December 2003 - cypherpunks-legacy

11 CENTS A CLICK - PINKCASH PAYS CA$H UPFRONT
by nobody＠nowhere.com 17 Dec '03

17 Dec '03

Friends, I am Scott Phillips from www.pbits.com, My apologies for this short spam, I`m only sending it because as a fellow ADULT WEBMASTER I know you will be interested in the first click thru system to pay you IN ADVANCE, BEFORE YOU EVER SEND A HIT! Lets keep it short and sweet so HERE IS THE DEAL! Sign up here http://usa-6.gsd.com.au/moremoney And get paid 11c a unique click by ww.pbits.com WE OFFER THE FOLLOWING BENEFITS - Real time stats - Click counts that are 100% real - NEVER BEEN ACCUSED OF SHAVING HITS - Rated "good as gold" on Serge`s good bad ugly sponsor list http://pusi.com/~contest - FRESH banners that pull HARD - straight, gay, hardcore, teen, fetish sites, we have it ALL covered - On the net since May 96 never ripped off a webmaster - The checks are cut by the legendary Serge, who has never been late with a payment ever! - Auto-signup - I answer email personally - Software designed by BobX who wrote the clickthru for cybererotica.com http://usa-6.gsd.com.au/moremoney This is my personal guarantee to you, my fellow webmasters. Pinkcash *is* and will always be the highest paying clickthru on the net. No matter what others claim to pay, at the end of the day you make more money with us, its a FACT! If you earn more with other clickthru programs I will refund the difference. Statistics show that a .11 banner for pinkbits earns TWICE what an xpics banner at 14c does. This is because we DON'T shave hits or filter every AOL proxy to steal from you. http://usa-6.gsd.com.au/moremoney HOW DO WE PAY IN ADVANCE? After you have a trading history with us for a month or two we put you on the advance program. Currently 93% of our traffic is payed before the hits are sent. This is not an idle promise, we send checks everyday. Look at http://www.pbits.com/whosyerdaddy to see a few real checks for people you probably know. And by the way, we pay an extra cent per click when we pay you in advance, its our way of thanking you for being trustworthy honest webmasters just like us. http://usa-6.gsd.com.au/moremoney I live in Australia but I`m travelling around the USA at the moment catching up with webmaster friends and buying more traffic. If you have the ability to send bulk volume traffic contact me and I`ll visit you while I`m in the USA Nobody has ever left our clickthru ever. Nobody has ever had a complaint EVER. This is state of the fucking art software, we are cool people, we want your business, and we treat you right. AND WE PAY MORE! Sign up now http://usa-6.gsd.com.au/moremoney Thanks Scott Phillips --- TO REMOVE YOURSELF FROM THIS LIST CLICK BELOW --- http://207.33.10.200/maillist/remove.html

1 0

Re: TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: TEMPEST > Date: Mon, 09 Feb 1998 21:07:22 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > Things are somewhat more complicated and I am not convinced that > the e-beam is the primary source of radiation. Only of the individual pixel modulations. Go back and re-read my post you missed a whole slew of implications. The vertical and horizontal positioning is via the yoke not the screen grid. Electrostatic steering of an e-beam is expensive and slow, you can't change the charge on the plates that fast. In regards the data for the individual scan lines, where else are you going to modulate that beam than a screen grid? This is a high-voltage low-current point. You can't drive the beam off the screen, the inside of the tube is coated in a carbon based chemical called 'aquadag' that will short the beam to ground and blow your flyback transformer in short order. Not to mention that the inertia of the e-beam will be a bit of a hassle to deal with as well. It won't move that fast. > Your claim that > the Tempest radiation is modulated by the screen grid does not agree with > my practical experience: All signals I get are close to harmonics of > the dot clock and not of the screen grid rate. The screen grid is where the dot clock goes to modulate the e-beam, or is your claim we're going to modulate the filament directly? If so I would suggest you re-take your electronics class and learn how to read a schematic a tad better. A short trip to either your local library or electronics repair business will pay off wonders. You're looking for a Sam's Photo-Facts on the particular monitor you are examining. There is also the fact that the dot clock itself is a low-voltage low-current device until it gets to the tube drive electronics where it switches the high voltage drivers to the tube. If your getting your signal off the harmonics you're doing it the hard way. Go back and re-read your texts on Fourier Transforms and then do a power-spectrum analysis on the signals to the tube; what you will find is that the primary frequencies get the majority of the signal (eg 1st harmonic of a square wave (ie a dot clock) only gets, at best, 1/3 of the energy of the primary). In any case, it's the high voltage emissions of the tube drive electronics that are detected, not the small 5V to 12V drive signals. The same is true for LCD, Plasma, and other flat panel displays. You detect the high-voltage emissions of the display drive electronics. Note that on active transistor displays (where you don't have the high voltage bias as in a LCD) you don't get these sorts of emission magnitudes and they are *much* harder to detect. In addition in the active transistor displays the display drive electronics should buffer the data and so, unlike a CRT, you don't have to send each individual pixel every time. You can actualy send only the changes and impliment those. Unless you're integrating the signals you receive your Tempest display will be gibberish. > In addition, the > Tempest monitor cannot distinguish between an all-black and an all-white > image, which it should in the case of a screen-grid caused modulation. What? This is malarky. If the screen is black the filament emissions are being blocked by the screen grid and the charge cloud gets shunted to ground via the aquadag coating. This means there is no current, and as a consequence no emitted rf field to monitor. And what keeps it from blowing the flyback in this case is that the charge cloud acts as a capacitor and limits the dv/dt to something that the flyback can deal with, it has to leak past the screen grid. You can also discern this using Tempest to monitor NTSC where the black pulse is a negative going pulse at the end of the scanline waveform. It's there so the receiver electronics can know when to turn the e-beam off so you don't get those annoying retrace lines across your screen when it moved back to the left and down one line. Since it's a negative going pulse with respect to the vertical and horizontal retrace it's dv/dt is going in the opposite direction. If you get a schematic find the horizontal retrace clock and disable it and monitor the display. > If there is indeed a screen-grid modulation, then it is *much* weaker > than any modulation that you get by software dithering. This is just plain silly. The switching of the software is drowned in a sea of such noise on the board. Anyone who claims they can pull a valid signal off a cpu pcb at more than a few feet is a liar or else they have some pretty remarkable extra-terrestrial technology. There are litteraly 10's of thousands of state transitions all over the pcb that are going on in parallel and the positive transition fields cancel the negative transition fields so what you end up with is a hash of noise. 30 seconds of looking at a spectrum analyzer will make this obvious. In modern computers what drives the crt is the data residing in the video frame buffer that drives the output electronics on the card and not the data on the cpu pcb. > Monitors are pretty strange antennas: For instance, my monitor still > radiates quite well (although noticeably weaker) if I switch its power > supply off. It can take as much as 20 minutes to drain a good high-voltage supply (read the documents of all power supplies that operate above a couple hundred volts, it should include the discharge time constant - you want to wait through at least 3 of those). There is also the issue that a crt tube sitting unconnected in the open dry air will develop enough of a charge to knock the shit out of you if you're silly enough to grab the grounding connection on the side with one hand and be grounded to earth with the other. So even if the machine is turned off you get a continous charge build up on the tube that gets drained through various resistors to ground. Unfortunately this is a pretty incoherent signal and low power as well. I routinely deal with voltages in the 1MV range and currents (usualy not at those voltages) in the 100A range (I build 12 ft. Tesla Coils for grins and giggles that throw discharges in the 8-12 ft. range). When you start talking about voltages above a few hundred there isn't any such thing as 'off', only a higher impedance path to ground and longer time constants. NOTE: if you do decide to play in your monitor then make shure that one of your hands is in your back pocket at *ALL* times. Otherwise make shure there is somebody there to call 911 so they can haul your body off. If you don't the discharge leakage current through your heart *when* you make a mistake will cause it to go into ventricular fibrillation (v-fib). Unless you got a de-fibrillator handy your dead in about 3 minutes. > Just the passive resonance of the chassis gives a clear > signal in around a meter radius with a simple untuned dipole antenna. If they get within a meter of my machine I seriously doubt they will be using VanEck but rather rubber hose or eye ball monitoring... We're talking real world here not some Tom Clancy novel. > Switching off a monitor alone does not protect you from eavesdropping > a VDU signal, especially if the signal is not just text but a pattern > optimized for reception. True, but instead of being within a couple hundred feet (the average succesful range for interception) you're now talking about 10's of feet. At that range my dogs barking will let me know that Mallet is in the house. > After I unplug the VGA cable however, I can't pick up any signal with > our Tempest receiver unless I bring the antenna almost in contact with > the cable or connector. Duh, can you say 'impedance'....go back and study your analog and rf electronics. A monitors off impedance per line is somewhere in the 50 to 75 ohms range. The impedance of a wire hanging in the air is much higher and as a consequence the current flow and as a result the emitted em field will be much lower. > The closed PC chassis also appears to be no very > big source of VDU emanations, certainly much below the levels that > our receiver can detect. And this surprises you? A pc chassis, provided you put all the screws in it and don't have lots of holes in it, is a Faraday Cage, it's the reason they make them out of expensive metal and not cheaper plastic. A very effective method to confuse Van Eck is to have several monitors sitting next to each other with different displays. A more active display is much more effective than one that is static (eg. such as a person typing in an email to cypherpunks). I strongly suggest the following reference: High-speed Digital Design: a handbook of black magic H.W. Johnson, M. Graham ISBN 0-13-395724-1 ~$60 US ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

E-CDA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Congressional Record: February 5, 1998 (House) ELECTRONIC CAMPAIGN DISCLOSURE ACT (Mr. WHITE asked and was given permission to address the House for 1 minute.) Mr. WHITE. Madam Speaker, in March we are going to vote on campaign finance reform in this House. It is a very important issue but also a very difficult issue, and it is made particularly difficult because most of the bills before us are big bills that deal with the whole comprehensive issue that we have to talk about. I have got one of those bills, and I hope that we can pass one. But just in case we cannot, today I am introducing what we might call a small bill that will deal at least with some of the problems. This bill is called the Electronic Campaign Disclosure Act, and what it does is tell the Federal Elections Commission to get into the 21st century. It directs the FEC to establish a database on-line to search over the Internet for all the information needed about campaign finances in our country. Every campaign would have to file within 10 days a report of every contribution that it receives and contributors, and PACs would also have to file. Madam Speaker, sometimes we cannot do it all in one step. The longest journey begins with a single step, and I think if we cannot pass a big bill a small bill like the one I am introducing today would be a step in the right direction. ____________________

1 0

Driver Licenses
by Anonymous 17 Dec '03

17 Dec '03

Recently had to renew my DL here in Florida. While we are not forced to give up our fingerprints (yet)we have a new little magnetic strip similar to those on a credit card or ATM card and I can see this as a way for the State to start holding more and more data about us on these I.D.'s (like fingerprints, criminal records, etc... Coincidentally, that day when I went into my grocery store to get a six pack of brew, I got carded. I handed my new little card over and the teller and rather than looking at my date of birth she started to swipe the damn thing through her credit card reader machine! I stopped her, grabbed my DL back and told her to manually enter the date as they have always done. When she explained that it is against store policy and that she 'had' to swipe any IDs that had the strip I got my keys outta my pocket and all but removed the strip from the back of my little nemesis. Handed it back to her and told her to swipe away; it is against MY policy to provide ! ! ! the store with my address. I don't want any damn pepsi coupons mailed to me each time I buy coke, or northern tissue coupons when I buy charmin. Nor do I want the store collecting information on how much beer I buy. Sure, I want my alchohol purchases going to the Dept of Motor Vehicles and the other State departments...like hell. My question is, how much information can be stored on these strips?

11 17

Re: SOFT TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: SOFT TEMPEST > Date: Mon, 09 Feb 1998 16:44:52 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > The software that displays the license number plus activation instance > random code in your windows toolbar as an easy receivable spread > spectrum barcode would have to take care of this depending on how > exactly your license agreement is formulated. This can be resolved > in many ways. Has your technique been verified by any 3rd parties who are not affiliated with you or your firm? Do you expect to do any public demonstrations of this technology in the near future? Would it be possible to arrange for a indipendant 3rd party to receive a test setup for evaluation? > The technique of hunting software license violators via Tempest > monitoring is not really targeted at providing 100% accurate > and reliable identification of abuse at any point of time as That's good. The thought that given current technology a signal reception van could pull one monitors display out of a building that could potentialy have 1,000+ pc's (my last job had about 1500/floor and 3 floors) at a range of say 200 ft. is truly incomprehensible. If it works that is a feat worth many laurels. > (e.g., has bought a single copy of an expensive CAD software but > uses it on over 80 workstations all day long), which then can > justify to get court relevant proof by traditional means of > police investigation. You show up in my companies parking lot without my permission and start snooping you'll be the one sitting in jail facing industrial espionage charges. Any defence lawyer worth a damn would be able to blow this out of the water, private citizens don't have the right to invade my privacy any more than police without a warrant - and that take probable cause. > One obvious countermeasure are Tempest shielded computers or rooms, It's the monitors that need shielded, the computers already sit in a Faraday cage. Simple copper screen glued to the inside of the monitor case with a paper sheild and then grounded will resolve that problem. Be shure to put a grounded screen on the front of the tube as well (similar to those radiation shields that some companies make that don't work because they aren't grounded). > Another countermeasure are software reverse-engineering and modifying > the broadcast code. This is around as difficult as removing dongle > checking code: Not impossible, but for the majority of users too > inconvenient. A simple Gunn Diode oscillator driving a broad-band 100W rf amplifier will swamp any signal you could hope to catch. Cost, about $250 ea. With the new low-power transmitter rulings there wouldn't be much anyone could do about it either. > an interesting application. Tempest research requires some > expensive equipment (special antennas, very high-speed DSP > experimental systems, an absorber room, etc.). Gee, and to think that when I've done this sort of stuff I only used a Commodore 1702 composite monitor and some rf amplifiers and filters... Duh, silly me. Any claim that it can *only* be done with lots of money is almost always wrong. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 4

Re: Washington on the verge of being nuked?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > > > LA has a combination of closed pipes and open aqueducts, often > in remote areas. Simple disruption, not poisoning, would > be easier. The resivoirs don't hold enough for more > than a few days. One can "disrupt" the water supply by just making a credible assertion that it's been poisoned - but it won't kill nearly as many people as actual poison (or virus/bacteria). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 16:36:16 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: Laptop TEMPEST (fwd) > At 08:30 AM 2/9/98 -0600, Jim Choate wrote: > >> FCC RF/EMC testing is well nigh useless for TEMPEST protection. > > > >I disagree, it would give you a gross baseline on the total emissions > FCC specs aren't real tight. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

What Jim Choate doesn't know
by Anonymous 17 Dec '03

17 Dec '03

When Jim Choate writes about something that I know about, he is usually wrong. Look at the hash he made of quantum mechanics recently. And don't get me started on his blunders regarding cryptography. So when he writes about something I don't know about, like the EM emissions of video tubes, I tend to assume the same thing. He's probably all messed up. Anybody else have the same experience? And how about his countless off-topic posts, forwarding all kinds of pointless crap? Is anyone else sick of that, too?

2 1

Re: the best justice money can buy --Lessig (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 14:22:40 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: the best justice money can buy --Lessig (fwd) > Gates got rich not by selling good software, but by selling software > very well. His original money was made by being the first company to sell a CP/M compliant BASIC. It was very heavily pirated and Microsoft became a de facto standard for S-100 using CP/M. Then because of Digital Research's failure to treat IBM with respect he was selected as the supplier for their basic OS. This decision was made because of his reputation with CP/M software. Because of this connection Microsoft was in a position such that Gates couldn't help but make money as long as IBM was selling pc's. And considering nobody ever lost their job buying IBM it was a shoe in that IBM was going to sell machines. His first versions of Windows didn't sell. He looked at what was selling which was a GUI with more features and better looks. He hired the right people to impliment those changes and wallah he had a winner. All those pc's running his old os no longer had to go to Desqview and DR to get a GUI that was acceptable to their users. From their they have used various marketing and licensing tricks to increase his market share. > Copyright is part of the process, but it's possible to > sell your product to computer manufacturers with any customization > they need using contracts instead of copyright to make your money. But a company doesn't make money from selling software to computer manufacturers, they make money by having their software on pc's that the users use. > It's also possible to do copy protection in your software; > games makers do this because they're widely pirated by non-point-source > attacks (kids, mostly) who are hard to track down and sue, > unlike major computer manufacturers who are easier to find, > both to sue if needed or to provide support for. > Copy protection was one of the things people hated about Lotus 123; > I don't remember Excel or MS-DOS ever having it. And in the long run non-copyrighted software has a significant market advantage. It's smaller, it is more stable, and people don't get as pissed off when they want to make their backups. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: What's the latest in factoring? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 13:40:03 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: What's the latest in factoring? > Remember that factoring difficulty is roughly exponential; > adding logn bits about doubles the cracking workload > (depending on which factoring method is being used). > Factoring a 1024-bit number is _much_ harder than factoring a 512-bit > number, and factoring a 2048-bit number is well into age-of-the-universe > difficulty level. The practical level of factoring right now > is about 512 bits, for either a distributed internet effort or > an NSA internal one; in the unlikely event that Moore's law lets > us double processing power 100 times in the next 150 years, > that means a 1500-bit key could be crackable. So 2048 bits > is certainly more than enough for _your_ lifetime. That depends on what current and near-future medical technology can do to extend the lifespan of humans. If your assumption is that most folks younger than about 50 will be dead in 75 years I suspect that you're in for a nasty surprise. The reason I posted those cc:'s regarding such research is enough that current estimates of key strength based on human life times need to be re-evaluated. It is my suspicion that within 10-15 years it will be possible, as a matter of course in regards employer medical insurance, to have ones biological clock reset such that the lifespan will be extended 3-4 times with the main limiting factor being cancers. Under those conditions key strength lifetime computations need to be re-evaluated. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1