September 2002 - cypherpunks-legacy

RE: cybersecurity proclamations vs. specific-application security
by Trei, Peter 20 Sep '02

20 Sep '02

> Major Variola (ret)[SMTP:mv@cdc.gov] wrote: > > > Instead of protecting the whole net, those responsible for > 'critical' services should be held responsible for their app. > > Use an air-gap, your refinery/dam/etc control doesn't > need to be online. > > If you must use networking for critical stuff (air traffic, medical > insurance > transactions) then use VPNs. And good policies. > Use several independent upstream providers if > reliability is important too, as it usually is. Tracert is your friend. > > Use caching DNS proxies if you worry about DNS-root attacks. > > Hold the managers of the 'critical' domains responsible. > Let them hire security folks who'll do gedanken et al. attacks > and learn to beef up their stuff. > > Its a *lot* easier to focus on specific 'critical' domains and > strengthen them than to whine and proclaim from D.C. about > the 'infrastructure' > > Perhaps fed tax breaks on fees paid to security folks > would help. And tax breaks on equiptment security upgrades. > Create/enforce tort laws so that when folks screw up security, > they pay. > > <\rant> > > At 07:33 AM 9/20/02 -0700, Declan McCullagh wrote: > >Previous Politech message: > > > >"Defense hawks bash White House report, want new laws, regulations" > >http://www.politechbot.com/p-03999.html > > > >James Lewis was one of the two CSISers I quoted in that article as > wanting more laws. [...] OR Make corporations financially liable if they fail to provide a service due to a cyberattack. Their insurance firms will then start to require standards in a much more diverse and flexible way than legislation would. This is similar to how bank vault and safe standards were improved during the last century. Peter Trei

1 0

Bit Commitment Blues
by Eugen Leitl 20 Sep '02

20 Sep '02

[via SomeMailingList] http://home.datawest.net/staym/commit.html Bit Commitment Blues by Mike Stay You think I got zero knowledge, But I know you done me wrong. Just commit to me baby, So's I can sing a happier song! One bit of commitment, That's all I really need, So send me your hashed answer And the random seed. I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues. I ain't oblivious, darlin', And honey, I ain't blind. Don't need sublim'nal channels To read your cheatin' mind. I'll share a secret with you: I know you hand out a public key. But why's it to the apartment That you're sharin' with me? I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues. You say you love me, baby, But you flirt with other guys. You say you want me, honey, But I see you wink your eye. You say you need me, Alice, Now forgive me if I sob; You know my name is Charlie, So quit hangin' out with Bob! I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues.

1 0

Re: software-defined radio killer app
by Ken Brown 20 Sep '02

20 Sep '02

The biggest police station in western Europe is being built less than half a mile from where I live. Your phone will keep on ringing and ringing... "Major Variola (ret)" wrote: > > In some parts of rural america, folks signal the presence of cops by > flashing their headlights > when driving. > > Occurs to me that would be a cool function for SDR: press code for or > say "cop". For N seconds, > phone periodically sends "cop" message picked up by other phones, > ignored by base station [1]. Phone also listens for these local > broadcasts. Upon hearing a suprathreshold number of "cop" messages the > phone alerts its owner. > > Better than a radar detector for emissionless, but visible, cops. Over > the hill coverage. Issues of > spoofing, trust, consensus familiar to readers here. > > [1] (different band entirely? UWB? B-tooth? FRS? )

1 0

CALL FOR HELP...
by MR. GEORGE WILLIAMS. 20 Sep '02

20 Sep '02

Dear C.E.O, It is my humble pleasure to write this letter irrespective of th fact that you do not know me. However, I came to know of you in my private search for a reliable and trustworthy person that can handle a confidential transaction of this nature in respect to our investment plans in real estate. Though I know that a transaction of this magnitude will make any one apprehensive and worried, but I am assuring you that all will be well at the end of the day. Let me start by first, introducing myself properly to you. I am MR. GEORGE WILLIAMS., a Branch Manager at one of the Zenith Commercial Bank Nigeria Plc, Lagos. A foreigner, Late Nicholas Owen, a Civil Engineer/Contractor with the federal Government of Nigeria, until his death three years ago in a ghastly air crash, banked with us here at the Zenith Commercial Bank PLC, Lagos. He had a closing balance of USD$46.7M (Fourty Six Million,Seven Hundred Thousand United States Dollars) which the bank now unquestionably expects to be claimed by any of his available foreign next of kin. Or, alternatively be donated to a discredited trust fund for arms and ammunition at a military war college here in Nigeria. Fervent valuable efforts made by the Zenith Bank to get in touch with any of late Nicholas Owens next of kin (he had no known wife and children) has been unsuccessful. The management under the influence of our chairman and board of directors, are making arrangement for the fund to be declared "UNCLAIMABLE " and then be subsequently donated to the trust fund for Arms and Ammunition which will further enhance the course of war in Africa and the world in general. In order to avert this negative development. Myself and some of my trusted colleagues in the bank, now seek for your permission to have you stand as late Nicholas Owens next of kin. So that the fund (USD$46.7M), would be subsequently transferred and paid into your bank account as the beneficiary next of kin through our overseas corresponding bank. All documents and proves to enable you get this fund have been carefully worked out and we are assuring you a 100% risk free involvement. Your share would be 30% of the total amount. While the rest would be for me and my colleagues for purchase of properties in your country through you/your Company. If this proposal is OK by you, then kindly get to me immediately via my e-mail wilge002(a)accountant.r.com furnishing me with your most confidential telephone, fax and e-mail, so I can forward to you the relevant details of this transaction. Thank you in advance for your anticipated cooperation. Best Regards. MR. GEORGE WILLIAMS. Branch Manager, Zenith Comm. Bank Plc.

1 0

Deposit not returned by TransAmerica? rbtj
by juu3.d_From_John Deposit not returned by TransAmerica?_To_cypherpunks＠minder.net 20 Sep '02

20 Sep '02

1 0

Fwd: Re: Making money the RIGHT way! 30191
by brean98＠hotmail.com 20 Sep '02

20 Sep '02

Do you know...? That it is EASY to make from $7,000-$10,000 per month as a Loan Officer? If you thought that in order to be a Mortgate Loan Officer, you had to Graduate from College, be Certified, Licensed or Bonded. . . Think Again! -> You can Start your own Home-Based Mortgage Loan Business with our Extensive Step-by-Step Training Program. -> Learn Our Exclusive - Response PROVEN - Method for Putting $7,000 - $10,000 in YOUR Bank Account every Month. -> Make Nation-Wide Mortgage Loans over the Internet in the Comfort of your Own Home. -> Sell Loans for HUGE Profits with NO out of Pocket Expense -> Take advantage NOW of the Lowest Interest Rates in OVER 50 years! Click Below NOW for all the details! "http://61.129.68.54/loanoriginators/index.php?Aff=2" OR you can also Cut & Paste the above link in your browser window. This message is coming to you as a result of an Opt-in Relationship our Clients have had with you. If you simply wish to be Removed from all future Messages, then CLICK BELOW "http://61.129.68.54/loanoriginators/remove/remove.html"

1 0

BRAND NEW CREDIT FILE!!
by MARIA 20 Sep '02

20 Sep '02

Dear Friend, We have got some great news for you... Finally, you can be approved for a brand new luxury car or dream house !!! With a BRAND NEW CREDIT FILE !! This is not credit repair. This is what the Government & the major Credit Bureaus do not want you to know !!! We will show you how to establish a brand new credit file that has absolutely no connection to your past credit history. We will also show you how to keep your two credit files from merging with one another. And the best part is that Everyone Qualifies!!! Bankruptcy, Foreclosure, Car repo, it does not matter. Your existing credit file will be invisible to your future lenders. Many honest people have suffered financial set backs due to sudden illness, job loss, divorce & unforseen legal problems. These financial set backs often result in the loss of a good credit rating & even bankruptcy. This makes it next to impossible to start over & qualify for major necessary purchases such as a car or home. Why wait the 7 to 10 years for your existing credit file to clean itself up. This process of achieving AAA credit, with your new credit file, takes less than 30 days & not only is this 100% LEGAL, it is your RIGHT !!! Everyone makes mistakes. Perhaps you had a car repo, a foreclosure, gone through a divorce or got stuck with thousands of dollars in hospital bills. It is no longer necessary to be punished for situations that were out of your control. You do not have to be penalized for this. This is your second chance. Not only does this new credit file program work in the U.S., Canada & the United Kingdom but in over 17 countries as well... Discover the loophole in the credit system !!! Get that new car or home now... For more FREE info, click here... http://beam.to/creditfile Yours truly, MARIA MORA Hey- I'm *not* spamming you. You are in my address book because we were introduced via Target opt mail list. However, if you wish to discontinue, please click on the email link below and in the subject area type in remove and you'll be instantly removed from my address book. maria66(a)wowmail.com

1 0

RE: Cryptogram: Palladium Only for DRM
by AARG! Anonymous 20 Sep '02

20 Sep '02

Lucky Green wrote: > AARG! Wrote: > > In addition, I have argued that trusted computing in general > > will work very well with open source software. It may even > > be possible to allow the user to build the executable himself > > using a standard compilation environment. > > What AARG! is failing to mention is that Microsoft holds that Palladium, > and in particular Trusted Operating Root ("nub") implementations, are > subject to Microsoft's DRM-OS patent. Absent a patent license from > Microsoft, any individual developer, open source software development > effort, and indeed any potential competitor of Microsoft that wishes to > create a Palladium-like TOR would do so in violation of Microsoft's > patent. U.S. Patent law takes a dim view of such illegal infringers: > willful infringers, in particular infringers that generate a profit from > their creation of a non-Microsoft version of a TOR face the risk of a > court ordering such infringers to pay treble damages. That's too bad. Trusted computing is a very interesting technology with many beneficial uses. It is a shame that Microsoft has a patent on this and will be enforcing it, which will reduce the number of competing implementations. Of course, those like Lucky who believe that trusted computing technology is evil incarnate are presumably rejoicing at this news. Microsoft's patent will limit the application of this technology. And the really crazy people are the ones who say that Palladium is evil, but Microsoft is being unfair in not licensing their patent widely! > As of this moment, Microsoft has not provided the open source community > with a world-wide, royalty-free, irrevocable patent license to the > totality of Microsoft's patents utilized in Palladium's TOR. Since open > source efforts therefore remain legally prohibited from creating > non-Microsoft TORs, AARG!'s lauding of synergies between Palladium and > open source software development appears premature. Well, I was actually referring to open source applications, not the OS. Palladium-aware apps that are available in source form can be easily verified to make sure that they aren't doing anything illicit. Since the behavior of the application is relatively opaque while it is protected by Palladium technology, the availability of source serves as an appropriate balance. But it does appear that Microsoft plans to make the source to the TOR available in some form for review, so apparently they too see the synergy between open (or at least published) source and trusted computing. > > [1] A message from Microsoft's Peter Biddle on 5 Aug 2002; > > unfortunately the cryptography archive is missing this day's > > messages. "The memory isn't encrypted, nor are the apps nor > > the TOR when they are on the hard drive. Encrypting the apps > > wouldn't make them more secure, so they aren't encrypted." > > In the interest of clarity, it probably should be mentioned that any > claims Microsoft may make stating that Microsoft will not encrypt their > software or software components when used with Palladium of course only > applies to Microsoft and not to the countless other software vendors > creating applications for the Windows platform. UNLESS Microsoft means that the architecture is such that it does not support encrypting applications! The wording of the statement above seems stronger than just "we don't plan on encrypting our apps at this time". There are a couple of reasons to believe that this might be true. First, it is understood that Palladium hashes the secure portions of the applications that run. This hash is used to decrypt data and for reporting to remote servers what software is running. It seems likely that the hash is computed when the program is loaded. So the probable API is something like "load this file into secure memory, hash it and begin executing it." With that architecture, it would not work to do as some have proposed: the program loads data into secure memory, decrypts it and jumps to it. The hash would change depending on the data and the program would no longer be running what it was supposed to. This would actually undercut the Palladium security guarantees; the program would no longer be running code with a known hash. Second, the Microsoft Palladium white paper at http://www.microsoft.com/presspass/features/2002/jul02/0724palladiumwp.asp describes the secure memory as "trusted execution space". This suggests that this memory is designed for execution, not for holding data. The wording hints at an architectural separation between code and data, when in the trusted mode. > Lastly, since I have seen this error in a number of articles, it seems > worth mentioning that Microsoft stated explicitly that increasing the > security of DRM schemes protecting digital entertainment content, but > not executable code, formed the impetus to the Palladium effort. Further reason to believe that Palladium's architecture may not support the encryption of executable code.

2 1

企业增效之路必备宣传手段
by ad＠ser.com 19 Sep '02

19 Sep '02

1 0

Time:12:07:23 PM
by calvin＠notrix.ch 19 Sep '02

19 Sep '02

1 0