July 2001 - cypherpunks-legacy

Legal Journals on the Web
by Jim Choate 04 Jul '01

04 Jul '01

http://www.usc.edu/dept/law-lib/legal/journals.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Cloning, miscarriange, and the 1st
by Steve Schear 04 Jul '01

04 Jul '01

At 08:22 AM 7/3/2001 -0500, Jim Choate wrote: >The fact is that if clonning research is stopped then the low success rate >will continue. A self-fulfilling prophecy. If it is allowed to go forward >in a very short time (a year perhaps) the problems will be ironed out and >the success rate will exceed 'natural' (Grrrr Judeo-Christian ethics) >rates of success. > >Eugenics - the management of reproductive choice by the state. > >What we need to do is outlaw the imposition of religious and political >viewpoints from the discussion....wait.... > > Amendment I > >Congress shall make no law respecting an establishment of religion, or >prohibiting the free exercise thereof; or abridging the freedom of speech, >or of the press; or the right of the people peaceably to assemble, and to >petition the Government for a redress of grievances. The problem with this argument is that despite the apparent religious agnosticism of the 1st, the moral basis upon which the SC has interpreted our laws is Judeo-Christian. Historically you've been protected from government intrusion unless your religion offends too many powerful people or presents political challenges. Consider the Mormons and shamanic drug rituals of the native Americans. Didn't Mao say something about all politics being, eventually, dispensed from the end of gun? steve

3 4

Re: [OT,long] "Zeroing" a machine / flashing from OS (fwd)
by Eugene Leitl 04 Jul '01

04 Jul '01

-- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Sat, 30 Jun 2001 11:13:15 -0400 (EDT) From: Bill Arbaugh <waa(a)cs.umd.edu> To: Peter Lister <P.Lister(a)sychron.com> Cc: linuxbios(a)lanl.gov Subject: Re: [OT,long] "Zeroing" a machine / flashing from OS I essentially solved this problem with a prototype built using the 430HX chipset a few years ago. The project, AEGIS, used the boot block portion of the flash to hold intitialization and recovery code. Everything else had a digital signature paired with it. Prior to passing exec control to the next step- the signature is checked. If it's valid, then we pass control. If it's not, then we try to recover a valid version. Essentially, I built a prototype of the TCPA spec (www.trustedpc.org) before the TCPA was even a thought. That's history. Today, we've been funded by DARPA to add this same functionality to LinuxBIOS (or at least use the init routines from LinuxBIOS). We also will add crypto hardware support. We're just getting started, but we hope to have some results late summer early fall. We're also hoping to team up with a major manufacturer so that we can have the capability on their servers and laptops. Our biggest problem is that we don't want users to have to change their flash chip. That means that we can't use Linux as the loader. Instead, we need to use something along the lines of GRUB. We're looking at a number of alternatives now, and we'll let everyone know what we find. Bill ------------------------------------------------------------------- Bill Arbaugh www.cs.umd.edu/~waa University of Maryland waa(a)cs.umd.edu College Park 301.405.2774 ------------------------------------------------------------------- On Sat, 30 Jun 2001, Peter Lister wrote: > James Finnie said... > > > Many boards do infact have a jumper on the board, which removes the > > ability to flash the BIOS without having physical access to reset > > the jumper - these mechanisms are completely secure, as they disable > > one of the flash chip write pins. And lets face it, if people have > > physical access to the machine, and want to do you some damage, > > there is little you can do about it. > > I'm thinking of cases where a hostile party can run any *software*, > including an arbitrary bootloader or OS, but can't get access to the > hardware to set a jumper or hit a switch (unless it's a software > controlled switch, of course - which includes the ATX "power switch"; > more of a polite hint to shut down). You tell me that the jumpers *do* > provide physical security. Fine - though it occurs to me that the > manufacturer's "secret" flash code might just look at the state > indicated by said jumper and refuse to flash, with no physical control. > Few people would know the difference. > > Yes, if someone has physical access, all bets are off - the question is > "How close can I get to physical access just via software?" and the > answer would appear to be "If I can flash system rom with an evil BIOS, > pretty close". > > > If a hacker has gained sufficient access to your mission critical > > datacenter systems through a trojan, in order to be able to run some > > arbitrary flashing code, I would say that was the least of your > > worries.... they already have access to whatever they could want, > > why would they bother implanting a trojan BIOS? > > Because it survives the scrubbing of magnetic media - even the complete > disassembly of the machine. Done well, it would be undetectable by any > current virus checker. You have to assume, for instance, that it could > pervert the disk controllers. I'm probably not interested in user A, > whose lax security gave me a root exploit (as you say, he's screwed > anyway) - I'll bide my time and wait until A has gone bankrupt and all > the computer systems are auctioned off to user B - whose system is > otherwise impregnable. > > I appreciate that commodity hardware is not designed for this sort of > security, since it is considered desirable to update in the field with > just a floppy. Most people consider a system board with BIOS as just a > component. Machines are being treated more as anonymous cluster members > than standalone systems with specific identities, so that it seems > likely that they will be moved between jobs quite dynamically. > > Given the stories of trivial "write protection", manufacturers > assurances of security seem generally worthless. :) Probably the best > defense would be a hardware "factory settings" switch which zaps all > nonvolatile storage back to a burned-in state, rather than relying on > "write protection". The machine could press its own button, since that > would be a guaranteed safe option, as even hostile software could do no > more than reinstate the trusted code. > > Don't be surprised when the first LinuxBIOS derived rom virus toolkit > gets into the hands of the script kiddies and the FBI arrests Ron. Of > course, this may be the best way to get the manufacturers to solve the > problem (a virus, not arresting Ron). > > -- > Peter Lister, Sychron Inc. - 1-866-SYCHRON > Intelligent Infrastructure - www.sychron.com

1 0

UFO Cult May Sue U.S. FDA Over Human Cloning
by Jim Choate 04 Jul '01

04 Jul '01

http://dailynews.yahoo.com/h/nm/20010704/ts/science_cloning_dc_1.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

The Register - Government, military scrambel for encryption technology
by Jim Choate 04 Jul '01

04 Jul '01

http://www.theregister.co.uk/content/55/20193.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

HAL2001 reminder; schedule; invitation
by Greg Newby 04 Jul '01

04 Jul '01

About a month ago I sent the HAL 2001 call for participation to cypherpunks. This is a reminder to people who might be thinking of submitting a presentation. We're still looking for more in-depth sessions on crypto topics. The current list of speakers & subevents is online at http://www.hal2001.org/hal/03Topics/06program/index.html The call for participation, and how to submit (as well as how to register to attend) is also there. There had been a cypherpunks gathering subevent that seems to have dropped off the list. I'll try to revive it, but if anyone knows who was thinking of organizing this, please drop me a note. Brief facts: August 12-14 on the campus of the U. of Twente, in the south-east of The Netherlands. -- Greg

1 0

YOURAWINNER
by yesyesyes＠aol.com 04 Jul '01

04 Jul '01

2 SEE THE BEST CUM SLURPING,BLOW SHOTS ON THE NET CHECK OUT THESE YOUNG LITTLE HONEY'S SMEARING THEMSELVES IN JISM http://www.geocities.com/xxxcumshooters CUM,CUM AND MORE CUM. THESE LITTLE WHORES ARE HERE TO EAT EVERY DROP OF YOUR LOAD AND MORE!!!!!!!!!! http://www.geocities.com/xxxcumshooters ****************************************************************** ALL MEMBERSHIPS RECIEVE ACCESS TO ALL OF OUR 32 SITES/LIMITED OFFER ------------------------------------------------------------------- FOR THE BEST ANAL FUCK SITE EVER TO BE RELEASED ON THE WEB!!! http://www.geocities.com/analxxxaction FUCK MY ASS UNTIL IT BLEEDS,PLEASE? THEN I'LL LICK THE SHIT OFF YOUR DICK. HOW I LOVE IT IN THE ASS, AGAIN AND AGAIN!!!!!! COME AND ENJOY A FREE TOUR NOW!!!THIS IS HOT XXX RATED SHIT MY PERSONAL FAVOURITE!!!!!!! http://www.geocities.com/analxxxaction ------------------------------------------------------------------ SEE ALL YOUR FAVOURITE CELEBRITIES GETTING FUCKED IN ALL POSITIONS IMAGINABLE. ANNA KOURNICOVA CATHERINE ZETA JONES CINDY CRAWFORD ARE JUST A FEW OF THE BIG NAME STARS THAT WE HAVE ON OUR SITE EVER WONDERED WHAT YOUR FAVOURITE STAR LOOKED LIKE WITH A BIG COCK IN HER ASS HERE IS YOUR CHANCE http://www.geocities.com/superstarxxxpussy ****************************************************************** TO HAVE YOUR EMAIL ADDRESS REMOVED FROM OUR MAILING LISTS GO TO http://www.geocities.com/cancelxxcancel

1 0

Factors for matching paper
by Jim Choate 04 Jul '01

04 Jul '01

from a shredder, that is... - handling marks (e.g. marks where a paper feeder impresses or moisture stains from handling) - paper fiber pattern extension across cuts - paper color shading across cuts - cut marks made by the cutting tools themselves - syntactic analysis (of the results, weak) -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Auto tracking at the airport
by Peter Capelli 04 Jul '01

04 Jul '01

Of course, it's all to help you find you car if you can't remember where you parked it ... http://www.newsobserver.com/wednesday/news/triangle/Story/513349p-508917c.ht ml Pete Capelli pcapelli(a)nsec.net http://www.capelli.org PGP Key ID:0x829263B6 "Those who would give up essential liberty for temporary safety deserve neither liberty nor safety" - Benjamin Franklin, 1759

1 0

Black Hat Briefings 2001 Conference Speakers Release (fwd)
by Eugene Leitl 04 Jul '01

04 Jul '01

(I guess I've been bitten by Choate. I hope the antidote is working). -- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Tue, 03 Jul 2001 00:22:26 -0400 From: B.K. DeLong <bkdelong(a)blackhat.com> To: press(a)blackhat.com Subject: Black Hat Briefings 2001 Conference Speakers Release For Immediate Release Contacts B.K. DeLong press(a)blackhat.com +1.617.877.3271 BLACK HAT BRIEFINGS 2001 SESSIONS HIGHLIGHT NEW COMPUTER SECURITY TOOLS, TECHNOLOGIES AND TACTICS Top Industry Gurus will Talk About Key Problem and Offer Solutions to Todays Security Issues http://www.blackhat.com/ -- Black Hat Inc. announced today over 40 different speaker sessions for this summer's Black Hat Briefings and Training 2001, the annual conference and workshop designed to help computer professionals better understand the security risks to their computer and information infrastructures by potential threats. This year's show will focus on hot topics including Honey Pot servers, secure programming techniques, incident response, Web-based vulnerabilities and Distributed Denial of Service attacks at the Caesars Palace Hotel and Casino in the heart of Las Vegas, 11 through 12 July, 2001. Top-notch speakers will deliver to the conference's core audience of IT & network security experts, consultants and administrators the newest developments on the vital security issues facing organizations using large networks with a mix of operating systems. "Our goal is to present a vendor-neutral environment where conference attendees can receive key intelligence in a face-to-face environment with the people developing the tools used by and against hackers," says Jeff Moss, founder of Black Hat Inc. "Our speakers discuss the strategies involved in correcting existing problems and inform attendees on upcoming issues, preparing them for the future." The lineup of Black Hat Briefings presenters for 2001 include: -- James Bamford, author of NSA books "The Puzzle Palace" & "Body of Secrets", will discuss some of his key research tactics that lead to his exposes about the most secret government agency in the United States. -- Richard Clarke is the senior U.S. government official responsible for cyber security policy. He was appointed by the President as the first national coordinator for security, infrastructure protection and counter-terrorism. He chairs the U.S. government's committees on cyber security, continuity of operations, counter-terrorism, domestic preparedness and international crime. -- Steve Christey, Lead INFOSEC Engineer in the Security and Information Operations Division at The MITRE Corporation will discuss the Common Vulnerabilities and Exposures (CVE) concept (naming standard for computer security vulnerabilities that hackers exploit to break into systems) and the challenges that MITRE faced trying to meet the criteria created for the concept. -- Martin Roesch, founder of Sourcefire Inc and author of the open source "Snort" Network Intrusion Detection System will talk about the new features in version 1.8 of the system (including features to improve it's enterprise scalability, resistance to anti-NIDS attacks, and integration with other security products and protocols) as well as the architecture and evolution of the next-generation Snort 2.0 system, is currently in the planning stages. -- Lance Spitzner, founder of the Honey Net Project and the group's 25 members will present the resulting research from their endeavors and discuss the goals of the project, how they accomplished their research and what they have discovered. -- Jose Nazario, a Biochemistry Ph.D. student from Cleveland, Ohio will discuss the future of Internet worm viruses and how the current crop (Ramen, Melissa, ILoveYou) are just the tip of the iceberg. Nazario applies the morphing approaches of biological systems with computing, and shows how new threats and adaptive defense strategies emerge. -- Dr. Ian Goldberg from Zero Knowledge Systems (known for cracking the first RSA Secret Key Challenge in three and a half hours, breaking Netscape's implementation of SSL encryption, and breaking the cryptography in the GSM cellular phone standard) will be discussing the "highly flawed" Wired Equivalent Privacy in the 802.11 wireless network standard. -- Brian Martin, founder and staff member of Attrition.org will cover the lessons learned and insight gained from monitoring the world of Web site defacements including reactions from the defacers themselves, system administrators, law enforcement and journalists as well as identification and analysis of several trends and statistics. Cryptography expert Bruce Schneier and Technology Futurist Richard Thieme will be giving this year's lunchtime presentations. Black Hat Inc. will also conduct computer security training for several different topics the two days prior to the briefings - 9 through 10 July. Subjects include: -- NT Network Intrusion Workshop -- Complete Windows 2000 Security -- Advanced Scanning with ICMP -- Reverse Engineering and Security Auditing with IDA The instructors for the training segment of this year's Black Hat are some of the top experts in their field and are fully active in the computer security community. You won't find most of these speakers anywhere else and these handpicked security gurus will train participants in understanding the real threats to any network and how to keep them from being exploited. To register for BlackHat Briefings, visit the Web site at http://www.blackhat.com. Direct any conference-related questions to info(a)blackhat.com. For press registration, contact B.K. DeLong at +1.617.877.3271 or via email at press(a)blackhat.com. About Black Hat Inc. Black Hat Inc. was originally founded in 1997 by Jeff Moss to fill the need for computer security professionals to better understand the security risks and potential threats to their information infrastructures and computer systems. Black Hat accomplishes this by assembling a group of vendor-neutral security professionals and having them speak candidly about the problems businesses face and their solutions to those problems. Black Hat Inc. produces 5 briefing & training events a year on 3 different continents. Speakers and attendees travel from all over the world to meet and share in the latest advances in computer security. For more information, visit their Web site at http://www.blackhat.com ### -- B.K. DeLong Press Coordinator Black Hat Briefings +1.617.877.3271 bkdelong(a)blackhat.com http://www.blackhat.com http://xent.com/mailman/listinfo/fork

1 0