From the where the fuck is it? file
On Mar 24, 2004 Bill Gates, Microsoft Chairman and Chief Software Architect,
has just officially unveiled Windows Mobile 2003 Second Edition at his
company's Mobile Developer Conference. I have been waiting for it from HP
for quite a while. I would like to have this by defcon rolls around so I can
switch from DVD to GPS without moving the display.
Check out http://www.brighthand.com/article/Overview_of_Windows_Mobile_20
03_SE?site=PPC for a lookie at this new update.

I am sure Patrick Norton is still going to come but remember:

This marks the third year we will be doing the Cannonball Run. On this site
you can find out 'what exactly is the DEFCON Cannonball Run?', 'when will it
occur?', 'where will this happen?', 'why would anyone do this?' or you can
find out how to help out...
This year we will be adding new features to the Defcon Cannonball Run. One
new feature we will be adding is organization. I promise that this year will
run a little more smooth. The car accident before the race didn't help
matters.

We will also have live updates on a video map of everyones positions as well
as an interviewer to capture race watchers comments and heckles.

If you or someone you know would like to volunteer for this years event,
please email cannonball-at-moloch.org , as always I promise a t-shirt for
people who help out.

People who are intersted who need more info can email
cannonball-at-moloch.org.

The race is set to start Thursday July 29th 2004 with the fist car leaving
at 11:00 AM.
We will start in Redondo Beach and arrive yet again at the Alexis Park Hotel
in Las Vegas, Nevada. There are no rules pertaining how fast you travel,
radar detectors, police lights, CB Radios or any other devices. The only
rules are that you are attending Defcon and that all cars will be starting a
few minutes apart from each other. We have yet to have someone die doing
this yet, lets keep it that way.

Don't forget video cameras! If you need help in ways of capturing your race,
let me know but I want to create another great DVD for everyone this year.

Symantec Client Firewall Remote Access and Denial of Service Issues
Symantec Security Advisory

SYM04-008

12 May, 2004

Symantec Client Firewall Remote Access and Denial of Service Issues

Revision History
None

Risk Impact
High

Overview
eEye Digital Security notified Symantec Corporation of four vulnerability
issues they discovered in the Symantec Client Firewall products for
Windows. By properly exploiting these issues, an attacker could render the
targeted system inoperable or execute remote code with kernel-level
privileges on the targeted system.

Affected Components

Consumer
Symantec Norton Internet Security and Professional 2002, 2003, 2004
Symantec Norton Personal Firewall 2002, 2003, 2004
Symantec Norton AntiSpam 2004

Corporate
Symantec Client Firewall 5.01, 5.1.1
Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)

Details
eEye Digital Security notified Symantec of four vulnerabilities they
discovered during product testing on versions of Symantec's client
firewall application. eEye Digital Security found three instances where
remote KERNEL-level access could potentially be gained. Additionally,
they reported a denial of service (DoS) issue that requires a system
reboot to regain system utilization.

All issues occur within routines in the SYMDNS.SYS component.

The first issue is a stack overflow in the processing of DNS responses
caused by improper bounds checking of external input. Successful
exploitation of this issue could result in remote code execution on the
targeted system with kernel-level privileges.

The second issue is a stack overflow in the processing of NetBIOS Name
Service responses that can result in a memory overwrite. If an attacker
could successfully create the conditions required to manipulate this
vulnerability they could potentially execute arbitrary code with
kernel-level privileges.

The third remote execution issue is a potential heap corruption problem
caused by improper bounds checking in the processing of NetBIOS Name
Service responses. If an attacker were to successfully exploit this
condition, they could possibly execute arbitrary code on the targeted
system with kernel-level privileges.

The forth issue is a potential DoS condition caused by improper handling
of DNS response packets. Maliciously configured DNS responses can cause
the targeted system to halt requiring a system reboot to clear the
condition and regain system access.

Symantec Response
Symantec confirmed the vulnerabilities exist in the consumer and corporate
Symantec Client Firewall applications as well as in Symantec's Norton
AntiSpam 2004 application. Symantec product engineers have developed
fixes for the issues and released patches for all impacted products
through Symantec LiveUpdate and technical support channels.

Clients running consumer versions of the affected products who regularly
run a manual Symantec LiveUpdate should already be protected against this
issue. However, to be sure they are fully protected, customers should
manually run Symantec LiveUpdate to ensure all available updates are
installed.
* Open any installed Symantec product
* Click on LiveUpdate in the toolbar
* Run LiveUpdate until Symantec LiveUpdate indicated that all installed
Symantec products are up-to-date
* Depending on the application, system may require a reboot to effectively
update available fixes.

Clients running the corporate versions of Symantec Client Firewall or
Symantec Client Security should download and apply patches obtained
through their appropriate support channels.

Symantec is not aware of any active attempts against or customer impact
from this issue.

CVE

The Common Vulnerabilities and Exposures (CVE) initiative has assigned
Candidate names to these issues.
Issues one, two and three are assigned under CVE Candidate Name,
CAN-2004-0444

The fourth issue, the Denial of Service in NetBIOS Name Service is
assigned CVE Candidate Name, CAN 2004-0445

These are candidates for inclusion in the CVE list (http://cve.mitre.org),
which standardizes names for security problems.

Credit:
Symantec appreciates the cooperation of the eEye Digital Security research
team in identifying this issue.

Symantec Product Security Contact:
Symantec takes the security and proper functionality of its products very
seriously. As founding members in the Organization for Internet Safety,
Symantec follows the process of responsible disclosure. Symantec also
subscribes to the vulnerability guidelines outlined by the National
Infrastructure Advisory Council (NIAC). Please contact
secure@symantec.com if you feel you have discovered a potential or actual
security issue with a Symantec product.

Symantec strongly recommends using encrypted email for reporting
vulnerability information to secure@symantec.com. The Symantec Product
Security PGP key can be obtained here.

This advisory is available on-line at
http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html

Google Unveils Redesigned Blogger.com
Mon May 10, 2004 11:43 AM ET

SAN FRANCISCO (Reuters) - Google Inc., the No. 1 Web search company that recently announced plans to go public through a Dutch auction, on Monday rolled out a new design of its Blogger service that enables users to self-publish Web content.

The latest version of the free product allows users to instantly publish their Weblogs, or personal journals called "blogs," from any e-mail-enabled device, including cellular phones and handheld devices. Other new features also enable Blogger users to invite comment from readers or to post personal profiles.

Mountain View, California-based Google acquired Blogger via its purchase of Pyra Labs in 2003. Google gets nearly all of its revenue from keyword ads generated by Web searches and the content on Web sites.

The company's $2.7 billion initial public offering is expected to be one of the hottest in years, with some analysts expecting the flotation to value the company at anywhere from $30 billion to $50 billion.
Internet News Article | Reuters.com

Sexual Predator Will Be Released in Vacaville
And Hackers get jailed for how long?

Over strident objections from community members, a judge has approved the release of a serial rapist to his wife's home in Vacaville.

A Marin County Superior Court judge approved the relase of Ghilotti late Wednesday afternoon. Now all that remains is for Ghilotti and his attorney to approve the release plan. It is not clear how soon the confessed rapist could arrive in Vacaville.

Under current state law, a sexual offender who has completed his prison term and undergone rehabilitation is eligible for release. Ghilotti's course of treatment at the state mental hospital included counseling for sexual predators as well as surgical castration.

Ghilotti has served time for four violent rapes in Marin County and admitted to six others. Ghilotti's wife lives on a cul de sac in central Vacaville, and a judge chose that as the place where he will live when he is released from the Atascadero State Hospital.

Neighbors and the Vacaville Police Department vehemently opposed the release of Ghilotti locating to the Solano County town. 'Him living across the street puts us in danger, puts our neighborhood in danger,' said resident Kari Chavez.

Residents have put up signs to make it clear that Ghilotti is not welcome in their neighborhood.

When released, Ghilotti will be fitted with a GPS tracking device to enable local police to monitor his whereabouts.

Ghilotti is the third person to be released from the state's Violent Sexual Predators Program. The earlier releases of Cary Verse and Brian Devries drew angry protests. Community pressure forced Verse to be moved from Marin County to two different locations in Alameda County and finally to Santa Clara County. Devries encountered similar pressure, and is now living in a trailer on prison property."
Sexual Predator Will Be Released in Vacaville

FBI investigates underground tunnel requests
Student interrogated after filing FOIA request with UT

Mark Miller had slept three hours in his parked car after a long night at an anime festival in a downtown hotel.
Then, the call. A number and a voice he didn't know.
"Hey Mark, we're at your dorm," the voice said. "We want to talk with you."
"Who are you?" asked Miller, a physics freshman.
"Law enforcement."
Two men met him in the hotel lobby and flashed badges: FBI. Secret Service. The questions began.
"Do you belong to any student activist organizations?"
"Have you ever thought of joining any student activist organizations, like UT Watch?"

He wasn't an activist. Nor a suspect or the messenger of a bomb threat, for that matter.

What interested the agents, from Austin's Joint Terrorism Task Force, was an open records request he filed with UT administrators for information about the underground campus tunnel system.

"The point was to see if there was any type of a threat to campus or public safety due to the nature of the information being sought," said Mark Rich, a special agent in the FBI San Antonio field office. "I don't think it had anything to do with the fact that a records request was made. It was what the request involved."

A network of underground utility tunnels connects campus buildings to provide water, steam, coaxial tables, compressed air and fiber optics. Miller was curious about the dimensions of the network. He said a physical plant official told him such details were secret "because of 9-11."

So he filed the request Dec. 16, 2003. Agents called him Jan. 30, 2004.

John Jones, the Secret Service agent who questioned Miller, called the matter an "ongoing investigation" and would not comment.

Rich, of the FBI, said the investigation won't be closed until the task force determines Miller's request is no terrorism threat.

"The question is how did the FOI act request get from [Miller] to the Joint Terrorism Task Force, and how did the Joint Terrorism Task Force find out about it?" said Edna Perry, special agent-in-charge of the Austin Secret Service office.

UT officials don't have a certain answer to that question.

Patricia Ohlendorf, vice president for legal affairs, said federal agents had visited campus to assess terrorism vulnerabilities as part of the University's argument against disclosing the tunnel plans.

"I'm sure, that's how they found out about the public information request," she said. "I think their activities are totally separate from ours."

She didn't know that agents questioned Miller. UT President Larry Faulkner, who met with Ohlendorf to decide to withhold the records, also said he wasn't aware of the investigation. UT open records coordinator Annela Lopez would not comment.

Miller said the agents wanted to know everything from his major to why he wears long hair.

They asked, how did he know open records laws? How did he know about campus tunnel systems? Did he ever think of joining UT Watch or filing a lawsuit through the American Civil Liberties Union?

"What disturbed me was the fact, that they went on for about 10 minutes asking me if I belonged to things like UT Watch. Anything to overthrow the government," Miller said. "They used the term 'activist organization.' Any stuff like that."

He said he had no luck visiting the Austin Secret Service office to ask what information on him had been collected. He also filed an open records request for this information with the FBI. It was denied.

"The next step is, of course, to file a FOIA request for the 'zero file' generated from the investigation of why I submitted an open records request. Good irony," Miller wrote Feb. 1 in his online journal, which includes entries on the 10 or more requests he has filed with the University.

He sought information about contracts to provide Internet service in dormitories and to install Webcams in classrooms. While not a member of UT Watch, he contributed to the group's security cameras Web page.

"In a way, it's flattering [that agents mentioned UT Watch]. In another way its kind of disturbing," said group member Nick Schwellenbach. "If UT or the FBI wants to investigate someone who wants to find out about the steam tunnels, in a way, it's overreacting."

n a Feb. 25 ruling, Attorney General Greg Abbott agreed with the University that the tunnel plans are exempt under HB 9, the homeland security bill that also closed access to campus surveillance camera locations The Daily Texan requested.

Faulkner said protecting the tunnel plans is more important than protecting surveillance information.

"I think there's a relation," Faulkner said. "This is actually a more serious question than the security cameras."

Suzy Woodford of the open government group Common Cause Texas lobbied against the security exemptions in HB 9. She said the task force investigation stepped on Miller's civil rights.

"Without a subpoena, without any clear evidence that this person is up to no good, I think this is chilling, and this could have a very adverse impact on people who are requesting information," Woodford said.

Questioning an open records requester is not usual for agents, said Perry, of the Secret Service. She said she didn't learn about the investigation until Miller showed up at the agency's office.

"It would not be normal for us in this office, but [Jones] is not assigned to this office," she said. "The Joint Terrorism Task Force probably would look into something like that. [Miller] could be a terrorist. He could be planning a plot."
FBI investigates underground tunnel requests - The Daily Texan