August 2001 - cypherpunks-legacy

Re: Traceable Infrastructure is as vulnerable as traceable messages.
by jamesd＠echeque.com 12 Aug '01

12 Aug '01

-- Faustine: > > > I think it's dangerous and entirely to your disadvantage to > > > dismiss everyone doing government work in computer security > > > as a donut- chomping incompetent Barney-Fife-clone > > > imbecile. > > > > > > Anyone can laugh at the department heads on C-SPAN, but did > > > you ever stop to think about who's really doing the > > > hardcore research for the NSA at Ft. Meade--and elsewhere? James A. Donald: > > To judge by their most recent crypto ballsup, some donut > > chomping incompetents. Faustine > That's just as inaccurate as condeming everyone who ever worked > for Microsoft as clueless because of their corporate propensity > for security lapses. You wouldn't go that far, would you? Microsoft, as a whole, is incompetent at security. All supposedly secure software coming out of Microsoft varies from poor to worthless. Does anyone doubt it? They take standard well known methods and make well known bungles in applying it and customizing it. We do not get to see much of the spook output. What we have seen in recent years is not good. During world war II the government sucked up all the best people from the open sector, and put them to work in the secret sector. For example most of the words greatest scientists wound up hand making nuclear weapons. However, one would expect, with the passage of time, that people who work in secret would suffer from Parkinson's law, and this appears to be happening. > I know of an old-school NSA red teamer who's been teaching > programming and engineering since before either one of us was > born. An honest-to-god mathematical genius. Some of those old > wizards could teach us all a thing or two. But whether the > donut-chomping incompetents have the upper hand is anyone's > guess. I wouldn't bet on it in the long run. I would bet on it in the long run. It is inherent in the nature of government. Without the market weeding out the unfit and pressuring everyone for excellence, bureaucracies unavoidably decay for well known reasons. Microsoft produces crap security because most of their customers do not know any better. Therefore NSA will produce crap security because their customers are forbidden to know any better. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG FwLinDdmbEa6PhxFDMsPXCIlj97FlY1YpxKNR3KV 4FBpZ7okXglgl5/19J96vLLEaPc1wi1VxGVTGCRJf

3 2

RE BOMB PLANS
by Secret Squirrel 12 Aug '01

12 Aug '01

Why is everyone pussyfooting around the bomb plan thing all the time? Why doesn't one of the lawyers on the list, or somebody like Tim, who can afford a good lawyer, just start a daily posting of pages from one of those CIA manuals that Loompanics or whoever sells, with all the explosive and incendiary formulas? What possible charge could the trolling LEO's make?

2 1

Stressed with Debt???
by qcbusoso＠att.net 12 Aug '01

12 Aug '01

1 0

Re: Linux On Steroids: DIY supercomputer software from Sandia
by measl＠mfn.org 12 Aug '01

12 Aug '01

On Thu, 9 Aug 2001, Faustine wrote: > 232.6 billion operations a second still looks fairly impressive to me. > > ~Faustine. Cryptographically speaking, *yawn*. -- Yours, J.A. Terranson sysadmin(a)mfn.org If Governments really want us to behave like civilized human beings, they should give serious consideration towards setting a better example: Ruling by force, rather than consensus; the unrestrained application of unjust laws (which the victim-populations were never allowed input on in the first place); the State policy of justice only for the rich and elected; the intentional abuse and occassionally destruction of entire populations merely to distract an already apathetic and numb electorate... This type of demogoguery must surely wipe out the fascist United States as surely as it wiped out the fascist Union of Soviet Socialist Republics. The views expressed here are mine, and NOT those of my employers, associates, or others. Besides, if it *were* the opinion of all of those people, I doubt there would be a problem to bitch about in the first place... --------------------------------------------------------------------

1 0

Famous Stanford Spy Camera
by Anonymous Coredump 12 Aug '01

12 Aug '01

Bill Stewart wrote: > SF Bay Area Cypherpunks August 2001 Physical Meeting Announcement > PLACE: Tressider Student Union Courtyard, > Stanford University Campus > Palo Alto, California, USA We should go take a look at the famous Stanford spy camera on the roof of Barnes. Barnes is a relatively tall building in Escondido Village on the south side of the campus. The camera can be clearly seen from the ground. The camera was installed for the World Cup a few years back. It is remotely controlled and is used to zoom in on faces at great distances. During the World Cup, the faces of fans were fed to a bullpen of representatives of "anti-terrorism" organizations from around the world. So far as I know, no computer recognition was used, but the effect is the same. Given that the U.S. has often been a haven for dissidents, and that universities in particular are advertised as havens for those with unpopular ideas, it would be interesting to know which precautions, if any, Stanford took to ensure the safety of those attending the Cup. "Anti-terrorist" organizations are often no more than secret police departments whose primary mission is repressing the political views of their citizens. Were the participating agents allowed to take pictures home? Were the images saved for later analysis, for instance by computer? Which nations participated and could any of them be said to have repressive governments? Some damage is unavoidable as even the knowledge of the presence of a dissident in the Bay Area could create problems. (Secret police are not confined to their countries of origin and often receive the cooperation of the U.S. Federal Government.) Likewise, simply associating with a known dissident could create difficulties for those returning to their native countries, or even for U.S. citizens visiting those countries. Given the international presence, the Federal government was clearly involved. Which organizations were involved? Has Rep. Dick Armey been informed of this involvement? What does Stanford use the camera for now?

2 1

Re: RE BOMB PLANS
by measl＠mfn.org 12 Aug '01

12 Aug '01

On Sat, 11 Aug 2001, Reese wrote: > Check the archives Aimee, look for crossposts between cypherpunks > and the rhizome-raw list (oh, about 18-24 months ago, wild guess). What ever happened to rhizome anyway? -- Yours, J.A. Terranson sysadmin(a)mfn.org If Governments really want us to behave like civilized human beings, they should give serious consideration towards setting a better example: Ruling by force, rather than consensus; the unrestrained application of unjust laws (which the victim-populations were never allowed input on in the first place); the State policy of justice only for the rich and elected; the intentional abuse and occassionally destruction of entire populations merely to distract an already apathetic and numb electorate... This type of demogoguery must surely wipe out the fascist United States as surely as it wiped out the fascist Union of Soviet Socialist Republics. The views expressed here are mine, and NOT those of my employers, associates, or others. Besides, if it *were* the opinion of all of those people, I doubt there would be a problem to bitch about in the first place... --------------------------------------------------------------------

1 0

Mixmaster Message Drops
by Nomen Nescio 11 Aug '01

11 Aug '01

My studies show about 1 chance in 20 that any particular running remailer will drop a message. This is based on sending a bunch of messages through chains of remailers of varying length and seeing how many arrive in a day or so, and then calculating the average probability. These are not the lame remailers, either, these are the cream of the crop, based on various performance reports. Note that in a chain of twenty remailers this causes many messages to be dropped. Even if we achieve a reliability rate of 1 in 100,000, this means about 1 in 5000 messages will be lost through a chain of 20 remailers - usable. For some reason remailer culture has accepted message drops as normal. They aren't normal. There isn't any reason why a remailer should be any less reliable than a mail server. I estimate mail servers are far more reliable than 1 loss in 100,000 messages. One possibility is that some of my tests went through remailers that are just down. This hasn't been ruled out beyond any reasonable doubt, but it appears that the drops are occuring in remailers which are still carrying traffic. I did an extensive series of tests with an internal mixmaster network running Mixmaster 2.0.3. I had to fool around with it, but I was able to run many hundreds of messages through chains of 20 hops without a single message drop. The core software appears to be solid (unless bugs have been introduced into more recent releases ;-), but the setup needs to be tweaked. The practice of putting something like this into .forward is a problem: "|/usr9/loki/Devel/Mix/mixmaster -R >> /usr/spool/mail/username" If too many messages come in at once this brings a machine to its knees because it runs too many mixmaster processes at once. This feeds on itself because as more processes run, it takes longer for each one to complete. There may also be a bug in mixmaster which is only expressed when many mixmaster processes simultaneously try to queue a message. (FYI, this also creates an easy DoS attack on a mixmaster node. Just send the node a bunch of messages which loop back into itself over and over again. This should rapidly cause sendmail to spawn many mixmaster processes and lock up the machine. I haven't tried this on anybody else's mixmaster node.) The solution is to have a small program which puts incoming messages into a spool file. I've enclosed the perl script I used, which comes with no guarantees and hasn't been tested all that much. The script copies the message into a file in the spool directory starting with "temp". Then it moves it to a file starting with "spool". The reason for the move is to guarantee that all "spool" files are complete messages. The time of creation is encoded in the filename so a processing program can get the files in order of arrival. The other pieces needed are a small perl script which monitors the spool directory and calls mixmaster to queue up each file and another process which calls mixmaster repeatedly to process the queued messages. This setup causes no more than two mixmaster processes to run at a time and is more robust. Would somebody mind polling the remailer operators to see how many are running mixmaster directly from .forward? I suspect this is most of the problem. If it isn't, we need to eliminate it before pursuing the next suspect. ---cut here------cut here------cut here------cut here------cut here------cut here--- #!/usr/bin/perl -w # This code is in the public domain. # Put in a .forward file. Spools mail into a directory for processing # by something else. require 5; use strict; use English; my(@pwvals) = getpwuid($UID); my($homedir) = $pwvals[7]; my($spooldir) = "$homedir/spool"; die "Home directory doesn't exist." if ! -e $homedir; die "Home directory isn't a directory." if ! -d $homedir; die "$spooldir doesn't exist." if ! -e $spooldir; die "$spooldir is not a directory." if ! -d $spooldir; my($now) = time; my($now_string); if( length($now) < 12 ) { $now_string = ('0' x (12 - length($now))) . $now; } my($temppath) = "$spooldir/temp.$now_string.$$"; die "Amazingly, $temppath already exists." if -e $temppath; open(SPOOLFILE, ">$temppath") or die "Could not open $temppath for writing.\n"; while(<>) { print SPOOLFILE $_; } close(SPOOLFILE); my($spoolpath) = "$spooldir/spool.$now_string.$$"; die "Amazingly, $spoolpath already exists." if -e $spoolpath; if( ! rename $temppath, $spoolpath ) { die "Could not rename $temppath to $spoolpath."; } # Let sendmail know everything is fine. exit(0);

4 7

RE: RE BOMB PLANS
by Aimee Farr 11 Aug '01

11 Aug '01

Reese wrote: > I held my tongue, but enough: > > At 10:22 AM 8/11/01, Aimee Farr wrote: [deleted stuff that Dr. Evil said] > >Ditto, and it can be used to mischaracterize the list and participants. > > 1 vote for moderation, check. Crossing the street to get to the other > side can be mischaracterized. So can using a toilet properly and then > flushing afterwards. > >Should some continue to persist, they might notice a sudden, and sharp > >influx of new female personalities discussing.... > > poontang? here? where? I should know better by now. > >-interior decorating tips > >-personal hygiene > >-manicures & hair styles > >-the new official colors for 2001 > > > >...and so on, and etc. > > Check the archives Aimee, look for crossposts between cypherpunks > and the rhizome-raw list (oh, about 18-24 months ago, wild guess). No thanks. I know enough of the archives.... I retract my weak threat. > Do you think a group of happy-clappy homemakers can do better? They can measure and follow recipes.

1 0

Infinity Bugs--A new can of worms?
by Tim May 11 Aug '01

11 Aug '01

The "infinity bug" is alleged to be a device rendering any telephone, even one on-hook, capable of transmitting audio to a listener. Whether it's real is not the point. Could the LEAs and intelligence agencies be using the equivalent of infinity bugs in the computers of targets? Something that is sent to a user as an attachment or executable, a la the various worms and viruses, something that sends results of keystrokes, or passwords entries, or keyword searches? Items: * The alleged use of "registration sniffers" which Microsoft was alleged (probably wrongly) to have used a few years ago to scan the hard disks of users of its products and then this information--it was alleged--could be retrieved by MS at some point. (I say probably wrongly for reasons discussed a few years ago. Still, it suggests some possibilities, which is why I mention it now.) * The spoof Web pages, masquerading as real Web pages. A classic man-in-the-middle attack, analogous to building a fake ATM (on screen or even physical) around a real ATM. Even the "Web page shrinks to a 3 x 5 pixel dot and lingers on the screen where it is not noticed" method. (I don't remember what this was called, so I'm describing it.) * The SirCam thing, of course. My spoof about NIPC secret documents being sent out turned out not to be such a spoof after all, we heard a few days later. Suppose a much more refined and much more targeted version of SirCam was deposited on a target's computer? * We know there has been much funding of worms and viruses by the government...for more than a few years. There were _claims_ after the Gulf War that the U.S. had disabled some Iraqi systems with worms, viruses, trojans, etc. (Some of these claims were based on an "Infoworld" spoof reporting on viruses being sent to printers. But I expect _some_ of the claims may be based on fact.) * I read a French novel some years back called "Softwar," where a software bug is placed inside a supercomputer and is set to go off if ever a weather report has a specific combination of temperatures and wind speeds in a specific city. Poorly written (maybe it was the translation, maybe it was just typical French SF), but an interesting idea. * There were some cases years ago where Webcams, often built into monitors or left sitting on top of monitors permanently, could be turned-on remotely. Even more the case with built-in microphones. It'd be a hoot if the Feds are finding ways to turn on Webcams and microphones in homes and businesses. Even to leave trojans on a system for storing compressed snatches of audio. These items are just meant to suggest possibilities. Besides doing research to "protect" the computer infrastructure, it seems that using "remote viewing" is a potential good alternative to Carnivore and to breaking physically into homes. Maybe something like this is the bugging technology the FBI doesn't want to disclose in open court? Last point. As networks get so complex, with so many old legacy things left hanging on corporate Intranets, on LANs and WANs and wireless nets (another can of worms, so to speak), more and more opportunities for depositing little bits of code to sniff passwords, to search for keywords, to turn on microphones and cameras. It's a place I'd be putting some money into, were I the CIA, DEA, FBI, or any of a dozen other agencies. --Tim May

3 2

RE BOMB PLANS
by An Metet 11 Aug '01

11 Aug '01

Evil whined: >> Ditto, and it can be used to mischaracterize the list and participants. > > Well put. Whenever a reporter needs to do a story about c'punks he'll > look at the archive and see this huge thread of idiotic posts about > bombs, and he'll say, "Yup, I thought so. Violent anti-government > terrorist wannabes." At a rational level, that isn't true; c'punks > aren't violent anti-government terrorist wannabes. But at a > psychological or emotional level, that's what it would look like to an > outsider. And it's boring. Speak for yourself, dude. Weapons discussions have always been a part of cypherpunks since the beginning. Check the archives. You don't bombs and guns, start your own list.

1 0