December 2003 - cypherpunks-legacy

Re: Computer Security Risk Assessment Software?
by Frank Willoughby 17 Dec '03

17 Dec '03

Methinks "Ross Wright" <rwright(a)adnetsol.com> wrote: >On or About 31 Oct 96 at 12:19, Dr.Dimitri Vulis KOTM wrote: > >> which I assume is NOT what you have in mind :-) Do you mean >> something that'll take a survey of a company's computer security > >Boom. Nail, head, one shot!!!! What's on the market now in that >area? > >> and >> assess the risk (like Stan) or something more global? > >The issues are: > >Information Risk Assessment and Management >and also Information Security Assessment. > >> AFAIK, there's >> no tool on the market to help in all aspects of risk management even >> for a small outfit, because there are so many sources of risk. There >> are many good specialized packages. > I beg to disagree. Tools, like checklists, are ok as far as a memory jogger goes (to make sure that you haven't overlooked something) but there is no way they can replace an assessment or audit by a seasoned Information Security Officer or professional. ISOs have eyes, ears, fingers, and a mind. Tools don't. Further, assessments & audits require a mindset - usually based on experience. A tool in the hands of an inexperienced person (be they consultant, or whatever) will more than likely result in major vulnerabilities being overlooked. There is no way a tool or checklist can have every possibility on it. (They don't make laptop hard drives big enough) 8^) As Murphy's Law goes, the vulnerability that isn't mentioned in the tool will be the one that a hacker will use to crack the systems and start peeling the corporation like a grape. Frequently, a reason people buy these tools are that they feel that the tools are more cost-effective than bringing in a consultant for the engagement. Their reasons for doing this are based on the fears that that the consultant's fee will be too high, and that when the consultant leaves, so does the knowledge he used to perform the assessment. In many cases, these fears are justified. (There are exceptions, however). The solutions to the above-mentioned problems are: o Shop around. Find out which consultants are qualified and what they charge. o Make sure the consultant caps his cost. You should know the maximum price tag associated with the consulting engagement BEFORE the consultant walks in the front door. This helps to avoid having the consultant camp on your doorstep at $XXX dollars per hour for days, weeks, or months on end. o Check the consultants to see if they have ever worked as an Information Security Officer. (Would you want to have eye surgery performed by someone who read a book about it, or by someone who had is experienced at the trade. IMHO, supplying textbook answers to non-textbook corporations is for the birds. o If the consultant is worth anything at all, they will walk the customer through the engagement (before the engagement is over) and TEACH them how to become self-sufficient in the areas of InfoSec which were part of the engagement. (Sounds counter-productive for business, but the word-of-mouth references are worth it. It is also more honest than milking the client as some people do. When the consultant leaves the site, the customer should know what the consultant did, and be able to follow the consultant's train-of-thought that led him to the recommend the particular solutions that he did. o Last, but not least, it also wouldn't hurt if they were professional enough to be a member of a consumer protection group (such as the Better Business Bureau, etc). This helps to keep the good guys honest and helps customers differentiate between the professionals and those who are out for a quick buck or just learned how to spell Information Security. Food for thought. Best Regards, Frank Any sufficiently advanced bug is indistinguishable from a feature. -- Rich Kulawiec <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Information Security Consulting http://www.fortified.com Phone: (317) 573-0800 FAX: (317) 573-0817 Home of the Free Internet Firewall Evaluation Checklist

2 1

Iridium satellite xceivers idea?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several months ago, someone was raving about getting Linux PCs and cheap satellite comms into Hong Kong in preparation for the mainland takeover so that the ensuing human rights violations could be documented. If there's anyone left on cypherpunks who knows or cares about that kind of thing, let me know. - -rich group 19 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMnr5qyoZzwIn1bdtAQHtWgF+J46Kz4kUiAdbZ8JWbiRPp5VSAfi4qAqk ZfMXNPh4ma/eUMBnxrDmfgKJuhdUGXcq =hUZX -----END PGP SIGNATURE-----

1 0

Re: 'what cypherpunks is about'
by Troy M. Barnhart 17 Dec '03

17 Dec '03

At 12:59 PM 11/01/96 +0000, Hard Media wrote: >Go and read a few books, >try "Bury My Heart at Wounded Knee" - J Dee >and then try "Blackfoot Physics" by F David Peat. my $.02 worth... Have live in the Western Dakota's all my life... I, currently, live about an hour away from Wounded Knee... Don't let the "Hollywood" effect on the American Indian overwhelm you.... They had some fascinating cultural facts, etc.... Are they Oppressed? Maybe more than 50 years ago... Now... most have done it to themselves... think on it... barney "Was mich nicht umbringt, macht mich starker." - (Nietzche) "Wit is educated insolence." - (Aristotle) E-mail: barney(a)rapidnet.com "Troy M. Barnhart" Web: http://www.rapidnet.com/~barney/

1 0

ITAR financial crypto exception?
by Greg Broiles 17 Dec '03

17 Dec '03

At 04:42 PM 10/30/96 -0800, Martin Minow wrote: >At the Bernstein case oral arguments last September, I distinctly >remember the government lawyer stating that the United States does >not restrict "financial cryptography." Perhaps he should have >qualified his argument somewhat. > >This statement bothered me, as I cannot understand how an encryption >algorithm can "know" that it is encrypting a financial transaction, >rather than some non-financial document that would be export-restricted. According to the "United States Munitions List", 22 CFR 121.1, Category XIII, "Auxiliary Military Equipment": "Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor" are included in the munitions list; but not if they are "[s]pecially designed, developed or modified for use in machines for banking or money transactions, and restricted to use only in such transactions. Machines for banking or money transactions include automatic teller machines, self-service statement printers, point of sale terminals or equipment for the encryption of interbanking transactions." (22 CFR 121.1, Category XIII (b)(1)(ii)), or if they are "[l]imited to access control, such as automatic teller machines, self-service statement printers or point of sale terminals, which protects password or personal identification numbers (PIN) or similar data to prevent unauthorized access to facilities but does not allow for encryption of files or text, except as directly related to the password of PIN protection." (22 CFR 121.1, Category XIII (b)(1)(v)). As I read this, people exporting ATM's and other commercial financial equipment don't need to fuss over the ITARs; and probably not people selling Bank-O-Matic software; the question is not whether or not the software involved could be used for financial applications, or if it can tell that it is (and turn on or off strong crypto), but whether or not the system in question was "specially designed, developed, or modified" for financial applications (or access control), and limited (by some means) to only those uses; and this is a question that humans can (and must) answer at the time of export. (Also, I don't think that *documents* are ever export controlled; just the applications/systems that read and write them. Nobody tell the State Dept about John von Neumann and the interchangeability of code and data, ok? :) I understood Mr. Coppolino's remarks to be referring to the above; but if his statement was as broad as you remember, he perhaps went a bit too far. (Or maybe he was thinking of something else.) I don't remember the context of his comments. Does anyone know if a transcript of the hearing is available? It's my understanding that many court reporters are now making transcriptions available on disk, facilitating easy transition to the Web. As always, my comments are provided not as legal advice (or even as an authoritative understanding/interpretation of the ITARs/AECA) but as a contribution towards a general discussion. I still don't have an especially current source for the text of the ITARs at home; the above is from the EFF's copy of the 1993 changes. Someday I'll remember to pop across the bay and pick up a copy at the US Gov bookstore, but it hasn't happened yet. (Looks like the paperback 22 CFR volume is around $30, from info I found on the Web, if anyone else is interested. It'd make a good thing to set hot things on when they come off of the stove. :) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

'what cypherpunks is about'
by dh12＠dial.pipex.com 17 Dec '03

17 Dec '03

Tim May should learn that holding 'harsh' and 'realistic' opinions require a little substantiation...not ignorence and blind scepticism. Rather than start an argument on third world politics and the like I'll quote two sources that Tim and everyone else ought to check out. These are at the end of this post. Second, ok so cypherpunks is not about the redistribution of wealth is it? How many of you would agree it is about retaining the status quo? Cypherpunks, in my (rather simplistic) opinion, IS about the redistribution of power. Wealth is often seen as a subset of power. The people who control assets today are by and large criminals. This is not a judgement but a simple statement...in the past the main form of power was violence - 'Political power grows from the barrel of a gun.' - Mao More gained through war, pirecy and pillage is today seen as liliy white, by the likes of Tim May. This is ignorence. Look closer. Cypherpunks & crypto gives us a chance today to 'redistribute' the power base from one based on fear, violence etc to one based on information...wait! I didn't say this new power base will be more ethical than the last...who knows? It certainly has the potential to be...that is what cypherpunks is about...to me! To Tim May it's about something very different. But remember people are NOT sheep and nothing lasts forever. Historically, geographic areas such as the third world are not responsible for their current economic climate any more than Tim May is responsible for the economic sucess of the US, or for that matter the criminal acts of Nixon...who is then? Read on MacDuff... Read 'A Fate Worse Than Debt' - Susan George for a popular understanding on the third world debt crisis. This will tell you about 'countless third world deaths' and also the extent of Citibank's involvement. A quote: 'If I were the president of a third world nation...I would be far more frightened by a well dressed gentleman bringing loans from the IMF or Citibank than by a bearded guerrilla muttering threats of revolution.' - Lewis Lapham, Imperial Masquerade, 1990 For an economic perspective on third world debt read: 'Economics for a developing world' - Michael P Todaro, ISBN 0-582-07136-4 Zaid Hassan ph93szh(a)brunel.ac.uk ps.sorry if this is rather harsh Tim, you sorta annoyed me.

7 6

Re: Sliderules, Logs, and Prodigies
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 AM 11/1/96 -0800, you wrote: >Seriously, only a very few of us had and used sliderules...mine was a big >synthetic K & E (Keuffel and Esser, as I recall). The raging "DOS vs. Mac" >or "RISC vs. CISC" debate of that age was "aluminum" (the yellow Dietzgens) >vs. the old standby, "bamboo." Plus some oddball circular sliderules. I used plastic ones, myself; they were good enough for any work I was doing, even after the occasional rebuild when the [whatever you call the clear slider with the line on it] fell off. Started with the basic model, and later a wider log-log-trig model. I also had a few circular ones, including a big car-rally model that let you get an extra digit or so of precision (remember when precision was measured in digits rather than bits? :-) There were also a variety of nomographs and other weird slide-rules and graphical tools that were simple analog computers. We used some of them in electrical engineering classes for complex calculations that didn't need to be highly precise, which most of them didn't in a world where the extra-fancy resistors had 5% tolerances and you achieved accuracy by adding various tweakers instead. ObCrypto: Secret Decoder Rings are more or less circular slide rules, but there really isn't much crypto you can do in analog. :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

http relay script
by Niels Provos 17 Dec '03

17 Dec '03

Hi! I am sure this was discussed already. Is there meanwhile a http relay cgi script out there which could be packaged with the common http daemons (like cern, apache or ncsa) ? The use of that is obvious: every new web server could be used as anonymizer and thus proxies would have a hard time to filter all those sites in censorship countries. Greetings Niels Provos =8) - PHYSnet Rechnerverbund PGP V2.6 Public key via finger or key server Niels Provos Universitaet Hamburg WWW: http://www.physnet.uni-hamburg.de/provos/ Jungiusstrasse 9 E-Mail: provos(a)wserver.physnet.uni-hamburg.de Germany 20355 Hamburg Tel.: +49 40 4123-2504 Fax: -6571

1 0

Re: 'what cypherpunks is about'
by Hard Media 17 Dec '03

17 Dec '03

Message 1/40 From Timothy C. May We mine the copper they have no money to mine and pay them with worthless trinkets like penicillin, schools, and roads. We are exploiting them. Yep, they are better off in a state of natural grace, eating grubs and with a life expectancy of 35. --Tim May I can't believe I'm hearing this. Buddy can you even READ? Have you forgotten that the Americas was doing fine until the Europeans got there and "civilised" it? Go and read a few books, try "Bury My Heart at Wounded Knee" - J Dee and then try "Blackfoot Physics" by F David Peat. Roads? Hell the longest tarred road in the world existed in India before the Americas was colonised, I have a list of Chinese inventions made 10,000 years ago longer than your arm. Oh yeah, the average life expentency for a male on the streets of LA is about 35. Then go and read some Chinese history, (Go and read Joseph Needman's history of ancient China.) then try some Arab and Indian history. Maybe that'll give you some idea of who was eating grubs when eh? Anyways who the hell is talking "natural grace" if anything Europe during the Dark Ages is a reflection of a "Western" heritage...and I can't remember when I mentioned that living in a "natural" state was better than being civilised, it's just that you seem to think that the "West" has a monolpoly on "civilisation". Which is pretty damn apathetic considering the access to historic records and books you must surely have. Honetly I'm just astonished that you insist on holding on to these ideas before you'v had the chance to check them out. What are your ideas based on anyways?CNN? I suppose I should know better than to ask, the many times I'v been in the States reminded me of Soviet Russia and the "Iron Curtain", there seems to be a complete news blockout about the rest of the world, enforced because intelligent people like you are content to base your ideas and perceptions of the rest of the world on a mistaken belief that the the universe revolves around the USA. Just to clearify a this. You might not being doing this, but don't lump me as being anti-Western. I was born and live in London in the UK, and there are a huge number of things that the West can be credited with achieving, but on the most part the role of the West, mostly the USA, has been overblown. In the UK and most of Europe there is a much greater understanding when it comes to the rest of the world. Very few, if any, Englishmen today will claim that our past colonial and imperial history is something to be proud of. On the whole it isn't. The only place where these ideas florish are in the USA. Which is a shame. Zaid Hassan

2 1

Unix User Password File Encryption
by Erp 17 Dec '03

17 Dec '03

Ok, I realize that you cannot reverse the encryption process for a Unix password.. But -- Explain to me why the following wouldn't work. And if it could work, I am willing to do the algorithms and math for this... I'm no good at coding and such.. But I can do algorithms and a lot of math easily enough *shrug*.... And if anybody uses this idea --- Please give me credit for the idea.. If it has already been tried -- Can someone please refer me to where it was tried, adn if there are any texts on it.. I would like to read them.. Thanks ok here it is: Normal Programs for Cracking a Unix password file, such as CrackerJack take a word, use the salt in the password file for that password, encrypt the word using that salt, and then compare what it comes out as. If it isn't the same, it moves on to the next word. My idea is similar to this, but is a bit different. Basically it would take a beginning word and encrypt it with the same salt as used on the password in the passwd file. So let us say that for an example our salt is aa, our outcome encrypted password is X8mfjs53D ... Ok now let us say that we take this salt of aa and run through the following into it and getting these patterns from it (these aren't the true patterns etc, I'm just making htese things up, but would it be possible?) salt aa -- inputed password 0001 -- outcome encryption Zkdrj234S salt aa -- inputed password 0002 -- outcome encryption Rksjr342s salt aa -- inputed password 0003 -- outcome encryption 25Svj43zY (For the following process we'd obviously use mor ethan three, we would probalby use a thousand at least, nad have them be all sizes of passwords and combiantions.. like aaaab or abababababab and so on...) Compare the outcomed encryptions -- And find a pattern in them.. Now in the above I'm just going to say like it comes out as 8x + 4/y - SQ(2z) + 4a = encrypted password.. Where xyza are each of the characters respectively such as 0000 xyza based on a 255 or however many ascii char system.. I know this is completely wrong for what I've done here, but I'm not doing the math or anything right now, I'm just making it up as I go for an example... Now say that since we have found the pattern... We take the outcome -- Do the algebra to figure out what the xyza would be.. And ther eya go woopity doo there is the password.. Not as simple as I've said here of course.. It would be a lot more complex.. But that is the basic idea... What is wrong with this idea? -- If it is something I have thought of, and havent' mentioned -- I'll inform you when you point it out.. But please do point it out.. Or I'll grasp at straws and say a lot of buts *laugh*... Anyways, What is wrong with this idea? How could it work? Would someone mind explaining for me, is much appreciated... Erp --------------------------- E'gads, ideas can be hell at time..

2 2

Re: New Bihman-Shamir Fault Analysis Paper
by Martin Minow 17 Dec '03

17 Dec '03

There is an inherent conflict between two claims that are central to the fault-analysis paper(s): "the secret key [is] stored in a tamperproof cryptographic device" and "the cryptographic key is stored in an asymmetric type of memory, in which induced faults ..." If the device is truly tamperproof, the attacker should not be able to induce faults. Even given susceptable "consumer- quality" devices, it would be trivial to store the cryptographic keys in a redundant memory configuration, such as ECC "error-correcting code" memory that can self-correct a range of failures and detect a much wider range. It would also seem reasonable to protect the cryptographic core (algorithms and data) with a digital signature that would "crash" the device, rather than proceed with incorrect key information. My naive reading of the attack suggests that storing the cryptographic key together with its one's complement would minimize the chance that an attacker can exploit asymmetric fault inducement. Finally, I'm curious whether this attack would work on masked ROM or fusable-link (one-time programmable) PROMs (not EPROMs that have no reprogramming window). These are more likely to be used in production devices than EEPROMs, if only for cost-savings. Martin Minow minow(a)apple.com

2 1