December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> > We've made no progress. Phil has lots lots of time and gained > >lots of grey hairs, and everyone who donated to his defense fund lost > >money. > > No progress? At least Phil is not going off on a trip to Alcatraz to > make small ones out of big ones. Thats a big plus in many peoples books. I wish I could make another of my pollyannaish posts now, but I agree with Sameer. It's great that Phil's off the hook, but there's nothing to stop them from doing the same thing to someone else tomorrow. What's more,, everyone here knows that, and so the government gets what it really wants: a chilling effect on crypto development. How much credit do you give a guy when he stops beating his wife? They put Phil through the ringer, made him spend his money on lawyers, and added a lot of stress to his life. But they haven't admitted that they were wrong, and they haven't renounced such actions in the future. We're all very happy that Phil's out of the woods, and today's announcement is a great thing. But it's not enough.

1 0

PGP_foi
by John Young 17 Dec '03

17 Dec '03

1-12-96. NYPaper: "Data Secrecy Export Case Dropped by U.S." By John Markoff. PGP_foi

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> From: Michael C. Peponis <mianigand(a)unique.outlook.net> > To: cypherpunks(a)toad.com > > Why let it bother you? You must understand that the majority of the ^^^^^^^^ > population of the United States is working class trash, the news ^^^^^^^^^^^^^^^^^^^ Hope you're including yourself in that. > media is just peddeling to the masses, just like the morons that hold ^^^^^^^^^ Can't spell - *must* be working class trash... > elected office. > > Regards, > Michael Peponis ^^^^^^^ Tell me: is the 'po' silent?

1 0

reach out!
by William T. Rainbird 17 Dec '03

17 Dec '03

I know this isn't a typical posting for this group, but I thought I'd point out that O.J. Simpson has a video for sale, to further exploit his carnage. You can buy it by dialing 1-800-OJTELLS 1-800-658-3557 it is a FREE CALL (for you). I guess that means the MERCHANT PAYS for the calls, even if NOTHING IS ORDERED... Please repost and tell your friends!

1 0

Re: Novel use of Usenet and remailers to mailbomb
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Jammin' on the mailbomb trick... Looks like it's a variant of another scheme used elsewhere, viz, --- begin forwarded text To: rah(a)shipwright.com (Robert A. Hettinga) From: oldbear(a)arctos.com (The Old Bear) Subject: Re: Novel use of Usenet and remailers to mailbomb Date: Fri, 12 Jan 1996 23:10:43 EDT rah(a)shipwright.com (Robert A. Hettinga) writes: >From: rah(a)shipwright.com (Robert A. Hettinga) >Newsgroups: tiac >Subject: Novel use of Usenet and remailers to mailbomb >Date: Fri, 12 Jan 1996 14:34:18 -0500 >Organization: e$ >| Somebody, too clever for their own good by half, has come up with a >| novel way of using Usenet and anonymous remailers to perpetrate >| mailbombs. The M.O. is to post a message to the naked-lady newsgroups >| saying "get pics in your mailbox! send this message to this address!), >| giving the email address of a cypherpunk-style anonymous remailer and >| including a pgp-encrypted message block. A variation on the mailbomb from dispersed unwitting sites, except involving the telephone network, was discussed on alt.dcom.telecom some time back. Maybe you call this a phone bomb. As you know, pager companies get blocks of numbers within a local exchange for their operations. So, for example, 635-3000 to 635-3999 may represent a thousand radio pager customers of a particular paging company. Wanting to harrass an estranged spouse, some nefarious character programmed a dialler deamon to sequentially call each of the numbers in a pager block and leave a messsage to return call to the spouse's phone number. Naturally, caller id did no good to track or ignore the unwanted calls to the spouse at all hours from pager subscribers who were receiving messages on their alpha-numberic pagers to call the spouse's number. 'Wrong number' calls were coming in to the spouse from all over at all times. Moreover, it is virtually impossible for a pager company to track a single number which calls each of its lines only once. Definitely not a nice thing. --- end forwarded text Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

E-mail Spoof Throws Apple for a Loop
by Anonymous 17 Dec '03

17 Dec '03

Your message here. Dirty, Rotten E-Mail Liar Accuses Apple of Being Worth a Lot More By JIM CARLTON Staff Reporter of The Wall Street Journal To Apple Computer Inc.'s litany of woes, add a mad e-mailer. The e-mailer struck this week with a copy of a bogus message from Sony Corp.'s president threatening a hostile takeover of the Cupertino, Calif., computer maker. The "letter" showed up in e-mail baskets of computers throughout Silicon Valley and beyond. Managers at Apple read the letter with great interest -- until they got to the part about Sony offering $63 a share, or roughly double Apple's stock value. Now Silicon Valley is abuzz about who the mad e-mailer is. Sony has launched an investigation, promising to explore "the availability of appropriate legal action against those responsible." At first glance, the letter appears to be worded authentically enough. Addressed to Apple CEO Michael Spindler from Nobuyuki Idei, it says Sony intends to buy all of Apple's shares for $7.74 billion after a breakdown in merger talks that were supposedly taking place between the two companies. "We believe this is the fastest, most efficient way to bring our companies together," Mr. Idei purportedly says. But at Apple, executives quickly dismissed the letter as a prank. For one thing, the Apple e-mail address was for a "c.franz," a person unknown to the company. The letter also misidentified Mr. Idei as Sony's chairman and CEO. And initial notification of such a takeover bid is almost never made by letter, for secrecy reasons. So just who is the mad e-mailer? The return address was left blank, and a list of suspects could prove endless. A disgruntled employee is one possibility. Scads of Apple managers have departed in recent months. Or, analysts say, it could be a cheap shot by an employee at an Apple competitor. Whoever the culprit is, "this sounds like a real attempt to tick somebody off," says Mark Macgillivray, an industry consultant in Sunnyvale, Calif. The e-mail letter was circulating as Apple was announcing an estimated loss of $68 million and plans for a restructuring that analysts expect to include massive layoffs. Since Apple has long been rumored to be a takeover target, the letter added to the angst in Cupertino. In a reflection of morale at Apple, some engineers are joking they're disappointed the letter was phony. They would have liked Apple to accept the offer.

1 0

Limiting Reuse of Certificates
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [To: cypherpunks list ## Date: 01/11/96 02:25 pm ## Subject: Limiting reuse of certificates. ] >Date: Mon, 08 Jan 1996 17:31:24 -0500 (EST) >From: Michael Froomkin <froomkin(a)law.miami.edu> >Subject: Certificates: limiting your liability with reuse limitations >Suppose I am a CA. I am worried that by issuing a certificate with >a lifespan of more than 2 milliseconds I am opening myself up to >unlimited liability if for some reason, despite my best efforts, I >issue an erroneous certificate. >I know I can put an expiration date on the certificate, but that's >not enough. I can accumulate a lot of exposure in a few seconds, >much less weeks. >I know I can put a reliance limit in the X.509 ver 3 certificate, >but that's not enough. Even a $1 limit could be used many millions >of times. >Is it feasabile to say: Can only be relied on once per >day/week/month? Is this something the relying parties can reasonably >be expected to monitor? This is a hard problem. The only way I can see to do this is to require interaction with the CA (or its proxy) for each signature. The good news is that if you're doing certificate revokation lists online, then there is probably already some interaction with the server to verify that a certificate is still valid, before it is accepted. The trick here is to flip around who has to check the CRL server. a. Bob forms D = document he wants signed, ID_B = Bob's ID, and sends to Alice M_0 = ID_B, D. b. Alice forms T = timestamp and sends to the Server M_1 = T, hash(ID_B, D), Sign_{SK_A}(T, hash(ID_B, D)). c. The Server verifies the timestamp, the signature, and that Alice is currently allowed to sign things (her certificate is valid and hasn't been overused today). If not, it drops the connection and ends the protocol. If things all check out, however, it forms M_2 = T, Sign{SK_S}(T, hash(ID_B, D), Certificate_A). d. Alice now has (until the timestamp T becomes too stale) an authorization to sign D. She does so, and sends to Bob (who's been waiting all this time) M_3 = T, ID_B, D, Certificate_A, M_2, Sign_{SK_A}(ID_B, D). Now, the trick is to redefine valid signatures as only those that look like M_3. The recipient has to verify the timestamp, and that he hasn't received an identical signature from Alice recently, and has to verify the two signatures. (I make no promises about the soundness of this protocol--it's meant to illustrate the idea, not to be used directly.) Other than that, I can't think of anything that will fit the bill. >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) >Associate Professor of Law | >U. Miami School of Law | froomkin(a)law.miami.edu >P.O. Box 248087 | http://www.law.miami.edu/~froomkin >Coral Gables, FL 33124 USA | It's warm here. Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPV110Hx57Ag8goBAQFVggP+P9ilz7cM8BQX+nDgjByG4avAoHxgDpDw cWsx7dw31MQsPCEkzvuvCcwf36e4xEQd3jKMh5rYmWrYRAMQAoB4yGm7ixN4tqXH 1g6Xw9QPCLnW4OJvjfynzFfKb5i8KcvOSBnCXzOd1Z/LYEI23/6phdNd9rRf/YjL mxbKS7gDrHI= =dn6t -----END PGP SIGNATURE-----

1 0

Re: Certificates: limiting your liability with reuse limitations
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

In Minnesota, you wouldn't be liable. All you can do IS all you can do. Anything else is a crime! (on their part). Love Always, Carol Anne At 05:07 PM 1/11/96 -0800, you wrote: >You write: >How do notaries public get around this liability problem? It seems to me >that the checking done for a certificate might be similar to the checking >done by a notary - a glance at a driver's license, say. Are they subject >to liability if they are fooled by fake ID? > >Hal > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Mitnick #4: Platt's final response to Markoff
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Topic 1119 [media]: Media Appearances of WELLperns VI, S.F.Bay Area Division #217 of 296: Aaron L Dickey (kieran) Wed Jan 3 '96 (20:19) 7 lines Charles Platt responds: "John Markoff's reply to my replies is much more factual and convincing than his original response to my review of his book. I thank him for his time and trouble. I still find it hard to agree with his overall perspective, but I am now convinced that he does have a sincere point of view, and I value the instances where he has corrected me on details." Topic 1119 [media]: Media Appearances of WELLperns VI, S.F.Bay Area Division #223 of 296: Declan McCullagh (declan) Thu Jan 4 '96 (07:33) 23 lines And one final response from Charles Platt: "Someone suggested that by criticizing TAKEDOWN I attempted to further my own career. "My primary career has nothing to do with computer journalism. Under a different name I write a series of prehistory novels, the first of which now has 200,000 copies in print. This is my main source of income; I pursue computer journalism as a sideline, because it pleases me. "I do have a computer-related book coming out under my own name later this year, but it was written more for pleasure than profit and is aimed at a small audience: people who are more concerned about really dangerous criminals such as James Exon or Ralph Reed than about hackers such as Kevin Mitnick. Frankly, this book will not sell a lot of copies no matter what I do, because decency legislation and first-amendment issues are a noncommercial topic compared with so-called computer crime. "Bearing all this in mind, it is misleading to suggest that I wrote my review for motives of self-promotion. I wrote it because I had just finished reading TAKEDOWN, it had irritated me greatly, and I believed (perhaps wrongly) that I possessed background information that might not be mentioned by other reviewers elsewhere."

1 0

Mitnick #2: Platt responds to Markoff's rebuttal
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Topic 1119 [media]: Media Appearances of WELLperns VI, S.F.Bay Area Division #190 of 296: Declan McCullagh (declan) Tue Jan 2 '96 (09:38) 212 lines <hidden> From cp(a)panix.com Tue Jan 2 09:26:11 1996 Date: Tue, 2 Jan 1996 03:11:10 -0500 (EST) From: Charles Platt <cp(a)panix.com> To: Declan McCullagh Cc: Charles Platt <cp(a)panix.com> Subject: John Markoff's "rebuttal" In Computer Underground Digest I wrote a critical review of the recent book _Takedown_ by Shimomura and Markoff, in which I suggested that John Markoff had profited handsomely by mythologizing Kevin Mitnick as one of "America's most wanted computer criminals." My review was copied to The Well, where JM wrote a rebuttal. I am amused to fiund that this rebuttal not only fails to answer my rather serious allegations, but commits exactly the same journalistic sins of vagueness and hyperbole that I complained about originally. JM writes: "Just for the record, Katie [Hafner] says that her remarks were taken out of context here by Charles." This statement is perhaps intentionally vague, because if I don't know exactly what I'm being accused of, I can't answer it. *What,* precisely, was taken out of context? JM doesn't say. All I know is that when Katie Hafner contacted me directly, she complained that she never branded Kevin Mitnick a "darkside hacker" in the book _Cyberpunk;_ she merely used the phrase as the title of the first section of the book. But in fact, the "darkside hacker" term *is* applied to Mitnick within the text of the book; and in any case, a section heading obviously sets the tone for everything that follows. Therefore, I do not believe that I quoted Katie Hafner out of context--unless JM is talking about something else entirely, in which case he should say so, instead of attempting to devalue my review by a generalized accusation. JM Writes: "The darkside hacker label was created during the late 1980s by the Southern California press. It is a label that I noted, but I didn't create. However, he's right I don't regret using it. And also for the record, Kevin Mitnick used to drive around in Las Vegas with a stack of copies of Cyberpunk in the trunk of his car to give away to admirers. He is on record as saying the book is '20 percent inaccurate.'" JM is confusing the issue. I never suggested he invented the "darkside hacker" term. This is totally irrelevant. I said, very specifically, that he was the first to *apply* this label to Mitnick. JM does not actually deny this, and I believe it is true. Re my description of his initial article about Mitnick for the NY Times, JM writes: "This is really inaccurate. Kevin Mitnick had become notorious nationally in the late 1980s as a result of his being arrested for attacks on Digital Equipment Computers. A menacing mug shot? It was the only photo available. No actual news? Not the way I remember it. The news was that he was being pursued by the FBI (three agents full time), the California DMV, US Marshalls, telco security, local police, etc. The further news was that the FBI had told cellular telephone companies that they believed the fugitive had stolen software from at least six cellular phone manufacturers. I thought then, and still think, this merited a story. I also think the story was a good yarn. Mitnick had succeeded in evading law enforcement for more than a year - again." "Notorious" in what sense? This is another of those vague terms that JM throws around without limiting or defining it. Mitnick may have been "notorious" in hacker circles, but not in the eyes of the general public. My point was, and is, that JM converted Mitnick from a relatively obscure hacker into a public figure. JM tries to evade this point but cannot specifically deny it. As for Mitnick being "actively pursued," I believe this is a vast overstatement. As I understand it, law enforcement had largely lost interest until JM's news item embarrassed them. Even after that, according to JM's own book _Takedown,_ law enforcement had to be prodded into taking action. They seemed not to share JM's perception of Mitnick as a severe threat. They certainly didn't characterize him as one of "America's most wanted." In response to my statement that Kevin Mitnick has never been accused of intentionally damaging a computer, JM writes: "Wrong again. He was accused of doing more than $100,000 damage at US Leasing, a SF time sharing company in 1980. Their system was trashed by a group that Mitnick was a member of. After that, at various other times he cost companies tens of thousands of dollars trying to close the door on his attacks. A further point is that I have no control over placement of my stories in the paper." With all due respect, this is not fair or accurate journalism. Was Mitnick *active* in the group that caused the alleged damage? Did he play a personal role? Does JM know? If not, he's just slinging mud. This is a smear and should not be presented as if it is a fact. On the other hand, if there is evidence that Mitnick was indeed actively responsible, I will gladly admit that I didn't know of this. As for the money that companies spent fixing the security weaknesses that allowed Mitnick to gain access, it is grossly unfair and misleading for JM to throw this into a paragraph discussing "intentional damage." This is exactly the kind of deliberate blurring of different kinds of computer misuse that I complained about in my review. Regarding Mitnick's "most wanted" status, JM writes: "Sorry, but I didn't create the character, Kevin did. He has now been arrested six times in fifteen years. Each time, except for this last time, he was given a second chance to get his act together. He chose not too. It seems to me that he is an adult and makes choices. He chose to keep breaking in to computers. He knew what the penalty was. So what's the problem?" Here again, JM avoids my direct point--that he was the first to categorize Mitnick as "one of America's most wanted." Of course Mitnick is responsible for his actions. I never disputed this, and never suggested he was innocent of the crimes for which he was convicted. I merely suggested that the crimes were relatively trivial and were exaggerated out of all proportion by JM's extravagant prose. Exaggeration, imprecision, and innuendo: *that's* the problem, JM. JM writes: "A witch hunt? Give me a break. It was an article describing a law enforcement hunt for a fugitive, who had been arrested five times previously, convicted at least three times, and was known to be attacking the computers of the nation's cellular telephone companies." My review complained that JM throws around words such as "attack" without ever defining them in computer terms. He's still doing it here in his rebuttal. Kevin Mitnick never attacked any computer, by my understanding of the word. Re providing advice to the police, JM writes: "I was called by Kent Walker, the AUSA on the case during a meeting at the Well. He asked me if I thought Mitnick was dangerous. I responded that everything I knew about Mitnick had either been in Cyberpunk or my July 4 1994 article, ie. in the public. I repeated the story of one arrest in which Kevin ended up handcuffed in tears over the hood of the detective's car. I gave no other information, nor got any." Since we will never know the extent to which JM tried to help the FBI, I guess we'll just have to take his word for this. Re Mitnick's dangerousness, JM writes: "This is just not true. Kevin Mitnick was actively sharing system vulnerabilities with other people on the net. That is about the most damaging thing that could be done to the Internet community." Is JM aware that some highly respected security experts believe that sharing news of vulnerabilities is the best way to encourage better security? True, this is a controversial subject; but certainly the sharing of vulnerabilities is NOT "the most damaging thing that could be done to the Internet community." That's just another of those wildly exaggerated phrases that JM throws out for emotional effect. I can think of many politicians--and even a few journalists--who pose a far greater danger to the future of the net than Kevin Mitnick ever did. Re the petty gossip in _Takedown,_ JM writes: "The reason we described what happened at Toad Hall on Xmas was that the attacks first came from toad.com while Tsutomu and Julia were there. If we hadn't have been complete in our description someone would have charged us with a cover up. Please remember that David Bank, a San Jose Mercury reporter, spent several weeks pursuing the hypothesis that Tsutomu had attack his own computers." Uh-huh. And I suppose the rest of the sordid, relentlessly personal thread in _Takedown,_ describing every little nuance of Shimomura's campaign to steal someone's long-term girlfriend, was merely included so that no one could complain that the account was incomplete? Really! In my review, I complained about pejorative terms (such as "attack") that JM uses repeatedly. His response: "Perjorative?? Yikes! I mean we could go to the dictionary....." Well, I guess JM *should* go to the dictionary. If he does, he will find that pejorative is a perfectly good word which I spelled correctly. It's ironic that he seems unaware of it, since it so aptly describes his own journalistic technique. Re my assertion that all charges but one against Mitnick have been dropped, JM replies: "Wrong. Kevin Mitnick is in jail in Los Angeles facing charges from more than six United States Federal Districts. He may go on trial or he may plea bargain." I tried to contact Mitnick's attorney before I wrote my review. He did not return my calls. I based my statement on information from three other sources. If it's incorrect, obviously I stand corrected. As I understand it, though, those charges from other federal districts may not have been actually filed. Is "facing charges" another of those slightly misleading terms that makes the situation sound worse than it really is? Are the charges actual, or potential? Finally JM writes: "Myth and reality? I have been writing about Kevin Mitnick for a long time, since 1981 to be precise, but I didn't create a myth, he created his own story." In his own rebuttal, JM has already referred to the Mitnick story as a "good yarn." A yarn, of course, is a richly embroidered, sometimes fictionalized version of the truth. This is precisely what I believe he concocted, and it isn't my idea of decent journalism. ---- Lastly, a question which occurred to me after I wrote my original review. Around the same time that Kevin Mitnick broke into Tsutomo Shimomura's computer, he also broke into the system of Dan Farmer, another extremely well known security expert. What did Farmer do? He didn't get self-righteous about the "invasion of privacy." He didn't start ranting about the "extreme danger" posed by Mitnick. He certainly didn't take several weeks from his normal schedule and pursue a personal vendetta. Nor did he coauthor a book portraying Mitnick as a danger to the net. He presumably fixed the flaw that had allowed Mitnick to get in, and went on with his life. Would JM like to explain how Dan Farmer's perception of "the Mitnick threat" can be so different from Shimomura's? To the outside observer, it almost looks as if there wasn't a significant security threat, and Shimomura must have been motivated by wounded vanity, while John Markoff was motivated by his desire to tell a "good yarn" and make a lot of money. Am I wrong?

1 0