December 2003 - cypherpunks-legacy

Secret Powers
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i have just completed Secret Powers (reading it, that is). unless you live in NZ, i don't think that there is much here for you. even the NZ stuff was pretty tame, unless you have been living under a rock, there is nothing here that wasn't already known. lots of pictures of NZ politicians and such stuff. also, a picture of a vax with a caption that implies that these are the NSA's echelon-network computers, sigh. the author can't seem to stay focused for very long. also, it's hard to see what his underlying message is, unless, of course, it's simply to sell books and make money, which is in no way a bad thing. on the one hand, he keeps harping on the theme of how the UKUSA (but really NSA) is forever telling NZ what to collect and what to do, and how NZ should be their own masters, but then he talks about how very much data NZ receives every day from the NSA. i guess he never heard the one about the one who pays the piper getting to call the tune. he also keeps trying to make something sinister about the use of acronyms and code words, and insists that the radomes are to prevent anyone from calculating the look angle and therefore the likely satellites that the dish is looking at. at another point, however, he mentions how the salt water corrosion destroyed an antenna array, but never seems to be able to figure out that radomes also protect the equipment inside from these very destructive elements. in general, a lot of nonsense that doesn't every get tied together. there is also this recurring theme about NZ's independence and it's nuclear-free shit. perhaps there are really people in NZ that care about this stuff, but in this day and age, it's hard to image that there would be. it's not like the book is poorly written or researched or anything like that, and it's certainly a hell of a lot more than i have done, but otherwise, ....... money isn't much of a problem to me, so i don't regret buying this book, but if you aren't in the same position, i'd give this one a miss. better to wait for the new release of The Puzzle Palace. BTW, does anyone have an update on this? are the authors having friendly chats with the boys from the fort, or something like that? if however, you really want to read it, the publishers were very prompt about selling me a copy and shipping it to me via air, and were generally pleasant to deal with. cheers, -paul

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

[This should make you feel better about GAK] New York Times: Thursday, November 21, 1996 Social Security Workers Held In Frauds Using Credit Cards By LYNDA RICHARDSON Federal officials announced the arrests of a group of Social Security Administration employees Wednesday, charging them with passing confidential information on at least 1,000 people to credit-card thieves for bribes as little as $10. Under the scheme, the employees would give out confidential information that would allow the credit-card thieves to use the cards when they made purchases. The authorities think the thieves were able to obtain the cards by stealing them through the mail, in some cases. The authorities said six current or former employees and a former security guard with the agency were arrested Tuesday in the scheme, which resulted in at least $10 million in losses to credit card issuers from October 1995 to this June. The credit card issuers are Citibank, Visa and Mastercard. The employees were charged with bribery and misuse of a government computer, and face prison terms of 2 to 15 years and fines up to $250,000. The arrests resulted from a federal investigation that began in February into what computer experts say may be one of the biggest breaches of security of federal government data on residents. Officials said 20 people have been arrested, including 10 current or former employees of the Social Security Administration. The scheme was first detected in February by Citibank, which noticed an unusual amount of fraudulent charges on credit cards it had mailed to customers but that the customers said they had not received, officials said. Like many banks, Citibank has a security procedure that requires customers who receive new cards to activate them by calling a toll-free telephone number and provide some personal information, like their mother's maiden name, to activate the credit card. The bank discovered that its security system had been foiled in dozens of cases in which cards were activated by someone who was not the cardholder but had access to the cardholder's mother's maiden name. Investigators for the Social Security Administration, which keeps files of maternal maiden names and records the identification number of employees who call up files, determined that an employee at the Brooklyn Social Security office had illegally looked at the personal records of nearly two dozen people and sold the information to conspirators, who activated credit cards, said Philip A. Gambino, an agency spokesman. Based on information from that employee, the agency identified several other employees who had illegally released confidential information, often in exchange for bribes. Those arrested this week were described as low-level workers, including claim representatives and clerks. In 1,000 cases, credit cards were activated using information illegally provided by the government employees, Gambino said. ``Most have been fired and the others are in the process of being fired,'' he said. Officials said the thieves who approached the Social Security employees already had access to Social Security numbers and wanted the numbers run through the agency's database. Social Security numbers are the closest thing to a universal identifier that Americans have, and are widely available from public sources like college and employee ID cards and hospital tags, and even driver's licenses in more than 30 states. The investigation has resulted in the arrests of nine people, including seven Nigerians, who are accused of receiving or using the stolen confidential information to commit various types of credit card fraud, said Brian F. Gimlett, the special agent in charge of the Secret Service in New York. He said the stolen or reissued credit cards were used to buy merchandise, obtain cash advances and line-of-credit checks and make illegal withdrawals from automated teller machines. Gimlett said the conspirators who approached the government workers were not part of an organized crime ring. ``Actually, most were individual operations, but doing the same type of crime,'' he said. ``This is another example of greedy people finding new ways to compromise the security systems to financially gain from credit card fraud and other types of fraud.'' EFT Report: November 20, 1996 Micro Card Targets U.S. Smart Card Market Bull CP8 Transac, of France, says it wants to help U.S. banks issue smart cards through its U.S. subsidiary, Micro Card Technologies, of Billerica, Mass. The company believes that 60 percent of the smart card opportunity resides here, says Gerald Hubbard, vice president of marketing. That market is expected to grow to a total of about $100 million to $200 million by the year 2000, according to industry figures. Debit and stored-value cards are targeted as the first smart-card applications to be issued in the United States. As a result, Micro Card is forming alliances throughout the card industry to penetrate the U.S. market. It recently partnered with NBS, of Plainfield, N.J., one of the nation's largest card manufacturers. Bull's strategy is similar to that of its competitors, says Ben Miller, president of CardTech/SecurTech in Bethesda, Md. All the world's major smart card firm are bringing smart card capabilities in from offshore and have set up acquisitions or partnerships with U.S. card manufacturers to build strength and confidence from American bankers, Miller says. Schlumberger, also of France, recently bought Malco. The existing manufacturing facilities are secure and card association compliant, helping the companies earn industry trust. The firms, in turn, receive an existing revenue stream from the magnetic stripe sales, Miller says. Micro Card claims it has the longest U.S. history of its competitors. It set up shop here in 1984 and has since participated in several smart card closed-system initiatives. For example, U.S. Marine Corp.'s recruits in Parris Island, S.C., receive their pay on CP8 Micro Cards, which are accepted at post exchanges for cash withdrawals and purchases. Micro Card also has been selected to provide half of the card readers in the Citibank and Chase Manhattan Bank smart card pilot in New York. Micro Card sells readers, encoders and several different types of cards ranging from the basic one-issuer, multiple-application system, called SCOT, to its high-end electronic purse card that can handle multiple applications from several unconnected service providers, says Hubbard. Its crypto card uses public key cryptography to secure transactions, Hubbard says. Micro Card's systems all contain microprocessors and comply with Europay, MasterCard and Visa (EMV) standards as well as International Standards Organization specifications, he adds. Micro Card also is partnering with Redmond, Wash.-based Microsoft and several smart card vendors to develop integration standards for smart cards and personal computers. Evening Standard (London): Monday, November 18, 1996 Smart Card Code is Cracked By Flora Hunter A Cambridge scientist has broken the smart card code, casting doubt over the card's future as the ultimate security device. Dr Ross Anderson's work, published today, has been kept secret for six months to allow institutions such as the Bank of England to review security. The Cambridge University computer expert claims his methods of accessing information from smart cards, which were previously thought impenetrable, could be used by organised criminals using simple equipment. He is warning banks and other financial institutions to rethink their security operations, as his breakthrough could lay bare the private financial secrets of everyone from governments to the holders of High Street bank accounts. Smart cards are used as identity tokens in satellite TV cards and bank cards. They are also used as top-level security passes at nuclear installations. The Government recently announced plans to store information such as driving licence, tax, social security and pension details on individual smart cards. Today, Dr Anderson said: 'For a number of years these smart cards and processors have been marketed as tamper-proof. If you try and get into their chip using whatever method, they are supposed to be inaccessible. 'We have developed techniques that can get into most of these smart cards and I believe they can all be accessed. Banks are moving away from magnetic cards towards smart cards to improve security but they are going to have to think again. 'They are going to have to rethink their whole security process because we have shown the security processors can be attacked with the kind of equipment available to any undergraduate. 'Organised criminals could use the techniques to cause disaster to financial institutions.' Smart cards can store information on a tiny microchip embedded in the plastic which lets the user access electronic and computer systems. Banks and other financial institutions must now make immediate changes to their sophisticated security systems, which could cost millions of pounds. In conjunction with an American colleague, Dr Anderson has perfected techniques that could cause havoc. Dr Anderson said: 'We have been in consultation with the Bank of England and various national intelligence agencies. We agreed to postpone publishing our paper to give them a chance to look at the findings. A lot of people have put all their eggs in one basket by relying on smart cards for security. Now the basket has been tipped over.' American Banker: Thursday, November 21, 1996 Wells, 31 Others Ease Downloading of Account Data from Internet By DREW CLARK Wells Fargo & Co. and 31 community banks and credit unions announced that their customers will be able to download account information from the Internet with the click of a button. The technology is one of the first uses of Microsoft Corp.'s set of standards for electronic financial connections, which were introduced last March. Called Active Statement Technology, advocates say that it will simplify the process of transferring account files from the World Wide Web to personal financial software programs. Making data on Web sites easier to download is likely to encourage banking customers to go to the sites, industry observers said. That, in turn, would offer banks more chance to promote their services on the Internet. "Today we offer both our Quicken and our Microsoft Money customers the ability to download information into their software spreadsheets," said Wells Fargo spokeswoman Janet Otsuki. But the features of Microsoft's new technology "will allow Money customers to have a more direct and more efficient downloading experience." The benefits of that arrangement are hardly accidental from the standpoint of Microsoft, which has been aggressively battling Intuit Inc. for a greater share of the personal financial software market. Intuit's Quicken leads Money by 75% to 20%, according to a recent independent consumer study. Microsoft offers its technology for free to all financial institutions, and it encourages banks to link their Web sites so that their customers will find a trial offer for the Money product. Competing Web browsers will be able to download financial data, but Microsoft Money 97 is the only financial software able automatically to receive the information. "We expect this will be a de facto technology that any bank would want to incorporate," said Matthew Cone, a business development manager at Microsoft. Others familiar with Active Statement Technology said the program's ability to recognize information that has already been recorded offers a crucial advantage over the widely used Quicken Import Format. "Comparing the Quicken Import Format to (Microsoft's technology) is like comparing apples to oranges," responded Intuit senior vice president Eric Dunn. "Automatic reconciling has been possible in both Quicken and Money for over a year." By now, 275 financial institutions offer some form of PC banking, and 46 let customers gain access to their accounts from the Web, according to the Seattle-based Online Banking Report. But encouraging customers to come over via the Web may hold benefits for banks. "Instead of starting with Money or Quicken, customers start at the bank's Web site," said Paul Fiore, chief executive of Digital Insight. The Camarillo, Calif., company has helped 28 credit unions develop transactional Web sites. Without having to pay Microsoft for a direct connection, all those institutions now offer their customers the ability to download their finances easily into Money 97. How soon will that affect consumers at those institutions? Cathi Cavanagh, home banking coordinator at the Plano, Tex., Community Credit Union, is already watching: "I am personally going to look to see if people are converting from Quicken to Microsoft Money."

1 0

Israel crypto restrictions
by Jyri Kaljundi 17 Dec '03

17 Dec '03

Does anyonw knoe about crypto export restrictions in Israel? The Crypto Law Survey (http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm) says that there are some restrictions, but "their scope is not clear". Also I have been iformed of occasions when a company in Israel does not export strong crypto. Still I believe I have seen many programs from Israel that have unlimited strong algorithms. The real question is, why can't Checkpoint who manufactures the Firewall-1 sell DES version in Europe, but only in US and Canada. Elsewhere they use a proprietary algorithm called FWZ (48-bit). I have not any analysis done on FWZ so I don't think anyone is using it. Jüri Kaljundi AS Stallion jk(a)stallion.ee WWW ja andmeturvateenused http://www.stallion.ee/

3 6

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

[This should make you feel better about GAK] New York Times: Thursday, November 21, 1996 Social Security Workers Held In Frauds Using Credit Cards By LYNDA RICHARDSON Federal officials announced the arrests of a group of Social Security Administration employees Wednesday, charging them with passing confidential information on at least 1,000 people to credit-card thieves for bribes as little as $10. Under the scheme, the employees would give out confidential information that would allow the credit-card thieves to use the cards when they made purchases. The authorities think the thieves were able to obtain the cards by stealing them through the mail, in some cases. The authorities said six current or former employees and a former security guard with the agency were arrested Tuesday in the scheme, which resulted in at least $10 million in losses to credit card issuers from October 1995 to this June. The credit card issuers are Citibank, Visa and Mastercard. The employees were charged with bribery and misuse of a government computer, and face prison terms of 2 to 15 years and fines up to $250,000. The arrests resulted from a federal investigation that began in February into what computer experts say may be one of the biggest breaches of security of federal government data on residents. Officials said 20 people have been arrested, including 10 current or former employees of the Social Security Administration. The scheme was first detected in February by Citibank, which noticed an unusual amount of fraudulent charges on credit cards it had mailed to customers but that the customers said they had not received, officials said. Like many banks, Citibank has a security procedure that requires customers who receive new cards to activate them by calling a toll-free telephone number and provide some personal information, like their mother's maiden name, to activate the credit card. The bank discovered that its security system had been foiled in dozens of cases in which cards were activated by someone who was not the cardholder but had access to the cardholder's mother's maiden name. Investigators for the Social Security Administration, which keeps files of maternal maiden names and records the identification number of employees who call up files, determined that an employee at the Brooklyn Social Security office had illegally looked at the personal records of nearly two dozen people and sold the information to conspirators, who activated credit cards, said Philip A. Gambino, an agency spokesman. Based on information from that employee, the agency identified several other employees who had illegally released confidential information, often in exchange for bribes. Those arrested this week were described as low-level workers, including claim representatives and clerks. In 1,000 cases, credit cards were activated using information illegally provided by the government employees, Gambino said. ``Most have been fired and the others are in the process of being fired,'' he said. Officials said the thieves who approached the Social Security employees already had access to Social Security numbers and wanted the numbers run through the agency's database. Social Security numbers are the closest thing to a universal identifier that Americans have, and are widely available from public sources like college and employee ID cards and hospital tags, and even driver's licenses in more than 30 states. The investigation has resulted in the arrests of nine people, including seven Nigerians, who are accused of receiving or using the stolen confidential information to commit various types of credit card fraud, said Brian F. Gimlett, the special agent in charge of the Secret Service in New York. He said the stolen or reissued credit cards were used to buy merchandise, obtain cash advances and line-of-credit checks and make illegal withdrawals from automated teller machines. Gimlett said the conspirators who approached the government workers were not part of an organized crime ring. ``Actually, most were individual operations, but doing the same type of crime,'' he said. ``This is another example of greedy people finding new ways to compromise the security systems to financially gain from credit card fraud and other types of fraud.'' EFT Report: November 20, 1996 Micro Card Targets U.S. Smart Card Market Bull CP8 Transac, of France, says it wants to help U.S. banks issue smart cards through its U.S. subsidiary, Micro Card Technologies, of Billerica, Mass. The company believes that 60 percent of the smart card opportunity resides here, says Gerald Hubbard, vice president of marketing. That market is expected to grow to a total of about $100 million to $200 million by the year 2000, according to industry figures. Debit and stored-value cards are targeted as the first smart-card applications to be issued in the United States. As a result, Micro Card is forming alliances throughout the card industry to penetrate the U.S. market. It recently partnered with NBS, of Plainfield, N.J., one of the nation's largest card manufacturers. Bull's strategy is similar to that of its competitors, says Ben Miller, president of CardTech/SecurTech in Bethesda, Md. All the world's major smart card firm are bringing smart card capabilities in from offshore and have set up acquisitions or partnerships with U.S. card manufacturers to build strength and confidence from American bankers, Miller says. Schlumberger, also of France, recently bought Malco. The existing manufacturing facilities are secure and card association compliant, helping the companies earn industry trust. The firms, in turn, receive an existing revenue stream from the magnetic stripe sales, Miller says. Micro Card claims it has the longest U.S. history of its competitors. It set up shop here in 1984 and has since participated in several smart card closed-system initiatives. For example, U.S. Marine Corp.'s recruits in Parris Island, S.C., receive their pay on CP8 Micro Cards, which are accepted at post exchanges for cash withdrawals and purchases. Micro Card also has been selected to provide half of the card readers in the Citibank and Chase Manhattan Bank smart card pilot in New York. Micro Card sells readers, encoders and several different types of cards ranging from the basic one-issuer, multiple-application system, called SCOT, to its high-end electronic purse card that can handle multiple applications from several unconnected service providers, says Hubbard. Its crypto card uses public key cryptography to secure transactions, Hubbard says. Micro Card's systems all contain microprocessors and comply with Europay, MasterCard and Visa (EMV) standards as well as International Standards Organization specifications, he adds. Micro Card also is partnering with Redmond, Wash.-based Microsoft and several smart card vendors to develop integration standards for smart cards and personal computers. Evening Standard (London): Monday, November 18, 1996 Smart Card Code is Cracked By Flora Hunter A Cambridge scientist has broken the smart card code, casting doubt over the card's future as the ultimate security device. Dr Ross Anderson's work, published today, has been kept secret for six months to allow institutions such as the Bank of England to review security. The Cambridge University computer expert claims his methods of accessing information from smart cards, which were previously thought impenetrable, could be used by organised criminals using simple equipment. He is warning banks and other financial institutions to rethink their security operations, as his breakthrough could lay bare the private financial secrets of everyone from governments to the holders of High Street bank accounts. Smart cards are used as identity tokens in satellite TV cards and bank cards. They are also used as top-level security passes at nuclear installations. The Government recently announced plans to store information such as driving licence, tax, social security and pension details on individual smart cards. Today, Dr Anderson said: 'For a number of years these smart cards and processors have been marketed as tamper-proof. If you try and get into their chip using whatever method, they are supposed to be inaccessible. 'We have developed techniques that can get into most of these smart cards and I believe they can all be accessed. Banks are moving away from magnetic cards towards smart cards to improve security but they are going to have to think again. 'They are going to have to rethink their whole security process because we have shown the security processors can be attacked with the kind of equipment available to any undergraduate. 'Organised criminals could use the techniques to cause disaster to financial institutions.' Smart cards can store information on a tiny microchip embedded in the plastic which lets the user access electronic and computer systems. Banks and other financial institutions must now make immediate changes to their sophisticated security systems, which could cost millions of pounds. In conjunction with an American colleague, Dr Anderson has perfected techniques that could cause havoc. Dr Anderson said: 'We have been in consultation with the Bank of England and various national intelligence agencies. We agreed to postpone publishing our paper to give them a chance to look at the findings. A lot of people have put all their eggs in one basket by relying on smart cards for security. Now the basket has been tipped over.' American Banker: Thursday, November 21, 1996 Wells, 31 Others Ease Downloading of Account Data from Internet By DREW CLARK Wells Fargo & Co. and 31 community banks and credit unions announced that their customers will be able to download account information from the Internet with the click of a button. The technology is one of the first uses of Microsoft Corp.'s set of standards for electronic financial connections, which were introduced last March. Called Active Statement Technology, advocates say that it will simplify the process of transferring account files from the World Wide Web to personal financial software programs. Making data on Web sites easier to download is likely to encourage banking customers to go to the sites, industry observers said. That, in turn, would offer banks more chance to promote their services on the Internet. "Today we offer both our Quicken and our Microsoft Money customers the ability to download information into their software spreadsheets," said Wells Fargo spokeswoman Janet Otsuki. But the features of Microsoft's new technology "will allow Money customers to have a more direct and more efficient downloading experience." The benefits of that arrangement are hardly accidental from the standpoint of Microsoft, which has been aggressively battling Intuit Inc. for a greater share of the personal financial software market. Intuit's Quicken leads Money by 75% to 20%, according to a recent independent consumer study. Microsoft offers its technology for free to all financial institutions, and it encourages banks to link their Web sites so that their customers will find a trial offer for the Money product. Competing Web browsers will be able to download financial data, but Microsoft Money 97 is the only financial software able automatically to receive the information. "We expect this will be a de facto technology that any bank would want to incorporate," said Matthew Cone, a business development manager at Microsoft. Others familiar with Active Statement Technology said the program's ability to recognize information that has already been recorded offers a crucial advantage over the widely used Quicken Import Format. "Comparing the Quicken Import Format to (Microsoft's technology) is like comparing apples to oranges," responded Intuit senior vice president Eric Dunn. "Automatic reconciling has been possible in both Quicken and Money for over a year." By now, 275 financial institutions offer some form of PC banking, and 46 let customers gain access to their accounts from the Web, according to the Seattle-based Online Banking Report. But encouraging customers to come over via the Web may hold benefits for banks. "Instead of starting with Money or Quicken, customers start at the bank's Web site," said Paul Fiore, chief executive of Digital Insight. The Camarillo, Calif., company has helped 28 credit unions develop transactional Web sites. Without having to pay Microsoft for a direct connection, all those institutions now offer their customers the ability to download their finances easily into Money 97. How soon will that affect consumers at those institutions? Cathi Cavanagh, home banking coordinator at the Plano, Tex., Community Credit Union, is already watching: "I am personally going to look to see if people are converting from Quicken to Microsoft Money."

1 0

Smart card attacks vs. clipper?
by Mike McNally 17 Dec '03

17 Dec '03

Has any work been done (yet) using the recently-publicised techniques used to foil smart card tamperproofing against Clipper implementations? Seems like it's a bit of a different story, since in the Clipper's case the algorithm is (ostensibly) unknown, but I'm just curious as to whether there is some compromise of its security-through-obscurity. -- ______c_________________________________________________________________ Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data http://www.io.com/~m101/ * processing" are different!

1 0

Forming a multinational
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

Hi, I am physically located in India and want to start up a US firm that will operate in India. Basically the firm will be a multonational with regional offices in couple of countries, to start with India and prolly one somewhere in Europe sometime later. The business involves a tie up with another US firm. These people will obviosly require USD payements, while most of the money we'll make will be in Indian rupees, since initially we'll be _actually_ operating only in India. The problems here are : x. Can I, an Indian citizen start a US firm? x. Is it _legal_ to transfer Rupees funds to our root US firm and buy dollars with it to pay our partners there? x. Who will sell us USDs? Foreign Exchange offices? Firms like Accu-Rate? x. What is the tax situation in US for non-citizens? x. Is US the best place to start such a firm, primary need is to be able to pay dollars to US partner, while earning in rupees, without any legal hassles. Any help will be appreiciated, Best, Vipul -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

Re: Symantec's claim.
by cvhd＠indyweb.net 17 Dec '03

17 Dec '03

At 03:45 PM 11/25/96 +0200, you wrote: >In light of recent claims,i would like somebody to clear this up for me. I'll try... >There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. >Symantec denies it's existence,although i hear differently?? You "hear" incorrectly... >Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt >usually deal with this topic of thought ;) That's correct. Try subscribing to the the Virus List Digest for this type of information. >Anyone come across the pkz300 trojan,if you have it send it please. Yeah, Right... >A student,a paper,and a possible future career are at stake here,so please dig deep into your >pockets!!!!!! Asking a lot i know! Well, gee since a student, a paper and a possible future career are at stake, here goes.... __________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Internet Hoaxes: PKZ300, Irina, Good Times, Deeyenda, Ghost November 20, 1996 15:00 GMT Number H-05 ______________________________________________________________________________ PROBLEM: This bulletin addresses the following hoaxes and erroneous warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and Ghost.exe PLATFORM: All, via e-mail DAMAGE: Time lost reading and responding to the messages SOLUTION: Pass unvalidated warnings only to your computer security department or incident response team. See below on how to recognize validated and unvalidated warnings and hoaxes. ______________________________________________________________________________ VULNERABILITY New hoaxes and warnings have appeared on the Internet and old ASSESSMENT: hoaxes are still being cirulated. ______________________________________________________________________________ Introduction ============ The Internet is constantly being flooded with information about computer viruses and Trojans. However, interspersed among real virus notices are computer virus hoaxes. While these hoaxes do not infect systems, they are still time consuming and costly to handle. At CIAC, we find that we are spending much more time de-bunking hoaxes than handling real virus incidents. This advisory addresses the most recent warnings that have appeared on the Internet and are being circulated throughout world today. We will also address the history behind virus hoaxes, how to identify a hoax, and what to do if you think a message is or is not a hoax. Users are requested to please not spread unconfirmed warnings about viruses and Trojans. If you receive an unvalidated warning, don't pass it to all your friends, pass it to your computer security manager to validate first. Validated warnings from the incident response teams and antivirus vendors have valid return addresses and are usually PGP signed with the organization's key. PKZ300 Warning ============== The PKZ300 Trojan is a real Trojan program, but the initial warning about it was released over a year ago. For information pertaining to PKZ300 Trojan reference CIAC Notes issue 95-10, that was released in June of 1995. http://ciac.llnl.gov/ciac/notes/Notes10.shtml The warning itself, on the other hand, is gaining urban legend status. There has been an extremely limited number of sightings of this Trojan and those appeared over a year ago. Even though the Trojan warning is real, the repeated circulation of the warning is a nuisance. Individuals who need the current release of PKZIP should visit the PKWARE web page at http://www.pkware.com. CIAC recommends that you DO NOT recirculate the warning about this particular Trojan. Irina Virus Hoax ================ The "Irina" virus warnings are a hoax. The former head of an electronic publishing company circulated the warning to create publicity for a new interactive book by the same name. The publishing company has apologized for the publicity stunt that backfired and panicked Internet users worldwide. The original warning claimed to be from a Professor Edward Pridedaux of the College of Slavic Studies in London; there is no such person or college. However, London's School of Slavonic and East European Studies has been inundated with calls. This poorly thought-out publicity stunt was highly irresponsible. For more information pertaining to this hoax, reference the UK Daily Telegraph at http://www.telegraph.co.uk. Good Times Virus Hoax ===================== The "Good Times" virus warnings are a hoax. There is no virus by that name in existence today. These warnings have been circulating the Internet for years. The user community must become aware that it is unlikely that a virus can be constructed to behave in the manner ascribed in the "Good Times" virus warning. For more information related to this urban legend, reference CIAC Notes 95-09. http://ciac.llnl.gov/ciac/notes/Notes09.shtml Deeyenda Virus Hoax =================== The "Deeyenda" virus warnings are a hoax. CIAC has received inqueries regarding the validity of the Deeyenda virus. The warnings are very similar to those for Good Times, stating that the FCC issued a warning about it, and that it is self activating and can destroy the contents of a machine just by being downloaded. Users should note that the FCC does not and will not issue virus or Trojan warnings. It is not their job to do so. As of this date, there are no known viruses with the name Deeyenda in existence. For a virus to spread, it must be executed. Reading a mail message does not execute the mail message. Trojans and viruses have been found as executable attachments to mail messages, but they must be extracted and executed to do any harm. CIAC still affirms that reading E-mail, using typical mail agents, can not activate malicious code delivered in or with the message. Ghost.exe Warning ================= The Ghost.exe program was originally distributed as a free screen saver containing some advertising information for the author's company (Access Softek). The program opens a window that shows a Halloween background with ghosts flying around the screen. On any Friday the 13th, the program window title changes and the ghosts fly off the window and around the screen. Someone apparently got worried and sent a message indicating that this might be a Trojan. The warning grew until the it said that Ghost.exe was a Trojan that would destroy your hard drive and the developers got a lot of nasty phone calls (their names and phone numbers were in the About box of the program.) A simple phone call to the number listed in the program would have stopped this warning from being sent out. The original ghost.exe program is just cute; it does not do anything damaging. Note that this does not mean that ghost could not be infected with a virus that does do damage, so the normal antivirus procedure of scanning it before running it should be followed. History of Virus Hoaxes ======================= Since 1988, computer virus hoaxes have been circulating the Internet. In October of that year, according to Ferbrache ("A pathology of Computer Viruses" Springer, London, 1992) one of the first virus hoaxes was the 2400 baud modem virus: SUBJ: Really Nasty Virus AREA: GENERAL (1) I've just discovered probably the world's worst computer virus yet. I had just finished a late night session of BBS'ing and file treading when I exited Telix 3 and attempted to run pkxarc to unarc the software I had downloaded. Next thing I knew my hard disk was seeking all over and it was apparently writing random sectors. Thank god for strong coffee and a recent backup. Everything was back to normal, so I called the BBS again and downloaded a file. When I went to use ddir to list the directory, my hard disk was getting trashed again. I tried Procomm Plus TD and also PC Talk 3. Same results every time. Something was up so I hooked up to my test equipment and different modems (I do research and development for a local computer telecommunications company and have an in-house lab at my disposal). After another hour of corrupted hard drives I found what I think is the world's worst computer virus yet. The virus distributes itself on the modem sub- carrier present in all 2400 baud and up modems. The sub-carrier is used for ROM and register debugging purposes only, and otherwise serves no othr (sp) purpose. The virus sets a bit pattern in one of the internal modem registers, but it seemed to screw up the other registers on my USR. A modem that has been "infected" with this virus will then transmit the virus to other modems that use a subcarrier (I suppose those who use 300 and 1200 baud modems should be immune). The virus then attaches itself to all binary incoming data and infects the host computer's hard disk. The only way to get rid of this virus is to completely reset all the modem registers by hand, but I haven't found a way to vaccinate a modem against the virus, but there is the possibility of building a subcarrier filter. I am calling on a 1200 baud modem to enter this message, and have advised the sysops of the two other boards (names withheld). I don't know how this virus originated, but I'm sure it is the work of someone in the computer telecommunications field such as myself. Probably the best thing to do now is to stick to 1200 baud until we figure this thing out. Mike RoChenle This bogus virus description spawned a humorous alert by Robert Morris III : Date: 11-31-88 (24:60) Number: 32769 To: ALL Refer#: NONE From: ROBERT MORRIS III Read: (N/A) Subj: VIRUS ALERT Status: PUBLIC MESSAGE Warning: There's a new virus on the loose that's worse than anything I've seen before! It gets in through the power line, riding on the powerline 60 Hz subcarrier. It works by changing the serial port pinouts, and by reversing the direction one's disks spin. Over 300,000 systems have been hit by it here in Murphy, West Dakota alone! And that's just in the last 12 minutes. It attacks DOS, Unix, TOPS-20, Apple-II, VMS, MVS, Multics, Mac, RSX-11, ITS, TRS-80, and VHS systems. To prevent the spresd of the worm: 1) Don't use the powerline. 2) Don't use batteries either, since there are rumors that this virus has invaded most major battery plants and is infecting the positive poles of the batteries. (You might try hooking up just the negative pole.) 3) Don't upload or download files. 4) Don't store files on floppy disks or hard disks. 5) Don't read messages. Not even this one! 6) Don't use serial ports, modems, or phone lines. 7) Don't use keyboards, screens, or printers. 8) Don't use switches, CPUs, memories, microprocessors, or mainframes. 9) Don't use electric lights, electric or gas heat or airconditioning, running water, writing, fire, clothing or the wheel. I'm sure if we are all careful to follow these 9 easy steps, this virus can be eradicated, and the precious electronic flui9ds of our computers can be kept pure. ---RTM III Since that time virus hoaxes have flooded the Internet.With thousands of viruses worldwide, virus paranoia in the community has risen to an extremely high level. It is this paranoia that fuels virus hoaxes. A good example of this behavior is the "Good Times" virus hoax which started in 1994 and is still circulating the Internet today. Instead of spreading from one computer to another by itself, Good Times relies on people to pass it along. How to Identify a Hoax ====================== There are several methods to identify virus hoaxes, but first consider what makes a successful hoax on the Internet. There are two known factors that make a successful virus hoax, they are: (1) technical sounding language, and (2) credibility by association. If the warning uses the proper technical jargon, most individuals, including technologically savy individuals, tend to believe the warning is real. For example, the Good Times hoax says that "...if the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop which can severely damage the processor...". The first time you read this, it sounds like it might be something real. With a little research, you find that there is no such thing as an nth-complexity infinite binary loop and that processors are designed to run loops for weeks at a time without damage. When we say credibility by association we are referring to whom sent the warning. If the janitor at a large technological organization sends a warning to someone outside of that organization, people on the outside tend to believe the warning because the company should know about those things. Even though the person sending the warning may not have a clue what he is talking about, the prestigue of the company backs the warning, making it appear real. If a manager at the company sends the warning, the message is doubly backed by the company's and the manager's reputations. Individuals should also be especially alert if the warning urges you to pass it on to your friends. This should raise a red flag that the warning may be a hoax. Another flag to watch for is when the warning indicates that it is a Federal Communication Commission (FCC) warning. According to the FCC, they have not and never will disseminate warnings on viruses. It is not part of their job. CIAC recommends that you DO NOT circulate virus warnings without first checking with an authoritative source. Authoritative sources are your computer system security administrator or a computer incident advisory team. Real warnings about viruses and other network problems are issued by different response teams (CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by the sending team using PGP. If you download a warning from a teams web site or validate the PGP signature, you can usually be assured that the warning is real. Warnings without the name of the person sending the original notice, or warnings with names, addresses and phone numbers that do not actually exist are probably hoaxes. What to Do When You Receive a Warning ===================================== Upon receiving a warning, you should examine its PGP signature to see that it is from a real response team or antivirus organization. To do so, you will need a copy of the PGP software and the public signature of the team that sent the message. The CIAC signature is available from the CIAC web server at: http://ciac.llnl.gov If there is no PGP signature, see if the warning includes the name of the person submitting the original warning. Contact that person to see if he/she really wrote the warning and if he/she really touched the virus. If he/she is passing on a rumor or if the address of the person does not exist or if there is any questions about theauthenticity or the warning, do not circulate it to others. Instead, send the warning to your computer security manager or incident response team and let them validate it. When in doubt, do not send it out to the world. Your computer security managers and the incident response teams teams have experts who try to stay current on viruses and their warnings. In addition, most anti-virus companies have a web page containing information about most known viruses and hoaxes. You can also call or check the web site of the company that produces the product that is supposed to contain the virus. Checking the PKWARE site for the current releases of PKZip would stop the circulation of the warning about PKZ300 since there is no released version 3 of PKZip. Another useful web site is the "Computer Virus Myths home page" (http://www.kumite.com/myths/) which contains descriptions of several known hoaxes. In most cases, common sense would eliminate Internet hoaxes. - ----------------------------------------------------------------------------- CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 510-422-8193 FAX: +1 510-423-8002 STU-III: +1 510-423-2604 E-mail: ciac(a)llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC duty person, and the secondary PIN number, 8550074 is for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://ciac.llnl.gov/ Anonymous FTP: ciac.llnl.gov (128.115.19.53) Modem access: +1 (510) 423-4753 (28.8K baud) +1 (510) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. CIAC-NOTES for Notes, a collection of computer security articles; 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 4. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called ListProcessor, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or SPI-NOTES for list-name and valid information for LastName FirstName and PhoneNumber when sending E-mail to ciac-listproc(a)llnl.gov: subscribe list-name LastName, FirstName PhoneNumber e.g., subscribe ciac-notes OHara, Scarlett W. 404-555-1212 x36 You will receive an acknowledgment containing address, initial PIN, and information on how to change either of them, cancel your subscription, or get help. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver(a)first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) G-43: Vulnerabilities in Sendmail G-44: SCO Unix Vulnerability G-45: Vulnerability in HP VUE G-46: Vulnerabilities in Transarc DCE and DFS G-47: Unix FLEXlm Vulnerabilities G-48: TCP SYN Flooding and IP Spoofing Attacks H-01: Vulnerabilities in bash H-02: SUN's TCP SYN Flooding Solutions H-03: HP-UX_suid_Vulnerabilities H-04: HP-UX Ping Vulnerability RECENT CIAC NOTES ISSUED (Previous Notes available from CIAC) Notes 07 - 3/29/95 A comprehensive review of SATAN Notes 08 - 4/4/95 A Courtney update Notes 09 - 4/24/95 More on the "Good Times" virus urban legend Notes 10 - 6/16/95 PKZ300B Trojan, Logdaemon/FreeBSD, vulnerability in S/Key, EBOLA Virus Hoax, and Caibua Virus Notes 11 - 7/31/95 Virus Update, Hats Off to Administrators, America On-Line Virus Scare, SPI 3.2.2 Released, The Die_Hard Virus Notes 12 - 9/12/95 Securely configuring Public Telnet Services, X Windows, beta release of Merlin, Microsoft Word Macro Viruses, Allegations of Inappropriate Data Collection in Win95 Notes 96-01 - 3/18/96 Java and JavaScript Vulnerabilities, FIRST Conference Announcement, Security and Web Search Engines, Microsoft Word Macro Virus Update C.V.H.D. Lord, grant me the serenity to accept the things I cannot change, the courage to change the things I can, and the wisdom to hide the bodies of the people I had to kill because they pissed me off!

2 1

SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by sameer 17 Dec '03

17 Dec '03

For Release November 25, 1996 C2Net Contact: Douglas Barnes, +1 510 986 8770 UK Web Contact: Dave Williams, +44 0113 222 0046 SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE Oakland, CA -- C2Net and UK Web, Ltd., announced today the beta release of a new product, "SafePassage Web Proxy." International users of popular web browsers such as Netscape or Microsoft Internet Explorer can use SafePassage to make secure web connections using full-strength cryptography. Prior to this release, international users of these browsers had to use weak cryptography, which could be easily broken. "SafePassage is the perfect complement to our Stronghold web server," said Mark Cox, Stronghold Product Manager for UK Web. "we've been marketing the international version of Stronghold with full strength cryptography for two months now, but we knew we would need matching strong cryptography on the browser side as well. SafePassage Web Proxy answers this need." SafePassage provides secure connections using strong cryptography for any browser that supports standard SSL tunneling. It currently runs on Windows 3.1 and Windows 95. "We don't believe in using codes so weak that foreign governments, criminals or bored college students can break them," said C2Net President Sameer Parekh, "we also oppose plans to put all your cryptography keys in a few places, where they can be sold to the highest bidder by traitors like Aldrich Ames, or recent suspect Harold J. Nicholson." Current "export" versions of Netscape and MSIE use a weak cipher that has been broken by online groups, such as the "Cypherpunks." Companies like HP and IBM, bowing to government pressure, have been promoting seemingly innocuous "key recovery" plans that would require centralized key storage and easy government access to -- or abuse of -- cryptography keys. Beta versions of SafePassage can be downloaded at no cost from UK Web's site at: http://stronghold.ukweb.com/safepassage. It is currently unavailable for distribution within the US and Canada, but a domestic version will be made available in the near future. The final release will be free for personal, educational, or other non-commercial use; for information on site licenses and bundling, send e-mail to safepassage(a)c2.net; or by phone, contact Douglas Barnes at +1 510 986 8773, or Dave Williams at +44 0113 222 0046. UK Web Limited is a leading Internet services company specialising in server technology, Internet security, business solutions and effective site design. C2Net is the leading provider of uncompromising security on the Internet. C2Net provides a wide array of Internet privacy services and powerful network security software. Netscape Navigator and Netscape Enterprise are trademarks of Netscape Communications Corporation. Microsoft Internet Explorer and Microsoft Internet Information Server are trademarks of Microsoft Corporation. Stronghold and SafePassage are trademarks of C2Net.

2 1

Where do I send this to get them stopped?
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, How can we stop such aweful programs? Is there a group I can send this to who trouble shoots spam? thanks, -lile (a webmaster(a)art.net) ----- Begin Included Message ----- >From 10ehnmugs6l6(a)MAIL-CLUSTER.PCY.MCI.NET Sun Nov 24 11:40:48 1996 Date: Sun, 24 Nov 1996 12:45:02 +0000 From: Emerald(a)earthstar.com Subject: FREE demo To: Emerald11249601(a)MAIL-CLUSTER.PCY.MCI.NET Reply-to: Emerald(a)earthstar.com MIME-version: 1.0 X-Mailer: Pegasus Mail for Windows (v2.32) Content-Type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Priority: normal Comments: Authenticated sender is <10ehnmugs6l6(a)mail14.MCI2000.com> Content-Length: 175 Are you interested in sending bulk e-mails? I know of a great new program! You can even test out the demo for FREE! Send me an e-mail for more details. Emerald(a)earthstar.com ----- End Included Message -----

1 0

(Fwd) New Mersenne Prime!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- New Mersenne Prime! 2^1398269-1 is prime! ------------------------------------------ Thanks to everyone's hard work, GIMPS (Great Internet Mersenne Prime Search) has discovered the 35th known Mersenne Prime! Joel Armengaud made the discovery on November 13. Amazingly, he kept this secret while he double-checked the find on two other computers. On the 18th, he notified Richard Crandall, Chris Caldwell, and myself. I verified it on my machine on the 20th. Slowinski, who was out of town at the time, provided the independent verification on the 22nd. More information can be found at these three web sites: http://www.sjmercury.com/business/compute/prime1122.htm http://ourworld.compuserve.com/homepages/justforfun/1398269.htm http://www.utm.edu/research/primes/notes/1398269.html As had been agreed upon before hand, credit for this new prime will go to Armengaud, Woltman, et. al. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Pyramid schemes and cryptoanarchy
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 11:23 AM 11/10/96 -0500, clay.olbon(a)dynetics.com wrote: >It seems that pyramid scheme spamming has increased of late (if that is >possible!). In my lifetime, I can only remember a single snail-mail >instance of a pyramid scheme - over the net it is an entirely different >story (although the number of instances is probably proportional to the >number of lists I subsribe to). With fully anonymous digital cash will come >the ability to develop untraceable pyramid schemes. As a staunch believer >in the free market, I find laws against these schemes distasteful, quite >hypocrytical (i.e. Social Security), and soon to be unenforceable. Aside from illegality, snail-mail pyramid spamming is rare because it costs enough money per piece of mail that it's hard to make money given the fraction of recipients who are both suckers and not too lazy to respond. Email, on the other hand, is cheap, and sending large quantities is easy. So you can expect to see a lot more email pyramid spamming, and electronic money, whether digicash or traceable, will make it more popular. On the other hand, I don't see anonymity helping it much - to the extent that the public understands it, they'll realize that the people higher up on the pyramid may all be tentacles, and they've got to mail out an address that's "theirs" to collect any money from lower-down suckers. Dealing with complexity tends to encourage clues, or at least delay, which is death for most pyramid scams. Pyramid schemes benefit more from traceable cash and non-anonymous suckers who can be targeted for later scams. Multi-level marketing reacts interestingly with the Internet. Where it's relatively legitimate, rather than a scam, it's a scaleable way for a company to hire a bunch of sales people that grows about as fast as the sales of the product, who don't have to be paid if sales drop off, and pay for advertising through sales people and word-of-mouth rather than expensive broadcasting. The Internet and electronic communication in general encourage small, flexible niche businesses that grow, sell stuff, and close. So MLM is useful for them, especially if their product is physical stuff rather than bits, and lower transaction costs make it easier to pay the sales people (either anonymously or taxably....) On the other hand, lower transaction costs make it easy to broadcast and deliver information to potential customers and deliver stuff by NextDayAir, and of course you can deliver bits for almost-free. So MLM probably won't work well for commodities with competing suppliers, like phone cards, soap, and high-tech motor oil, but may survive for products where personal recommendations are important, like Super Blue-Green Algae and Smart Drugs, (where the sales rep and customer know each other and anonymity at most keeps out greedy tax collectors and meddling FDA censors) or where the sales person performs some useful part of the process, like made-to-measure lingerie or direct personal loan collections. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

Provably "Secure" Crypto (was: IPG Algorithm Broken!)
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Our friend Don Woods seems to have inadvertently sparked what could be a useful and serious discussion regarding "provably secure cryptography." Not to be confused with the usual "unbreakable" snake oil we see peddled so often, I refer to systems for which rigorous mathematical proof that "there are no shortcuts" exists. To my knowledge, no such systems, with the exception of a real one-time pad, exist today. However, I also under the impression that ongoing research on this topic continues. For example, consider the work being done on "Lattice" cryptosystems (see http://jya.com/lattice.htm) "diGriz" is right. Nothing precludes the existence of a cryptographic algorithm for which a rigorous mathematical proof of "security" exists --- where "security" means a provable lower bound on the time required for recovery of the key. Indeed, it seems that finding such an algorithm --- or providing the necessary rigorous proof for a current algorithm --- is a laudable goal of academic cryptographic research. Rigorous proofs of the non-existence of an algorithm are not new. Neither are rigorous proofs that any algorithm which can solve a given problem requires a minimal running time. Or, in an even stronger sense, that a particular known algorithm for a given problem is indeed a (provably) optimal algorithm for that problem. For a (non-cryptographic) example of a proof of the first sort --- that is, that "there exists no algorithm" --- consider the famous "Halting Problem" for Turing machines. (I believe someone else has also mentioned this.) There are many proofs such as this one, often related, though the Halting Problem itself is perhaps the most famous example. For an (again, non-cryptographic) example of a proof of the second sort --- that is, that "any algorithm that solves a given problem requires a minimal running time" --- consider the proof that the "minimal" number of key comparisons in the worst case required to sort a random list of elements for which only an ordering relationship is known is O(nlog(n)). See Knuth, Volume 3, section 5.3. For a simpler example, a standard "binary" search which requires O(log(n)) comparisons to find a given element in the worst case is provably the optimal algorithm for this task. Turning once again to cryptography, there is presumably an "optimal" algorithm for factoring a "general" number in the "worst" case. Of course, known algorithms for factorization seem to regularly improve and no one has even suggested that any current algorithm is (provably) the "optimal" algorithm. Worse case bounds on running time for currently known algorithms can certainly be produced, but no one currently knows if these are the best algorithms. However, just as one can say, "How do you know that tomorrow some brilliant mathematician will not produce a polynomial time factorization algorithm?" one can also say, "How do you know that tomorrow some brilliant mathematician will not provide a rigorous proof that all factorization algorithms --- in the worse case --- require some specified minimal running time?" While the current state of mathematical knowledge suggests that this is not likely to happen anytime soon for the factorization problem, it is encouraging to see work in areas where more rigorous proofs of security are within closer reach. Again, I refer to work on Lattice problems. If the types of rigorous proof regarding "what can't be done" that are known for the Halting Problem, sorting, and searching are available for cryptographic problems, then this is indeed a major (and laudable) advance in cryptography. Obviously, discussion on this topic is unrelated to such security problems as implementation mistakes, fault analysis, outright theft of keys, etc. I hope that I've been careful to explain what I mean by "provably secure" and that it's not interpreted to include these types of attacks. I'm interested in the current state of research (if any) on this topic. Other than what John Young sent to the list some time ago about Lattice stuff --- which is certainly far from prime time --- I've not seen anything else. I also haven't devoted a lot of time to looking. Relevant pieces of the earlier thread are included below. Comments, anyone? Dana W. Albrecht dwa(a)corsair.com ---------------------------------------------------------------------------- Eric Murray <ericm(a)lne.com> writes: > Don Wood <wichita(a)cyberstation.net> writes: > > Do not belive it, it will never happen. It is impossible, and we can > > prove it to your satisfaction. > > No, you can't. It's impossible to prove an algorithim unbreakable. > You can only say that it hasn't been broken yet, but you can't > predict the advances in cryptoanalysis. > > If, in two or three years, no one's broken it then maybe it'll seem > like a reasonably-secure algorithim. Of course when someone does break > it you'll just say "oh, that wasn't the real algorithim" like you did > last time. [ Snip ] > You can't prove a negative. The best IPG could say is that > it can't be broken with current technology. > Next week someone might come up with a new way > to break ciphers that renders the IPG algorithim breakable. > > You point could have been that the same problem exists > for proofs- that next week someone could come up > with a way to prove, for all time, that an algorithim > really IS unbreakable. So, to cover that posibility > I should have said "it's currently impossible to > prove an algorithim unbreakable". :-) ---------------------------------------------------------------------------- "diGriz" anonymously writes: > The good news is that you can prove a negative. For example, it has > been proven that there is no algorithm which can tell in all cases > whether an algorithm will stop. [ Snip ] > The best they can say is what they did say: they have a proof that > their system is unbreakable. What you question, quite reasonably, > is whether they have such a proof. [ Snip ] > Or, more accurately, nobody credible has seen such a proof. But, a > clever person might invent one. ---------------------------------------------------------------------------- The Deviant <deviant(a)pooh-corner.com> writes: > No, he was right. They can't prove that their system is unbreakable. > They _might_ be able to prove that their system hasn't been broken, and > they _might_ be able to prove that it is _unlikely_ that it will be, but > they *CAN NOT* prove that it is unbreakable. This is the nature of > cryptosystems. > > > >The best IPG could say is that > > >it can't be broken with current technology. > > >Next week someone might come up with a new way > > >to break ciphers that renders the IPG algorithim breakable. > > > > The best they can say is what they did say: they have a proof that > > their system is unbreakable. What you question, quite reasonably, > > is whether they have such a proof. > > It is impossible to prove such a thing. It's like saying you have proof > that you have the last car of a certain model ever to be built. Anybody > could come along and build another, and then you don't have the last one. > > > > > >You point could have been that the same problem exists > > >for proofs- that next week someone could come up > > >with a way to prove, for all time, that an algorithim > > >really IS unbreakable. So, to cover that posibility > > >I should have said "it's currently impossible to > > >prove an algorithim unbreakable". :-) > > > > Or, more accurately, nobody credible has seen such a proof. But, a > > clever person might invent one. > > There *IS NO SUCH PROOF*. Just like you can't prove that god created the > universe, or that Oswald shot Kennedy, and so on and so forth. It can't > be proven. It never has been proven, and it never will be proven. People > have new ideas, new algorithms are invented. Someday, somebody will crack > _all_ the cryptosystems that have now been invented. [ Snip ] > diGriz anonymous writes: > > At 6:56 PM 11/23/1996, The Deviant wrote: > > >No, he was right. They can't prove that their system is unbreakable. > > >They _might_ be able to prove that their system hasn't been broken, and > > >they _might_ be able to prove that it is _unlikely_ that it will be, but > > >they *CAN NOT* prove that it is unbreakable. This is the nature of > > >cryptosystems. > > > > Please prove your assertion. > > > > If you can't prove this, and you can't find anybody else who has, why > > should we believe it? > > Prove it? Thats like saying "prove that the sun is bright on a sunny > day". Its completely obvious. If somebody has a new idea on how to > attack their algorithm, it might work. Then the system will have been > broken. You never know when somebody will come up with a new idea, so the > best you can truthfully say is "it hasn't been broken *YET*". As I > remember, this was mentioned in more than one respected crypto book, > including "Applied Cryptography" (Schneier). ---------------------------------------------------------------------------- "diGriz" Anonymously responds: > Page number? > > Perhaps it would be helpful to hear a possible proof. If somebody > were to show that breaking a certain cryptographic algorithm was > NP-complete, many people would find this almost as good as proof that > the algorithm is unbreakable. > > Then if a clever person were to show that the NP-complete problems > were not solvable in any faster way than we presently know how, you > would have proof that a cryptographic algorithm was unbreakable. > > There is no obvious reason why such a proof is not possible. > > diGriz

8 7

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

>Is the concept here that: Whereas conventional crypto generates/hashes >a *key* with which to encode the text, IPG generates a *pad* from a key, >more or less the length of the text, with which to encode the text?? It makes no difference whatsoever, no PRNG can have more entropy in the output stream than there was in the initial seed. Indeed, in general, the longer the PRNG runs for the more chance an adversary has of breaking it due to an increased amount of output. >It seems to me they're putting an additional layer of stuff ("OTP") between >the key generation and the actual encoding, so what's the problem with that, >as a concept? Well for a start it`s not a one time pad because that requires a totally real random pad. They have a stream cipher, as for whether it is any good or not I would normally not trust a man with the talent for bullshit Don Wood has. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

4 3

Anarcho-Science Fiction
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:08 am -0500 11/24/96, Roy M. Silvernail wrote: >[ I freely admit this is noise ] Yeah. What he said. >C'mon, both of you... 'First Contact' falls _way_ short of Doc Smithean >proportions. Although Data's charade did kinda remind me of the fourth >Skylark book, in terms of plot-device rescue of a failing direction. >(IMHO, Doc Smith is the master of the over-the-top school of sci-fi >plotting) Unfortunately, I've had trouble sticking my tounge in my cheek far enough for people to see it lately. My apologies. >> Even Babylon 5, AKA "Science Fiction He Wrote", has a bigger clue. > >B5 is my current favorite TV sci-fi, when I even turn the damned thing >on. Ditto. Again, I was trying so hard to be facile that I wasn't clear enough. :-). For all the constraints of televised science fiction, I *really* like JMS and B5. Especially compared to the pseudoscientific sugar-coated totalitarian happy horseshit that passes for Star "Treck" these days. Much less such scienceless silliness as the X-Files, or Lois and Clark. However, at the risk of being forced into the trap of science fiction which tells more about when it was written than the future, I find the presentation in science fiction of faster-than-light travel, "alien" visits or travel to "alien" cultures, time travel, prophecy, telepathy, (or any other pseudomystical claptrap) to be extremely annoying. Almost as annoying as "fantasy", which doesn't even belong near the science fiction bookrack (how about the "romance novels" section? ;-)). Much less, a science fiction bookstore. For instance, I think the concepts of faster-than-light travel and anything beyond rudimentary interstellar radio reception of other civilizations belongs in the era of the Lensman's "inertialess" drive. An almost pretelegraphic, age-of-sail world view, developd when sea power was still the dominant form of "projecting" force. However, I do look forward to science fiction with cryptoanarchic economies, and, interestingly enough, a solarcentric universe. People just don't understand that we have a monsterous amount of undeveloped physical resources in this solar system. I expect that when we actually look down with any accuracy on the moon's poles, for instance, we'll find water buried there ("where the sun don't shine" as a friend put it a few days ago), just like it is on Murcury. The belt alone is big enough for us to spread out into into it for the next, say, 7000 years. That's at the human species' historic argicultural and industrial growth rates, the very same "frighteningly asymtotic" growth rates that had the Club of Rome gibbering hysterically in the early 70's. Before, of course, we came to our senses and remembered that Malthus is still quite dead. A central fact of human existance is that progress is always more "geometric" than population growth. Every time we discover a way to extend human life expectancy, the population grows until everyone goes through a demographic transition and figures out they don't have to breed so much to get the same rewards out of life anymore. We're humans. We build stuff. We always find new resources, and we always use them to our own advantage. So, what else is new? The extinction rates that happen and the habitat modifications that humans *always* make when they take over a new ecosystem have been with us ever since we had the ability to kill at a distance and use fire. A very long time. Modern humans grew up living on savannahs, so they cut or burn down forests so they can hunt game or grow food. (Or suburban lawns, for that matter.) The aborigines burned their habitat for 40,000 years. The American prairies have evolved to burn, a process immesurably accellerated by the active burning by 14,000 years of humans. Fortunately, we're about to be confronted with our toughest resource challenge yet. An "ecosystem", or more properly, a set of ecosystems, that we're going to have to build ourselves, from scratch, outside the earth's atmosphere, either free-floating in space, or on the surface of an inhospitable planet. I used to think that that will mean that we would then use the opportunity to "save" the rest of the species of this planet from certain extinction. Earth as biopark. Now I see that kind of thinking is pure romantic hogwash. We are not anti-nature. We *are* nature. We will do what it takes for us to survive, like any other species. Earth will not be "saved", it will continue to be modified to our own needs. Because, like the metaphorical dog, we can. <ewww!!!> :-). We may not make the same disaster of it that we made of the Tigris-Euphrates valleys or the Southeastern Mediterranean, but the "conserving" nature is an oxymoron. Or maybe even a tautology. Anyway, this also means taking other species with us when we move off the earth, and changing those species, and ourselves, to meet the physical conditions of survival in a new paradigm of extraterrestrial resources. By way of my own politically correct "reclaiming" of language, I mean "extraterrestrial resources" literally, of course. Not "extraterrestrial" as in ETs or BEM's, or LGM's or UFO's, or any other such "alien" bunk. I'm carving my own crop circles into the landscape of pseudoscience, if you will, ;-), and using "extraterrestrial" to mean just what it says: off the earth. Speaking of other "species", I now also see the technology of cryptofinance to be integral to this next stage of human expansion. Centralized industrial control regimes aren't suited to extremely decentralized automated decisions, like the kind that could happen in a micromarket. I think that eventually, the idea of micromoney as processor food will create the economic efficiencies necessary to coordinate the very large macroengineering projects that extraterrestrial existance will require. If you can use cryptofinancial controls to organize a swarm of habitat-building bots, then your structure appears to an observer like it's building itself. The bots work because they're paid to. They "evolve" into more efficient builders of stuff because they make more money when they do, and they compete with each other to do it. By the same token, the money is not raised by some kind of central financial "action-figure" like McNamara, or William Sword, or J. Pierpont Morgan, (and especially not a World Bank McNamara-mandarin) but by a swarm of millions (or billions) of finance-bots of various kinds living throughout a geodesic economy looking for places to park their excess cash. Central project planning considers such competition wasteful, and the paradox is that the Misian calculation argument holds for a manager of a macroenterprise the same way it did for any Soviet Commisar. Sooner or later, you can't figure it all out in enough detail to execute it, and that's where the project stops. I think we'll step through this dilemma into a world where everything is, as Kevin Kelly says, "Out of Control", where stuff happens not because someone planned it down to the last detail, but because, like the above dog, it can <ewwww!>. So, what does that mean in terms of science fiction? Well, certainly Stevenson understands all this, only he's not as much of a space-opera hound as I am. Sterling's "Schismatrix" handles extraterrestrial society fairly well, but it certainly is pre-cryptoanarchy. I didn't like "Islands in the Net" even though it had the same theme of taking someone out of their mileu and stopping time around them while the world passed them by. In IitN, the heroine was being captured by guerillas, in Schmatrix, it was kidnapping and putting people in suspended animation for a decade or two, just for kicks. Frankly, protocrypto or no, Vinge strikes me as more than a little silly at times, with stasis fields, and physical constants varying with your distance from the galactic core, and talking dogs and all that other stuff. Cherryh writes almost perfect space opera, among other things, and I see her as a perfect decendant of Smith and Heinlein. People I think I now lump in with Forrester's classic "Hornblower" novels. I really like Ian Banks, but even his ideas and certainly his politics (and not his story telling, of course) now pales in comparison to the stuff you get from imagining the consequences of a geodesic economy. Gibson now seems positively industrial, and even the Difference Engine makes perfect sense when seen in this light... One of the reasons I don't like science fiction anymore is that, like a lot of people here have said about themselves, and for the first time in my life, I'm out in front of the science fiction writers on something which is so fundemental that, frankly, their stuff now makes me laugh. This from someone who not too long ago read science fiction by the yard. I suppose this will eventually make me want to evangelize stuff like cryptoanarchy, financial cryptography, and micromoney mitochondria to science fiction authors. Or, maybe, just by shooting our mouths off here and by being archived doing so, all of us already have done our evangelizing. On the other hand, some day this stuff will be old hat, and I can go back to buying science fiction by the yard to learn about new stuff. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Skipjack patent and GATT
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Since Skipjack is protected by a secrecy order, the NSA can patent the algorithm without disclosing it. As soon as it is reverse-engineered, the patent is officially issued and expires 17 years from the time it was issued. GATT now changes the patent laws so that a patent expires 20 years after application. Does anyone know how this will affect the Skipjack patent? If the secrecy order is considered application, then that would shorten the lifetime of the patent considerably (assuming it isn't disclosed or reverse- engineered any time soon). I doubt this is the case, and I suspect that either the 17 year lifetime will still apply or the patent will expire 20 years after the patent is issued. TIA. Mark - -- finger -l for PGP key PGP encrypted mail prefered. 0xf9b22ba5 now revoked -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMpoTWyzIPc7jvyFpAQFHywf8Do9Fni5GC0kfL0XR7FGM6yLhVwLNgf4h XJZlpMMML46MWmmqwjfJnCgi+ktMQMHxTT2mCYA2eIzEBq0FbAc8M9340Xkx0KPH L1qi2tQ1ZCKnUdVWYENYL65uJAk4dB3lgsnmBJwNb80GD3tP6LVSq5wFSa2pz/Pu 3HO5YNUHmTfvrtZE2wt/7CMwJNxEPTKpTGAbDnwkri6y2u2aDrUD1nhnlfzqUz86 85TNTIpqPo06d3g1wKSKmddwqYeu3kpyu0khdUzS5rjj/7sJAECLQi2IlXkXOLjo OsaKG+sl9UNSYn9wrU+HvE9BbhlmC4B1sfOHPBqJDQ405QWurQHSZg== =sRxa -----END PGP SIGNATURE-----

1 0

Re: Smart card attacks vs. clipper?
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

(snip) > Seems like it's a bit of a different story, since in the Clipper's > case the algorithm is (ostensibly) unknown, but I'm just curious as > to whether there is some compromise of its security-through-obscurity. Actually, in a more recent attack to be published at USENIX (if i remember correctly) the attack being performed can also be utilized to help determine unknown algorithms. I will try to dig up the reference (unless someone gets to it first). Matt > -- > ______c_________________________________________________________________ > Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that > mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data > http://www.io.com/~m101/ * processing" are different! > >

1 0

Donate your spare cycles to a good cause
by Lucky Green 17 Dec '03

17 Dec '03

It's that time of year. Please donate the spare cycles on your Pentium or PowerPC to a good cause and help find a new Mersenne prime while you sleep. See http://ourworld.compuserve.com/homepages/justforfun/range.htm for details. Seriously, folks, what is your PC's CPU doing half the time? I thought so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

1 0

Re: Exon Countdown Clock and farewell messages
by azur＠netcom.com 17 Dec '03

17 Dec '03

This is a draft of my letter to our dear retiring senator. Any suggested improvements? ------------- Honorable Senator Exon, Although in all likelyhood you will never read this memorandum, I wish to express my sincere regret at your retirement and thanks for your many years of ignoble service to our nation misrepresenting the wishes of your constituents. You have served as a stallwart against change as did those who resisted the telephone, automobile, radio, television and computer (to name but a few) before you. You are a champion of politically correct thinking and behaviour, perhaps the most dangerous manifestation of an American trend to intolerence and obedience to social rules. It is a shame we will not have your carcass to kick around in the halls of Congress come next term. All the luck you're due. -- Steve Schear

2 1

[CRYPTO] Bank Cards, Interac, Bank Machines, etc
by C Kuethe 17 Dec '03

17 Dec '03

I'd like to hear what everyone knows about security holes in bank machines. I don't believe in that little bank machine cracker they used in Terminator 2, but I'm interested in the algorithms and protocols the ABM uses to communicate w/ the home bank. My bank says they have some special chip inside the ABM to secure the transfer, and that's all they told me. I also heard that the magnetic stripe on the back contains your card number (the shiny metallized numbers on the front) encrypted using DES using your PIN as the key. Way out to lunch? Too close for comfort? Any knowledge...heck, even rumors.... would be appreciated. That way we can see what kind of FUD is out there. My bet is that the magstrip with DES'd card number on it theory is FUD. But my bank did say that there were some fraudulent transfers (read successful hits) in Europe. I bank with Alberta Treasury Branches, and they said their hardware is immune to the attack that was performed in Europe.... I will have to dig a bit on that one. Anyway, I hope I hear something from all of you soon... -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL: http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: KILL cypherpunks !!!
by Eric Wilson 17 Dec '03

17 Dec '03

At 07:28 PM 11/25/96 -0500, you wrote: >On Mon, 25 Nov 1996, aga wrote: < whole bunch of stuff > >> This is a world-wide internet problem that you are about to get >> taken care of. You will be among the first locations to be >> eliminated. And just remember that your termination is your own >> doing. You had your chance to keep the fucking cypherpunks list >> OFF of your e-mail to me, and blew it. > >Oops, now what will I ever do? Wow, I'm going to miss cypherpunks. I didn't post much, but I've always been an avid reader (sniff). If I only had it to do all over again... Oh, by the way, since you're planning on doing away with things, could you get rid of some of these outfits that do the mass e-mails, thanks in advance. >> I pump iron and run three times a week. And as a Tae Kwon Do >> black belt holder, I get lots of physical activity. I am in >> better physical shape than any other man that you know. > >I have a date this weekend already, thanks. I find you're martial arts reference very interesting. But if you were truly any good, you wouldn't be waving it in everyones face like a banner. I find your demeanor to be that of someone that has never practiced the warrior arts. If you had, you'd have developed more respect for your fellow human beings. I'm guessing you're a very lonely person, whos only way of getting attention is to try and cause a conflict. Share your pain with us, and together we'll grow stronger ( Star Trek reference ;)). But if you can't do that, shut off your computer ( or leave your terminal), and go find someone to talk to, like a counselor. Eric Wilson ----------------------------------------------------------------- Join the BugList! "How many times?" The Blind Man http://case.cioe.com/~serw30

1 0

Need info on non-OS specific random functions (pref C++)
by Rick Osborne 17 Dec '03

17 Dec '03

I am looking for information on non-OS specific RNGs. Nothing really complex, just easily portable to a few different OSs and compilers. Any pointers would be appreciated. Thanks! Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- Q: How many surrealists does it take to screw in a lightbulb? A: Two. One to hold the giraffe and the other to fill the bathtub with brightly colored machine tools.

2 1

An interesting tid-bit
by Mark Neely 17 Dec '03

17 Dec '03

I was just testing out some new search software, and polled Alta Vista to see how it all worked. I used "sex" as my search term, and Alta Vista reported that their were "no documents matching - sex ignored"! Interestingly enough it will let you search with other, sex-related terms (such as "nude", "f*ck" etc), but not sex! Very bizarre indeed. Mark Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

2 1

market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

I'm considering building a PCB to make a hardware random number generator. My first impression is that it will consist of a reverse-biased zener (for a broadband source of uncorrelated white noise) driving one of those one-chip FM recivers, with the audio output driving an 8-10 bit flash A/D convertor. Fairly simple. For cryptologic applications, the output would have to be hashed down to a somewhat smaller output of bits since not all outputs are equally probable, but I suppose after such massaging it could produce at least 2 bits of randomness per sample at a 10 kilosamples per second or so, possibly much more with a wideband receiver chip. But on thinking about this a little more, I began to wonder if anybody really wants this. Pessimistically, it occurs to me that: 1. Many if not most people don't even understand why a hardware RNG is desirable. 2. Users of programs like PGP today already get at least a fairly decent RNG already. Would they want better? (I'm not suggesting a total replacement; I assume that the output of any hardware RNG would be hashed with more "traditional" PC sources, like disk timings, keyboard timings, etc, which should deter attempts to attack just the hardware part.) 3. Even hardware RNG's aren't "perfect": they could be subverted, replaced, or perhaps influenced. Would someone who was sufficiently sophisticated as to recognize the need for it actually accept a real, functioning device? On the other hand... if this kind of pessimism had infected Phil Zimmermann before he wrote PGP 1.0, he might have deleted the first 50 lines of code, erased the file, and said, "fuck it!" Jim Bell jimbell(a)pacifier.com

2 1

Netscape working with the NSA.
by Tim Tartaglia 17 Dec '03

17 Dec '03

Check out the following: http://www-tradoc.army.mil/dcsim/browser.htm Here's an excerpt: > ...Netscape has been working with NSA...Their proposed solution is based > on the use of Fortezza card technology. In November NSA expects to > certify Netscape Navigator 3.0 for "unclassified but sensitive" use... Tim

2 1

The dish on TEMPEST
by Lucky Green 17 Dec '03

17 Dec '03

The following is from a tread involving a friend of mine. An ex-military fellow. Take it for what you want. I believe him. >>> This depends in large part on the strength of the >> > degausser and how long it remains powered up. The one >> > I have I used to "clean" 10.5 inch tape reels written >> > at FM broadcast quality to a noise level -20db down from >> > brand new tape - this back in my quadraphonic stereo >> > days. It will not quite suck satellites out of orbit... >> > TWA planes, maybe. >> >> >> -20dB down from new would be a better spec if new tape was typically >> nulled rather than just blank low-level white noise. >> >> However, even so, a SQUID is a very scary thing.... I've been out of commission for a week and found 276 messages in my in-box today. The tapes I was writing about were those already "prepared" for recording "items of interest", and had already been degaussed in the preparation procedure to FM broadcast standards then/there. My little hummer would take whatever whit noise remained even then to a further 20 dBA DOWN from the ridiculous levels then/there specified. In other words, it's pretty good. Of course, IF Big Brother wants, there are any number of ways for him to obtain whatever information he wishes. I recall long, long ago, I was privileged to watch a demo of equipment (1955 or 1956, I forget exactly) in a truck parked a MILE away from our CommCenter, in the years before Faraday cages, TEMPEST, etc., and watch these guys print out a 5x5 copy of our top secret traffic as it was read by the [elided upon request] one-time-tape encryption devices. Shortly after that demo, our CommCenter was moved into a cave (no joke) and modified to "low level" dc signalling voltages. And other measures were taken to screen the area... I _have_ led an interesting life... As for Squids, only if you read Jules Verne are they scary. Otherwise, cleaned and fried with a tangy dipping sauce, well, that's another story! --Lucky

1 0