December 2003 - cypherpunks-legacy

CERT vs. Net Mafia?
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

NEWSWEEK, February 21, 1994, p.73 Technology: How to fight crime on the Internet A SWAT Team in Cyberspace Joshua Cooper Ramo The First Hint of trouble came at 3 a.m. one night last December. A panicky New York computer bulletin board operator called the Computer Emergency Response Team center at Carnegie Mellon University in Pittsburgh to report discovering an unauthorized program that could surreptitiously record users' secret passwords. CERT is the SWAT team of the electronic frontier; the call sent these cybercops scrambling to their keyboards to try and figure out who was behind the break-in - - and whether it had spread. "It's like finding rats in your apartment," says CERT manager Dain Gary. "When you see one, there are probably a hundred. In this case, there are probably 10,000." The New York bulletin board is hooked up to the Internet, an international web of computers that links 20 million users. If one system is compromised, many more are vulnerable. The December break- in turned out to be the first of hundreds of similar reports: earlier this month Gary's team concluded there was an organized effort to infiltrate the Internet. Although the culprits were still loose and their motives were unclear last week, CERT's detective work has won the team respect and new attention on the net. A typical Internet message: "It's nice to know that somebody out there is helping keep us techno-peons in the loop." Created by the Defense Department five years ago after the last widespread Internet break-in, the CERT team operates out of a sleek granite building. CERT has no legal power to arrest or prosecute; instead, the team of about 15 programmers pokes through violated systems using their only weapons: dozens of computers. Like the hackers they track, CERT team members often work round the clock, subsisting on takeout Chinese food. Gary, 52, CERT's manager, is a decorated army attack- helicopter pilot and an expert in computer security. Hackers are "the adversary," he says. "We try to help the victim" by posting warnings of "holes" -- vulnerabilities -- and fixes on the net. "But as the net grows, the incidents are climbing," he says. "The motives are changing." Net Mafia? Ten years ago hackers were usually youthful pranksters, mostly interested in demonstrating technical ingenuity. Now there's a growing feeling that more sinister forces may be loose, perhaps a kind of net mafia intent on outright theft through use of credit-card numbers or other data. Last year CERT responded to almost 1,500 calls, a 75 percent increase from 1992's. CERT won't disclose its budget, but clearly a lot of help comes from volunteers interested in preserving the integrity of the net. Particularly complicated security breaches are farmed out around the country to an unofficial brain trust of specialists in specific operating systems. The rest of the detective work is on line in Pittsburgh. Rich Pethia, 47, CERT's coordinator, has spent 25 years working on the net; he says his job gets tougher every year. The team must deal with increasingly sophisticated hackers and criticism from netters who think that providing hole data is like giving cybercrooks keys to computers. Unfortunately, finding holes is often easier than fixing them. CERT still doesn't have a long-term solution to the current break-in problem. Last week, in response to the CERT alarm, network operators around the world booted and rebooted their systems, looking for signs of trouble. Back in Pittsburgh, the CERT team members were hunched over their keyboards, ready for the next call.

1 0

(fwd) iPower crypto chip in PCMCIA card
by kelly＠netcom.com 17 Dec '03

17 Dec '03

Newsgroups: alt.2600 Path: netcom.com!mocten From: mocten(a)netcom.com (Mark Hudson) Subject: iPower crypto chip in PCMCIA card Message-ID: <-62PjOECJDZt057yn(a)netcom.com> Sender: mocten(a)netcom.com (Mark "Marcus" Hudson) Organization: NETCOM On-line Communication Services (408 241-9760 guest) Date: Fri, 18 Feb 1994 02:02:38 GMT Lines: 21 I got this out of newsletter I received a few days ago. Hopefully it isn't old knowledge yet. Crypto Chip Debuts National Semiconductor has released the iPower encryption chip, which was designed for use in PCMCIA cards and provides a reange of security features. The chip can encrypt data via multiple enryption algorithms, and will self-destruct upon any tampering attempt, using a self-contained chemical. Cards that use the iPower chip can also provide additional functions such as tracking user access times. The iPower division is based in Santa Clara, CA. 408/721-8797. --Mark -- -- Mark Hudson is mocten(a)netcom.com (or vice versa) Mr. Congealiality--a suppository of knowledge. This has been a blipvert. (Hose down or prepare to explode.)

1 0

Blacknet trademark offence.
by mpd＠netcom.com 17 Dec '03

17 Dec '03

> > IMPORTANT ANNOUNCEMENT!!!!! > > RE: ILLEGAL USE of the name BLACKNET! > > OFFENDER: "NOBODY(a)SHELL.PORTAL.COM" How embarrassing! I had completely forgotten about the FIDO Blacknet which is carried by a large number of BBS systems both in this country and abroad. These people must now be extremely pissed and running to their lawyers in droves. Oh well. :) -- Mike Duvos $ PGP 2.3a Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Blacknet worries
by hal＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

Tim's Blacknet story has gotten a lot of reaction after Detweiler's random posting escapade last week. I think it is a good essay, but there is one point I don't think was stressed enough. > BlackNet is currently building its information inventory. We are interested > in information in the following areas, though any other juicy stuff is > always welcome. "If you think it's valuable, offer it to us first." > > - trade secrets, processes, production methods (esp. in semiconductors) > - nanotechnology and related techniques (esp. the Merkle sleeve bearing) > - chemical manufacturing and rational drug design (esp. fullerines and > protein folding) > - new product plans, from children's toys to cruise missiles (anything on > "3DO"?) > - business intelligence, mergers, buyouts, rumors The glaring omision, mentioned only in passing, is military intelligence. A friend at work tells me that in the Manhattan project, presumably one of the most secret projects ever attempted, the Soviet Union had no fewer than six agents passing on information. Since then, three have been identified. The KGB says there are three more who have never been discovered, and they won't say who they are. (Of course, this could be in part KGB boasting/disinformation, but apparently the three who were discovered are confirmed.) Keeping business secrets and manufacturing techniques secret is one thing. But, from the point of view of the government, the world of Blacknet could be an utter disaster for the protection of military secrets. Despite its consumption of a large fraction of our society's resources, government jobs tend not to be high paying, especially compared to jobs with comparable degrees of responsibility in civilian life. The temptation to sell secrets for cash has got to be present for almost everyone. But it is balanced against the immense practical problems involved: making contacts, arranging deliveries, being caught in a "sting" operation. Blacknet could remove most of this risk. With near-perfect anonymity and digital cash, a tidy side income could be created for anyone with access to classified information. There would be no need for risky physical meetings. The money could be spent on a few nice extras to make life more comfortable, without fear of it being traced. How many people would succumb to such temptation? People do undergo security checks, and presumably those who pass are mostly honest. But they are human, and money is a powerful motivator. Especially if the person figures that if he doesn't sell the info someone else will, the temptation will be all the stronger. There are possible countermeasures: frequent lie-detector tests (as in Snow Crash); "fingerprinting" documents so everybody has a slightly different copy, allowing sting operations to identify the culprits; perhaps even swamping the legitimate offers of cash with bogus ones (a denial-of-service attack, in effect). But none of these are really likely to solve the problem. This is probably the issue which has the government really scared, the issue which turned Barlow's government friends against free encryption, as he describes in his Wired article ("if you knew what I know, you'd oppose it too"). The NSA in particular has for a long time been wildly paranoid about this issue, as detailed in The Puzzle Palace; sometimes it seems that despite its ostensible mission, the NSA is more concerned about protecting its own secrets than discovering others'. I could see any technology which would facilitate sellouts by their people to be considered a mortal threat, something to be fought by any means. And I imagine that the rest of the military intelligence community would feel the same way. Imagine if Blacknet had existed during the Manhattan Project, how much easier it would have been to corrupt those involved. This must be a nightmare for the government, and they appear determind in their fight against it to create a nightmare in turn for proponents of privacy. Hal Finney hfinney(a)shell.portal.com

2 1

Remailer killing subject line
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Hi, why do some remailers (e.g. anonymous(a)extropia.wimsey.com) kill the subject line of a message? It would be very usefull to remail the subject line also. Thanks

2 1

signoff
by RFORBES＠Gems.VCU.EDU 17 Dec '03

17 Dec '03

I can't keep up with the mail on the list. Can't sign on everyday. Would like to unsubscribe. Give me some help in removing my name from the cypherpunks list. Thanx.

1 0

Re: REMAIL: down (sortof) remailers
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> (I figure they were just renamed and locked because the grad > student who admins rosebud probably can't figure out how to remove > an account being a VMS guy ;) Or he found the remailers and is handing over full logs to the FBI on a regular basis.

1 0

Key escrow for all encryption?
by jimn8＠netcom.com 17 Dec '03

17 Dec '03

Fellow Cypherpunks, Please gently correct my misinterpretation of the White House press release. I read it to state that commercial encryption must embody key escrow, even if it's not Clipper. Does this mean we must turn over our one-time pads and our PGP private keys to a government agency? I don't like this. Not one bit. Perhaps the CPSR request for votes should have read, "I oppose key escrow," not just "I oppose Clipper." - Jim Nitchals

1 0

Re: Blacknet worries
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

With all due respect....the U.S Government has PLENTY of tools to go after those deemed to be violators of various rules and regs...with or without Blacknet, with or without encryption. For the purposes of discussion, let's assume perfect, unbreakable encryption, all undistinguishable (even in principle) from noise. Yes, I admit, that is a big assumption. What other tools can be used, well... 1. Imputed income. If you live well, and don't show enough reportable income, the IRS can determine how much you are _Really_ making, and figure your tax thereon. You disagree? Prove it in tax court. By the way, the burden of proof is on ...YOU. 2. Criminal conspiracy. Elements are a. two or more people b. a prepatory act So...if we were talking about any number of possible illicit activities, conspiracy is a really viable charge. Even if nobody ever commits the act. Think about this one next time you talk with anyone you don't know really well about anything much more controversial than the *_Lovely_* weather we've been having! 3. CCE (Continuing Criminal Enterprise). Did you know that the statute of limitations is suspended under this law? And, testimony from third party *_unidentified_* informants is admissable? 4. IRS-1040, Schedule B, Part III, Foreign Accounts and Trusts. Except for one relatively minor loophole, if you fail to report a foreign bank account, it is considered prima facie evidence of tax fraud. Sound like a really bad day in the making? 5. If you have more than $10,000 in US Dollar value in an offshore account, you are required to fill out a special form for the IRS giving your account numbers; unless you want to declare that you have more than 20 such accounts, aggregating to more than $10,000. 6. RICO. They got Mike Miliken using this...indeed, Barron's magazine did an interesting report on RICO, with the conclusion that a determined Federal Prosecutor could use the law to convict a ham sandwich. 7. Did you know that Federal prosecutors have a better than 90% conviction rate? 8. HOW does one spend "magic money"? If you have bunches of cash offshore, and bring it in, records are created. If you buy something, potential witnesses are created. Can you really expect that the clerk in wire transfer at XYZ bank (who makes $6.50/hr) won't tip off someone when you wire in the $20,000 to buy ...whatever? 9.. Spies, criminals, and others often get in trouble due to their own and others' lack of discretion. Can we really expect users of a hypothetical blacknet would never drink too much, never wish to impress someone, never trust someone unwisely? NO, I'm not an attorney...by all means, check out what I've said; and, wherever you find errors, please correct them. Hopefully, I've not given offense. I enjoy encryption, and I'm all for more of it; but, I really don't think it will be anything more than a minor inconvenince for law enforcement and prosecutors if people engage in wholesale criminal acts. The rather silly efforts in Waco, where those inside used assault rifles to shoot at battle tanks; comes to mind as analogous to use of encryption to stave off prosecution. Now...your turn. Let the Flames begin! Regards, Dave

2 1

New Remailer up!
by Matthew J Ghio 17 Dec '03

17 Dec '03

At last, my long-promised pseudo-account remailer is open for testing. Here's how it works. Send mail to mg5n+getid(a)andrew.cmu.edu you will receive back an encrypted email address of the form: mg5n+eaxxxxx(a)andrew.cmu.edu (ea=encrypted address, in case you were wondering) All mail sent to that address will be forwarded to you. When you post anonymously, you can include that address for people to make replies to. That way, people can send replies to your messages but not know who you really are. Most of the cypherpunk remailers allow you to insert a Reply-To: header. Random padding is added to the address before it is encrypted. Therefore, every time you request an encrypted address, it will be different. This allows you to get a different email address for each of your cypher-tenacles. :) Messages sent thru the remailer are not anonymized. The complete, unaltered message is forwarded. If you want anonymnity, first send your mail thru one of the anonymous remailers. Source code is availaible. Email me if you want it. P.S. Expect a moderate delay for messages sent thru this remailer.

3 3