December 2003 - cypherpunks-legacy

Re: CIA@funet.fi ?
by Graham Toal 17 Dec '03

17 Dec '03

: From: paulj(a)xs4all.hacktic.nl (Paul Jongsma) : Well don't think the funet.fi one is a CIA setup, but i know for sure that : anon(a)hacktic.nl isn't..... The trouble with the cypherpunk remailers is there isn't a single one of them I'd trust. The overwhelming credo of the sort of person I've met in this area is that they want extreme absolute privacy for *themselves* but sneak and spy on everything they possibly can about everyone else. (Oops - that sounds bad - I don't specifically mean the people who run cypherpunk remailers; I mean people who're obsessive about secrecy in general and hackers in particular. Secretive hackers being the worst.) And you can take it as read that every remailer will be logged by the Black Hats too. Only double-blinded *encrypted* remailing is going to have any chance of maintaining secrecy, and then only if you go out of your way to explicitly chain round dozens of remailers in the hope of finding *one* that isn't compromised. (And that, only if all the remailers are regularly spoofing traffic between themselves to foil traffic analysis) G

3 2

Loompanics: SECRETS OF A SUPER HACKER
by walter kehowski 17 Dec '03

17 Dec '03

Cypherpunks: I recently received the recent Loompanics catalog and read the review of SECRETS OF A SUPER HACKER in it. I wondered if the book was just hype ("Approaching Zero" comes to mind) so I'm glad to read in Timothy May's "Books, Loompanics, and other weird stuff" that the book might actually be worth reading. I've appended the review. Thanks, tcmay! Walter A. Kehowski <wak(a)next0.math.pitt.edu> ###################################### SECRETS OF A SUPER HACKER by The Knightmare, introduction by Gareth Branwyn, 205 pp., 8 1/2" x 11", ISBN 1-55950-106-5, March, 1994, Loompanics Unlimited, Box 1197, Port Townsend WA, 98368. Price: $19.95 plus $4.00 for shipping (includes a copy of their must-have 280 page catalog of unusual books). Credit card orders to 206-385-2230 (phone) or 206-385-7785 (fax). This is a very good practical book on breaking into computer systems. It's readable, interesting, informative, balanced, and accurate, with a nice spirit of fun and swashbuckling! Here's the contents: Introduction: Hackers: Heroes or Villains? I: The Basics II: The History of Hacking III: Researching the Hack IV: Passwords and Access Control V: Social Engineering VI: Reverse Social Engineering VII: Public Access Computers and Terminals VIII: On-Site Hacking: The Tresspasser-Hacker IX: Hacking at Hope: Dialing Up Computers With Your Modem X: Electronic Bulletin Board Systems XI: Borderline Hacking XII: What To Do When Inside XIII: This Lawful Land XIV: Hacker Security: How To Keep From Getting Caught XV: Conclusion Further Reading Glossary 8 Appendices The Knightmare covers lots of clever technical tricks for gaining access, but he shows most glee with scores of hilarious "Social Engineering" scams for seducing legitimate users into revealing their passwords. The striking thing about these spoofs is, just reading them, you realize through the laughter how often these simple Social Engineering techniques will produce results and how the credulity of non-security- minded naive users is the weak point of any security system. Sometimes while reading, I wished the book provided more specific info about phone numbers, brand names, specific techniques that work on specific bulletin board systems, etc. But I recognize that such information would go quickly out-of-date, or would be fixed in response to the book's publication, or could implicate the author. The Knightmare is presenting concepts that won't go out-of-date soon, giving the interested non-hacker a comprehensive and comprehensible survey of the field, and tipping off the potential hacker with just enough details to get him/her started and steered in the right direction and minimize the chance of getting caught. On this final point... a few times during the early chapters I thought The Knightmare was being cavalier about personal safety, favorably reporting (for example) Social Engineering advertizing scams that would likely bring the cops to one's doorstep. But The Knightmare was saving his warnings for 2 chapters towards the end, 22 sobering pages that make very clear the risks involved and what definitely NOT to do. A very balanced presentation. As usual with Loompanics books, this one can be read backwards, and pages 167-168 are directed specifically to System Administrators interested in beefing up security. I also appreciated all the hacker philosophy and pragmatic do-no-damage hacker ethics. The Knightmare disdains and derides "crackers" who break into a system in order to wreak havok; for him, "hackers" are peaceable, non- destructive puzzle-solvers and liberators of information. In a world where the govco is ever working to extend and centralize its control over financial data, encryption techniques, cyberspace, and every aspect of people's lives, the hacker may emerge as a modern-day Robin Hood.

1 0

Re: CIA@funet.fi ?
by Black Unicorn 17 Dec '03

17 Dec '03

Graham Toal cypherpunk regular said: The trouble with the cypherpunk remailers is there isn't a single one of them I'd trust. The overwhelming credo of the sort of person I've met in this area is that they want extreme absolute privacy for *themselves* but sneak and spy on everything they possibly can about everyone else. (Oops - that sounds bad - I don't specifically mean the people who run cypherpunk remailers; I mean people who're obsessive about secrecy in general and hackers in particular. Secretive hackers being the worst.) <- It's interesting to me how double standardized (is that a phrase in english?) the concept of privacy is in general. One seems to have to do some snooping to make sure one's privacy and security is assured. In doing so one is invading the privacy of others. I have met very few privacy purists. Most tend to feel that privacy is not a general responsibility of the collective to assure. The collective in this sense is either the government, or the people as a whole. Phrased another way, most of the privacy advocates I have met and discussed with seem to feel that what is not protected is fair game. They lay the burden on the individual to secure his/her own privacy and scowl at those who are too lazy to do it. (note that this message isn't signed because I'm too lazy to do it) In addition they seem to snarl at any attempts to collectivze privacy and make it a function of government to enforce privacy on the ground that there exists a conflict of interest. Unfortunately, while there exist SOME tools for the individual today to provide for his or her own privacy, (stong encryption) many of the other tools are provided by smaller collectives. (the remailers for example) Indeed it is a collective of perhaps 2 (the operator of the mailer and the system admin if seperate) but a collective none the less and one which the user must rely on. Are remailers then a departure from the "secure your own privacy" doctrine? It stands to reason that all remailers should provide for double blind double encrypted remailing. (Provided you subscribe to the theory, ) Just as a side note, I tend to think that laying the burden on the individual is the best approach. -uni- (Dark)

1 0

PC Week article
by Giuseppe Cimmino 17 Dec '03

17 Dec '03

Copyright (c) PC Week - Reproduced without permission Volume 11, Number 10 - March 14, 1994 Jim Seymour's column The Corporate Micro Businesses would be Clipper victims, too This Clipper-chip stuff is getting out of hand. A manifestly bad idea that seemed likely to sink of its own weight has taken on a life of its own as government officials offer ever more specious arguments for its desirability. Many corporate computing managers tell me they haven't thought about Clipper much, because they aren't interested in politics. That's naive. Ignore this one at your own - and at your company's - very substantial risk. In case you've been on Mars for the past few months, the Clinton administration is pushing for adoption of a data-encryption standard using an embedded chip in every piece of communications equipment. Decryption by any entity other than the intended recipient of the data would be impossible - except by the government, under strict limitations: The necessary keys would be held in trust by a government agency, which would deliver them to a law enforcement agency only after issuance of a court order based on probable cause. The government expects that by requiring Clipper chips in every piece of communications equipment it buys, Clipper chips will become ubiquitous. There is also talk about barring data that is not encrypted by the Clipper standard from any national information superhighway, further assuring its universal use. Uncle Sam assures us this is the best ever data-security system and that we have nothing to worry about from government snooping which just wouldn't happen. This whole proposition is so ludicrous that it seemed unlikely to make it to the congressional hearings on a new telecom act. But it did, and now our servants in Washington are considering making this the law of the land. Which has led to the spectacle of FBI Director George Orwell - oops, make that Louis Freech - saying that Americans should be willing to give up some of their freedoms to become more secure. What's next, Lou, viewscreens in every room? Organizations from Computer Professionals for Social Responsibility to Wired magazine are sponsoring petitions and letter-writing campaigns to try to end this craziness. You can't get on the Internet these days without being asked to sign a petition. All that is well and good; the personal-privacy arguments are powerful and appropriate. But in the flag-waiving over potential government snooping, we're missing a compelling business argument against the Clipper standard. If the image of Uncle Sam as a snoop doesn't move you to action, maybe this one will. Say Clipper becomes the standard and your company's electronic communication is Clipperized. How secure from interception and decoding by competitors do you think your data will be? Beyond the press-release smoke about how limited access to Clipper decryption keys will be, the fact is that ordinary people will be responsible for safeguarding them. And people can be bribed, and can take impetuous and spiteful actions. It's not a question of whether a scandal will erupt when critical and highly confidential corporate information is invaded - only how long it will be before that happens. You and I break our backs devising super-secure communications systems. Our livelihoods depend upon our expertise and commitment to that goal. Do you really want to undermine that work and commitment with this kind of insane back-door risk? Jim Seymour can be reached via MCI Mail at 336-5687.

1 0

Re: spyproofing your house/work building
by System Operator 17 Dec '03

17 Dec '03

"Perry E. Metzger" <anagld!lehman.com!pmetzger> writes: > > Make sure the drapes block IR. There are instances of even local > > police forces flooding the front of a house with IR light, > > You mean heat? What did they do, exactly? Erect giant heat lamps in > front of the house? No one inside noticed either? This is getting rather far afield, but I'll answer: Light sources to generate usable IR aren't any larger than visible systems, and do not generate the amounts of heat you're imagining. These aren't Kentucky Fried Chicken food warmers. Pick any of several security industry magazines and you'll find many advertisements for "undetectable" (in the sense of being visible to the naked eye) IR surveillance systems. Even the FLIR systems mounted on police observation helicopters (Ft. Worth being the most notable user) are easily mounted inside a van or delivery truck. >From the literature I have, the British SAS have long used this observation method immediately prior to initiating hostage rescue. It will be interesting to see if any "peeping tom" cases come out of the large amount of Soviet night vision gear now available, relatively cheaply, to civilians. Due to it's low price, it has also become popular with local police departments. Even the town I went to high school in, population 10,000, has some night vision gear. Dan -- system(a)decode.UUCP (System Operator) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

3 2

Re: PowerMacPGP
by Derek Atkins 17 Dec '03

17 Dec '03

Forwarded with permission. ;-) FYI: I saw a Power PC yesterday, and asked about running standard Mac Apps, and was told it would do it, but not get the Power PC speedups... -derek ------- Forwarded Message Date: Mon, 14 Mar 1994 17:10:42 -0800 Message-Id: <199403150110.RAA26805(a)mail.netcom.com> Mime-Version: 1.0 To: Derek Atkins <warlord(a)MIT.EDU> From: plaz(a)netcom.com (Plaz) Subject: Re: PowerMacPGP Derek Atkins <warlord(a)MIT.EDU> replies to someone. >> Does anyone know if Mr. Zimmerman or anyone else will be writing a >> Power Macint -osh PGP porgram. What about the other popular >> encryption programs. Thanks, > >The source code is available. If you have a C compiler, it shouldn't >be very hard to build. Then again its a Macintosh, so who really >knows? I don't expect to see Phil to do it, since Phil hasn't done >any coding for PGP. Also, I don't think that PowerMacs are prominent >enough for developers to have them, yet. I am 99.9% certain that MacPGP will run on a PowerMac, in emulation mode. Some time soon someone will get around to recompiling for native mode. For the original poster: PowerMac is supposed to run all Macintosh OS based programs, right out of the box. No porting of the programs is required. They run slower than native apps, but they run as fast as they would on most Macs now. _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 ------- End of Forwarded Message

1 0

Reinterpretation Reprised
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Jim choate: As to putting them all together, you do a diservice in my eyes. They did not occur together and they certainly did not occur in the same social milieu that the Civil War or the Vietnam War - Civil Disobedience did. There were national events that effected every person. The events that you refer to were local events that eventually effected every person on a national scale. Slightly different animals. ............................................................. Do you mean that a Majority Happening is the only thing which is important in your eyes? That the individual is insignificant when s/he is affected by legislation on a personal basis? That if only one person feels discomfitted by it then it's no big deal because no one else has realized that they've been violated? That life, liberty & the pursuit of happiness is only important when carried out by large groups? That the standard of Good Government is a National Event rather than the quality of individual existence? That a Rose by any other name or any lesser multiplicand is not a rose? Blanc

2 1

my improved anonymous remailer
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

Cypherpunks, Seeing as how everyone else is announcing their anonymous remailers, I may as well announce mine which is nearing completion. The remailer is written in Knuth's WEB using Perl so there is nice documentation. The remailer includes among other things, virtual addresses (handles), padding/packetizing messages (splitting them up and sending pieces through multiple remailer chains), chaining, mixing, a key-server, a list of remailers server, a socket-server to bypass the sendmail queue and get immediate error return, a stealth mode (delivery via direct SMTP or socket instead of through the local sendmail), secure remailer network (remailers sign and encrypt chained messages between each other), fake remailer traffic, and other small features. The virtual handles are fairly secure. They can be stored in the database as either plaintext real email addresses, virtual addresses located elsewhere on the remailer network, or SAEE cypherpunk remailer blocks (self-addressed encrypted envelope) The following text is taken from the WEB document and contains some addition information. Send any comments you have to me, rjc(a)gnu.ai.mit.edu -Ray p.s. I expect that it will be ready for beta release in about two weeks. At that point, I would need some beta testers to set up a remailer network to make sure the socket-based and e-mail based networking works (especially the packetizing) p.p.s. e-mail commands are of the same form as the extropian's mailing list, backwards compatibility with the cypherpunks pasting token is not supported. Why? All headers in the message are ignored (and in socket-mode, there is no header anyway) and the prefered mode of operation is to encrypt the body and the commands so no outside eyes can see the remail request destination nor the message subject. ------------------------------CUT HERE--------------------------------------- \documentstyle{article} \title{Remailer 2.0 \\ An Improved Anonymous Remailer} \author{Ray Cromwell \\ rjc@@gnu.ai.mit.edu} \date{March 1, 1994} %$Id: remailer.w,v 0.2 94/03/01 03:22:27 rcromw1 Exp $ \newcommand{\rem}{{\tt Remailer 2.0\ }} \begin{document} \maketitle \tableofcontents \section{Introduction} The following text describes an improved anonymous remailer based on suggestions Tim May made on the cypherpunks\footnote{Send subscription requests to cypherpunks-request@@toad.com} mailing list a few weeks ago. I was stuck in the middle of school work and the {\em Extropians List Software} when Tim made the anouncement, but I had plenty of ideas on how to implement and improve remailers. So here at last is the result of my hacking. \begin{center} {\Large Remailer Improvement Principles} \begin{itemize} \item Secure Virtual Addresses \item Chaining \item Mix Delays \item Fake Remailer Traffic \item Padding/Packetizing Messages \item Builtin Remailer List Generation \item Builtin Public Key Server \item Socket Operation \item Stealth on Multiuser Systems \item Open Design \item Simple ``.forward'' Mode Operation \end{itemize} \end{center} [...] \subsubsection{Socket Mode} Socket mode provides a more secure form of operation by bypassing the standard sendmail delivery mechanism allowing a message to be piped directly to the remailer. In addition, the socket mode remailer functions as an information server allowing clients to request a publically networked list of public keys and up-to-date list of \rem servers. The port number can be anything but I'm suggesting we all agree to use port 2258. Upon connection to the remailer port, a greeting message will be sent to you of the following form. On the first line is a general greeting message which can be any string. On the next line is status information separated by ``/''. The status information in order is: \verb|remailer_name|, version, administrator e-mail address, and finally a list of flags. The flags are single character upper case letters specifying the following options. {\bf P} to specify that the machine is privately owned and single-user, {\bf M} for mixing enabled, {\bf C} for chaining, {\bf K} if the keyserver is turned on, {\bf E} if this remailer only accepts encrypted messages, and {\bf S} if stealth mode is on. \begin{center} \begin{verbatim} Example: telnet remailer.nsa.gov 2258 Connected to remailer.nsa.gov Escape character is '^]' Greetings, Welcome to Billy Bob Jake's Super Deluxe Remailer! bob_remailer/Version 1.1/bob@@remailer.nsa.gov/PMCKESF \end{verbatim} \end{center} While connected, entering {\bf list} for example, would get you a list of remailers, or {\bf keys} for an index of keys. You can also remail at this point and even get an error status. [...] \subsection{Reading and Writing the Remailer List} The remailer list is a simple text file which consists of a list of lines each containing a \verb|remailer_name|, ':', the e-mail address of the remailer, the flags for that remailer, and a timestamp recording the last time a response was received from this remailer. Each field is separated by a comma. `\#' Comments and null lines are allowed. A visible comment can be attached to a remailer by using the form ``\verb|remailer_name|\%comment string'' Additional comments to the same \verb|remailer_name| are concatenated. [...] \begin{verbatim} Example: ann's remailer: ann_remailer@@host.domain,PKCMS,77676734 ann's remailer% My remailer is special because my machine has ann's remailer% TEMPEST shielding around it. It can also self destruct ann's remailer% in the event of an NSA raid. \end{verbatim} \subsection{Database Functions} \rem uses a dbm database to record information neccessary to implement ``Virtual Addresses'' These are penet\footnote{`penet' refers to the anonymous posting service running at \verb|anon.penet.fi|. Send mail to \verb|help@@anon.penet.fi| for information.} style handles used by the anonymous remailer network to allow easy addressibility to anonymous recipients without the complication of anonymous encrypted return address blocks. Each record in the virtual database is keyed by the handle in the virtual address itself. A record contains 3 fields right now. The first is the storage method, the second is the user address connected with the handle. The third is a timestamp revealing the last time this address was used. Later, a fourth record might be added for electronic postage. [...] \subsubsection{Virtual Addresses, A Side Note} Virtual Addresses consist of a {\bf user handle} and an optional {\bf remailer name} separated by `{\bf \#}' I used `\#' because I wanted to differentiate virtual addresses from internet style addresses. An example of a virtual address is ``darkmodem\#deepanon'' which means that the message should be sent to the user connected with the handle ``darkmodem'' through the remailer named ``deepanon'' You can chain your own remailers by simply adding multiple remailer names to the virtual address. For example, ``user\#remailer1\#remailer2\#remailer3'' which will send the message first through remailer1, then remailer2, then remailer 3, and finally to whoever happens to be connected with ``user''. A special remailer name ``*'' is provided. Each instance of ``*'' in a remailer chain will be replaced by a random remailer. For example, ``darkmodem\#*#*#deepanon'' will first chain the message through two random remailers and then finally to deepanon. The random remailers chosen are not guaranteed to be unique. [...] \section{Change History} \begin{verbatim} $Log: remailer.w,v $ Revision 0.2 94/03/01 03:22:27 rcromw1 prerelease \end{verbatim} \section{Identifier Index} @u \end{document} ----------------------------------------------------------------------------- -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0

NTIA on NII
by peace＠BIX.com 17 Dec '03

17 Dec '03

The follow should be of some interest - possibly some action Peace .. - - - Subject: NTIA INQUIRY ON PRIVACY ISSUES Date: Tue, 15 Mar 94 17:10:46 EST Marshall Abrams brought to our attention the following notice which appeared on the NTIA Bulletin Board. NOTE EXTENSION: The March 11 issue of NII NEWS states that the March 14 deadline in this notice has been extended to March 30. ++++++++++++++++++++++++++++++++++++++++++++++++++ CONTACT: Larry Williams (202) 482-1551 NTIA RELEASES NOTICE OF INQUIRY ON PRIVACY ISSUES TECHNICAL NEWS ADVISORY The National Telecommunications and Information Administration (NTIA) is undertaking a comprehensive review of privacy issues relating to private sector use of telecommunications-related personal information associated with the National Information Infrastructure (NII). Public comment is requested on issues relevant to such a review. After analyzing the comments, NTIA will issue a report and make recommendations as needed. The inquiry will focus on potential uses of personal information generated by electronic communications, including interactive multimedia, cable television and telephony. NTIA is studying the issues that arise when such telecommunications-related information is used to create detailed dossiers about individuals. NTIA seeks to determine whether any overarching privacy principles can be developed that would apply to all firms in the telecommunications sector. In addition, NTIA is soliciting comment on other countries' actions to ensure the privacy of information transmitted over telecommunications networks, and to ascertain how any U.S. policies in this area will affect the international arena. The Notice of Inquiry and Request for Comments will appear in Part IX of the February 11, 1994, Federal Register and will also be available on the NTIA Bulletin Board at (202) 482-1199. Set communications parameters to no parity, 8 data bits and 1 stop. Comments should be filed on or before March 14, 1994. If you have further questions, please contact Carol E. Mattey or Lisa I. Leidig at the Office of Policy Analysis and Development, NTIA, 202-482-1880.

1 0

IR Blocking.
by Peter Murphy 17 Dec '03

17 Dec '03

One idea that I thought about is to simply use frosted glass. The police/ /FBI/CIA/other using the IR cameras don't just want to recieve IR light; they want it in a coherent pattern. Using frosted glass, the light is dispersed in (mostly) all directions. The spooks should then only be able to percieve some fuzzy shapes. Oh, they'll be able to know if the lights are on, but for all they know, you are just having a quiet game of bridge. (I am not absolutely certain about the va .. veracity of this method, but I gathered that if frosted glass disperses normal light, it should do the same for IR. The range of refractive indices would be different, and that's about it.) Any criticisms of this method would be appreciated. Peter Murphy.

4 3