December 2003 - cypherpunks-legacy

Anyone using Microsoft Access 95?
by Just Rich 17 Dec '03

17 Dec '03

Have a hackmsoft submission that needs fleshing out. Not enough general interest to post in detail. Basically, you're supposed to be able to spoof the database server as any user. -rich

2 1

Don't type: "g**d t*m*s v*r*s"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:35 PM 1/9/96, Kent Dahlgren wrote: >God...are we going to have to endure this like we have had to endure that >stupid g**d t*m*s v*r*s e-mail crap? Let it die. Let it die. I have edited the name of this virus so as to minimized its damage. I read that even _typing_ the phrase "g**d t*m*s v*r*s" in its full form can cause the information stored in the phrease "g**d t*m*s v*r*s" to unpack itself, install itself on all types of disk drives, and then initialize the disks. I hope we caught it in time! (More seriously, I notice that "alt.folklore.suburban(a)c2.org" was in the distribution list for the message I'm replying to (pared out by me on this message). I really hope that this does not mean what I think it means, that "alt.folklore.suburban" is not being copied! The cross-contamination of many mailing lists is one thing, but cross-contaminating our mailing list and Usenet groups would truly be the work of the Army of the Twelve Monkeys.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: Eggs at Customs (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:36 PM 1/15/96, Lindsay Haisley wrote: >There has (fortunately!) been a big crackdown recently on the illegal pet >bird import trade, something akin to the slave trade of the 19th century for >those of us who like pet birds. One of the methods people use to import >birds is to wear special vests full of pockets for rare bird eggs. If the >person who wrote this was coming in from SE Asia, especially Australia, then >this was very possibly the meaning of the question. Yes, Cliff Stoll described how this plot was hatched in his book "The Cuckoo's Egg." (This was a yolk, folks. I stoll it.) P.S. I am persuaded that the importation of rare tropical birds into the U.S. is a GOOD THING, and that the attempts to ban such imports are misguided eco-fundie efforts. Diversity will be enhanced by having the birds in the U.S., and if left in their native jungles, most will die anyway. Better a pampered tropical bird in a gilded cage than lunch for some predator, or starvation as the jungles are cleared by slash-and-burn farmers. The same data transparency of borders, where truckloads of stuff come in easily, means that truckloads of birds, eggs, embryos, babies, etc. can also make it in. Most such shipments are only caught when surveillance yields a shipping schedule...such surveillance is becoming more and more difficult because of the technologies we push. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

10 13

CAQ - Secret FISA Court Violates Rights (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: CAQ - Secret FISA Court Violates Rights C O V E R T A C T I O N I N F O R M A T I O N B U L L E T I N ========================================== CovertAction Quarterly has won numerous awards for investigative journalism. It is read around the world by investigative reporters, activists, scholars, intelligence buffs, news junkies, and anyone who wants to know the news and analysis behind the soundbites and headlines. Recommended by Noam Chomsky; targeted by the CIA. Each article in the 64-page magazine, which is in its 16th year of publication, is extensively footnoted and accompanied by photographs and graphics. ============================== For a single issues send $6. A one year subscription: US $22; / Canada/Mexico $27; Latin America/Europe $33; / Other areas $35. Please send check or money order in $US to: CAQ, 1500 Massachusetts Ave. #732 , Washington, DC 20005, USA Phone: 202-331-9763 / Fax: 202-331-9751 / E-mail: caq(a)igc.apc.org ================================================================= THE SECRET FISA COURT: RUBBER STAMPING ON RIGHTS by Philip Colangelo Part 1 of 3 SEVEN JUDGES ON A SECRET COURT HAVE AUTHORIZED ALL BUT ONE OF OVER 7,500 REQUESTS TO SPY IN THE NAME OF NATIONAL SECURITY. THEY MEET IN SECRET, WITH NO PUBLISHED ORDERS, OPINIONS, OR PUBLIC RECORD. THOSE SPIED ON MAY NEVER KNOW OF THE INTRUSION. NOW, CLINTON HAS EXPANDED THE POWERS TO INCLUDE NOT ONLY ELECTRONIC, BUT PHYSICAL SEARCHES. The aftershock of the Oklahoma City bombing sent Congress scurrying to trade off civil liberties for an illusion of public safety. A good ten weeks before that terrible attack, however with a barely noticed pen stroke President Bill Clinton virtually killed off the Fourth Amendment when he approved a law to expand the already extraordinary powers of the strangest creation in the history of the federal judiciary. *2 Since its founding in 1978, a secret court created by the Foreign Intelligence Surveillance Act (FISA rhymes with ice -a) has received 7,539 applications to authorize electronic surveillance within the U.S. In the name of national security, the court has approved all but one of these requests from the Justice Department on behalf of the Federal Bureau of Investigation and the National Security Agency. *3 Each of these decisions was reached in secret, with no published orders, opinions, or public record. The people, organizations, or embassies spied on were not notified of either the hearing or the surveillance itself. The American Civil Liberties Union was not able to unearth a single instance in which the target of a FISA wiretap was allowed to review the initial application. Nor would the targets be offered any opportunity to see transcripts of the conversations taped by the government and explain their side of the story. Without access to such materials, said Kate Martin of the ACLU, targets of FISA searches are denied any meaningful opportunity to contest the basis for the execution of the FISA search. *4 ======================================== OPEN-ENDED SURVEILLANCE When Clinton signed Executive Order 12949 on February 9, the frightening mandate of the FISA, court was greatly expanded: It now has legal authority to approve black-bag operations to authorize Department of Justice (DoJ) requests to conduct physical as well as electronic searches, without obtaining a warrant in open court, without notifying the subject, without providing an inventory of items seized. The targets need not be under suspicion of committing a crime, but may be investigated when probable cause results solely from their associations or status: for example, belonging to, or aiding and abetting organizations deemed to pose a threat to U.S. national security. Furthermore, despite a lowered standard for applying the Fourth Amendment against unreasonable search and seizure than is necessary in other U.S. courts,5 under the 1995 expansion, evidence gathered by the FISA court may now be used in criminal trials. Previously, evidence was collected and stockpiled solely for intelligence purposes. ========================================================== LEGALIZING THE AMES SEARCH Granting new powers to the FISA court was accomplished quietly and treated as a non-event in the national media. The lack of reporting was somehow fitting, though, following as it did the silent debate last year when Congress rubberstamped the annual Intelligence Authorization Act. *6 Some legal minds found the whole exercise positively refreshing. The fact that this was done with a minimum of fuss and posturing on both sides, and without having to have a debate that tries to roll up the corners of classified information is very impressive, cheered former NSA General Counsel Stewart Baker. *7 Reportedly, the Clinton administration had not always been enthusiastic about expanding the court's powers. Like its predecessors, it operated under the assumption that the executive already had inherent authority to exempt itself from Fourth Amendment constraints and could order warrantless searches to protect national security. Nonetheless, the government avoided allowing this inherent authority to be tested in the courts. *8 Then along came Aldrich Ames. The spy case proved a convenient vehicle on which to hitch expansion of state power. It also offered a glimpse at the state-of-the-art domestic counterintelligence techniques that might well be turned on an activist group near you. Following months of electronic and physical surveillance which included a break-in of Ames' car and searches through his office and family trash FBI agents were finally turned loose in the early morning hours of October 9, 1993. They didn't `pick' locks like in the movies; they made their own keys. Among other agents in the FBI, the consensus was unanimous: The tech agents were geniuses. *9 Thanks to a warrant authorized by Attorney General Janet Reno, a team of agents from the sprawling National Security Division had permission to enter the Ames home in Arlington, Va.10 There was only one minor problem. The attorney general of the United States does not have the authority to order a warrantless physical search of a citizen's home, argued Professor Jonathan Turley of George Washington University National Law Center. The Aldrich Ames search in my view was obviously and egregiously unconstitutional. 11 Other civil liberties lawyers agree with this evaluation, and the Justice Department itself was concerned enough about the question to refer to this problem when it negotiated a deal with Ames in order to avoid trial. While Ames was sentenced to life in prison, his wife Rosario received five years. We didn't get to the point of litigation, I regret to say, said Ames' lawyer Plato Cacheris. The problem was that Ames very much wanted to see that his wife was treated a little more softly than he was being treated. *12 Now eager to put a stamp of judicial impartiality on the hazy executive branch doctrine of inherent authority, the Justice Department immediately got behind the bill to expand the FISA court's power. Soon after Ames pleaded guilty last year to spying, administration officials began arguing that adherence to traditional Fourth Amendment protections for American citizens would unduly frustrate counterintelligence efforts against spies operating in the U.S.13 Physical searches to gather foreign intelligence depend on secrecy, argued Deputy Attorney General Jamie Gorelick. If the existence of these searches were known to the foreign power targets, they would alter their activities to render the information useless. 14 Gorelick went on to explain that A [traditional] search can only be made when there's probable cause to believe a crime is involved, whereas a national-security search can be made at a substantially earlier stage. We often don't know what we're looking for when we go in, she observed.15 ======================================================

1 0

remarkable recent stories
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen much dialogue on some key things that have popped up recently of high relevance to this list; forgive me if these are covered in threads (inappropriately named?): 1. GNN had an article in which Madsen (puzzle palace coauthor I believe) stated that the NSA was trying to restrict anonymity by working behind the scenes with Lotus, Microsoft, etc. major meat for TCM's "NSA visits" compendium assuming he's still working on it. also, it sounds like the most direct evidence that the NSA is working against anonymity in cyberspace, something that really surprises me. 2. the same article had Madsen stating that the NSA is vacuuming down Internet traffic. he gave the likely entry points that they are doing this. this is one of the first major credible insistences I've seen that the NSA is doing this. (there are of course a bazillion urban legends that the NSA does this). Madsen claimed that some private companies were getting contracts for the work. hmmmmmmm, possibility of some cyphersabotage here, like what went on with mycotronix? (sp?) 3. the absolute biggest blockbuster of them all: the NSA supposedly did a study about how crypto regulations affect US competitiveness in the international marketplace and *concluded* they were damaging it. (surprise!!) the Commerce Dept. has recommended *easing* export regulations. this is very notable for several reasons: - The NSA would probably not release the study unless they were hinting at a new policy decision. they do a bazillion studies surely but none of them see the light of the public day. why would they release *this* one? - the commerce dept is probably heavily influenced by the NSA-- i.e. I doubt that they would come out with a favorable recommendation for crypto unless the NSA approved. however, on the other hand, in the articles there was a caveat that "if the military and spy agencies allow it". not sure what was meant by that. - what I wonder is if the same NSA study was more comprehensive and tried to look at the overall implications of current or altered crypto export policy. i.e., did they try to address the question, "what would really happen to overall US situation if crypto were unregulated? would it mean better business? more or less crime?" etc. I have said this before, but everyone seems to *assume* that unrestricted crypto necessarily releases the 4 horsemen of the infocalypse, but what if an actual *study* was done, that potentially *contradicts* this idea? there are many examples of new technology being introduced that has an effect far different than that anticipated by the masses or the conventional wisdom, and often much more benign than expected. - what this all suggests to me is a possible major policy/political switch inside the NSA in which possibly someone who is more in favor of code making than code breaking is gaining the reigns. its tough to guess based on the NSA's entrails, but recent events are some pretty odiferous entrails, I'd be interested to here what others think.

3 2

Re: Crypto anarchist getting through customs
by James A. Donald 17 Dec '03

17 Dec '03

At 08:20 AM 1/16/96 +0000, attila wrote: > Bubba signed PPD 25 which permits UN control of US > forces, _in America_! and allows the UN to bring in UN troops. While there are undoubtedly people plotting a one world government, the miserable performance of the blue helmets means that there is no present danger. Soldiers are just not willing to die for the greater glory of the United Nations. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Eggs, or, To Get Some Entropy You Gotta Break Some Eggs...
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Amazing that a discussion of eggs could come back to crypto...) At 2:17 AM 1/16/96, Rich Graves wrote: >Kind of analogous to an engineer like Paul Kocher taking a hard look at >crypto systems that had only been analyzed by pure mathematicians. You >need to feed the sniffers real entropy, not just highly evolved math. I keep thinking of different ways of looking at Kocher's timing attack. (Paul Kocher gave a nice talk at the Bay Area Cypherpunks meeting on Saturday.) Rich's point above suggests yet another way of looking at this: that a chip or algorithm that can be "instrumented" (timing measured) is in some sense too predictable. The chip itself lacks sufficient entropy. (Before the purists, especially those who've read the paper closely, jump on me here, I'm not saying adding random delays is the best way to deter the attack. In fact, a variation of blinding is the best approach it seems. (Though blinding does not affect attacks which monitor the crypto chip's or CPU's power dissipation.)) My point, or this angle on it, is that to some extent the mechanistic nature of the encryption process (such as Diffie-Hellman) can leak information to an attacker who can watch the mechanistic process unfolding. This is a result which is not surprising, in retrospect. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Information Sent by Netscape during Queries
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Here's some questions I hope some of the Netscape staffers on the list can help with. 1) Can we delete/rename or otherwise disable the MagicCookie file and still use Navigator? 2) Are there headers besides the standard HTTP/1.0 fields sent with our http transactions? What are they? 3) Can we go completely stealth inside of Netscape without a proxy server? In a privacy seeking frame of mind, Bill Bill Humphries \/\/\/ bill.humphries(a)msn.fullfeed.com /\/\/\ Madison, WI, USA PGP Public Key Fingerprint = 84 05 17 9D B9 6E 2D FE A7 D1 E0 DC D0 96 63 FB

3 2

Novell & Microsoft Settle Largest BBS Piracy Case Ever
by gbe＠primenet.com 17 Dec '03

17 Dec '03

I saw this in a news summary today and thought that it might be of interest to the list. Sorry, but this is all of the article that I have. >From PR Newswire: "Microsoft Corporation and Novell, Inc. Jointly announced today they have reached a settlement with Scott W. Morris, who was doing business as the Assassins Guild Bulletin Board Service, in what is belived to be the largest settlement ever..." -- Gary Edstrom <gbe(a)primenet.com> | Sequoia Software PO Box 9573 | Programming & Technical Services Glendale CA 91226-0573 | PGP Key ID: 0x1A0D44BD PGP Fingerprint: 72 AA 4F 73 05 53 89 C6 8A EE F4 EE D1 C0 13 8D

5 4

Re: Digital postage and remailer abuse (was Re: Novel use of Usenet and remailersto mailbomb from luzskru@cpcnet.com)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 8:47 1/13/96, Alan Bostick wrote: >Maybe I'm misunderstanding how using digital postage with remailers would >work. I was assuming that the postage stamp would be included *inside* >the encrypted envelope, that what the remailer would do on receipt of >mail would be: (a) decrypt the envelope; (b) validate the postage stamp; >and (if the stamp is valid) (c) forward the message according to the >now-decryped instructions. > >Using this model, if the perpetrator doesn't include a postage stamp, >then the message is ignored. If the perp includes a stamp, the first >horny net geek's message is relayed but subsequent ones get bounced for >invalid postage. You are right. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0