December 2003 - cypherpunks-legacy

Re: FL Demonstrates Fatal Flaw in Logins
by joseph＠genome.wi.mit.edu 17 Dec '03

17 Dec '03

Sorry to all, but I'm not seeing what would appear to be obvious. There seems to be a lot of talk about FV "new program" that undermines security of computer login/credit cards over the net and such like that. I don't know about you guys, but I wrote stuff like that in sixth grade on the old apple IIe. It's pretty simple to write a programs that attaches itself to the keyboard driver and logs the text types, or only logs certain parts, what is the large deal? As it applies to internet security, I don't see how it can make a difference. It must be run from the local computer, at system level. If I'm on my home computer, I know what's running, and feel safe that a loging program isn't amung them. What would enable a remote site to pick up my typings. However, I don't know much about Java, would it be possible to make such an applet with Java? --Joseph -------------------------------------------------------------------------------- Joseph Sokol-Margolis joseph(a)genome.wi.mit.edu Assistant Systems Administrator seph(a)mit.edu Whitehead Institute/MIT Center for Genome Research phone: (617) 252-1922 One Kendall Sq. Bldg. 300 fax: (617) 252-1902 Cambridge, MA 02139-1561 ----------------------http://www-genome.wi.mit.edu/~joseph/----------------- ----

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

Congratulations to FirstVirtual for having taken key-capture techniqures that everyone has known about forever, and skillfully propagandizing it as a 'fatal flaw in software encryption' playing on the technophobia of the masses, who are afraid of computers already ("INFORMATION IS INSECURE THE MOMENT YOU TOUCH A KEY". snork), to engeder widespread fear in encryption ("ENCRYPTING CREDIT CARDS ON THE DESKTOP IS NOT ONE OF THE SAFE MECHANISMS"), thereby (hopefully) enhancing market share of FV, which doesn't use encryption. 1) I remember Mr. Borenstein saying a year or two ago, something like "We have nothing against encryption; we're just using a non-encrypting technique for the moment, becuase it can be quickly, easily, and safely deployed by us. Eventually, we'll probably use encryption." Apparently, this propaganda piece marks a change of strategy. 2) This is the first net distributed "security alert" distributed that I've noticed, with almost no real content. No one who knows a bit about computer security learned anything they didn't already know from that "alert". Rather, it was distributed in the _form_ of a CERT-like alert, but with the purpose and effect that is almost solely marketting of FV. I'm sure we can expect many more now that FV has pioneered the propaganda-as-alert technique--people are really scared about virus and security risks, since they know nothing about them, and will pay a lot of attention to them (witness "Good Times")--much more attention then they'd normally pay an advertisement. This masquerading advertisement is akin to the advertisements masquerading as editorial content that you see in many magazines not respectable enough to prohibit such things. 3) I believe that FV works by assigning the user some sort of id number. They send the id accross the net, FV has a database with "FV-ID" <-> credit-card-number correspondences, the merchant sends FV the id, FV bills your card and pays the merchant. Now, if I'm correct about how FV works, we could clearly write a program that searches your HD for FVs data files, extracts your FV-ID from it, and steals it. It could be a virus, it could send the FV accross the net, whatever. We could then use your FV-ID to make fraudulently make purchases through the FV system that would be billed to you. This is essentially the same attack as FV "demonstrates" against software encrypted credit cards over the net: that is, the "You have an insecure system and if we can put evil software on it, we can get you." attack. True, we wouldn't have your credit card number, and we couldn't order stuff from LL Bean billed to you. We could just order stuff from FV merchants. So maybe it's marginally better. Maybe. But I can't see any way FV could be immune to an attack of this sort. I believe that all they do is give you a first virtual ID number sent accross the net (in the clear!) in lieu of your card number. With an insecure PC as an assuption (and it is probably a good one, actually), I can't see how FV could be immune from an attack of this sort. If Mr. Borenstein or anyone else thinks it is, please explain how. Sigh.

5 4

NRO Slush Fund
by John Young 17 Dec '03

17 Dec '03

URL: http://www.nytimes.com/yr/mo/day/front/spy-agency-money.html January 30, 1996 Spy Agency Said to Have Spare Billions The National Reconnaissance Office, the secret agency that builds spy satellites, lost track of more than $2 billion in classified money last year, largely because of its own internal secrecy, intelligence officials say. In the past, congressional oversight of the reconnaissance office has been sketchy, because few members of Congress understood the highly technical language of spy satellites and some did not know what they were approving when they authorized billions of dollars a year in secret spending.

2 1

Re: Lotus Notes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

One other small advantage I can see to using Lotus's crippled encryption. It disguises the fact that a message is actually (double) encrypted with PGP. Attackers have to break the 40 bits before they see the PGP encrypted data. A pecular kind of steganography. (If you leave off the PGP header and trailer, it may be hard to determine which 40 bits are the correct key.) ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Re: "German service cuts Net access" (to Santa Cruz)
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

olmur(a)dwarf.bb.bawue.de writes: > Free speech ends where other people can reasonable claim that their > feelings are badly hurt. Ask yourself what standard in implied in this sentence... Is it "Man as a life-loving rationnal animal" or "Man as an ever sobbing, unable to cope, emotionnally controlled animal" ??? JFA "I always tried to live in order to be able to *fly* another day." -Gen. Chuck Yeager

3 2

[FACTS] Germany, or "Oh no not again"
by Thomas Roessler 17 Dec '03

17 Dec '03

I had the prosecutor's spokesman on phone today. The result is that someone gave a hint to the prosecutors which explicitly mentioned Zundel, T-Online and Compuserve. Consequently, the prosecutors *had* to start investigations against Zundel, T-Online and Compuserve. In particular, they are right now *checking* whether providing internet access is a criminal offence due to the possibility to gain access to `inciting material' (the German word is `Volksverhetzung') via the Net. This means that it is not even clear whether the investigations against internet providers will be dropped or not; in fact many people believe that these investigatinos *will* be dropped. My personal guess about all this is that some net.citizens are trying to have the prosecutors engaged in absolutely absurd investigations (or, even better, achieve a court room clash on this subject) to get some clarification of the legal situation of the Net in Germany. Quite similar to the RSA T-Shirt story in the States. ,-) tlr

6 7

RE: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by Tim Oerting 17 Dec '03

17 Dec '03

no doubt all the responses to the cypherpunk list are unnecessary as we all agree this is a load of PR nonsense. But I just can't believe that he thinks that the telephone is more secure on average than a keyboard. I can tell pretty easily if something is running on my system that I didn't intend..it is much less probably to say that I know that someone isn't listening with a scanner if I'm on a cordless or just plain tapping my line if I'm on a standard phone. Admittedly I think cell phones may take more effort on the part of the eavesdropper but are still doable. I'm certain that none of first virtual customers use a cordless phone, indeed since you feel the telephone is such a secure device you no doubt require that all of your customers use STUIII phones to communicate. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 12:07 PM To: cypherpunks(a)toad.com Subject: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards First Virtual's Internet Payment Systems never places the consumer's credit card number on the Internet. Instead, the consumer provides it to us by telephone when the account is opened. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 1:39 PM To: cypherpunks(a)toad.com; dmacfarlane(a)zip.sbi.com Subject: Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!) Well, the mis-conceptions are flying fast and furious. You're twisting our words. We believe it is a truly fatal flaw in those internet commerce schemes that are based on software encryption of credit card numbers. There are several schemes for Internet commerce that are unaffected: -- First Virtual (of course)

4 3

Crypto-smart-card startup Inside Technologies
by Peter Monta 17 Dec '03

17 Dec '03

There's an article in the January 29 _EE Times_ about a French cryptographic-smart-card startup called Inside Technologies. Tidbits: ..."In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design." ..."Users want their own, custom algorithms, which can be downloaded at the time of use". ..."The CLU [cryptographic logic unit] will operate at a higher clock frequency than the RISC---60 MHz, in our design---yielding 640-bit RSA decrypt in less than 50 ms". The article goes on to say that they plan to both manufacture smart cards, presumably for ecash and communications, and license the design at the macrocell level, possibly for use in embedded systems like mass storage. By my count, six European companies mentioned, zero American. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

2 1

Re: Apology and clarification
by Eli Brandt 17 Dec '03

17 Dec '03

In a nutshell: FUD Virtual's press release glosses over the hard part of the attack -- distribution and collection. Yes, the credit-card system is broken as designed, but that's already reflected in its cost structure. The proposed attack will never make up a significant fraction of credit-card fraud. You know, FV should put out a press release warning that all encryption-based payment systems are insecure, due to the threat of the proposed "Chinese-lottery virus". Bet you could get the Times to print it... In article <+cmu.andrew.internet.cyclists+0l3TCU200UfA00z5cl(a)andrew.cmu.edu>, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >When you put all four of these together, you have an attack that IS new, >in the sense that nobody we know of has ever mentioned it before, Who would bother? Ask yourself if you'd have been quite so excited about this "new attack" if you were just Nat Borenstein, private citizen, with no financial interest in a competing technology. >and which could in fact be used by a single criminal, with only a few >weeks of programming, to tracelessly steal MILLIONS of credit cards, >if software-encrypted credit-card schemes ever caught on. You wave your hands and say that "consumer machines are insecure", but I don't think you have any conception of what it would take to get your trojan onto "MILLIONS" of machines. There is no historical precedent for such an attack (no, Ping-Pong and Stoned don't make the cut). Your suggestions of such things as rogue GIF viewers aren't even in the ballpark. What fraction of the victims will expose their credit card numbers? what fraction will notice your trojan and warn against it? The ratio has to be very, very large. >and get them back to the program's author by non-traceable >mechanisms. I didn't see the part where you explain how this works, either. >If not, I think it's worth noting that this fact was previously >completely unknown to the bankers and businessmen who are putting >large sums of money at risk on the net. The only way to get the >message to those communities is with a very visible public >announcement of the kind you saw yesterday. You wouldn't have shot your reputation so badly if you weren't so damned disingenuous about the whole thing. Paragraphs like the above really irritate me. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

short FV question
by Simon Spero 17 Dec '03

17 Dec '03

When my CTS plays up like it has this past week, I use a Dragon dictate Voice Recognition system. Since I' Not actually touching a keyboard, does this make me secure? Simon ---- RSA - The Canadian For Butt

2 1