December 2003 - cypherpunks-legacy

steganography & fidonet
by doug＠netcom.com 17 Dec '03

17 Dec '03

In regard to things like Fidonet sysops noting forbidden encryption pasing through their systems: Encrypted messages could be encoded in a final pass as English sentences. A 2000 line C program with a 200,000 word dictionary could encode and decode sentences that were roughly grammatical, even if they sounded really weird on average. Although I've never heard of this being done, it's pretty obvious in one sense, so I'm sure it's no surprise to the spooks. It surely wouldn't be obvious to snoopy Fidonet sysops, though, so it may have its uses. BTW a more complex program + dictionary could confine the encoded utterances to topical words and therefore sound even less weird. With enough sophistication, such an encoding could generally pass muster as "confusing and poorly worded jargon" to anyone but the most devoted analyst. I've got enough (or almost enough) sw & dictionaries & word clusters on hand to implement such a thing, but I've personally no purpose to use it for. Doug

1 0

Re: POISON PILL
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

What you need to do, is take advantage of the paranoia of the policemen. -Have fake bombs all over your computer. Police tend to blow up fake bombs just in case they are real. :-) -You need to add the signature of a virus to all your encrypted files. file.pgp is infected with Stoned type virus. Delete [y]: Peter Baumbach baumbach(a)atmel.com Now that I've thought of it, that bomb idea has many more applications! Let the police blow up the evidence.

1 0

REMAIL: digicash II
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Heh, my math is slightly off: the chances of a duplication are actually 1/(62^60) since valid characters are [a-zA-Z0-9], and each cash string is of length 61, 60 characters taken randomly from the set of valid characters, and an initial 'B' (since all the cash issued from elee7h5@rosebud starts with an 'A'). On the other hand, I'm not using a cryptographically strong random number generator (I'm waiting for the soon to be released PGP library :-) Remailing seems to a bit slower, probably because the perl hacks I added slurp the entire file of valid strings, check payment, and rewrite the file, minus valid payment. Also, the more enterprising and devious among you :-) will soon note that the remailer elee6ue@rosebud passes along the subject line even when payment fails. Thus, if you collapse your entire message into the subject, you can still get a message through. I will fix this problem soon! -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

HELP! I lost a message
by L. Detweiler 17 Dec '03

17 Dec '03

I have been *drowning* in email lately, and I think I accidentally deleted a message that appeared on the list. It had the following text. Could anyone send me the original message ASAP? this is a matter of critical importance. Also, could the original author contact me if possible? I thought I sent you email but I can't find that either. Yes, I've got a bad case of cyberspatial insanity. tx. ===cut=here=== Date: Wed, 29 Sep 1993 10:43:47 -0700 (PDT) I agree that messages to president(a)whitehouse.gov, or to the whitehouse area on Compu$erve are not acknowledged. I have sent several to each as well as a letter direct to President Hillary, none of which were acknowledged. I wrote about a major money-waster in government medical care systems which could easily save the government in the three-digit millions. For what its worth, the boondoggle is this: When DOD decided to automate their medical facilities they put out an RFP. A company called SAIC was aware that the entire software system that VA uses to automate its 1000 bed hospitals is available for free under the FOIA. SAIC got a copy of all the VA software, and bid to DOD to take this VA software which the government already owns, and sell it back to DOD for giga-bucks. Now they (DOD) must negotiate with and pay for every change they want to that software. Meanwhile the VA programmers continue to improve the VA software (DHCP) as salaried government employees. In fact, now DOD is looking to pay SAIC to write interface routines to allow the DOD software (CHCS) to share info with the VA software (DHCP). You would think that this would get their attention, but no. Instead we continue to pay a private firm to sell us our own software. Hows this for medical care cost over-runs?

1 0

Re: POISON PILL
by mycal (voices through your head ＠ 88.1MHz) 17 Dec '03

17 Dec '03

On Thu, 30 Sep 1993 15:19:44 -0500 (CDT), "Jim McCoy" <mccoy(a)ccwf.cc.utexas.edu> wrote: > > If you want to protect your data is such situations you need to set up your > system so that even if they have the data it does them nothing (e.g. > encryptiong), not so that it will destroy the data. > OK, here is the twist that should work . If the computer falls into the wrong hands the computer could just lock down all the data on the hard disk, encripting it. None of the data would be lost, just encripted. You'd need the recovery program boot disk and the password/phrase to unlock the hard disk. This program could be hidden in a modified copy of the operating system, you could also add the modified prom code so the computer wouldn't work without the modified operating system. So they would have a useless computer, but the data wouldn't be recoverable and if they reformatted the HD, they still couldn't use it. I don't think they would be smart enough to know that the prom had been replaced. Then again, there are probibly already programs out there that encript the HD already. mycal

1 0

Media declassification
by baldwin＠LAT.COM 17 Dec '03

17 Dec '03

Eric Townsend writes: > The US Gov policy for the disposal of any media that has been used to > store classified data is: > wipe -- demagnatize with a *massive* demag unit > grind -- toss in a thing that'd make ground chuck out of godzilla > incenerate -- at some amazingly high temperature. > The media is treated as if it had classified data until after step #3. In addition to degaussing, crushing, and incenerating classified disks, the US Government has approved a number of software systems that overwrite the media with ones and zeros. Different agencies have different rules and defense contractors have to obey the rules of the agency that they are servicing. The NSA and DOE require four passes over the data with the patterns 0x00, 0x55, 0xAA, and 0x41 (these are hex byte values). The last value is the Ascii letter 'A', which is then verified by spot checking. This pattern flips each bit at least once after setting all bits to zero. With a scanning electron microscope it is possible to pick up fringe regions of the magnetic domains and reconstruct the last dozen or so values for a particular domain. This result means that if a disk has really sensitive information, and it is leaving the secure facility (i.e., not just being re-used for another project, or being transfered to another secure location), then the four-pass overwrite program must be run at least three times. There are also low-level considerations. The main one is that the disk head must be wiggled back and forth as it moves along the disk to vary the alignment between the head and the track to maximize the erasure of outlying magetic domains. If the head is simply stepped from track to track, all tracks will miss the same outlying domains because the head stepping error rate (e.g., 2% off true alignment in the inbound direction) tends to remain constant as the head moves inward. Another low-level consideration is to be sure to erase all the data surfaces including sector headers, bad blocks, alternate cylinders, disk label regions, and sectors reserved for holding redundant copies of the disk geometry information or the disk controller microcode. All this requires going below the operating system to directly issue SCSI or IDE disk commands. LAT sells the only overwrite program that has been approved for Unix platforms. --Bob ---------------------------------------------------------------------- Director of Development Our mission is to provide Los Altos Technologies, Inc. the best solutions to our Voice: 415/988-4848 customers' key computer Fax: 415/988-4860 security problems while email: baldwin(a)lat.com increasing their productivity. ----------------------------------------------------------------------

1 0

PERL: creating pgp look-alike messages
by nobody＠Menudo.UH.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In case you lost your random PGP look-alike message generator :-), here is one in PERL. Run it with an argument (number of lines of "encrypted" text to produce). Such a message won't pass pgp itself, since magic bytes and checksums aren't there. - ----------8< cut here >8---------- #!/usr/local/bin/perl #creates random messages that look like PGP messages @pgpchars = (a .. z, A .. Z, '+', '=', '/'); $lenpgpchars = @pgpchars; $pgplinelength = 64; $numlines = shift @ARGV; print "-----BEGIN PGP MESSAGE-----\n"; print "Version 2.3a\n\n"; foreach $i (0 .. $numlines) { foreach $j (0 .. $pgplinelength) { $char = $pgpchars[rand $lenpgpchars]; print $char; } print "\n"; } print "-----END PGP MESSAGE-----\n"; - ----------8< cut here >8---------- Karl L. Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLKuzBIOA7OpLWtYzAQHJZgP+PE0kcLVyHr2Ml/D0QEYJqVh58x8h0UGD U8aShHVcryrKk7Uj2xXNtC8OAH1ltoi98jiEuJvqi3rcLaj8lui+gTSe96vpoWRP iQSMuQUn0NNMOP3BooeCoeV2KY7Kd4511Km8yOtzJflwPrk2AyeI8Bra4tpuVxnH 6eErL3MBUzU= =Xcys -----END PGP SIGNATURE-----

1 0

POISON PILL
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jim says I shouldn't booby-trap my computer because: -1 Really, really piss off those investigating you. Nothing like giving people who can make your life a living hell a reason to want to make your life hell... Too late, Jim, if the situations has gotten as far as warrants and seizures, they are already making my life a living hell. Investigation my ass; this is war! He further states: -2 Opening yourself up for destruction of evidence and obstruction of justice charges in addition to whatever else they may have had on you. Well, I haven't done the relevant legal research lately, but that's not the way I remember things. Plus please remember the subject of this note--POISON PILL. I not only want my *data* unavailable to the bastards, I want my *computer* unavailable to them, too. And if possible, I would love to have it fuck up *their data* as well. Eh...theoretically speaking, of course. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

FIDO, steganography, PGP
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've had fun writing this! This is a PERL script that takes as input a PGP encrypted, ascii output file. It skips the headers and stuff, and converts every character in the body into a geographic name. I don't think I'll have a chance to write the reverse script tonight, but it will coming along soon. So maybe this can be used to mail other people lists of geographic names rather than encrypted messages since I've heard some networks frown upon encrypted mail :-) Generate your PGP file, and invoke the script like this: pgpsteg < encrypted_file_ascii_output > steg.out and steg.out will contain a list of places derived from your input file. - ----------8< cut here >8---------- #!/usr/local/bin/perl #simple minded steganography for pgp encrypted messages #Karl L. Barrus <klbarrus(a)owlnet.rice.edu> %conversion = ( '0', 'canada', '1', 'united states', '2', 'mexico', '3', 'pacific ocean', '4', 'atlantic ocean', '5', 'arctic ocean', '6', 'gulf of mexico', '7', 'north america', '8', 'allegheny mountains', '9', 'rocky mountains', 'a', 'alabama', 'b', 'alaska', 'c', 'arizona', 'd', 'new mexico', 'e', 'arkansas', 'f', 'california', 'g', 'colorado', 'h', 'connecticut', 'i', 'rhode island', 'j', 'delaware', 'k', 'maryland', 'l', 'florida', 'm', 'georgia', 'n', 'hawaii', 'o', 'idaho', 'p', 'illinois', 'q', 'indiana', 'r', 'iowa', 's', 'kansas', 't', 'kentucky', 'u', 'louisiana', 'v', 'maine', 'w', 'massachusetts', 'x', 'michigan', 'y', 'minnesota', 'z', 'mississippi', 'A', 'missouri', 'B', 'montana', 'C', 'nebraska', 'D', 'nevada', 'E', 'utah', 'F', 'new hampshire', 'G', 'vermont', 'H', 'new jersey', 'I', 'new york', 'J', 'north carolina', 'K', 'north dakota', 'L', 'south dakota', 'M', 'ohio', 'N', 'oklahoma', 'O', 'oregon', 'P', 'pennsylvania', 'Q', 'south carolina', 'R', 'tennessee', 'S', 'texas', 'T', 'virginia', 'U', 'washington', 'V', 'west virginia', 'W', 'wisconsin', 'X', 'wyoming', 'Y', 'washington d.c.', 'Z', 'bermuda', '+', 'guam', '/', 'puerto rico', '=', 'virgin islands', ); while (<>) { last if /^-----BEGIN PGP/; } while (<>) { last if /^$/; } while (<>) { last if /^-----END PGP/; $line = $_; chop $line; @pgpchars = split(//,$line); while (@pgpchars) { $convert = shift @pgpchars; print $conversion{$convert}, "\n"; } print "\n"; } - ----------8< cut here >8---------- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLKvBOYOA7OpLWtYzAQGsAwP/Y5xZx5nZdKYM785zQSmPAU60UqqqU7X+ bAZ6+6f0foC2bo7AfClSTcAcCmZkCyPAL10toB6Qs0Qzkoe6eZKSlRVJgy9WzDdB oZhJV/jlvYxxlgpBJXz95sJ7ADxmtIBw6jIbfRYPjX1zva7GenTeBzXcMTabJUZJ SPG853ZqWeA= =0MEu -----END PGP SIGNATURE-----

1 0

Re: Anonymous Forwarding Software Available
by nobody＠Menudo.UH.EDU 17 Dec '03

17 Dec '03

At 9:26 PM 9/20/93 +0000, Ray wrote: >put a copy of my anonymous >forwarding software in soda.berkeley.edu:pub/cypherpunks/incoming/aforward.shar Can't find it. Was I too slow?

2 1