December 2003 - cypherpunks-legacy

Innaresting Fortune article on "Garbage Goodfellas" in NYC
by Rich Graves 17 Dec '03

17 Dec '03

January 15th Fortune (don't normally read it, but I picked up a free copy) has a lengthy and evidently well-researched article bylined Richard Behar on the efforts of BFI, a large regional trash hauler and recycler, to break into the (by most accounts) Mafia-controlled garbage collection industry in New York City. Cypherpunk relevance: BFI is cooperating closely with the DA in helping to prosecute its allegedly mob-affiliated competitors, which raises a lot of very interesting questions, for which I have yet to formulate any answers. Also a sidenote about how NYC's disclosure laws actually aid organized crime by helping the various bosses track who owns what territory. Electronic surveillance. Money laundering. Steganography (sending messages by way of the disembodied head of a dog). Open access to information and free-market capitalism versus violent bozos, with and without uniforms. Pen trumps sword. Rich says check it out. -- Rich Graves Fucking Statist

1 0

Web site with Updated Telecom Bill Info
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

http://bell.com/ (Alliance for Competitive Communications) has updated Telecom Bill info including "A concise resource guide to the House Senate Conference on H.R. 1555/S. 652.", 12/22/95 draft of the Telecommunications Conference Bill, and a statement by VP Gore. (Beware of editorial bias at this site, as these people are not a disinterested party). Our beloved Vice President said: "We are very gratified that the bill contains the provisions for the V-chip that will enable families to control the contract of television programming that comes into their homes and that it contains a provision to make advanced telecommunications services available at low cost to schools, libraries and hospitals" -Thomas

1 0

Update on Netscape and the Anonymiser site
by Alan Olsen 17 Dec '03

17 Dec '03

Netscape 2.0b6a (win32 version) now reports the user name as "Mozilla". Name is no longer fed out through the ftp... Thanks Jeff! Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Idea for "friendly" Windows password hack
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Why not provide a way to grab the passwords cached in RAM, encrypt them >securely, put them away somewhere, and scramble the original copy of the >passwords in RAM so that Microsoft's code can't get to them? Ahh, the problem is the "put them away somewhere" part. There's nowhere to put them. The solution I'm using now for an (unreleased) variant of SFS is to store encryption keys in write-only hardware as per FIPS PUB 140-1, but that's hardly practical for most systems. The same standard also allows for key storage in software, but at the minimum useful level (level 2) you need at least a C2-certified OS to protect the keys (the standard is good reading when it comes to protecting encryption subsystems BTW, as are the specs for things like GSS-API and GCS-API). This isn't going to happen under Win'95 (for example, here's how to get to any keys held in memory by the OS: Win'95 allows for demand-loaded VxD's, so you run a trojan with an embedded VxD which searches the system VM for the keys and then unloads itself). It would require a significant reengineering of Win'95 to make it even passably secure (assuming MS don't screw up the implementation), and I don't think it's practical to do. Under NT you can do it to some extent because this level of security was designed in from the start. Peter.

1 0

Re: The Lotus Position
by Herb Sutter 17 Dec '03

17 Dec '03

At 23:17 01.19.1996 -0800, Timothy C. May wrote: >Like many, I take it for granted that 40-bit RC4 can be broken for "small >change." Moreover, my guess is that foreign traffic is routinely cracked if >it is encrypted. On Friday morning, Whit Diffie took five minutes to announce a report that he and other big names (including Rivest, Wiener, etc.) produced a week or two ago in Chicago. The subject of the report was recommended minimum symmetric key lengths... the paper should be published at http://www.bsa.org (Whit threatened them if they didn't get it up by Monday morning<g>, but the BSA site currently just says that they'll add a pointer to the report within the next week). To avoid keeping everyone in suspense, here's the basic result Diffie announced: the world's leading cryptographers (outside the walls of the NSA) agree that 75-bit keys are the minimum (I think this was for protecting commercial communications). To build in time-sensitivity, add one bit per year... i.e. if the information needs to be kept secret for 20 years, use at least 95 bits. That said, talk to the NSA about 40-bit keys -- and to Lotus about its max. 64-bit keys, for that matter! When he made the announcement on Wednesday morning, Ray Ozzie (of Notes fame) knew he might get flak about keeping Notes at 64 bits, so as soon as he mentioned it he added a phrase something like (going from memory) 'but let's leave aside for now the question about whether 64 bits is enough.' Interesting comment in light of Diffie et al's answer announced two days later. :-/ In answer to a question from the floor, Ozzie did say that yes, the agreement reached with the NSA was scalable -- IOW, that you could use 128-bit keys and give the government 88 of them, instead of 64-and-give-24 -- but in retrospect I wonder whether keeping Notes at 64 bits was a condition of the NSA deal. I'm not normally a conspiracy theorist, but considering that Ray was clearly aware that the 64-bitness was going to raise eyebrows and still somehow didn't get around to simply strengthening it... well, it makes you wonder. >And in a few years, 40-bit RC4 will be even more ludicrously weak. > >The Lotus position is untenable. Hear hear... but unfortunately industry doesn't seem to "hear hear" well enough yet, though they've been learning lately. Instead of hammering Markoff for his NYT articles, we should be thanking him that at least he's helping to raise public awareness -- even if he does tend to overplay things. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

2 1

Re: "Trustworthy" PGP Timestamping Service ??
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 03:42 PM 1/21/96 -0800, Timothy C. May wrote: >At 6:51 PM 1/21/96, Matthew Richardson wrote: >>-----BEGIN PGP SIGNED MESSAGE----- >> >>I have recently setup a free PGP timestamping service which operates >>by email. >> >>The objective of the service is to be able to produce "trustworthy" >>timestamps which cannot be backdated without detection. It achieves >>this by:- >> >>(a) giving every signature a unique sequential serial number; >> >>(b) every day making a ZIP file of that day's detached signatures >>and feeding the ZIP file back for signing (and hence the assignment >>of another serial number); >... > >It sounds like a variant of the Haber and Stornetta work on digital >timestamping, about which much has been written on our list (check the >archives, and/or sections of my Cyphernomicon). > >They have a company, Surety, which is doing this (or was, last time I heard). > >www.surety.com will get you there. > >My hunch is that your scheme implements a version of a hash (the idea of >hashing the doc and then publishing the hash as a "widely witnessed event," >in Haber and Stornetta terms) that could infringe on their patents >(assuming they applied, as I recall hearing they did). > >Before you go much further on this, it would behoove you to check on what >they are doing and on what patents, if any, you might need to license. > >--Tim May > >Boycott espionage-enabled software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 - 1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > > What was the web page for the first mentioned service? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: HAVAL (was Re: crypto benchmarks)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sun, 21 Jan 1996 01:29:49 -0800 (PST), you wrote: [..] Now, the *big* question is... any new cryptanalysis that sheds light on the security of HAVAL? (I haven't yet gotten AC2 if there's info in there.) Email to one of the authors of HAVAL said he knew of nothing but that a recent attack on MD5 didn't apply.

1 0

[NOISE] Re: mailing list
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 19 Jan 1996 17:35:50 -0500 (EST), someone wrote: >You come recommended by the Happy Mutant Handbook. Was just wondering ^^^^^^^^^^^^^^^^ Uh-oh. I have nothing to do with that. More fodder for Alta-Vista....

1 0

good background on CitiBank/Russian caper
by attila 17 Dec '03

17 Dec '03

The folling article was culled from the current issue of the journal of internet banking. ---------- Forwarded message ---------- Date: Fri, 19 Jan 1996 18:01:32 -0500 Journal Of Internet Banking And Commerce Vol. 1, no. 1, January 19, 1996 --------------------------------------------- The Citibank Affair: A Purely Russian Crime? --------------------------------------------- Nahum Goldmann ARRAY Development Nahum.Goldmann(a)ARRAYdev.com> http://www.ARRAYdev.com/ --------------------------------------------------------------------- Nahum Goldmann has been employed as a manager, scientist and lecturer in leading industrial high-tech firms and academia. Mr. Goldmann has published several critically acclaimed books that deal with knowledge transfer issues. --------------------------------------------------------------------- Novoye Russkoe Slovo (NRS), a NY-published newspaper which acclaims itself as the largest Russian-language daily outside of the x-USSR, published an engaging account of the so-called Citibank Affair in September 1995. A fairly large article ("Purely Russian Crime..." NRS, Sept. 15, 1995, pp. 13-14) was written by Vladimir Strizhevsky but was actually based on the original investigative materials submitted by several contributors from Moscow and St. Petersburg, as well as from NY, London, Brussels and other world financial capitals. Undoubtedly, NRS have done quite a good job in clarifying and illuminating the background of the Citibank Affair. For whatever reasons, the English-language media have not covered the background of Russian participants that well. However, an expert in electronic banking and commerce on Internet might find utterly fascinating the very minute details of this complex crime scheme that involved many people and spread across several continents. The story at NRS starts at the end of August, 1994 in Tel-Aviv. A certain Alexei Lachmanov, a Georgian national and a holder of a false Greek passport to the name of Alexios Palmidis, had been arrested by Israeli police when he tried to withdraw nearly US$1M. The funds in question were electronically transferred to five Israeli banks from Invest-capital, an Argentinean subsidiary of the Citibank. The Israelis had been tipped by the Citibank through the FBI with the information that all the money transfers had been done with the illegal use of Invest-capital's own secret codes. The subsequent multinational investigation has shown that it was a leading St. Petersburg's, Russia computer expert Vladimir Levin who was able to conduct numerous electronic transfers from several Citibank's subsidiaries in Argentina and Indonesia to various financial institutions in San Francisco, Tel-Aviv, Amsterdam, Germany and Finland. According to NRS's speculations, Mr. Levin's succeeded so well because, in addition to Citibank's own electronic cash- management hub in NY, he was also able to crack down the electronic defense of several SWIFT's branch offices in the third-world countries. SWIFT, a secretive Belgium-based electronic telecommunication consortia of World-leading banks, is primarily involved in mutual settlement payments amongst its members. On the other hand, in the interview with an NRS correspondent V. Kaminsky, Citibank's spokesman rejected the newspaper's version of SWIFT's penetration. Instead he claimed that Citibank knew all along about Mr. Levin's infiltration, playing with him a sophisticated multistep deception game. Of course, the Citibank's face-saving version of events sounds not that convincing, taking into account a large number of uncontrollable players, a sizable amount of real cash involved, multicontinental reach of the overall crime scheme and the fact that the bank was ultimately unable to recover a substantial chunk of its own money. Not your ordinary self-taught hacker, Mr. Levin, 31, an aloof man and a graduate of a prestigious Department of Applied Mathematics, was considered somewhat of a computer genius in the St. Petersburg's University circles. The scheme started when Mr. Levin's acquaintance, a Russian-American wholesale trader, asked him to develop programming support for his international trading business. According to Mr. Levin's university friends, the idea of breaking into secure bank networks has been born somewhat spontaneously during a purely technical discussion on the advantages and disadvantages of different bank networking programs. The debaters were members of a St. Petersburg's group of elite computer experts that could best be described as a local response to the Internet's own Cypherpunk community. I found it fascinating and somewhat ironic that the infiltration plot had actually started as a low-key bet that the Russian famous resourcefulness would triumph where the famed Yankee ingenuity has already proven to be unsuccessful! In the overall crime scheme, Levin was supported by as many as 30 collaborators, at least some of them computer experts. Several of his partners-in-crime, arrested in the U.S., Russia, Israel and the Netherlands, were primarily involved in cash retrieval and laundering, ultimately the most vulnerable part in any grand scheme of electronic theft. It is hardly a secret that most professional bankers are routinely trained to contest, or at least report to authorities, any suspicious withdrawal of large sums of cash. Some of the U.S. arrests have been successfully kept in secret for many months, for the fear of alerting the criminals back in Russia. Mr. Levin himself was arrested in September 1995 in a UK airport, en- route through that country. Apparently, in the best tradition of this fledging industry, Citibank have already used the lessons obtained from Mr. Levin's penetration to beef up the security of its own electronic payment system. COPYRIGHT ========= The Journal Of Internet Banking And Commerce is Copyright (C) 1996 by ARRAY Development, Ottawa, Canada. All Rights Reserved. Copying is permitted for noncommercial, educational use by academic computer centers, individual scholars, and libraries. This message must appear on all copied material. All commercial use requires permission. __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches....

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:56 PM 1/21/96 EST, Dr. Dimitri Vulis wrote: >tcmay(a)got.net (Timothy C. May) writes: >> >Degaussing the media (running a household magnet over it :-) may be an optio >> >> Ordinary household magnets fail for a couple of reasons: > >I've just established experimentally that thoroughly running a household magnet >over a 3.5" floppy messed up less than 1/2 the sectors I tried to read. Was that with the floppy in the case, or with the case popped open... Also: Did you rotate the disk physically to expose the data normally partially shielded by the door slider? And was it an ordinary ferrite magnet, or an alnico, or...? >Not a good option even for floppies. Ditto! >(Actually, there _was a smiley up there) Yes, I noticed. <G> [stuff deleted] >Jim Bell mentioned the trick of hiding information into 'extra' tracks and >sectors not used by the usual DOS formatting. It's very old too. I will admit that at this point, even calling it a "trick" is giving it excessive credence. Actually, I think it wasn't really used initially for "data hiding" purposes. I'm talking about the early days of CP/M and other such systems, circa 1977 and such, when individuals "discovered" that floppy drives had no hard mechanical stop past the "last" good track, and they "stole" a few percent of extra capacity from a floppy by simply ignoring the recommended "last" track. Naturally, it would work okay on some drives but not on others... which is why it was a bad idea. In addition, I also discovered that it was possible to put a few more than 26 sectors on each track of an 8" single-density (240 kilobytes!) floppy disk. The main problem with using these "tricks" is that the floppy had no method of conveying formatting information to the system it was in, which meant that any floppy using this trick was by definition non-standard. ("feature" or "bug" depending on your goal...) > I think I saw >copy protection schemes circa 1982 that hid important data on tracks 41--43. >360K diskettes normally had 40 tracks. If the diskette was copies by DISKCOPY, >it didn't know about the extra tracks, and the copy didn't have the info >(usually, a piece of the program). It's very easy to do with just BIOS calls to >format/read/write the track. Problem is, many cheap floppy drives these days >aren't capable of seeking beyond track 80 when the FDC asks them to. You can >write the data there and give the floppy to a friend who won't be able to read >it from there. I started building my own 12.5 MHz Z-80 -based CP/M system in 1978, fully designed and wire-wrapped by myself, and wrote my own BIOS. (Used a WDC 1791 FDC) Had total control. I didn't try this trick even then because of compatibility reasons, but one thing I _DID_ do was to write a floppy formatter that "undid" the 6-sector skewing that standard CP/M had to do to keep up with the data read/write. (in other words, I physically re-skewed the sector numbering to make the next "desired" sector come faster...) I ended up with an effective skew-factor of 2. Even a skew factor of 1 worked on my system (no skew at all), but the problem was that when I gave the most extreme of these oddly skewed floppies to my friends with 8" floppies, they took A LONG TIME to read the data! (Their systems always missed the next sector because their systems were too slow, so they only ended up being able to read one sector per disk rotation.) All this helps to explain why I asked if PGP had ever been ported to CP/M. Nostalgia! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQMF6vqHVDBboB2dAQG1+QP7BpyrLaVbTJISLo12rWMo9sqyfwtpv6A2 r7GGTvQTw6MwACA3pTh6HnnjpllveQSznNLpHaUeEjfpQX9NUXuJc4Z63E+EBFYw Xp3c0rygdC4fHS2WJbrhn0JUpC1C5V+Cn/oEpL5qygfaoqE1mAvsw7cCAht44ne+ /dJvdnm+N9M= =CbtQ -----END PGP SIGNATURE-----

2 1