December 2003 - cypherpunks-legacy

NOT the Orange Book
by John Young 17 Dec '03

17 Dec '03

Paul Merrill, the author of "NOT the Orange Book," has provided a digital version of his "Guide to the Definition, Specification, Tasking, and Documentation for the Development of Secure Computer Systems -- Including Condensations of the Members of the Rainbow Series and Related Documents:" http://jya.com/ntob.htm (385K) Zipped: http://jya.com/ntob.zip (92K) This is Paul's 1992 manual prepared while working for DoD to evaluate and purchase secure computer systems, for ADP, C4I and weapons, and to compensate for the shortcomings of the official regulations. It's still widely used, Paul says, for the unending conflict between DoD, NSA, DIA and defense contractors about how to develop and assure computer security from lab rat pipedream to the warfighter's "wha's this piece of shit." Section IV, Case Studies, is a wonder at describing what to do when perfect design goes to hell in the field, and a pissed warrior who's comm's been compromised got a K-Bar sawing your apple, roaring "tech support, now!"

2 1

RE: UK police chase crooks on CCTV (fwd)
by Albert P. Franco, II 17 Dec '03

17 Dec '03

Snipped down to DCF's response... >My point is not that we shouldn't grab them it's that the "Human Rights >Community" is politically discriminatory and wouldn't think of going after >commies. > Since I live in Spain, I am privy to a side of the story that doesn't seem to get much air outside of Spain. (At least not that I've seen) In Spain, Spain is the protagonist in this issue--not the "Human Rights Community". It may be that they accept any help they may get from these folks, but the main push is from the families of Spanish citizens murdered by Pinochet. He not only killed his "countrymen" but also foreign nationals. Spain will try him for the murders of Spaniards NOT Argentineans, Brazilians, Americans, or any other nationality. >From inside Spain this issue doesn't seem nearly as global as the international community portrays it. I guess it's kind of like a certain African nation wanting to try a certain western hemisphere president for the deaths of some factory workers... Or perhaps in a small way a refutation of the international norm that protects rulers from the otherwise natural consequence of their actions. APF

1 0

No Subject
by nations＠freeyellow.com 17 Dec '03

17 Dec '03

11/02/98 Y2K Solution! 8 Pine Circle Dr., Silicon Valley, Calif. USA OTC Company "TCFG" 21 st. Century Frontier Group has through several members of their administrative research department leaked vital information about their companies efforts. Everyone was tight lipped and interviews were refused, and through un-named sources we have learned that the technology and software solution are in the process of being patented! In over 1640 trials, using various data systems the use of the new technology and software solved the Y2K problem 100% of the time. This small publicly traded company "TCFG" which is just 3 years old is through various sources now negotiating with the "Big Boys"! "TCFG" the letters to look for.....

1 0

Hacktivists
by Secret Squirrel 17 Dec '03

17 Dec '03

"HACKTIVISTS" SAY: "THE REVOLUTION WILL BE DIGITIZED" Two political activists in New York, of cofounders of the Electronic Disturbance Theater, are organizing "virtual sit-ins" and recruiting programmers to attack the Web sites of persons or organizations they believe responsible for oppression. "We see this as a form of electronic civil obedience," says Stefan Wray, one of the two leaders of this effort. National Information Protection Agency chief Michael Vatis says, "I wouldn't characterize vandalizing Web sites as cyber-terrorism, but the only responsible assumption we can make is that there's more going on that we don't know about." Some activists agree with that assessment, but for different reasons; they think such methods are unproductive because they will antagonize the general public. (New York Times 31 Oct 98)

1 0

Computers as instruments of liberation
by Tim May 17 Dec '03

17 Dec '03

"Wired News" carried an article reporting on a plan to (somehow) spread computers around the world, blah blah, and quoting John Gage at Sun on how this would promote peace. A couple of paragraphs have Cypherpunks resonances" --begin excerpt-- Conference tackles ``techno-inequality'' By Judy DeMocker SAN FRANCISCO (Wired) - When US farmers can call their cows home individually using animal pagers, but the average teenager in Burkina Faso has never made a ..... Wiring developing nations could have some far-reaching consequences. One might be that computer-based communications would be used to keep the peace, according Net Day co-founder John Gage, who works by day as Sun Microsystems' chief scientist. When content from The New York Times can be translated into 30 Arab dialects, for example, or when a remote Rawandan village has access to more perspectives than the local magistrate, the Internet may become an instrument in preventing violence. ``The Web gives people access to other voices, and instant access to speaking about how the world really is,'' said Gage. ''If people can get that, maybe that band of villagers will think twice before going down the road and killing its neighbors.'' --end excerpt-- Fatuous nonsense. After all, those folks down the road may be taxing them, and may need killing. Or those folks may use computer networks to connect to others for the purposes of liberation. I see computer networks as promoting secessionism, freedom fighting, and resistance in general. The New World Order, the One Worlders, see this as "terrorism." Which is why strong encryption is needed. Which is why "they" oppose strong encryption. John Gage has a typically Fabian socialist view that somehow computerization will lead to an orderly, peaceful world. Me, I view networks as the key to retribution and justice. --Tim May Y2K: A good chance to reformat America's hard drive and empty the trash. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments.

2 1

RE: 4 Horseman not so bad..
by Brown, R Ken 17 Dec '03

17 Dec '03

I wrote: >>> but some peope are scared of > >>> drugs/paedophiles/terrorists etc, so thats the way in for the > jackboots. > >>> To oppose it we need to reduce fear. > Chip wrote: >>Thats the most interesting POV I've ever heard >>of in these discussions, seems like for the most part, >>we counter fear arguments with other fear arguments, >>Never saw this before. Bears more examination. Anon wrote: > Right. The new Happy Net campaign. > Druggies.. why, they're friendly enough to > be elected officials in such peaks of civilization as > D.C. and L.A. And the more successful recreational > pharmaceutical merchants are luxury-car and mobile > telecomm early adopters! London is full of spy cameras (mostly owned by banks and large corporations, pointing out from their windows and doors) Nobody much objects to the invasion of privacy. Why? Because lots of them are scared of the streets. If they knew the actual chance of getting robbed or beaten up they probably wouldn't be so scared.

1 0

[humor] Testing software
by Jean-Francois Avon 17 Dec '03

17 Dec '03

A friend of mine sent me the following: We are in the process of testing the new piece of software we designed: > AGGRESSION TESTING: If this doesn't work, I'm gonna kill somebody. > > COMPRESSION TESTING: [] > > CONFESSION TESTING: Okay, Okay, I did program that bug. > > CONGRESSIONAL TESTING: Are you now, or have you ever been a bug? > > DEPRESSION TESTING: If this doesn't work, I'm gonna kill myself. > > EGRESSION TESTING: Uh-oh, a bug... I'm outta here. > > DIGRESSION TESTING: Well, it works, but can I tell you about my truck... > > EXPRESSION TESTING: #@%^&*!!!, a bug. > > OBSESSION TESTING: I'll find this bug if it's the last thing I do. > > OPPRESSION TESTING: Test this now! > > POISSON TESTING: Alors! Regardez le poisson! > > REPRESSION TESTING: It's not a bug, it's a feature. > > SECESSION TESTING: The bug is dead! Long live the bug! > > SUGGESTION TESTING: Well, it works but wouldn't it be better if... Added by JFA: DELUSION TESTING: Naahhhh, don't loose any time doing any testing, it'll work... Jean-Francois Avon, B.Sc. Physics, Montreal, Canada DePompadour, Société d'Importation Ltée Limoges fine porcelain and french crystal JFA Technologies, R&D physicists & engineers Instrumentation & control, LabView programming PGP keys: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

2 1

Re: TEMPEST laptops
by Tim May 17 Dec '03

17 Dec '03

At 12:26 PM -0800 11/1/98, Dave Emery wrote: >On Sun, Nov 01, 1998 at 09:53:37AM -0800, Tim May wrote: >> >> Anyway, were I to try to shield a laptop I'd start with microwave leakage >> meters, a couple of t.v.s and radio (of different types and bands), and >> then I'd start recording signal levels of various sorts as different >> shielding layers and types were applied to the laptop(s). Simple lab stuff. >> > > As someone who has actually spent hellish weeks working to >suppress the RF emissions of some commericial network gear I designed - >to make it pass FCC B and VDE certification - let me say this is a black >art and no fun. There are sophisticated electromagnetics programs that >can sometimes succeed in modeling the radiation from a computer system, >but they are very expensive and inputting all the required information >is painful or downright impossible (data just not available or in a >usable format), so this nasty job usually gets done seat of the pants >style using rules of thumb and educated guesses and hard won experiance >and lots of trial and error. The job consists of attaching lossy >ferrite beads, copper tape and other RF and common mode current supressing >devices, shielding plastic packages with spray metallic coatings, adding ... All good points, but there's a big difference between trying to meet FCC emissions requirements for a commercial product that has to meet cost, weight, and cosmetic requirements (e.g., a plastic case!), and the scenario of making a TEMPEST-like box for a laptop. Ferrite beads and copper tape are a lot different from a sealed box made of 10-gauge copper sheet. > Nobody does this using ordinary radios and TVs, the standard >tool is a broadband spectrum analyzer or special EMC receiver with >quasipeak filters and special calibrated wideband dipole antennas that >have known gain and pattern characteristics. Isolating of radiating >sites is often done with near field probes or sniffers attached to the >spectrum analyzer that allow hot spots to be tracked to within a few cm. >Often in order to get enough sensitivity one also needs special >preamps, and a RF quiet site where signals from the DUT aren't drowned >out by pagers and cellphones and emissions from nearby computers. A >good bit of this work is done way out in the country under non-metallic >fiberglass buildings that don't create reflections that confuse the >measurements. And conducted as opposed to radiated noise is measured >with special power line filters and cable filters... Sure, but my point was that John Young should *at least* start with actual measurements, as opposed to putting most of the onus on a FOIA request to get TEMPEST docs declassified. If he can get spectrum analyzers and all that stuff, so much the better. --Tim May Y2K: A good chance to reformat America's hard drive and empty the trash. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments.

1 0

No vulnerability known in SSH-1.2.26
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 2 Nov 1998 10:33:29 +0200 (EET) From: Tatu Ylonen <ylo(a)ssh.fi> To: ssh(a)clinet.fi, ssh-bugs(a)clinet.fi, bugtraq(a)netspace.org, info(a)rootshell.com, coderpunks(a)toad.com CC: "David A. Curry" <davy(a)ers.ibm.com>, cert(a)cert.org, auscert(a)auscert.org.au Subject: No vulnerability known in SSH-1.2.26 Organization: SSH Communications Security, Finland Sender: owner-coderpunks(a)toad.com Precedence: bulk -----BEGIN PGP SIGNED MESSAGE----- As the original author of SSH I want to comment on the rumored vulnerabilities. I have personally looked into the claimed vulnerabilities, including the ones reported by IBM, and do not have any reason to assume that there would be any vulnerability in ssh-1.2.26. NO SUCH VULNERABILITY IS KNOWN. I repeat, I KNOW OF NO VULNERABILITY IN SSH-1.2.26. The IBM-ERS report on ssh vulnerability turned out to be false alert. They could not reproduce it after they recompiled their ssh and linux kernel. I have personally checked all places where ssh displays debugging messages, log messages, or otherwise uses functions like sprintf. I was unable to find any vulnerabilities. I have talked to people at both CERT and the IBM emergency response service and none of them seems to have any knowledge of any vulnerability in SSH. In summary, to my best knowledge, ssh-1.2.26 can be safely used. Please communicate this information to the relevant people. Brief history of events: - On October 28, the rootshell.com home page was defaced by hackers. After the host was brought up to date, their front page contained information that listed the services that had been active, and mentioned that entry may have been made with ssh. (Note that this does not by itself indicate anything; password or other authentication may have been obtained at the other end) - On October 29, a message about the rootshell case is posted to bugtraq and possibly other mailing lists. Many people took this as indication of a vulnerability in ssh. - We looked at the rootshell case, and found no cause for alarm, but decided to be watching. - On October 30, IBM sent an draft advisory reporting a buffer overflow vulnerability that could be used to gain root access to any host running ssh from anywhere on the Internet. The draft advisory was sent to at least CERT, FIRST, ssh-bugs, and a few other places. - On october 30, several major computer manufacturers and their offices around the world were advising their customers to follow the situation, and possibly disable ssh for now. Some CERTs around the world issued preliminary alerts to their most important sites. - I learn of the IBM advisory on October 31 at 2 AM. By 6 AM I've talked to both CERT and IBM Emergency Response Team, checked the code claimed to be at fault (finding no problem), and no-one seems to have any concrete information, and we conclude there is no cause for immediate alarm. - By November 1, the IBM researchers who found the vulnerability in the IBM draft advisory have been reached. One of them says he never saw an exploit, and the other first said he had an exploit and he was going to send it over shortly, and the next day he said that he could no longer reproduce the problem after recompiling ssh. He does not appear to have an exploit after all. - I've personally gone through all places where ssh1 passes information to sprintf, log_msg, or any other functions using sprintf. I found no security problems. I found one place where an argument to a format string was missing, but it is probably not exploitable, and one place where one byte less was allocated for a string than was used (only appears on Solaris). Neither of these have security consequences or are cause for alarm. - On November 1, the IBM announcement for which IBM has already issued a cancellation is widely distributed by rootshell through their announcement list. - Now at Morning November 2, I'm convinced (>99% sure) that both the rootshell issue and the IBM draft advisory were false alerts. We are also trying to track down the linux compilation problem that may have caused the false alert behind the IBM advisory. We will issue an announcement as soon as possible if real vulnerability is found. For more information, please keep tracking http://www.ssh.fi/sshprotocols2. Best regards, Tatu Ylonen <ylo(a)ssh.fi> - -- SSH Communications Security http://www.ssh.fi/ SSH IPSEC Toolkit http://www.ipsec.com/ Free Unix SSH http://www.ssh.fi/sshprotocols2/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBNj1tbqkZxfGWH0o1AQEaLwP+LPhkCOGFs30gfbyjMLLMkNp03OOfpALJ uwqBvLPIntIWhHbjq1GF9D3hekyQ3PdiC+5SEBfFBj1xlAg1SPROJ2JV5d2QHuPm B39j3YuQSJT5j/QXN0nkbP7ll9UoPJ9eMWBQvd5Hgf//eAk6ccns4fUqensMypeR 9J3O2JQG6ow= =gesm -----END PGP SIGNATURE----- --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: TEMPEST laptops
by Trei, Peter 17 Dec '03

17 Dec '03

> -----Original Message----- > From: Lucky Green [SMTP:shamrock@cypherpunks.to] > Sent: Sunday, November 01, 1998 8:33 PM > To: Bill Stewart > Cc: cypherpunks(a)cyberpass.net > Subject: Re: TEMPEST laptops > > On Sun, 1 Nov 1998, Bill Stewart wrote: > [...] > > Just using a regular laptop isn't enough; I've seen laptops > > transmit recognizable images to a television (though I was probably > > using AC power rather than batteries, and may or may not have had > > the display mode set to LCD-and-monitor.) > > Thanks for touching on the popuar myth that laptops radiate less than > CRT's. Many laptops in fact radiate more compromising emissions than > CRT's. Ross Anderson does his van Eck demos to undergrads using a laptop, > because it works so much better than CRT's. > > -- Lucky Green <shamrock(a)cypherpunks.to> PGP v5 encrypted email preferred. Nearly all laptops have a built-in video port, for connection to an external monitor. This is often poorly shielded (usually just a plastic plug). I'd be curious to know how much the radiation from this port could be attenuated by (1) a metal plug contacting the laptop's ground plane, and (2) removing all the video-port specific circuitry (major surgery for a laptop :-( ). Peter Trei

1 0