December 2003 - cypherpunks-legacy

PGP and crypto News from France
by Anonymous Sender 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------- PLEASE REPLY ONLY TO : <pplf(a)usa.net> - ---------------------------------------------------------- SUBJET : PGP and crypto News from France Hi all, We're glad to announce an english "PGP and crypto News from France" on the PGP FOR FRENCH site, and a "beta" ;-) translation of our little PGP History, here : http://www.geocities.com/SiliconValley/Bay/9648/pgpnews.htm Bye - -------------------------------------------------------------------- PGP pour les francais / PGP even for the French <pplf(a)usa.net> http://www.geocities.com/SiliconValley/Bay/9648 PGPkey 14A0 4A67 0431 2402 684D 6EBA 537F 664D 3F80 0D58 http://www.geocities.com/SiliconValley/Bay/9648/pplf.txt - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com> iQA/AwUBNTRhsVN/Zk0/gA1YEQJQHACfWWAhaHVKblH2S0VSazSw94F8FXUAoPt+ bxFrPDrfbgcPQgLD3NgULSA2 =8Wr+ -----END PGP SIGNATURE-----

1 0

eligable receiver
by David Honig 17 Dec '03

17 Dec '03

THE WASHINGTON TIMES April 16, 1998 Bill Gertz Computer hackers could disable military; System compromised in secret exercise Senior Pentagon leaders were stunned by a military exercise showing how easy it is for hackers to cripple U.S. military and civilian computer networks, according to new details of the secret exercise. Using software obtained easily from hacker sites on the Internet, a group of National Security Agency officials could have shut down the U.S. electric-power grid within days and rendered impotent the command-and-control elements of the U.S. Pacific Command, said officials familiar with the war game, known as Eligible Receiver. "The attack was actually run in a two-week period and the results were frightening," said a defense official involved in the game. "This attack, run by a set of people using standard Internet techniques, would have basically shut down the command-and-control capability in the Pacific theater for some considerable period of time." Pentagon spokesman Kenneth Bacon said, "Eligible Receiver was an important and revealing exercise that taught us that we must be better organized to deal with potential attacks against our computer systems and information infrastructure." The secret exercise began last June after months of preparation by the NSA computer specialists who, without warning, targeted computers used by U.S. military forces in the Pacific and in the United States. The game was simple: Conduct information warfare attacks, or "infowar," on the Pacific Command and ultimately force the United States to soften its policies toward the crumbling communist regime in Pyongyang. The "hackers" posed as paid surrogates for North Korea. The NSA "Red Team" of make-believe hackers showed how easy it is for foreign nations to wreak electronic havoc using computers, modems and software technology widely available on the darker regions of the Internet: network-scanning software, intrusion tools and password-breaking "log-in scripts." According to U.S. officials who took part in the exercise, within days the team of 50 to 75 NSA officials had inflicted crippling damage. They broke into computer networks and gained access to the systems that control the electrical power grid for the entire country. If they had wanted to, the hackers could have disabled the grid, leaving the United States in the dark. Groups of NSA hackers based in Hawaii and other parts of the United States floated effortlessly through global cyberspace, breaking into unclassified military computer networks in Hawaii, the headquarters of the U.S. Pacific Command, as well as in Washington, Chicago, St. Louis and parts of Colorado. "The attacks were not actually run against the infrastructure components because we don't want to do things like shut down the power grid," said a defense official involved in the exercise. "But the referees were shown the attacks and shown the structure of the power-grid control, and they agreed, yeah, this attack would have shut down the power grid." Knocking out the electrical power throughout the United States was just a sideline for the NSA cyberwarriors. Their main target was the U.S. Pacific Command, which is in charge of the 100,000 troops that would be called on to deal with wars in Korea or China. "The most telling thing for the Department of Defense, when all was said and done, is that basically for a two-week period the command-and-control capability in the Pacific theater would have been denied by the 'infowar' attacks, and that was the period of the exercise," the official said. The attackers also foiled virtually all efforts to trace them. FBI agents joined the Pentagon in trying to find the hackers, but for the most part they failed. Only one of the several NSA groups, a unit based in the United States, was uncovered. The rest operated without being located or identified. The attackers breached the Pentagon's unclassified global computer network using Internet service providers and dial-in connections that allowed them to hop around the world. "It's a very, very difficult security environment when you go through different hosts and different countries and then pop up on the doorstep of Keesler Air Force Base [in Mississippi], and then go from there into Cincpac," the official said, using the acronym for the Commander in Chief, Pacific. The targets of the network attacks also made it easy. "They just were not security-aware," said the official. A second official found that many military computers used the word "password" for their confidential access word. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu Clarke's Third Law: Any sufficiently advanced technology is indistinguishable from magic.

1 0

---> How Can I Pay You For My Order
by 1-800-893-6001＠toll.free 17 Dec '03

17 Dec '03

Turn Key Payment Solutions - Sell From Your Web Site Take Checks By Phone - Fax - Or At Your Web Site - FREE or Take Credit Cards - MasterCard - Visa - AMEX and more... Our site has changed since you last visited, so please take the time to visit again, you will be glad you did. <a href=" http://www.hoststar.com/payments/">Internet Payment Solutions</a> You can call us directly at 1-800-893-6001 or see our site for other contact information. No company offers easier web commerce solutions - Checks by phone Credit card merchant accounts Secure Payment Form Hosting for your web site Free Collection Services ***************************************************************** This mailing was sent by RCS Promotions on behalf of the above client. RCS is not affiliated with the above client, other than to provide a mailing service. Removal options are available at the above listed web site. Questions about names, lists and marketing may be directed to RCS Promotions at 781-892-4191. *****************************************************************

1 0

None Re: Gary Lee Burnore, Registered Sex Offender in Raleigh, NC
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Gary Lee Burnore <gburnore(a)databasix.com> wrote: > In 11/96, I kissed a 17 year old girl. I'm not going to provide you > with a lot of detail because this isn't the place for it. If the girl's mother had heeded the earlier warning she received via e-mail about your behavior several months earlier (the one you called "harassment" at the time), this all could have been prevented. You're lucky that the 11/96 "kiss" is all you were arrested for. You were foolish to continue it knowing that Nancy had already been tipped off. In case you've forgotten, you whined: -> So now the cowards in Ronald Francis's corner (I'm outright expecting the -> culprit to be ronald francis himself) have taken to sending email to -> those who have names listed on databasix's web page. Sending comments to -> a 17 year old that they're going to tell her mother that she's having an -> affair with me. Telling her mother that I'm molesting her daughter. -> Having all sorts of fun. And you threatened to report the anonymous whistleblower to the authorities? What chutzpah! You're molesting a minor, someone tips off her mother, and you threaten to report the person who tipped her off about your behavior? Your claim has now been proven to be a lie. How would the mere fact that the girl had a web page at databasix.com have alerted an outsider to the fact that you were molesting her? Presumably she didn't post her diary on her web page, detailing your sexual activities towards her. Where would "Ronald Francis", or any other random "harasser" have obtained this information? You were too quick to dismiss the idea that all the alleged "harassment" and spam baiting might have originated from a DataBasix insider with detailed knowledge of your private life, as well as the complete list of all DataBasix employees and customers that Belinda Bryan claimed had been "spam baited". Who else is getting ahold of all this inside info, Gary? > I pass no > judgment on whether or not she instigated it. I held myself > responsible. That's why I went to see a counselor and offered to pay > for hers if she wanted to do the same. > > It was at the counselor's office that I learned what had happened was > considered a crime under CA law. I discussed this with the girl and > her mother; neither wanted to get law enforcement involved. But apparently it was serious enough that both your victim and her mother thought you needed psychiatric help. (Plenty of people on usenet could have told you that.) > To date, this ordeal has cost me nearly $30,000.00 in legal fees, lost > wages, and other costs. That however, is nothing compared to the > emotional stress of this. You spent $30K on what was supposedly a misdemeanor charge to which you pled guilty? Someone must have seen you "coming"? Was it Nancy? The maximum penalty for a misdemeanor is what? 6 months + $500? You spent $30K to get off with 3 years probation? On a 6 month sentence, you'd probably have been out in 3 months, and that's assuming you got the maximum sentence. Or was the $30K to get it plea bargained down from a more serious charge? > It goes on and on and on. I thought the shrink was to ensure that if didn't. > You know what's so damn frustrating about this? I chose to talk to a > councelor about this even though I knew it would bring charges. I was > doing the right thing. What statute in California makes it a misdemeanor to kiss a 17 year old girl? (It must make senior proms a lot of fun there if such a law really exists as you claim.) Or does it depend on what part of her body you "kissed" her? It's also interesting that when it was revealed that you had also been arrested in San Francisco for unlawful assembly in blocking traffic, you minimized it and called it a mere "traffic ticket", concealing the fact that you had already been convicted of something more serious. Then when someone finally reveals a second criminal conviction on your record, your sock puppets whine that it's a "half truth". Well, gee, Gary, you were content when the WHOLE truth was being concealed. So much for you "I have nothing to hide" boast!

1 0

Re: eligable receiver
by CJ Parker 17 Dec '03

17 Dec '03

From: David Honig <honig(a)alum.mit.edu> THE WASHINGTON TIMES Computer hackers could disable military; System compromised in secret exercise So when can we expect to hear the first announcements of high-level military resignations over the disgraceful state that they have let our national security fall into while wasting billions of dollars of our money? Please zipfile the announcements forwarded to the list, so that their massive volume does not swamp all of our email accounts. cjp ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: GSM cellphones cloned---Threats?
by Dave Emery 17 Dec '03

17 Dec '03

On Thu, Apr 16, 1998 at 05:50:36AM +1000, Marc Briceno wrote: > > Several radio enineers I talked with speculated that it /might/ even be > possible to modify a standard GSM phone to act as a rouge "key reaper" > base station. I am not a radio engineer and have no way to verify this > claim. The modifications would be fairly major and rather difficult on a surface mount high density low cost phone PC board. A lot of the stuff required is in ASICs in a typical phone, and they are not in general easily adapted to playing a different role even if the full design database and phone schematics are available to the hacker which it would not be. On the other hand, some of the components of a standard GSM phone could be used to fill a number of functions in such an animal, and a couple of partially stripped GSM phone PC cards would certainly be useful as part of such. I would see such a probe base station as a briefcase size object run by a laptop or powerful palmtop spliced into two or three hacked up phone PC cards with some added signal processing logic in a FPGA or two (and maybe an added RF modem chip as well). Of course some older phone designs might be less ASIC intensive and more adaptable, although the 1.9 ghz PCS US versions are mostly pretty recent. And there may be some universal multi-standard brand that is much more software configured than others and might be an easier jumping off place - I certainly have not investigated this at all (nor do I expect to). On another topic - privacy... Your break suggests that A3/A8 may have been deliberately weakened to allow such SIM probing. Intelligence agencies are not in general interested in cloning, but for those without access to whatever magic hardware (or software) exists for cracking A5/1 at low cost in real time, the ability to once recover the SIM secret allows easy listening to all subsequent calls from that phone (or SIM) with no required cracking hardware time or access. And this is very valuable in lots of situations, such as covert operations out of hotels in foreign places where having highly classified A5 cracking boxes in tow would be a significant security risk. And for countries with GSM phone systems interested in spying on visiting diplomats, heads of state, or trade delegations who are using their GSM phones in a roaming mode and depending on the fact the GSM home switching office does not disclose their long term secret, such probing can be quietly concealed in the real traffic of a legitimate base station. The secrets recovered can then be used to crack traffic back in the visitor's home country where he may be trusting his local system to be secure. And the ability to probe the phones of visiting dignitaries from nearby hotel rooms and recover their secrets must be awfully useful to many even third rate intelligence operations - this allows listening to all their subsequent traffic without requiring an A5/1 cracking capability at all - let alone one that works real time from low cost portable units. And even if there is some sanity test in GSM phone firmware that would catch or prevent enough probes to crack the SIM secret, your physical access method allows black bag jobs to recover the SIM secret of phones left poorly guarded for a few hours. This alone is very obviously of great use to intelligence types (at least unless there is some hardware backdoor in the SIM to allow the readout in seconds rather than hours). -- Dave Emery N1PRE, die(a)die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18

1 0

woah
by ArtNoire 17 Dec '03

17 Dec '03

To: ArtNoire(a)aol.com Subject: woah From: ArtNoire <ArtNoire(a)aol.com> Date: Fri, 17 Apr 1998 00:53:09 EDT Organization: AOL (http://www.aol.com) <a href="http://members.spree.com/iconz/index.html">Click here to see my picture</a>

1 0

DataFellows wins President's Export Award
by Bill Stewart 17 Dec '03

17 Dec '03

It's nice that _some_ presidents give awards for crypto export instead of trying to stop it! ------------------------------------ http://www.datafellows.com/news/finexpo.htm 4 February 1998 The developer of F-Secure data security products, Data Fellows Ltd., has received the President of Finlands Export Award. This award is granted annually to the most outstanding export companies in the country. This is the first time a developer of commercial software packages has been granted the award. ------------------------------------------------------------------- Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

EC
by Tyrone W. Grandison 17 Dec '03

17 Dec '03

Does anyone know where I can find a compilation of E-Commerce attacks ? Any sites on conpromising EC would be a plus ..

1 0

Best Looking Sites
by rory＠rory.rory 17 Dec '03

17 Dec '03

We design & maintain the Hottest & Best looking Web Sites in the World at dirt cheap prices. - There are Millions of potential clients using the Internet - Your Business could increase incredibly - We use the Best tools to make your Site Known to Millions Make Money Now - With a WEB SITE - you have Nothing to lose For further information please go to: webmaker(a)n2mail.com

1 0