antifederal libertarianism, but rather the spittle-flecked anger of his own noisiest supporters.There are definitely a lot of nuts among Ron Paul’s supporters. Meanwhile, he raised $3.8 million yesterday (apparently a number revised downward from $4.3 million) in the largest one-day online political fundraiser ever. Intrade currently shows Paul as the third most likely GOP nominee, after Giuliani and Romney. A few other Ron Paul-related blog posts that I realize I’ve neglected to mention here, from Dispatches from the Culture Wars: “Is Ron Paul a Dominionist?" Argues that Paul appears to have much in common with some theocrats. “Sandefur on Ron Paul” Doubts that Paul is a dominionist, but suggests he might be a Thomas DiLorenzo-style neo-confederate who thinks we don’t even need a federal government (in which case he wouldn’t really be the supporter of the Constitution that he seems to be) and that the U.S. Civil War wasn’t about slavery (which is pernicious nonsense). I also just came across this story, which says that Paul would like to see the U.S. Constitution amended to remove the subject of abortion from the purview of the courts, which is yet more anti-constitutional insanity. ...

The Register (UK) reports that C I Host, a webhosting provider, has now had a fourth break-in at its Chicago colocation facility. Someone cut through a wall with a saw and stole customer equipment (and the DVRs or tape recording devices for the CCTV system). C I Host apparently took days to inform its customers of the break-in, and some have voiced suspicions that it was an inside job. UPDATE (February 4, 2007): There was some followup discussion.

Friedrich Kirschner has built a device to make 3D image scans of objects placed in a small plastic container, using a webcam and a platform built of Legos, and some milk. (Hat tip to Dave Palmer on the SKEPTIC list.)

A hacker has found a flaw in Adobe’s PDF file format which can be used to exploit Adobe Reader 8.1 on Windows XP. Dave G. at the Matasano Chargen blog predicts that such attacks–targeting popular applications–will become more common. PDF in particular is a likely target due to its ubiquity and its complexity.

Boston authorities have filed another set of bogus “hoax device” charges, against Star Simpson, a 19-year-old MIT student who was wearing a sweatshirt with a homemade electronic nametag stuck to the front of it. The device was made of a breadboard with LEDs and a 9V battery, and Simpson was also holding “a lump of putty” in her hands, as she was waiting at Logan airport for a friend’s flight to arrive. She explained that she made the device for career day because she wanted to stand out. She was released on $750 bail and will have to appear in court on October 29 on charges of “possessing a hoax device." The Boston Globe’s article says: ...