December 2003 - cypherpunks-legacy

Motorola Secure Phone
by dan＠milliways.org 17 Dec '03

17 Dec '03

I saw a new cordless phone made by Motorola in a retail outlet today that is supposedly "Secure from eavesdroppers." I asked the salespeople for more technical info, but they weren't very helpful. Does anyone have any information on this? I didn't notice any "Not for Export" stickers on the box, and the ITAR does cover spread-spectrum technology. So is it analog or digital? Is it just doing simple analog tricks, or is it encrypting a bitstream? Clipper maybe? I doubt it. Any info appreciated. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

5 4

Re: Secured RM ? (source)
by Josh M. Osborne 17 Dec '03

17 Dec '03

In message <Pine.LNX.3.91.800121064335.1068A-100000(a)HellSpawn.gate.net>, root w rites: > >OK ... here we go.. Based on discussion on this list this is what I >hacked out to (hopefully) more securely remove a file under unix. >I'd really apreciate any input, but my main interest is in the security of >the protocol in general and not the sloppy and embarassing C >programming.. :) Well it seems to assume that it only needs to write 1024 bytes past the end of the file. You either don't need to write any bytes at all past the end, or you need to write one "block" past the end (normally 8K, but it varies), you can use fsstat(2) on many systems to find the block size for a filesystem. Secondly you need to flush the data out to the file (use fflush(3), and fsync(2) if available, otheruse call sync(2) *twice*). If you don't some small set of Unix systems may notice that you are writing to a file that no longer exists, and not do the writes at all. Thirdly you should make several passes over the file, writing diffrent patterns on each pass (and remember the flush & sync after each pass - while it is uncommon for Unix systems to supres writes to unlinked files it is extreamly common for them to detect multiple writes to the same part of a file, and only do the last one). Forth - and this is the kicker - there is no gaurentee that the filesystem itself won't keep a copy of the old data for some reason. Three examples: * a compressed filesystem may write the new data elsewhere because it compresses diffrently from the old data - you should be able to defeat this by filling the disk several times with random paterns * the log structured filesystem (LFS) *will* write the new data elsewhere, and the space the old data is on will not be overwritten untill the cleaner comes and examines the part of the disk it is on - again filling the disk several times with random patterns should cause an overwrite * NetApp's NFS appliance ("the toaster") can (and normally is) configured to take "snapshots" of the filesystem at various times, this makes the blocks the file is currently on read-only, and any ovewrites will merely allocate new space. The old copy of the file will be readable for some peroid of time (frequently up to a week) under a diffrent name - here you will be unable to fill the disk (unless you are the NetApp admin - then you can delete the appropriate snapshots and fill the disk...) While we are at it you probbably want to use stat(2) to find the length of the file, and you can get far more I/O if you allocate a sizeable chunk of memory (say 1K, or 8K) and use writev(2) to shove multiple copies of it out per syscall... and some indenting on the code would make it more readable (and simpler for you to write as well). >While we're here.. I havn't been able to find anyone on the planet who's >seen or heard of a linux un-remove, which makes testing my code very >tricky. If anyone can point me at it I'd apreciate it. Hell, if someone >can definitively say they've /seen/ such a thing it'd be nice. So far >i've found one person who insists that his system admins sisters >boyfriends cousin from Saint Petersburg has been using un-rm for unix for >years. *sigh* I don't know of a real un-rm. In "the old days" there was a fsdb (filesystem debugger) that could be used to alter the filesystem at a low level. If you knew enough you could "un-rm" a file. It had to be a very valuable file to be worth it!). At some sites they alias rm to do something like "mv $1 .$1.deleted", making an un-rm is left as an exercize for the intrested reader.

1 0

Alien Abductees, Flat Earthers, and other Fringoids
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:37 PM 12/15/95, Giles Bowkett wrote: >Does anyone know of a mailing list organized around political issues >regarding electronic networks, virtual community, the changing roles of >the city and the corporation, and especially issues of class in a "wired" >world? > >Much thanx, pls pardon the spam. Don't mention it! After all, all right-thinking Cypherpunkz are intensely interested in these mailing lists you sent this to: abducted(a)hyperreal.com (many Cypherwonks are alien abductees!) flat-earth(a)zikzak.net (where the "edge" culture meets the edge of the Earth) email(a)fringeware.com (yes, we're at the fringe) So nice to know that we're lumped in with these folks. --Tim "Dr. Bob" May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

personal privacy
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

Well, as of about two days ago IL passed a bill that says employers can listen to their workers phone calls all they want. Dr0id

1 0

Re: Netscape announces position against GAK
by jim bell 17 Dec '03

17 Dec '03

At 01:16 AM 12/9/95 -0800, you wrote: >http://home.netscape.com/newsref/ref/encryption_export.html > >> NETSCAPE PRESENTS POLICY ON ENCRYPTION EXPORT TO KEY MEMBERS OF THE >> ADMINISTRATION AND CONGRESS >> >> ---------------------------------------------------------------------- >> >> This week Netscape representatives attending a government presentation >> of the administration's proposed Key Escrow Policy for Export detailed >> the company's firm opposition to the proposed policy. Netscape is >> opposed to this type of proposal for a number of reasons including its >> failure to adequately address the issues of acceptability by foreign >> governments and corporations, significant personal privacy concerns, >> and the mandatory nature of tying the Exportable Key Size to the Key >> Escrow Proposal. [rest of position deleted] While this may be a reasonably good start, what I would have preferred that you say is that if any kind of GAK system is adopted, either foreign or domestic, you as a corporation would ENTHUSIASTICALLY do everything in your power to (_legally_) circumvent, undermine, sabotage, neutralize, and counteract whatever goals the US government has with reqard to implementing GAK. In other words, while you might stay barely within the letter of the law, you would tirelessly exploit every possible loophole (both legal and technical) to ensure that the government NEVER gets its way. I feel certain that with a few imaginative lawyers and programmers (both foreign and domestic), it should be possible to turn this into a "nightmare scenario" for the government.

1 0

Re: ADDRESS DATABASE?
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

>> any type of billing information to the phone company. The number is also by >> nature unlisted and the only way to get it is by you or the cellular >> carrier. If the cellular carrier gives your number out without your >> permision or a court order they are in BIG trouble.. > >My untrained brain sees two problems with this: > >1) Cellular systems are inherently less secure than standard telephones, >as anyone who can afford a decent scanner can listen to your conversations >at will. I was speaking more secure in that the billing information is much harder to get. If someone had the time, money, and equipment to track a particular person at a specific location making a cellular phone call from a given number they would most likely already have the means of getting the information an easier way. >2) You're relying on someone other than yourself to protect your security, I do agree that letting anyone other than yourself control your personal information is bad! It happens all to often. >which is always a bad idea. Cellular carriers, Ma Bell, anyone. Does anyone >on this list really believe that representatives of these organizations >would think twice about bending over and spewing out everything they know >about you? They do it all the time, without your permission and without >valid court orders. At least 50% of the cellular carriers are not telco related. Giving out cellular numbers and names is a tabbo NONO for cellular carriers. If cellular customers start getting sales calls from a company that received a list from a cellular carrier, the cellular carrier is obligated to refund the customers bill for those calls if the customer complains becuase the customer pays for calls comming or going. I don't feel that cellular is completely private or secure but its getting much better with the addition of digital cellular. The problem with digital is that the conversations are more secure but the information about the people calling is not. Digital cellular and PCS offers ANI and a bunch of other identifying information. Dr0id

2 1

Re: Secured RM ? (source)
by Adam Shostack 17 Dec '03

17 Dec '03

| | While we're here.. I havn't been able to find anyone on the planet who's | seen or heard of a linux un-remove, which makes testing my code very | tricky. If anyone can point me at it I'd apreciate it. Hell, if someone | can definitively say they've /seen/ such a thing it'd be nice. So far | i've found one person who insists that his system admins sisters | boyfriends cousin from Saint Petersburg has been using un-rm for unix for | years. *sigh* From comp.unix.questions FAQ: (http://www.cis.ohio-state.edu/hypertext/faq/usenet/unix-faq/faq/part3/faq-d…) MIT's Project Athena has produced a comprehensive delete/undelete/expunge/purge package, which can serve as a complete replacement for rm which allows file recovery. This package was posted to comp.sources.misc (volume 17, issue 023-026) -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

More Balto Sun on the NSA: Infowar
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

The last part of the Baltimore Sun's series of articles on the NSA arrived today. It concentrated upon the prospect for a bloodless "Infowar." The article began with a hypothetical attack beginning on January 17, 2001, the tenth anniversary of the US bombing of Baghdad. In the attack, bad, computer related things happen like stock markets crash and all of the money is drained from the accounts of the sailors in the US Navy. The article then uses this as a beginning for a long contemplation of the NSA's future. Many of the details are well-known to cypherpunks. The NSA is poking around with drug interdiction, economic intelligence and computer security. The Russian linguists are being retrained. Etc. The article ends with a story told by Senator Rudman of NH. He says that 100 years ago, the houses were wood and we needed fire stations on every corner. Now, they're made of brick and concrete and come with sprinkler systems. The Fire Union might argue that you still need a fire station on every corner, he told the reporter, but that's not necessarily true. So, perhaps Clipper is a form of job insurance? True perfect security would not only hurt SIGINT, but it would remove the need for crypto firemen. If you want to have a system that gives some people access and not other people, then you need a lot of folks to stand around, sign forms and generally make sure that everything is running smoothly. Strong cryptography is automation. GAK requires a large bureaucracy to administer it. The article also has some anecdotes about how the agency protected US firms abroad. One company was alerted that its European competitor was bribing the Latin American officials who were choosing the winning bid. Also, when the Peso collapsed, the US negotiators had access to some information that the Mexican government wasn't being as forthcoming as they should have been about the country's assets. They used this information in negotiations. --Peter Wayner You can purchase the complete articles from the Baltimore Sun by dialing 410-332 6962. The price is $3.95. (See my second post for more info on an earlier article about Crypto AG).

2 1

Re: NET - HLR on highway privacy (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 15 Dec 95 at 13:54, Jon Lasser wrote: : I hadn't seen this cross the list yet... : : ------------------------------------------------------------------------------ : Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 : Visit my home page at http://www.goucher.edu/~jlasser/ : You have a friend at the NSA: Big Brother is watching. Finger for PGP key. : : ---------- Forwarded message ---------- : Date: Mon, 11 Dec 1995 05:59:53 -0600 : From: FringeWare Daily <email(a)fringeware.com> : Subject: NET - HLR on highway privacy : : Sent from: hlr(a)well.com (Howard Rheingold) : : We Need Privacy Protection On Intelligent Highways : -- By Howard Rheingold : : Ominous steps have been taken recently, steps that perhaps move us : all closer to a global surveillance state, but few people are aware of them. : Governments around the world are installing "intelligent highways," whose : snooping capabilities ought to concern every driver. [ Much about automatic tool billing and how it can be used to track vehicles deleted.} The MTA (the people who 'run' the toll roads about Houston) have an automatic payment system in place that use transponders mounted on windshields. Most people who have these don't know it, but they have pickups for these little devices all over the freeway system, not just at the toll booths. But if you go to http://herman.tamu.edu/houston-real.html you can get an idea of what they are able to do with the data. And then they have the lobes to ask you to volunteer to put one of these things on your car. What boggles the mind, is that people do... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMNIdqjUjeCeeebC9AQG7XAf/YgxgSAhNrsEFMtjUtS4UrzTVNhEkzBK6 IQv+LMb45B/niD+fQYKmViTu8ki/jEoBZ4zLEmSLmrE8Gl0vhmSgnYCoLjVeURxo k4JEf3uYRCrGWt94hihiLl+2GahqkPdaxBdksGVR0DHAF6SIWKbwvh0LRgDiUcOT lQ6Cb9AwthPuX2BYx/1kmijABSwsEJYv2mF7J3mWwqR/3C9u92thMqfMVPIWkPfn mzgK+/OROzug2nPjIZ2ULhbJYY05mrVr0JD70kmBoThH1kqt8+1xU9v9HeziZl/y WZ8b24i3rKxLZq4PaPMsKX6TlWpIlnJt4QPTwVt4gr0sRwuY4I37sw== =GJjw -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com The difference between science and the fuzzy subjects is that science requires reasoning, while those other subjects merely require scholarship.

1 0

Re: Motorola Secure Phone
by Peter Trei 17 Dec '03

17 Dec '03

Sameer wrote > > My AT&T 900 (or is it 9000?) MHz digital cordless phone says > the same thing. I figure it uses a weak cryptosystem. There is > something about key setup when you return the handset to the base. > (The phone was $200, FWIW) > Dan wrote: > > I saw a new cordless phone made by Motorola in a retail outlet today > > that is supposedly "Secure from eavesdroppers." I asked the > > salespeople for more technical info, but they weren't very helpful. > > Does anyone have any information on this? I didn't notice any "Not > > for Export" stickers on the box, and the ITAR does cover > > spread-spectrum technology. So is it analog or digital? Is it just > > doing simple analog tricks, or is it encrypting a bitstream? Clipper > > maybe? I doubt it. Any info appreciated. > > Dan I've also got an ATT 9000. It's one of the digital 900Mhz phones, and has no encryption. It claims extra security due to being digital - your average 14 year old's scanner is analog only. There's a bunch of frequencies. The frequency to use, and (fairly small (16bit?) security code gets reset when the receiver is put on it's stand. The code is used only for a handshake, so several phones in the same area won't interfere by accident. It is not frequency agile - the same freq is used throughout the call. It's a good phone - nice tone, long range, and it's secure against jerks with scanners. Secure against serious eavesdroppers it's not. When I bought it a year or so ago, I also looked at another phone from (I think) Uniden, which *was* frequency agile. I was intrigued enough to call the manufacturer, and confirmed that it did indeed hop frequencies while the call was underway. How often, and how the next frequency was determined was not known by the guy I talked to, and I balked at the $350 price. speaking for myself Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0