December 2003 - cypherpunks-legacy

Re : Crypto AG: The NSA's Trojan Whore?
by Michael Motyka 17 Dec '03

17 Dec '03

J, This stuff has been on and off the list for quite some time now. I think the general opinion is that you cannot trust any software that does not come with full source code. Especially operating systems ( read : Windows ). Furthermore, hardware could be untrustworthy. As an example of the latter just imagine a keyboard chip that takes the serial data signal, ANDs it with the clock and runs the current-limited output through a metal loop on the die or couples it to an outside trace that is not likely to be filtered. Instant keyboard transmitter. Short range but probably usable. Try it outside the chip, I'll bet an old AM radio will pick it up pretty well. If you have better receivers try 1x, 3x, 5x ... clock carrier frequencies. What sort of other things would you design into an OS or a CPU or peripheral chips if you wanted to snoop? Let the OS do the keysnoop for you and send it off through the network? Keystrokes seem like the obvious choice because they are low-bandwidth and have a high information content but someone who's smarter can probably think of all kinds of other stuff to send. ls -al > G-buddy. You know, keystrokes are so low in bandwidth that I bet a receiver/recorder could be placed on your premises, say behind an outlet for power, and checked surreptitiously only when needed - how long would it take you to fill a 1Gb drive from your keyboard? I don't think that there can be real security unless you use embedded systems ( unknown to the OS and Host HW ) for critical roles and maintain two machines - one clean in a cage, the other on-line and without any sensitive information. Use sneakernet between the two using media that you can readily analyse. If I can think up a feasible method to do something in 5 minutes it was probably already done a long time ago and the people who do this stuff full-time have probably taken the field to amazing heights. They seem to be able to get cooperation from commercial companies too. Snooping probably won't be done wholesale, too expensive in terms of manpower, and I don't know anyone who needs real security but, in principle, everyone should have it. mike *** Crypto AG: The NSA's Trojan Whore? http://caq.com/cryptogate Are people familiar with this document? Why shouldn't NSA have implanted this kind of back-doors in various software and operating systems as well? It seems to have worked so very well in the past.

1 0

No Subject
by Patrick Hudson 17 Dec '03

17 Dec '03

Hi Have spent the last few weeks going through various web pages describing GSM cloning. Some contradicting views, but overall the point is well made (and quite correctly) - cloning and/interception/monitering is both viable and achieveable. I recently was commissioned to look into this subject on behalf of a client who wished to moniter a GSM phone. Putting aside the rights and wrongs of the issue, we realised the objective. In summary it is possible to moniter/intercept a GSM phone using 2 pieces of commercially avaliable RACAL equipment, linked via a custom made preselector/combiner. The overall setup is easily portable and is controlled via a pc. It goes without saying that RACAL do not market the hardware for the above purpose - it has legitimate engineering needs, and is marketed under that legimate need. RACAL do not make the precombiner/selector (we had to make that) and they do not market the software AT ALL. I suspect that they are aware that the hardware in conjunction with the software (and access to a combiner/spliter)would give access to interception. So you must be thinking what sim parameters (or other parameters) had to be programmed into the pc software programme to allow selective interception of a GSM phone? Very little - in fact all that had to be programmed in was the phone number of the GSM handset to be targeted - and absolutely nothing else! It's food for thought. Best Regards Patrick_33(a)hotmail.com *This is not for general distribution on the web, but is shared with you on the basis of what appears to be a serious discussion on the subject on your side. please respect that aspect of confidentuality and feel free to get back to me with any comments you may have. One important aspect of the exercise has been deliberatly left out, it has little effect on sizing or costing but none-the-less is a requirement. Most engineers who understand what is involved in running 2 pieces of rf equipment in parrallel (both in TX and RX functions)at the same time will understand what is left out. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

The Cypherpunks Agenda
by Tim May 17 Dec '03

17 Dec '03

I wrote a personal reply to Adam Back, including some stuff about what's apparently happening in the Bay Area community...I may learn more if I make it to the Saturday physical meeting at Stanford, which I hope to make. Some of the other things I mentioned to Adam may deserve a wider audience. Warning: this is not a a carefully-constructed major essay, just some thoughts which have been brewing for a couple of years. I agree fully with Adam's point that many list members, and certainly many of those who reflexivly shout "Cypherpunks write code!" whenever political issues come up, are _missing the point_. What code should be written without some grounding in what one's goals are? I'm not calling for the usual debate about gun control, abortion, religion, discrimination, etc. We sometimes get off, get sidetracked, on these issues, but the debates are rarely useful. Rather, I think we are no longer trying to figure out which building blocks for our "agenda" are needed. Indeed, some here claim that any discussion of goals or agendas is ipso facto "off topic." Well, let me assure you otherwise. I was there at the beginning, at the first meeting (called by Eric Hughes and me), in September 1992. Politics--of a specific sort--dominated that first meeting, and subsequent meetings. Not politics about welfare, or minimum wages, or Democrats vs. Republicans (or Greens vs. SDU or other national parties in whatever countries). No, "politics" about privacy, anonymous communications, digital cash, information markets, etc. We spent the afternoon playing a paper-based game, using envelopes as mixes, using bulletin boards as information markets, using "Monopoly" money as digital cash. Far from being a worthless game, it educated people as to how a crypto-anarchic system might work. Out of this game came the first "anonymous remailers" (of the Cypherpunk flavor, not the Julf flavor). First written by Eric, then improved by Hal Finney, then by many others. Out of this first meeting came wide use of PGP...we distributed PGP 2.0, the first "modern" version of PGP, several days after release. And out of this meeting came "BlackNet," "Magic Money," and several other "politically motivated" demonstrations. Cypherpunks has _always_ been political! Those who think otherwise are missing the boat. Anyway, here's some of what I wrote to Adam: At 6:50 AM -0700 10/8/98, Adam Back wrote: >This is what I meant by my short rant about coderpunks detracting from >the cypherpunk objective: siphons off 'punks from cypherpunks into a >crypto-politically neutral environment. Then it gets increasingly >more crypto-politically neutral subscribers, and anyone reminding or >commenting that the original aim of the game was to distribute strong >crypto to undermine the state, gets told by the local retro moderators >that political stuff isn't welcome. > >Try reading the cyphernomicon (*), if you haven't. Thanks for the plug. I agree fully with your point about the "crypto-politically neutral" stance many are now taking. I see this at the few CP physical meetings I manage to attend these days. Many of the attendees are just cogs inside companies, and have no idea why they're working on some widget, except that "crypto is cool" and it's "their job." I also am fed up with the "Cypherpunks write code" mantra. Yes, code is very, very important. But _what_ code? And for all of the mantra-chanting, actually very few have ever written any memorable code. We are basically "coasting" on some code (PGP, SSLeay, Mixmaster, a few other pieces) that implement only _two_ of the building blocks: straight encryption and mixes. So where is the _rest_ of the code? "Cypherpunks write code" is a mantra to shut up any discussion of which building blocks are important to write. And yet most of the mantra chanters are actually not writing useful or interesting code, just hacking away in their cubicles.... Sad. --Tim May Y2K: A good chance to reformat America's hard drive and empty the trash. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments.

2 1

EVEN MORE FREE PORN: STUFFED HAS 10 LINKS TO 100S OF FREE PICS, NEW EVERY DAY
by STUFFED FRI OCT 9 17 Dec '03

17 Dec '03

+ 30 SUPERB, HI-RES, HOT PHOTOS + 5 SUPER SEXY STORIES + HARDCORE SEX WITH ZOOM + XXX FEMALES + HARDCORE IMAGES + FREE PORN SITE + THE PUSSY FARM + RACHEL'S UNIVERSE + HOIHOI GIRLS + BRAND X + NATURAL BODIES + XBABES + BONUS PIC 1 -> http://stuffed.net/home/23356.htm + BONUS PIC 2 -> http://stuffed.net/home/28430.htm + BONUS PIC 3 -> http://stuffed.net/home/6666.htm + BONUS PIC 4 -> http://stuffed.net/home/3074.htm + BONUS PIC 5 -> http://stuffed.net/home/29541.htm + MUCH, MUCH MORE! ----> http://stuffed.net/home/ <---- If you haven't visited STUFFED in the last few days, you're in for a real treat. It's faster than ever before and now, as a subscriber, you get 35 FREE new pics every day, plus over 100 more at carefully selected FREE sites we link to. This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka! ----> http://stuffed.net/home/ <----

1 0

(Fwd) Request for Assistance
by Ross Wright 17 Dec '03

17 Dec '03

What the hell is THIS: ------- Forwarded Message Follows ------- From: Gordon Jeff INSP <Jeff.Gordon(a)inspection.irs.gov> To: "'m1tca00(a)frb.gov'" <m1tca00(a)ccgate.FRB.GOV> Subject: Request for Assistance Date: Thu, 8 Oct 1998 10:42:12 -0400 Hello, The IRS and United States Attorney's office are looking for assistance in a criminal investigation involving threatening messages which were posted to the Cypherpunks mailing list. This e-mail address was noted to be one of those which receives the Cypherpunks list. I would appreciate it if you would contact me to discuss whether you would be willing to assist us in this matter, and what records or information you have relating to the Cypherpunks list. You can contact me at this e-mail address or at (503) 326-2787. Thanks Jeff >From Jeff.Gordon(a)inspection.irs.gov Thu Oct 8 10:48:40 1998 Return-Path: <Jeff.Gordon(a)inspection.irs.gov> Received: from primary.frb.gov by bksmp2.FRB.GOV (SMI-8.6/SMI-SVR4) id KAA29878; Thu, 8 Oct 1998 10:48:39 -0400 Received: from new-frbgate.frb.gov (root(a)new-frbgate.frb.gov [198.35.166.180]) by primary.frb.gov (8.8.6/8.8.6) with ESMTP id KAA02189 for <m1tca00(a)frb.gov>; Thu, 8 Oct 1998 10:48:38 -0400 (EDT) (envelope-from Jeff.Gordon(a)inspection.irs.gov) Received: (from root@localhost) by new-frbgate.frb.gov (8.8.8/8.8.8) with UUCP id KAA03072 for m1tca00(a)frb.gov; Thu, 8 Oct 1998 10:44:05 -0400 (EDT) Received: from tcs-gateway2.treas.gov (tcs-gateway2.treas.gov [204.151.246.2]) by newfed.frb.gov (8.8.8/8.8.8) with SMTP id KAA00110 for <m1tca00(a)frb.gov>; Thu, 8 Oct 1998 10:42:24 -0400 (EDT) (envelope-from Jeff.Gordon(a)inspection.irs.gov) Received: by tcs-gateway2.treas.gov id KAA00684 (InterLock SMTP Gateway 3.0 for m1tca00(a)frb.gov) Thu, 8 Oct 1998 10:42:23 -0400 Received: by tcs-gateway2.treas.gov (Internal Mail Agent-2); Thu, 8 Oct 1998 10:42:23 -0400 Received: by tcs-gateway2.treas.gov (Internal Mail Agent-1); Thu, 8 Oct 1998 10:42:23 -0400 Message-Id: <9F00F15E736BD11196B700A0C98448FE0A97B6@WR-SEA-SERVER-2> From: Gordon Jeff INSP <Jeff.Gordon(a)inspection.irs.gov> To: "'m1tca00(a)frb.gov'" <m1tca00(a)ccgate.FRB.GOV> Subject: Request for Assistance Date: Thu, 8 Oct 1998 10:42:12 -0400 Return-Receipt-To: Gordon Jeff INSP <Jeff.Gordon(a)inspection.irs.gov> Mime-Version: 1.0 X-Mailer: Internet Mail Service (5.5.1960.3) Content-Type: text/plain content-length: 548 X-folder: +inbox Thanks Jeff -_-_-_-_-_-_-_-_-_-_-_-_-_- Thanks. View my site from: http://ross.adnetsol.com/links.html Click on "Internet Auctions"

1 0

Re: Web TV with 128b exported
by Information Security 17 Dec '03

17 Dec '03

Wherever the 128-bit encryption is located, it is irrelevent: you send someone email, they receive it in clear-text. ---guy

1 0

[Fwd: Here come the rafting iguanas] Here come the rafting iguanas
by David Miller 17 Dec '03

17 Dec '03

2 1

Vertical vs. Horizontal Crypto (was: RE: propose: `cypherpunks license' (Re: Wanted: Twofish source code))
by Fisher Mark 17 Dec '03

17 Dec '03

> Lucky Green writes: >Cyphpunks believe that more strong crypto is better. And this holds true for vertical as well as horizontal applications. Unlike Mr. Stallman, I think that there is a case where closed-source software is appropriate, and that case is vertical applications. Just as I wouldn't propose that TCE release the source code for our devices (RCA TVs, ProScan VCRs, etc.), as the intellectual return on the release would be low (how many people are going to write low-level software for their own TVs?), I think it is also inappropriate for other vertical-market applications (another example: book library maintenance software). However, some of the bad effects of closed-source crypto can be countered by the use of open crypto protocols, like TLS/SSL, OpenPGP, IPSec, and the like. Although this still won't protect against all attempts at getting around the security of the crypto protocol, at least some crypto protocols are pretty immune to these kinds of attacks -- for example, a PC web browser talking to a set-top box using TLS should only be able to be subverted by the set-top box itself, not by a third party through a hole in the protocol. I'm somewhat surprised that no one has brought this (open crypto protocols) up in the discussion before. (Could it be that I had an original idea? Nah...) ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Cyphernomicon Intranet Mirror (was: RE: propose: `cypherpunks license' (Re: Wanted: Twofish source code))
by Fisher Mark 17 Dec '03

17 Dec '03

Adam Back writes: >Try reading the cyphernomicon (*), if you haven't. Which we've mirrored on our Intranet (been meaning to mention this...). It would be terrible if it were to disappear due to linkrot, so we have a local copy. Not accessible to the outside, though... Just another datapoint. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

RE: Request for Assistance
by X 17 Dec '03

17 Dec '03

Jeff, Good luck in your pursuit. I think, in the future, you might want to offer us the customary 800 number to call you on to rat on our acquaintances. Two things worry me about your approach: 1) how do you know what emails I get and why in the world do you think it's any of your business? 2) is this suspicion by acquaintance? I'm sure you already know this, but I just recently joined the list so I know nothing about anything threatening on this list. The biggest threat I see is from people publicizing that the government is sniffing out email addresses and categorizing them based on what they _receive._ Dangerous pursuit, dangerous precedent. Watch what side you're on. X (although I have to admit, you have a lot of guts to come in here and ask 'free-thinking individuals" to help you gang up on a guy.) ~> -----Original Message----- ~> From: Gordon Jeff INSP [mailto:Jeff.Gordon@inspection.irs.gov] ~> Sent: Thursday, October 08, 1998 8:42 AM ~> To: 'm1tca00(a)frb.gov' ~> Subject: Request for Assistance ~> ~> ~> Hello, ~> ~> The IRS and United States Attorney's office are looking for assistance ~> in a criminal investigation involving threatening messages which were ~> posted to the Cypherpunks mailing list. This e-mail address was noted ~> to be one of those which receives the Cypherpunks list. I would ~> appreciate it if you would contact me to discuss whether you would be ~> willing to assist us in this matter, and what records or information you ~> have relating to the Cypherpunks list. You can contact me at this ~> e-mail address or at (503) 326-2787. ~> ~> Thanks ~> ~> Jeff ~> ~>

1 0