March 2001 - cypherpunks-legacy

Join Shopping & Investing Club...
by Specialty Online Sales 22 Mar '01

22 Mar '01

This is not Junk Mail. See our Anti-Spam Alert below... This is an invitation for you to review the newest concepts in both Shopping and Investing. Visit our web site at http://specialtysalesonline.com/cgi-bin/redirect.cgi?52616e646f6d4956db91cc… and review these concepts to see if they fit into your style. Click on the link to seamlessly explore. SHOPPING: Each month SpecialtyOnlineSales.com will present a category of products (usually four to six items), direct from the manufacturer to you. There will be a limited quantity of these items available for a limited time. You can review and make a selection by clicking onto our store at Yahoo.com. Your purchase will be shipped directly to your home or office. Then, each month, we will send you an e-mail itemizing the newest selections. INVESTING: Are you an online investor? Do you want to gain an edge on the big boys? SpecialtyOnlineSales.com is a clearinghouse for an Investing Consortium. You still do all of your own investing and handle all of your own money, but you do it in consort with many other club members. SOS2001.net is a consortium of independent traders interested in maximizing their investment potential by acting as a collective block. Volume of trading can influence price and subsequent participation. Click on our site to review this newest concept. ANTI-SPAM ALERT: This e-mail invitation was sent to you because at some time you opted-into a list and asked to receive information on special offers. If this e-mail is not acceptable to you, please reply by clicking the link below and we will remove you immediately from any further mailings. Click here: http://sos2001.net/cgi-bin/optout.cgi?52616e646f6d4956db91cc7c7fe475e35e552…

1 0

What the Founding Fathers wanted
by Jim Choate 22 Mar '01

22 Mar '01

The intent of the founding fathers was not to put ourselves in the place of the them. It was a much harder and more rewarding road, To understand the philosophy and process of Americal democracy. We have failed. ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

The Law & Courts
by Jim Choate 22 Mar '01

22 Mar '01

I believe the last couple of days with two lawyers and a couple of wanna be's clearly demonstrate the primary problem of todays judicial system. The courts are not concerned with The Law, they are concerned with their continued existance. This is exemplified by lawyers making reference to 'precedence' instead of 'the law' (ie a codified set of laws that are applicable to all). It's supposed to be 'equal protection under the law', not 'equal protection by the courts'. A court <> the law. ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CNN.com - Charles Bierbauer: Supreme Court rulings on unlawful searches, arbitration, and pension benefits - March 21, 2001
by Jim Choate 21 Mar '01

21 Mar '01

Note Scalia's vote... http://www.cnn.com/2001/LAW/03/21/bierbauer.debrief/ -- ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Inferno: Fw: Opening the Border for FTAA (fwd)
by Jim Choate 21 Mar '01

21 Mar '01

---------- Forwarded message ---------- Date: Wed, 21 Mar 2001 20:54:23 -0500 From: Any Mouse the regional convergence towards Quebec is audible... ----- Original Message ----- From: "moose" <moose000(a)earthlink.net> To: "* Anti IMF" <antiimf2000(a)yahoogroups.com>; "* AAC" <aac(a)lists.tao.ca>; "* Yaba East" <yabastaeast(a)topica.com>; "* Bay Area DAN" <bayareadan(a)yahoogroups.com>; "* Buffalo FTAA" <a20buffalo-subscribe(a)yahoogroups.com> Sent: Wednesday, March 21, 2001 1:38 PM Subject: Opening the Border for FTAA > Opening the Border for FTAA > by CARLYN ZWARENSTEIN 11:27am Tue Mar 20 '01 > > Americans coming north to protest free trade > talks in Quebec City next month will find the > border open, if Shawn Brant has his way. > > > A Mohawk from the community of Tyendinaga and an > organizer with the > Ontario Coalition Against Poverty (OCAP), Brant will take > part in a plan to > open the international border near Cornwall, Ont., on the > weekend of the > Free Trade Agreement of the Americas talks in Quebec City > (April 20-22).The > border cuts through the Mohawk territory of Akwesasne, which > overlaps > Ontario, Quebec and the United States. > > "My motivation is to assert and reinforce the > sovereign integrity > of Mohawk people within the Mohawk nation and to bring the > organizing > bodies together so we can stand and fight in preparation for > the fall," he > says, referring to a series of actions with which OCAP and > allied groups > plan to confront the Ontario government. "We will engage in > attacks against > the provincial economy, the provincial infrastructure. We > will shut down > highways, roadways, bridges until this government is brought > to its knees." > > As Brant describes it, people will assemble in > Cornwall on April 19 > and then move into Akwesasne, while supporters from the US > will gather on > the American side of the border. And then? > > "The Mohawks of Akwesasne will have pre-secured the > bridge," says > Brant, though he is reluctant to go into details. "That's > probably > something that wouldn't be best to publish, tactically," he > says. "We are > preparing for every possible scenario. Certainly an > aggressive stand by the > state would not stop us from pursuing our objective -- we'll > respond to > force with force and to opposition with opposition." > > Meanwhile, OCAP is forming networks with Mohawk > communities in the > area. A recent OCAP tour raised interest among Oneida, > Cayuga and Seneca > communities south of the border. > > The action has been endorsed by the Cornwall Labour > Council (CLC), > the Kingston-based People's Community Union (PCU) and > members of the Mohawk > communities of Akwesasne and Kahnawake. The CLC has sent > letters to the > elected leadership in Akwesasne, requesting their support. > > Brant maintains that although some members of the > Akwesasne Mohawk > community may oppose a potentially explosive action, none > oppose opening > the border. "The border is a barrier to community life in > Akwesasne," says > Brant, who must submit to car searches and ID checks at > Customs in order to > visit relatives who live in the same Mohawk territory, but > across the > border. "It is the right of the Mohawk nation to determine > who can cross > the border," he adds. > > According to Darren Bonaparte, the Akwesasne author > of A Line on a > Map: A Mohawk Perspective on the International Border at > Akwesasne, the > Mohawks have had a love-hate relationship with the border > over the years. > During Prohibition it provided opportunity for illegal > profit through > alcohol trading, and more recently cigarettes and foreign > nationals have > illicitly traveled north and south, respectively. > > The border action was news to Canada Customs > spokesperson Collette > Gentes-Hawn. "Have we been officially notified?" she asks. > Still, she's not > surprised. "This wouldn't be the first time there are > demonstrations on > this bridge," she adds, noting that a court case relating to > the border is > outstanding. The case, launched by Grand Chief Mike Mitchell > and the Mohawk > Council, alleges that the feds knew about cigarette > smuggling across the > border, but used the Mohawks as scapegoats rather than > acting against the > tobacco industry. > > According to Brant, the action is really about the > free-trade-friendly policies of the Ontario government, > which are of > concern to poor people and First Nations alike: "[Free > trade] does > everything to help corporations, and absolutely shit to help > people in > poverty." > > > >

1 0

Fw: Hacker Uses Forbes List to Steal
by Carlos Macedo Gomes 21 Mar '01

21 Mar '01

----- Original Message ----- To: <reclaimthestreets(a)listbot.com> Sent: Wednesday, March 21, 2001 6:34 PM Subject: Hacker Uses Forbes List to Steal > Reclaim the Streets NYC - http://reclaimthestreetsnyc.tao.ca > > --------------------------- ListBot Sponsor -------------------------- > Build a marketing database and send targeted HTML and text e-mail > newsletters > to your customers with List Builder. > http://www.listbuilder.com > ---------------------------------------------------------------------- > > > > > >Hacker Uses Forbes List to Steal > > > > > >By THE ASSOCIATED PRESS > > > > > > > >Filed at 8:46 p.m. ET > > > > > > > >NEW YORK (AP) -- A restaurant busboy is accused of using the > >Internet and Forbes' list of the richest people in America in a > >scheme to steal millions from such figures as Steven Spielberg, > >Warren Buffett, Martha Stewart, Oprah Winfrey, Ross Perot and Ted > >Turner. > > > >Police are calling it one of the most ambitious identify-theft > >schemes they have seen. They are still tracing the complex > >electronic trail to determine exactly how much was stolen, but fear > >it could be well into the millions. > > > >New York police investigators arrested Abraham Abdallah, a > >32-year-old high school dropout, on March 7 as he allegedly picked > >up equipment to make phony credit cards. > > > >Court papers say Abdallah was carrying the Social Security numbers, > >home addresses and birth dates of 217 CEOs, celebrities and > >tycoons. The information was scribbled in the margins of a tattered > >copy of Forbes' ``The 400 Richest People in America.'' > > > >Abdallah, police say, also had more than 400 stolen credit card > >numbers, including some that were used to buy about $100,000 of > >dollars of computer equipment and gold coins. > > > >``All those people ... have not been compromised,'' said Chief of > >Detectives William Allee, referring to the Forbes 400. ``The ones > >we believe have been compromised, we've contacted.'' > > > >Abdallah, charged with multiple counts of criminal impersonation, > >forgery and fraud, is being held on $1 million bail. Authorities > >said he has a long record of arrests for various schemes, and at > >the time of his arrest was on supervised release for a federal bank > >fraud conviction. He once even appeared as an ``expert'' on a > >training video on fraud prevention prepared for credit card > >companies. > > > >Defense attorney Sam Gregory said Abdallah is innocent. Prosecutors > >``made an unfair leap from possession of this information to an > >inference that there was an attempt to take money,'' said Gregory, > >who declined further comment. > > > >Police Commissioner Bernard Kerik described Abdallah as ``someone > >who was very innovative, very creative. ... He didn't try to pry. > >He was very organized. He would go one step at a time to build his > >database.'' > > > >The alleged scheme was uncovered when an e-mail request to transfer > >$10 million from a Merrill Lynch account belonging to Thomas > >Siebel, founder of Siebel Systems, raised red flags, police said. > > > >Siebel said he never made the request and Merrill Lynch contacted > >authorities. > > > >The trail of evidence led police to mailboxes rented by Abdallah > >under the names of Paul Allen, co-founder of Microsoft, and James > >Cayne, head of Bear Stearns, court papers said. He allegedly used > >the addresses to order merchandise using their credit card numbers. > > > >A spokesman for Allen said the businessman was cooperating with > >authorities. Turner, media mogul Michael Bloomberg and Spielberg > >were unaware that their identities may have been stolen, > >representatives said. Cayne, Perot, Winfrey, Buffet and Stewart > >declined comment. > > > >A spokeswoman for George Lucas said the movie producer had not been > >affected by alleged scam. > > > >Investigators say Abdallah used computers at a local library, > >Web-enabled cell phones and virtual voicemail during a six-month > >scam that involved duping credit reporting companies such as > >Equifax into providing reports on his rich victims. > > > >He allegedly used the data to gain access to credit cards and > >accounts at brokerage houses such as Goldman Sachs, Bear Stearns > >and Merrill Lynch. > > > >Equifax said it had no evidence of fraudulent access to its files, > >and had not yet been contacted by authorities. > > > >Experts said the case was a glaring example of how access to > >private data on the Internet has helped make identity fraud one of > >the fastest growing white-collar crimes. > > > >Martin Biegelman, a former Postal Service inspector, recalled using > >Abdallah to make the training video as part of a plea deal in the > >mid-1980s. > > > >``He agreed to go on camera as a reformed criminal,'' Biegelman > >said. ``He was talking about fraud, how easy it was. ... He said he > >wasn't going to do it again.'' > > > >http://www.nytimes.com/aponline/business/AP-Forbes-List-Hacker.html?searchp… online?ex=986212427&ei=1&en=78f1197e591527ee > > > >/-----------------------------------------------------------------\ > > > > > >Visit NYTimes.com for complete access to the > >most authoritative news coverage on the Web, > >updated throughout the day. > > > >Become a member today! It's free! > > > >http://www.nytimes.com?eta > > > > > >\-----------------------------------------------------------------/ > > > >HOW TO ADVERTISE > >--------------------------------- > >For information on advertising in e-mail newsletters > >or other creative advertising opportunities with The > >New York Times on the Web, please contact Alyson > >Racer at alyson(a)nytimes.com or visit our online media > >kit at http://www.nytimes.com/adinfo > > > >For general information about NYTimes.com, write to > >help(a)nytimes.com. > > > >Copyright 2001 The New York Times Company > > > > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at http://explorer.msn.com > > > ______________________________________________________________________ > To unsubscribe, write to reclaimthestreets-unsubscribe(a)listbot.com >

1 0

[Fwd: Have they found a serious PGP vulnerability?!]
by Ken Brown 21 Mar '01

21 Mar '01

Forwarded without permission from BUGTRAQ. I have no idea if there is any substance in the rumour, though I imagine there probably isn't. Ken Brown Pavel Kankovsky wrote: > > The rumour goes around that a group of cryptologists working for a Czech > company called ICZ has discovered a fatal problem in PGP as a side effect > of their work on a special crypto device for the Czech government. > > If you understand Czech (or if you want to check all the keywords are > there), you can read an article titled "Do you trust PGP? A mistake!" > about the whole thing at http://www.swnet.cz/article.php?id=15096 > > Allegedly, there is a vulnerability in OpenPGP format definition (sic) > allowing an attacker to circumvent (sic) the encryption used to protect > private signing keys and to recover those keys in real time (sic). > > To make the article sound a little more like a piece of FUD, they add > that only higher and more demanding professional systems (sic), when > implemented and used correctly, can be considered really secure. > > No details are available right now and the data included in the article > seems to be partially self-contradicting (on the other hand, it can be > just a result of standard journalistic post-production). They say there > will be a press conference today (March 20) at 15:00 MET where ICZ people > will shed more light on this issue. > > Personally, I think they have found some new obscure attack (perhaps some > side-channel attack) that can be used when some bizzare conditions are > met, or maybe they have reinvented the wheel, and have discovered a Trojan > horse can steal private keys when PGP decrypts them in order to be able to > use them. > > --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] > "Resistance is futile. Open your source code and prepare for assimilation."

3 2

embedded PGP boxes
by Blank Frank 21 Mar '01

21 Mar '01

These are current contest-projects I have no association with. See http://embedded.linuxjournal.com/advertising/press/finalists.php Dave Baker: P(aranoid)GP A keysigning station and standalone data signer, for people who are paranoid about untrusted computers, keystroke recorders and other attacks that get around PGP or GNUPG protection. Robert J. Meier: Classic RSA Box A PGP appliance with an electrically isolated box-in-a-box with capacitive sensor interlock and optoisolated data channels. Intended to self-destruct if tampered with.

1 0

Re: PGP flaw found by Czech firm allows dig sig to be forged
by lcs Mixmaster Remailer 21 Mar '01

21 Mar '01

Ian writes: > Of course, if someone can modify your private keyring, I'd suspect your > TCB is toast. (Unless you're in the habit of shipping your private keyring > around the Internet.) > > For the interested, this is my guess at the attack. > > Modify the encrypted value of p, somewhere near the middle. > When decrypted, depending on the chaining mode, it's possible that > only a couple of blocks of p will be mangled, and the remainder > of the private key file will decrypt successfully. Here's where > PGP fails to do a MAC to verify integrity of the data. > > Then, it behaves just like DFA (Differential Fault Analysis). > The idea is that to calculate a signature M^d mod n, we calculate > M^d mod p and M^d mod q, and use the CRT to combine them to S = M^d mod n. > > If p is wrong, the result S' will be correct mod q but incorrect mod p. > so S' ^ e mod q = M mod q, but S' ^ e mod p != M mod p. > > Therefore GCD(S' ^ e mod n, M) = q, and we're done. Pretty good! Actually they modify what PGP calls "u", which is p^(-1) mod q, but get the same effect. PGP has a simple bytewise checksum to protect the data but it is not enough. Now can you figure out how to do it to DSS keys? Hint: you change the public, not secret, data this time.

1 0

Re: PGP flaw found by Czech firm allows dig sig to be forged
by iang＠cs.berkeley.edu 21 Mar '01

21 Mar '01

In article <20010321133551.B2386(a)cluebot.com>, Declan McCullagh <declan(a)well.com> wrote: > > >http://www.wired.com/news/politics/0,1283,42553,00.html > > Your E-Hancock Can Be Forged > by Declan McCullagh (declan(a)wired.com) > 10:20 a.m. Mar. 21, 2001 PST > > WASHINGTON -- A Czech information security firm has found a flaw in > Pretty Good Privacy that permits digital signatures to be forged in > some situations. > > Phil Zimmermann, the PGP inventor who's now the director of the > OpenPGP Consortium, said on Wednesday that he and a Network Associates > (NETA) engineer verified that the vulnerability exists. > > ICZ, a Prague company with 450 employees, said that two of its > cryptologists unearthed a bug in the OpenPGP format that allows an > adversary who breaks into your computer to forge your e-mail > signature. Of course, if someone can modify your private keyring, I'd suspect your TCB is toast. (Unless you're in the habit of shipping your private keyring around the Internet.) For the interested, this is my guess at the attack. Modify the encrypted value of p, somewhere near the middle. When decrypted, depending on the chaining mode, it's possible that only a couple of blocks of p will be mangled, and the remainder of the private key file will decrypt successfully. Here's where PGP fails to do a MAC to verify integrity of the data. Then, it behaves just like DFA (Differential Fault Analysis). The idea is that to calculate a signature M^d mod n, we calculate M^d mod p and M^d mod q, and use the CRT to combine them to S = M^d mod n. If p is wrong, the result S' will be correct mod q but incorrect mod p. so S' ^ e mod q = M mod q, but S' ^ e mod p != M mod p. Therefore GCD(S' ^ e mod n, M) = q, and we're done. - Ian

1 0