December 2003 - cypherpunks-legacy

Re: taking electronic privacy into our own hands
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995, Eric Anderson wrote: > Would it be possible to write a program ( i.e. a worm or > Trojan) to ferret out personal information that is stored in databases > and encrypt it? > > I was just wondering what such an undertaking would entail. Actually, there is no need to write any such code. AT&T distributes just such a beast to any and all comers. It can take personal information and send it out over a secure socket layer. I think a couple of partners in crime, Cheswick and Bellovin of AT&T research had a hand in its continuing distribution. > Eric Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: 900mhz digital phones
by Weld Pond 17 Dec '03

17 Dec '03

floyddb(a)alpha.c2.org: > There is a company called Optoelectronics that markets a > radio reciever > called the Interceptor. This is a broad band (several > hundred MHz) device designed to lock on to the most > powerful signal around, regardless of frequency. As > supplied, it only has a rubber duck antenna, but a > broadband, directional antenna (Log Periodic?) could be > attached. There are AM and FM versions that output audio > and a version called the Scout that controls a scanner. > These could have outboard devices hung on to them to decode > digital signals, record the conversation ... all for less > than $1000 I don't think that the Interceptor is going to be much use with spread spectrum reception. Unless you are really, really close to your target other non-ss signals are going to be much stronger. The freq range of the device is 30MHz-2GHz. It is also legal to sell even though it is great at picking up the cellular phone conversations in the car you are tailing. There is also the plausible deniability in a device like this because you don't know what frequency you are listening to so you don't know if it is one of those "illegal ones". A directional antenna isn't much use with a device like this because it will pick up many other stronger signals that will overwhelm your target transmission. I am speaking of suburban or urban areas here. This may work if you are in a rural region where there are no cell towers, braodcast towers, or repeaters in use. The Scout is a just frequency counter so you must have a scanner or the Interceptor to actually listen in. - Weld Pond -

1 0

Re: Newsweek Nerd 50
by jim bell 17 Dec '03

17 Dec '03

At 11:04 PM 12/21/95 -0600, you wrote: >Cypherpunk Notables on the List: "Newsweek's Epithet" >Phil Zimmerman: "Crypto Creator" >Marc Rotenberg: "Privacy Advocate" >Sameer Parekh: "Protector of Privacy" >Johan Helsingius: "Crusader" >and Steven Levy, who sometimes posts here has the byline on the "Year of >the Net" feature. >PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a >"Geek" for exposing those bogus factors the marketdroids want to use to >control their survey data back up to the population level. Of course, Newsweek should have included the "baddies" as well: Dorothy Denning would be the Wicked Witch of the West, and Sternlight would have been one of those Winged Monkeys...

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: ex encrypted script
by jim bell 17 Dec '03

17 Dec '03

At 11:20 PM 12/21/95 -0800, you wrote: difficult for the amateur attacker. >> >>A tale I hear is that when HP had to deliver operating system source to >>the french government they stripped all comments and changed all variable >>and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >>It still compiled but was 100% useless to human readers. > >There is a commercial product out there from Gimpel Software called _The C >Shroud_. It removes all structure from the code, replacing it with gotos, >renames all the symbols to axxxxxxx, converts constants and strings to hex, >substitutes all #defines and expands all macros, strips all formatting and >comments, etc., resulting in a perfectly compilable, but infuriatingly >obfuscated set of source files. >Steven Weller On the other hand, there are some programmers out there whose work product makes such a product totally redundant!

1 0

Re: Navy hacked by Air Force?
by RobL 17 Dec '03

17 Dec '03

At 04:58 PM 12/22/95 -0500, Vin McLellan wrote: > Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... > > I'm new to C'punks, so I don't yet have a grip on the context in >which you consider privacy, property, and other ultimate values. I do >wonder, though: Do you spend a lot of time pissin' on each other's shoes >like this? Laughing my ass off here.. not yet I have seen someone so precisely hit the nail on the head.. Seems this is happening a lot lately.. must be the tension of the holiday season.. <g> Guess I need to start adding plastic shoe-guards to the C-punk kit.. ;) ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

More developments in Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I have been updating my web page almost daily with developments in my case. The latest is that we've written and asked the Court to accept a Supplementary Memorandum opposing the government's motion to toss out our suit, and I've backed it up with a Supplementary Declaration. In it I explain how I just found all of the source code at issue (the Applied Cryptography diskette) on a public FTP site in Italy. This took about 10 minutes using Netscape. I then downloaded the Triple DES code referenced in the earlier Declarations by NSA Deputy Director Crowell and myself in 1.7 seconds, adding that this is somewhat less time that it takes me to move to my computer, insert a floppy disk and return to the keyboard. The government is now asking the judge not to accept these latest filings. Stay tuned! The URL again is http://www.qualcomm.com/people/pkarn/export Phil

1 0

Re: [ecash] Re: Multi-issuer questions
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

>On Tue, 19 Dec 1995, Marcel van der Peijl wrote in the ecash mailing list: > >> Q: If user A signs up with bank A, and merchant B signs up with bank B, >> can user A buy at merchant B? >> >> A: In theory: >> >> Bank A and bank B need to have an interbank clearing agreement. User >> A sends his money to merchant B. Merchant B contacts his own bank, >> bank B. Bank B recognizes the money as being issued at bank A, >> contacts bank A, and clears the coins there. Bank A credits bank B's >> account at bank A, bank B sends an acknowledge to merchant B and >> merchant B sends the goods to user A. > On Fri, 22 Dec 1995, Patiwat Panurach <pati(a)ipied.tu.ac.th> replied: > I dispute this even on theoretical grounds. > >Am I right in assuming that the only reason Bank B has in contacting Bank >A is to confirm that the ecash hasn't been double spent? Once that is >confirmed, there should be no need for contact between the two banks. >Bank A should not have to credit Bank B's account as there has been no >transfer from Bank A to Bank B. The transfer has been the deposit from --------------------- I guess you mean: from Bank B to Bank A >Bank B's customer to Bank B. Bank B is allready "credited", i.e., its >(e)cash researves have increased, the moment Bank A confirms that the >ecash is valid. > In my understanding - and I'm sure Marcel van der Peijl :-) will correct me :-( if I'm wrong - the only way Bank B can verify with Bank A that the ecash it has received from merchant B has not been spent before is by actually sending the _coins_ to Bank A. Hence there _is_ a transfer from Bank B to Bank A and thus Bank A has to credit Bank B's account... Marcel? Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

Houston C'punk gathering
by turner＠TeleCheck.com 17 Dec '03

17 Dec '03

For C'punks in the Houston area, there will be an informal gathering at Strack's Restaurant, tomorrow at approx. 11:00 a.m. I will attempt to get there a little early, and I will be the one with a red lamborghini countach on the table. Just come up and sit down. Strack's has a breakfast buffet which is reasonably priced, or at least it was the last time I went there. Possible Topics for Discussion: I will also be bringing the encryption algorithms used by VMS (the AUTODIN-II, Purdy with salted input, Purdy (Purdy V) with variable length username, and the Purdy (Purdy S) with additional bit rotation). I have tested these under VMS 6.2 and they seem to work fine, although they could be (and should be) optimized for brute forcing. I will also be bringing some password brute forcing code that utilize the system services to encrypt the password (and punch CPU usage through the roof). It will crack a three character password in under a minute on a loaded AXP 3000LX. I will also be bringing a copy of the infamous _Giant Black Book of Computer Viruses_ by Mark Ludwig. Interesting stuff. Directions (from Houston): Take I-45 North. You will pass 1960 and then will drive though a stretch of road riddled with construction barrels. Do not exit Holzworth, but take the next exit (Louetta). Get on Louetta (you will have to make a right turn and you will be on the overpass), and take the overpass west towards Tomball. You will cross through several intersections, Strack's will be on your left, after you cross Kukendaul (approx. 1-2 miles ahead). If anyone gets lost, or wants more info you can page me at: (713) 866-0989.

1 0