December 2003 - cypherpunks-legacy

THE MIND OF A SERIAL HACKER
by Lou Zirko 17 Dec '03

17 Dec '03

Thought you might find this of interest. >From PATHFINDER Compass Issue 3: * THE MIND OF A SERIAL HACKER: Kevin Mitnick was cyberspace's most wanted hacker. But while Mitnick's alleged crimes have been publicized, his story has never been told. Until now. Chat live with Jonathan Littman, author of THE FUGITIVE GAME: ONLINE WITH KEVIN MITNICK on Monday, January 22nd at 2:00 pm (EST). http://pathfinder.com/Chat/chat.html Lou Z. Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBLJocAAAEEAMlDzYJPYq0pvfMuSiKU0Y65L2nJql+qEJHYGjO5Pys4prDw YW1ooPWaqrPQAy/eyqrM7I9KNFDCtmaPxtgcPw2oEDfc/w6cPkrVzvovKLfHQvtg V/hHUekptSf6j525omrVAoM9MxVL3sEGCjn9VrTeC3h9upkfntHOJeL88i2NAAUR tB5Mb3UgWmlya28gPHppcmtvbEBkYXRhdGVrLmNvbT4= =Qlxm -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

At 06:43 PM 1/21/96 -0800, Peter Monta wrote: >Tim May writes: > >> Much more expensive would be various electron microscope-based imaging >> methods to directly image the domains and extract subtle signs of past >> write cycles. > >I recently took a tour of Park Scientific, the scanning-probe >microscopy people, in Sunnyvale. One of their demo-stations >showed a small portion of a hard disk (taken with an AFM >tip fitted with a small magnet to generate the force). Most >impressive. (I did look closely at the edges of the track, >but saw no sign of previous writes.) >Peter Monta pmonta(a)qualcomm.com While I admit that I'm not particularly familiar with modern hard disk head design, I think it is futile to look for data in this way. If they "tunnel erase" the edges of the data track, even small misalignments will not allow remnants of data to remain. (And I assume that "all" modern hard disk drives employ high-precision data-read feedback mechanisms to maintain track alignment down to the submicron level... thermally-sensitive stepper motors and linear positioners of the 1980's are (or at least should be) gone!) Further, modern read-channel techniques (PRML; partial response, maximum likelihood) bring the normally readable signal closer to the noise level than ever before, and the PREVIOUSLY written signal is that much more difficult to resurrect. As a method for gathering intelligence on anyone, I think that this is dead and buried. However, I _still_ want to see brainless operating systems like MSDOS changed to erase (zero) allocated data buffers before and after use (and especially before re-use!), so that parts of vital files don't accidentally get written to the ends of other files.

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:23 AM 1/20/96 -0800, Timothy C. May wrote: >At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote: >>tallpaul(a)pipeline.com (tallpaul) writes: Interestingly, we wrote almost identical responses to Dmitri, although admittedly you won the "time race." Is it: 1. "Great minds run on the same path"? or 2. "Fools think alike" <G> >3. A time-varying field is preferred. Bulk erasers work this way, by >plugging into an a.c. socket and generating a time-varying field. And even >these are getting harder to use to erase video tapes, for example, due to >the high coercivity of modern media. Most folks I know no longer even try >to bulk erase tapes. Video tapes, yes. Audio cassette tapes, maybe. However, they should still be useful for floppies, for two reasons: 1. Distance to the media is far smaller than to the average distance to the inside of a videotape cartridge. (floppy cases are thinner.) 2. The volume of material to be erased is FAR smaller than a typical videotape cartridge. The middle of the tape of a 1/2" wide videotape spool is self-shielded by at least 1/4" of videotape; a 3.5" floppy disk is shielded only by distance. (actually, the sliding doo-hickey over 3.5" floppies probably acts as a shield, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQF04vqHVDBboB2dAQGlhwQAmS2fbPTCdcyRsqsKukaUfgesqultJ15J ZaAM0CUK1MH96szfHltSM7JkVr/t2wuDxY8gMZnmW5Jz1XUxDy+/a0NsJxkDWV+R 9eNOAKdsFaaV3xmIOBvZyIIU8RHgSw16Z0DZIDJhV/kZgACqfndn0YOHG4ESNe5T VrpCuKLBdSo= =T9tq -----END PGP SIGNATURE-----

1 0

You want to read MY e-mail?
by Scott Staedeli 17 Dec '03

17 Dec '03

from the Nando Times- DENVER (Jan 20, 1996 01:16 a.m. EST) -- A college student's request to look at the electronic mail of several high-profile state politicians got lawmakers' attention Friday. Becky O'Guin, a senior journalism student at Metropolitan State College of Denver and a reporter for The Capitol Reporter, a student newspaper that covers legislative action, stirred up the ruckus. She sent a letter to Sen. Charles Duke, R-Monument, asking for all of his e-mail messages from Jan. 1 to Jan. 16 and cited the Colorado Open Records Act as her right to get it. The letter noted that Colorado law would force him to pay court costs and attorney fees if a member of the public "has to take official action to enforce his or her right to view a public record." That really miffed legislators. Lawmakers said they'd get a legal opinion on whether they must disclose their electronic-age messages and may pass legislation to make sure their messages have some protection of privacy. Senate Majority Leader Jeff Wells, R-Colorado Springs, said he and Senate President Tom Norton, R-Greeley, got similar requests, but verbally. Personally, Wells said, he believes e-mail is privileged information unless it is specifically identified as public information under existing law. A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as telephone conversations was killed in a Senate committee. A somewhat stronger bill still rests in the House. O'Guin, meanwhile, was standing her ground, although she admitted to being a little surprised about the uproar. "The way I read the open records statute, those are open records," O'Guin said. "I was very serious about the request. What I was looking for was to find out how much public business is conducted through e-mail. "If they're using e-mail to send memos back and forth discussing public business, I see that as public record," she said. "Most of them don't (have e-mail), but about 30 people have software that allows them to send e-mail back and forth." She said only Duke and Gov. Roy Romer have been sent letters so far, but she intends to send them to other high-profile politicians. Jim Carpenter, press secretary for Romer, said his office was "looking at all the issues, all the options." Duke said he has always complied with requests for public records, but said the request for e- mail messages goes too far. "I'm disturbed by it," Duke said. (John Sanko writes for the Rocky Mountain News in Denver.) OK, if _I_ can't read your e-mail Mr. Legislator, why should you be able to read _mine_? - --scottst(a)ionet.net---------------------Scott Staedeli-- >~<^xXx | "There is no reason for any indiv- xX # | idual to have a computer in their (XXX) # | home." (XXXXXXX) | DON'T TREAD ON ME| -- Ken Olsen, president of DEC, 1977 ========================================================

2 1

Hassles taking App. Crypt. to Taiwan?
by Daniel A. Monjar 17 Dec '03

17 Dec '03

I've lurked for quite a while now. It is time to ask my first newbie question. I'll be going to Taiwan for three weeks in March. Is there likely to be any problems at US or Taiwan customs if I take Applied Cryptology 2/e along for personal study? Dan -- Daniel A. Monjar | "All opinions are my alone... dmonjar(a)vnet.net | and possibly my children's." PGP Public Key fingerable --

1 0

VTW: "Lotus blinks in industry/NSA crypt standoff"
by Declan B. McCullagh 17 Dec '03

17 Dec '03

=========================================================================== VTW BillWatch #33 VTW BillWatch: A weekly newsletter tracking US Federal legislation affecting civil liberties. BillWatch is published at the end of every week as long as Congress is in session. (Congress is in session) BillWatch is produced and published by the Voters Telecommunications Watch (vtw(a)vtw.org) (We're not the EFF :-) Issue #33, Date: Mon Jan 22 00:42:06 EST 1996 Do not remove this banner. See distribution instructions at the end. ___________________________________________________________________________ TABLE OF CONTENTS Announcements Oregon ISPs stand up for your rights Recap of ECHO Virtual Culture Event 1/21/96 Lotus blinks in industry/NSA crypt standoff Subscription Information (unchanged since 10/21/95) ___________________________________________________________________________ ANNOUNCEMENTS Each week never fails to bring us some interesting development in the world of telecommunications and civil liberties and this one is no different. Keep an eye on http://www.vtw.org/. We'll be posting an alert on the New York State cyberporn bill later tonight. Also, if you haven't yet scheduled a meeting with your legislator and your local ISP to talk about the Exon bill, you're wasting valuable time. Do so now! Shabbir J. Safdar Advisory Board Member Voters Telecommunications Watch This issue can be found in HTML form at URL:http://www.vtw.org/billwatch/issue.33.html ___________________________________________________________________________ [...] LOTUS BLINKS IN INDUSTRY/NSA CRYPT STANDOFF It's not clear why this hasn't made a larger impression on the net yet, because we think its of crucial importance in the ongoing debate about cryptography. For years since the original introduction of the Clipper Chip, the debate over cryptography has continued to gain momentum. Recently, the Administration, embarrassed by its defeat over the Clipper Chip proposal, put forth it's Commercial Key Escrow proposal. What is all the fuss about? It's about cryptography, and who has the right to encrypt information and who has the right to keep the key. Right now, you do, but that could all change. Think of cryptography as a really good front door on your house or apartment. The door key is yours to hold, isn't it? It's your right to give a copy to someone you trust, or if you choose, nobody at all. The Administration contends that this is not so. With their "commercial key escrow" scheme, they contend that you shouldn't be able to build a door they cannot break down, but they also contend that they should be able to order you to give a copy of the key to a government-approved individual, so that they can come enter your house (with a warrant, of course) when they wish. Industry, of course, panned this plan when it proposed late 1995, and continues to object to it. All the while, a standoff continues: the Administration refuses to allow cryptographic software with keys longer than 40 bits to be exported, and industry refuses to build Big Brother into their products. And this is where the standoff stayed until last Wednesday, when Lotus blinked. On Wed, Jan. 17th, 1996, Lotus announced that it had increased the key length of its International version of the Lotus Notes product to 64 bits. They did this by building in a back door for the Administration to use to decrypt any international traffic that it might desire to read. Although there are a lot of reasons why we think this is a terrible idea, the first one that springs to mind is the fact that the one public key that Lotus has embedded in all their software is a single point of failure for every International Lotus user throughout the world. Sure, this key is held with a high security clearance by the government, but then Aldritch Ames also had some of the most sensitive information available to him, and he proved untrustworthy. After all, if $1.5 million can buy a CIA counter-intelligence agent, I wonder how much a Lotus Notes key escrow holder goes for these days? You can find a copy of the Lotus press releases at http://www.lotus.com [...]

1 0

Why is blowfish so slow? Other fast algorithms?
by David Mazieres 17 Dec '03

17 Dec '03

First, can someone tell me if the latest version of blowfish (the one in Applied Crypto 2nd edition) is available online somewhere? I looked at a bunch of crypto ftp servers and could only find an older version of blowfish that did not have the blf_ctx structure allowing multiple keys to be active at a time. More importantly, however, on a 120 MHz Pentium, the old blowfish (compiled with gcc version 2.7.2 optimization -O6) seems to take about 12.6 microseconds for 1 M encryptions and decryptions, which works out to about 95 cycles per byte. This is significantly more than the 26 cycles/byte number cited in Applied Crypto 2nd edition. Can anyone suggest what I might do to speed this up? Failing that, can anyone suggest other secure, preferably unpatented, shared-key encryption algorithms that could encrypt at ethernet speeds (1 MByte/sec) without using most of the CPU on a fast Pentium or equivalent processor? Thanks a lot, David

2 2

Microsoft to digitally certify other manufacturers' code?
by Rich Graves 17 Dec '03

17 Dec '03

This is old news, but I don't remember it being brought up. This is interesting in light of recent discussions regarding the CryptoAPI, the uncertainty of Microsoft's support for Java (it won't be in Internet Explorer 3.0, but Visual Basic will), and Microsoft's Internet Developers' conference scheduled for mid-March. One of a set of press releases on http://www.microsoft.com/internet/ I thought I remembered seeing an announcement of Microsoft's plans to license Java there before, but it's not there. I know they've revised press releases without changing the date before (most notably the October 20th SMB security bug acknowledgement). > [Microsoft] > Microsoft Announces Internet Code Safety Initiative > Microsoft Previews Internet Digital Signature Initiative to 150 ISVs > > REDMOND, Wash. - Dec. 7, 1995 -At the Internet Control Developers' > Workshop on December 6, Microsoft Corporation proposed to the top > 150 software companies in the world, an Internet digital signature > initiative which provides a safer environment for executable code on > the Internet. To address concerns about potentially malicious code > or viruses, this technology will enable users to verify that a > program's integrity is free of third-party tampering. Browsers such > as Microsoft Internet Explorer will be equipped with the ability to > automatically download applications from a list of vendors approved > by the user. If the author is not on the user's pre-approved list, > the browser can display the signature of the executable code and > allow users to make an informed decision on whether to proceed with > the download. > > Microsoft plans to propose the Internet digital signature > specifications to the W3 Consortium (W3C) and the Internet > Engineering Task Force (IETF) as an open Internet standard. The > technology will be an open, proposed specification available to the > entire Internet community. In addition, as part of the Open Process > Design Review, Microsoft will host a digital signature design > preview in January to solicit feedback from the Internet community. > > Ken Wasch, president of the Software Publishers' Association (SPA) > said "The Software Publisher's Association applauds this important > initiative. Independent software publishers large and small will > have greater business opportunities publishing powerful software > with this mechanism. Users will buy more signed software over the > Internet because it will be more powerful and users will have > confidence in the accountability of its creator." > > "Digital signatures allow people to interact over the Internet with > the same confidence that they interact with each other in everyday > life," said Bob Atkinson, digital signature architect. "A reliable > accountability mechanism like this allows users to avoid walking > around in a virtual suit of armor, giving users the flexibility to > download and run the most powerful and interesting programs without > undo fear of anonymous computer vandalism." > > Founded in 1975, Microsoft (NASDAQ "MSFT") is the worldwide leader > in software for personal computers. The company offers a wide range > of products and services for business and personal use, each > designed with the mission of making it easier and more enjoyable for > people to take advantage of the full power of personal computing > every day. > > Microsoft is either a registered trademark or trademark of Microsoft > Corporation in the United States and/ or other countries.

2 1

Re: Wipe Swap File
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:27 1/21/96, jim bell wrote: >However, I _still_ want to see brainless operating systems like MSDOS >changed to erase (zero) allocated data buffers before and after use (and >especially before re-use!), so that parts of vital files don't accidentally >get written to the ends of other files. Not only DOS suffers from this problem. The MacOS does as well. All 'wipe unused space' utilities for the Mac fail on a typical hard drive to overwrite several hundred kB of data. Few people seem to care that the OS fills the unused parts of the last block of a file with whatever happens to be in the buffer. Not good. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Hassles taking App. Crypt. to Taiwan?
by Bill Stewart 17 Dec '03

17 Dec '03

>At 1:49 PM 1/21/96, Daniel A. Monjar wrote: >>I've lurked for quite a while now. It is time to ask my first newbie >>question. I'll be going to Taiwan for three weeks in March. Is there >>likely to be any problems at US or Taiwan customs if I take >>Applied Cryptology 2/e along for personal study? The first edition of Applied Cryptography has explicit permission to be exported, thanks to Phil Karn. It's not clear that he needed to ask, except as a setup for asking permission to export the same material on floppy disks; books normally get lots of slack because they look surprisingly like the kind of thing the First Amendment covers. (It's also not clear that he _didn't_ need to ask, given Dan Bernstein's attempts to get official permission to teach cryptography.) >On the Taiwan side, though, they may wonder why you brought an expensive >U.S.-printed copy when you get the special rice-paper edition of "Applied >Cryptography, 2nd Ed." for the equivalent of $2.25 in Taipei's book stalls. If this were Singapore, they might consider it subversive literature, because it is :-) Don't know about Taiwan; you can tell them it's a computer textbook or math textbook if they ask any questions. Rice-paper editions of books are especially good if you need to eat them in a hurry when the Feds are raiding you.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

3 2