August 2001 - cypherpunks-legacy

The secret knock, the red carnation (Re: Gnutella scanning instead of service providers.)
by Dynamite Bob 22 Aug '01

22 Aug '01

On Wed, 22 Aug 2001, Gary Jeffers wrote: > If a scanner were written and widely deployed, then I think that >the problem of crushing Gnutella would be at least a magnitude harder. >Maybe the Gnutella support sites would promote and distribute such >a scanner? You can always use the following method: Participating Nodes listen on random (UDP, say) ports for "I'm here" and "Gimme a pointer" queries. When booting your Node, it randomly sends "Gimme a pointer" messages to random IP addresses/ports until a helpful Participating Node is found, who shares the indexing info he has. Or if you are worried about exposure when a Fed/RIAA/MPAA box receives such a query from your machine: Nodes could instead listen for contacts on an 'uninteresting' port like TCP/80, and disguise queries as innocent looking requests. (You'll note resemblances to Code Red IIS-exploits...) Note also similarities to how spooks arrange to meet in public places... with a deniable nonsuspicious introduction

1 0

Get .Sex Domains Today!
by domainsdirect＠yahoo.com 22 Aug '01

22 Aug '01

The latest domain name extension has arrived .SEX!!! It's the fresh ,new, exciting web address that is taking the world by storm. Who wants to be .com when you can now be .SEX Register your .SEX domain name today exclusively at: http://www.dotsex.com ------------------------------------------------------------------------- To be taken off the mailing list please click below: http://www.dotsex.com/unsubscribe.phtml

1 0

Re: Bomb Law Reporter - special edition
by Faustine 22 Aug '01

22 Aug '01

Bill Stewart wrote: At 03:31 PM 08/20/2001 -0400, Faustine wrote: >Eugene wrote: > > > and switching to an emission poor system (chucking CRT for LCD > > would do plenty for starters) > >Actually, that won't help you much: emissions from LCD screens can be >easier to decode than those from monitors. Active matrix LCD screens create >very strong and clear emissions--as long as a display uses some form of >pixel sweep where each pixel is activated at a unique time, then the >emissions are simple to decode. Though in theory LCD screens emit less than >a VDU, recent EMC controls have greatly reduced emanations from VDUs--with >the result that the graphics card will often be the greatest source of >compromise. >Also, most laptops have a VGA connector on the back, which leaks heavily. >An external VGA screen might be a bit quieter, because the cables can be >shielded, but it still depends on how capable the attacker is. >And basically, if the Feds are sitting outside your house listening >to whatever they can from your computer, you've already blown your >security :-)Shoulda used Blacknet. Have you happened to have seen any good papers on constructing do-it- yourself cheap, effective, portable shielding? Probably might as well ask for the moon too while I'm at it, but it's worth a shot! ~Faustine.

1 0

RE: Bomb Law Reporter - special edition
by Sandy Sandfort 22 Aug '01

22 Aug '01

Faustine wrote: > Have you happened to have seen any good > papers on constructing do-it-yourself cheap, > effective, portable shielding? Here's a company that sells tempest shielded "tents": http://www.bemashield.com/seseries.html This a site that has all sorts of tempest links: http://www.eskimo.com/~joelm/tempestsource.html With a bit more searching, you can find a company that manufactures the material used in the tents (I'd try 3M). Then, if you're handy with a sewing machine and can find the appropriate Simplicity pattern, you're in business. S a n d y

1 0

Need Contact? 230 Mio Prospects just $90 !!!
by contact＠gogoo.com 22 Aug '01

22 Aug '01

230 MILLION EMAIL ADDRESSES FOR ONLY $ 90 You want to make some money? I can put you in touch with over 230 million people at virtually no cost. That's right, I have over 200 Million Fresh email addresses that I will sell for only $ 90. These are all fresh addresses that include almost every person on the Internet today, with no duplications. They are all sorted and ready to be mailed. That is the best deal anywhere today! Imagine selling a product for only $5 and getting only a 1% response. That's OVER $10,000,000 IN YOUR POCKET !!! These 230 Million email addresses are yours to keep, so you can use them over and over. They come on a collection of several CDs. This offer is not for everyone. If you can not see the just how excellent the risk / reward ratio in this offer is then there is nothing I can do for you. To make money you must stop dreaming and TAKE ACTION. TWO PACKAGES: Simple: (addresses and Reports ONLY) Extended: (mailing software included) PACKAGE DESCRIPTIONS BELOW; **************************************** THE SIMPLE MARKETING SETUP (addresses and ReportsONLY) 230,000,000 email addresses on CD Reports, Helpfiles etc. These name are all in text files ready to mail!!! CHF 150.00, (~$90.00) ORDER METHOD - SEE BELOW **************************************** THE EXTENDED MARKETING SETUP 230,000,000 email addresses on CD Reports, Help-Files etc. These name are all in text files ready to mail!!! AND Several different email programs and tools to help with your mailings and list management. CHF 200.00 (~$ 120.00) ORDER METHOD - SEE BELOW IF YOU ORDER BY MAIL OR FAX WE WILL SHIP YOUR CD CONTAINING THE 230 MILLION NAMES WITHIN 24 HOURS OF YOUR ORDER!!! WE ACCEPT: AMERCAN-EXPRESS, VISA & MASTERCARD TYPE OF CARD AE/VISA / MC??_______________ EXPIRATION DATE ___________________________ NAME ON CREDIT CARD________________________ CREDIT CARD #_______________________________ BILLING ADDRESS ____________________________ CITY_________________________________________ STATE___________________ZIP__________________ COUNTRY____________________________________ PHONE INCLUDE AREA CODE___________________ EMAIL ADDRESS______________________________ WE WILL BILL selected amount to your account (shipping costs included!!!) FAX your order and the above requested credit card information to: FAX # ++41 61 923 94 41 ---> AUTOMATED ORDER FAX ONLY!!!! ALL INFORMATION NECESSARY FOR YOU TO SUCCESSFULLY MAIL QUICKLY, PROPERLY, & LEGALLY IS PROVIDED WITH YOUR ORDER. Please NOTE: This advertisement is NOT sponsored by ANY Internet Service Provider!!!

1 0

Re: BESS's Secret LOOPHOLE (censorware vs. privacy & anonymity)
by Duncan Frissell 22 Aug '01

22 Aug '01

At 10:24 PM 8/15/01 -0500, Jim Choate wrote: >Liar, check the archives. I never said anybody was dangerous. What I did >say was that I felt the C-A-C-L philosophy was dangerous. I stand by that. >I believe that were the C-A-C-L philosophy to take hold the results would >make the death counts from Nazism and Communism in this century pail in >comparison. You have to be wired a little funny to think that a free society would suffer the murder rate of those slave societies with their organized mechanisms of extinction. Killing the 170 Megs of people that socialists of all stripes murdered in the 20th century is hard work. Takes a big killing organization. For fun I tried to guestimate the number of murders private individuals committed in the 20th century and even making assumptions that inflated the final figure, I was only able to come up with a max of 30 megs of people. (Derived by applying the peak US murder rate of 10 per 100,000 to a somewhat arbitrary average world population of 3 billion during this century) DCF ---- In normal operation, a 1000 MGW coal-fired power plant releases more radioactivity than a 1000 MGW nuclear power plant.

2 1

Timing Analysis of Keystrokes and Timing Attacks on SSH (fwd)
by Jim Choate 22 Aug '01

22 Aug '01

---------- Forwarded message ---------- Date: 22 Aug 2001 11:37:39 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> To: cryptography(a)wasabisystems.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH What I find really neat here is that up until now, serious traffic analysis has been fairly neglected in the open crypto community. Is this the start of things to come? ------- Start of forwarded message ------- Date: Wed, 22 Aug 2001 08:53:30 -0600 From: aleph1(a)securityfocus.com To: secpapers(a)securityfocus.com Cc: secureshell(a)securityfocus.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH Message-ID: <20010822085330.J3366(a)securityfocus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Timing Analysis of Keystrokes and Timing Attacks on SSH Dawn Xiaodong Song, David Wagner, Xuqing Tian University of California, Berkeley SSH is designed to provide a security channel between two hosts. Despite the encryption and authentication mechanisms it uses, SSH has two weakness: First, the transmitted packets are padded only to an eight-byte boundary (if a block cipher is in use), which reveals the approximate size of the original data. Second, in interactive mode, every individual keystroke that a user types is sent to the remote machine in a separate IP packet immediately after the key is pressed, which leaks the interkeystroke timing information of users' typing. In this paper, we show how these seemingly minor weaknesses result in serious security risks. First we show that even very simply statistical techniques suffice to reveal sensitive information such as the length of users' passwords or even root passwords. More importantly, we further show that using more advanced statistical techniques on timing information collected from the network, the eavesdropped can learn significant information about what users type in SSH sessions. In particular, we perform a statistical study of users' typing patterns and show that these patterns reveal information about the keys typed. By developing a Hidden Markov Model and our key sequence prediction algorithm, we can predict key sequences from the interkeystroke timings. We further develop and attacker system, Herbivore, which tried to learn users' passwords by monitoring SSH sessions. By collecting timing information on the network, Herbivore can speed up exhaustive search for passwords by a factor of 50. We also propose some countermeasures. In general our results apply not only to SSH, but also to general class of protocols for encrypting interactive traffic. We show that timing leaks open a new set of security risks, and hence caution must be taken when designing this type of protocol. http://paris.cs.berkeley.edu/~dawnsong/papers/ssh-timing.pdf - Elias Levy SecurityFocus http://www.securityfocus.com/ Si vis pacem, para bellum --------------------------------------------------------------------- To unsubscribe, e-mail: secureshell-unsubscribe(a)securityfocus.com For additional commands, e-mail: secureshell-help(a)securityfocus.com ------- End of forwarded message ------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Para t� siempre lo mejor ...
by MisProductos.com 22 Aug '01

22 Aug '01

1 0

Re: Lawyers, Guns, and Money
by Faustine 22 Aug '01

22 Aug '01

dmolnar wrote: >Perhaps in evaluating potential programs, it would be helpful to list >people in the policy + technology area who are worth looking into. Along >perhaps with which institutions they studied at? I'll start. I regret that >I'm not familiar with this area, and so I'm sure I'll overlook many >interesting people. Great start! If anyone is interested, maybe this weekend I could put together a list of the top policy analysis schools with their technology & policy faculty and backgrounds: I'm sure there are plenty of researchers with a lower profile than those on your list who might be a great match for potential students out there. All you really need is to find a few key people to mentor you whom you can really learn from and relate to, to make it worthwhile. >I'm also not sure what to do about people with some >policy interests who are primarily cryptographers -- do we include Ron >Rivest because of his work on electronic voting? Sure, anyone you think might be interesting to work with and learn from. >By the way, what exactly do you *do* after you graduate from a technology >and policy program? You can find all sorts of thing to do at universities, think tanks, NGOs, lobbying groups, etc. doing applied work, abstract work, or a combination of both. I'm sure where you end up depends a lot on your focus area and skill set. >Every now and then I wonder if I will eventually end up in law school or a >policy + technology program. The thought is alternately exciting and >saddening. Then again, so is the prospect of being a "pure" researcher. Since it's multidisciplinary from the start, if you take the analysis road, you have a much better chance of "building in" some flexibility and doing as much "pure research" as you want to in the long run. Take law, you're just stuck with doing law. But of course I'm 100% biased, so any any encouragement in this direction should be judged accordingly! :) Good luck... ~Faustine.

1 0

Information You Requested from Microsoft.com
by 1support＠microsoft.com 22 Aug '01

22 Aug '01

NOTE: PLEASE DO NOT RESPOND DIRECTLY TO THIS E-MAIL. THIS E-MAIL IS NOT MONITORED. Welcome to Microsoft Online ID secure Internet environment! Below is your membership information. Please keep this confirmation mail as a record of your password. Consider this information confidential and treat accordingly. Your Microsoft Online ID Password is: cypherpunks A Microsoft Online ID provides access to various Microsoft secured programs. Please check the Frequently Asked Questions and/or Help page of the program you are accessing for questions. Sincerely, Microsoft Online ID Administrator

1 0