December 2003 - cypherpunks-legacy

Re: Drivers Licenses
by David Miller 17 Dec '03

17 Dec '03

Anonymous (remailer(a)htp.org) wrote: > My question is, how much information can be stored on these strips? The data that's stored on most of the cards (credit cards, hotel keys, gym cards, etc.) are encoded with 5 bits per character. I believe that this is also known as Baudot encoding. You can store somewhere around 80 characters per track on "normal" cards, and most cards contain a 1/2" magnetic stripe that can hold 4, 1/8" tracks. So, I would estimate that your drivers license would hold a total of about 320 characters on all four tracks with standard encoding techniques. If you are interested in rendering only individual tracks unreadable, it can be done. I have done it by scratching off the magnetic material as you described. Of course, all tracks run horizontally across the card, with track 1 being the track closest to the edge of the card. So, if you wanted to destroy track 1, you could scrape off the 1/8" of the strip closest to the long edge of the license. Have fun. --David Miller middle rival devil rim lad

1 0

The Latest Horiuchi Antics
by Eric Cordian 17 Dec '03

17 Dec '03

Now that the Feds have gotten the Horuichi case moved out of state jurisdiction into a federal courtroom, they want their federal judge to dismiss all charges. ----- BOISE, Idaho (AP) The federal government on Monday sought the dismissal of a state involuntary manslaughter charge against the FBI sharpshooter who killed Randy Weaver's wife at Ruby Ridge six years ago. The Justice Department petition filed in federal court argued that Lon Horiuchi was protected by the Supremacy Clause of the U.S. Constitution so he cannot be subject to state prosecution for actions in the line of duty. "It is imperative that federal officials be protected from state prosecution in such circumstances because without the protection ensured by the Supremacy Clause, rigorous enforcement of federal law would be severely chilled to the detriment of the general public good,'' the petition said. Horiuchi was among dozens of federal agents who surrounded Weaver's remote mountain cabin in the Idaho Panhandle in August 1992 in an attempt to arrest Weaver on an illegal weapons charge. Weaver's 14-year-old son, Sam, and deputy U.S. Marshal William Degan of Quincy, Mass., were killed in the gunfight that touched off the 11-day siege. Vicki Weaver was fatally shot by Horiuchi on the second day. Both Randy Weaver and family associate Kevin Harris were acquitted in 1993 of federal murder and other charges in connection with the siege. Weaver was also acquitted of the weapons charge that had prompted federal agents to confront him. Last August, five years to the day after Mrs. Weaver's death, prosecutor Denise Woodbury filed the involuntary manslaughter charge against Horiuchi. The Justice Department had earlier declined to prosecute Horiuchi. The prosecutor also charged Harris with murder in Degan's death, but that charge was dismissed on a double-jeopardy ruling. On Jan. 7, U.S. District Judge Edward Lodge moved the case to federal court. Horiuchi pleaded innocent. His trial is scheduled for March 10. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" "America is like a corrupt hard drive. It's full of virii and huge inefficient programs written in Java and Visual Basic. Whan a hard drive gets to the point that it is as screwed up as America is, it's beyond repair. America needs to be formatted."

1 0

RE: Cyber 'Nannys"
by WebWarrior3＠InfoWar.Com 17 Dec '03

17 Dec '03

An anonymous person wrote, in reference to CyberSitter type 'blocking' software: "These companies are attempting to provide the services desired by their customers... They give concerned parents a sense of safety..." While I do not disagree that these companies should be able to market their products, I wholeheartedly disagree with the fact that often their customers (the adults who bought the software or subscribed to he 'service') are not allowed to have a list of what is actually blocked, and decide for themselves if they want their kids to have access to any of these sites. It would be beating a dead horse to describe, here, the potential value of some of the information that is blocked by these packages; one only has to take a look at any of the published news reports (or actually use one's sense of reason) to see that there are many web sites that contain some of the words that are automatically bloked by these 'services' that are absolutely not...smut <for lack of a better term>, hate speech, or illegal/illicitly oriented. On another, perhaps more severe (to you, Anonymous poster,) angle, they DO NOT, NOR CAN THEY provide a genuine saftey zone for the children who are to be 'protected.' They are providing a false sense of security to parents who, for one reason or another, feel that they are not able to provide their children with direction on what to, and what not to, view on the internet as well as what to do if the instance arises that something that is deemed taboo happens to pop up on their monitor when they click on the 'Chutes and Ladders' web site <for example, I don't know if there is one...trying to be safe and guess that there is not>. I am assuming that there is no latent support for the use of these packages in public libraries, so I won't go into that issue. In general, these programs are flat out crap. They purport to do something that is impossible to accomplish and they often refuse to even inform their customers what they actually ARE doing. Scott R. Brower http://www.infowar.com http://www.efflorida.org

5 11

Algorithms used in PGP 5.x; Relative strength of Blowfish
by Alan Tu 17 Dec '03

17 Dec '03

What are the algorithms used in PGP 5.x, symetric ones, that is? For anything besides 3DES and IDEA, what are their relative strengths to 3DES or IDEA? Could someone tell me what their key lengths are? Also, what's the relative strength of Blowfish to 3DES or IDEA? Its key length is variable, as I recall. Could someone tell me the range? --Alan

2 1

Re: What's the latest in factoring?
by Alan Tu 17 Dec '03

17 Dec '03

Dear Bill, Sorry, but you may see this message twice. Bill Stewart wrote: >>>>> There are two countervailing arguments about very long keys; one is that if you understand cryptography well enough to evaluate the issue, you'll know you don't need to bother, but the other is that if you don't understand crypto very well, maybe you should be overly conservative. <<<<< Well, personally, I guess by your def I'm in the second group, since I didn't know I don't need to bother. >>>>> Remember that factoring difficulty is roughly exponential; adding logn bits about doubles the cracking workload (depending on which factoring method is being used). Factoring a 1024-bit number is _much_ harder than factoring a 512-bit number, and factoring a 2048-bit number is well into age-of-the-universe difficulty level. The practical level of factoring right now is about 512 bits, for either a distributed internet effort or an NSA internal one; <<<<< I kind of knew this from a hypothesis, so PGP 5.x is being conservative, possibly overly so by your definition. I've seen a screen on a friend's computer and the default is something like 2048. By the way, we don't know about NSA. They may be able to factor any number, if they have an algorithm. >>>>> in the unlikely event that Moore's law lets us double processing power 100 times in the next 150 years, that means a 1500-bit key could be crackable. So 2048 bits is certainly more than enough for _your_ lifetime. Increasing processing power 2**100 times is likely to be tough :-) After all, features in current microprocessors are on the order of 100 atoms wide. And by the time we've developed the level of nanotechnology needed to speed up processing that much, there'll be tiny audio bugs listening to you type your passphrase into your keyboard and reporting it back to the Central Intelligence Corporation, or picking up the electromagnetic fields from your direct neural interface, so the crypto strength won't matter much. <<<<< I believe in Moore's law, since in 1992-1993 I read an analysis that Moore's law was true for the last 100 years. I think its still true today. Your last set of thoughts is chilling, isn't it? But consider this. People 10, 20, 30 years ago like us are saying that the government can eavesdrop on their communication in the future, just as you are saying now. Look now. I am very proud that I am part of the e-crypto revolution (my coined word). I am helping to slow down NSA. I hope that, by the time the tech you hypothesize about is here, we again will have technology to slow down NSA. >>>>> But do you really _need_ to factor the prime number to crack PGP? No. Remember that PGP uses the RSA key to encrypt session keys for IDEA, or for signing MD5 hashes of documents, rather than using it directly. So you can decrypt the message by cracking IDEA, or forge a message by finding MD5 collisions. Cracking IDEA's 128-bit keys was estimated to be about as hard as factoring a 3100-bit number, though improvements to factoring technology may make a 4096-bit number as easy as IDEA. Also, PGP 2.x passphrases are encrypted with IDEA, so if they've got your secring.pgp and can crack 4096-bit keys, you're toast, <<<<< I know this. The point is that most if not all people know that RSA is the weak link, not IDEA. Would you rather start to work on a 1024-bit RSA key or IDEA passphrase of an enemy? Obviously the RSA key. Barring any mathematical weakness in IDEA, I am not worried about IDEA. By the way, my three-year-old info says that IDEA was being mathematicly attacked in many quarters, civilian and non-civilian alike. If they was anything, I would have heard by now, but I still want to ask. Has any significant cryptanalysis attack against IDEA been "successful"? >>>>> even if your passphase isn't just your dog's name spelled backwards. Similarly, by the time processing power doubles 100 times making your 1500-bit key insecure, MD5 will be long toasted. Either way, there's no need to go beyond 4096-bit keys ever, with old-style PGP. Even if you're being overly conservative, that's more than enough. <<<<< You seem to be suggesting that MD5 will lead to the downfall of all of our keys. Let's think about your toasting of MD5. The worst thing that can happen to a one-way hash function is that it can go both ways. So its dead for signatures. So let's suppose now that I can take any document and produce another document with a higher or lower dollar figure in it and come up with the same hash. I can do this easily. But to somehow exploit MD5 to crack a passphrase it is impossible because you have nothing to start working with. You only have an encrypted key, encrypted with an 128-bit IDEA key. Look, for our lifetimes, I don't see much point in going beyond 4096 bits either, maybe even 3072. >>>>> Newer versions of PGP dump RSA and IDEA for patent reasons, but they also offer alternatives to IDEA and MD5 which may be stronger. (SHA-1 is stronger than MD5, triple-DES requires immense amounts of storage to reduce it to a strength similar to IDEA, and just being extensible means you can replace algorithms that are obsolete.) <<<<< Triple-DES is not stronger than IDEA, although it is secure for the most part. According to Phil Zimmerman, its effective key length is 112 bits to 128 bits for IDEA. Its also 3 times slower than DES, which is comparably slow anyway. Also, to settle this issue once and for all in my mind, the Win95 version of PGP, what symetric algorithms do you have to choose from? Does anyone have any comments on the relative strength of Blowfish? What about the mathematics of Blowfish? Has anyone tried to cryptanalyze it yet? Also, I apologize for going on like this, I'll post a separate question on that. >>>>> The other side of practical is how much work it takes to use long keys, and how many people who want to talk to you use them. The answer to the latter is "Not many" for RSA keys over 2048. The former is about N**2 for decryption and N**3 for key generation, and about linear for encryption with short exponents, so it'll take you 64 times as long (once) to generate the key, and 16 times as long to decrypt or sign anything, compared to the far-more-than-strong-enough 2048-bit key, which is already 4 times as hard to use and 8 times as hard to generate as a 1024. <<<<< As I said, I have a 2048-bit key in hibernation. I haven't posted it to a key server, but a friend who recently got PGP decided to use my public key ring, and use my 2048-bit key. There are only two places in which this key of mine is accessible. Anyway, I don't see the 4 time slowdown for using my secret key. (I have a 133 MHz). However, the effect is probably true for slower processors. I agree that we shouldn't bother with keys above 4096 bits because its not necessary and it takes too long to communicate with people who have slower processors. >>>>> It's not worth the bother, unless you know have a really, really special application that needs to remain secret until long after you've overthrown the government. On the other hand, at least the RSA patent will have expired by then :-) <<<<< I already addressed this point. >>>>> The Diffie-Hellman implementations in PGP 5.x will let you use key lengths up to 4096, but the speed behaviour is a bit different. In particular, key generation is much faster, so generating overkill-length keys isn't as boring. <<<<< First of all, Win95 (not my computer) seems slow to me, even if that person's processor is faster than mine. And I hear so much disk reading or writing, no wonder its slow. Boring? Win95 cannot make you bored. Go do something else, or play a MIDI file. You can multi-task. --Alan

1 0

Re: 145 Million
by Anonymous 17 Dec '03

17 Dec '03

Someone wrote: >>If someone with an 8th grade >>education can make a personal >>fortune of $145 million in network >>marketing with herbs, And someone else replied: >that's a shitload of weed! it would >be quite risky too trying <sic> to >move over 45,000 lbs of quality >weed. All I can say is that if you are paying $145 for 45K pounds, you are getting ripped off no matter if it is the kindest Norhtern Lights you ever smoked. That is $18,777.78+ a pound.

1 0

King Willie:-- He's between Iraq and a Hard-On
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Well... It looks as though the 17th will be a "good day to die" if your an Iraqi...Many sources seem to be targeting the window of Feb 17 - Feb 23 for the start of hostilities... Wag the dawg... comes to mind of course... I wouldn't put it past King Willie to do such a thing to deflect attention from Peckergate.. It seems to me though that the lunatic in charge of North Korea might just find that Feb 17- 23 is also a good time to play games in the south :( after all... the worlds policeman will be preoccupied and stretched mighty thin...

1 0

CFP - Recent Advances in Intrusion Detection (RAID'98)
by Marc Dacier 17 Dec '03

17 Dec '03

Call For Participation - RAID'98 First International Workshop on the Recent Advances in Intrusion Detection September 14-15, 1998 Louvain-la-Neuve, Belgium We solicit your participation in the first International Workshop on the Recent Advances in Intrusion Detection. This workshop, the first in an anticipated annual series, will bring together leading figures from academia, government, and industry to talk about the current state of intrusion detection technologies and paradigms from the research and commercial perspectives. Research into and development of automated intrusion detection systems (IDS) has been under way for nearly 10 years. In that time, only a few systems have been widely deployed in the commercial or government arena (e.g., DIDS, NADIR, NetRanger, Stalker). All are limited in what they do. At the same time, the numerous research systems developed have been more engineering than scientific efforts, with scant quantitative performance figures. As we survey the field of automated intrusion detection, we are faced with many questions: 1) What *research* questions have yet to be answered about IDS? 2) What are the open questions, limitations, and fundamental concerns about existing intrusion detection methodologies? 3) What metrics shall we use to measure IDS performance and thus compare different IDSes? These measurements should highlight the successes and expose the limitations of current IDS approaches. 4) What factors are inhibiting transfer of research ideas into functional deployed IDSes? How can those be addressed? 5) What is the role of a deployed IDS? How should or can it fit in with other security systems? 6) What are the typical operating environments and policies in which IDSes are used? 7) What are the challenges for IDSes in very large environments, such as the Internet? 8) Is it time to be thinking about IDS standards? What are the advantages and disadvantages of standardizing components of IDS? What forums (e.g., IETF, ISO) would be appropriate for pursuing such standards? 9) What are the problems of turning the results of intrusion detection tools into legally reliable evidence? What are the problems of admissibility and of court-room presentation? We invite proposals and panels that explore these questions or any other aspect of automated intrusion detection. We especially solicit proposals and panels that address: 1) New results related to intrusion detection methodologies and technologies. 2) Innovative ways of thinking about intrusion detection; for example, the applicability of R&D in the fields of survivable and/or dependable systems, data mining, etc. 3) User experiences and lessons learned from fielded intrusion detection systems. 4) IDS for emerging computer environments (e.g., Java, CORBA, NT ). 5) Commercial intrusion detection systems. We have scheduled RAID'98 immediately before ESORICS'98, at the same time as CARDIS'98, and at the same location as both of these conferences. This provides a unique opportunity for the members of these distinct, yet related, communities to participate in all these events and meet and share ideas during joined organized external events. INSTRUCTIONS: Proposals for presentations must include a title followed by an abstract that is a maximum of 600 words in length. The presenter may include a full paper with the abstract, and will have either 15 or 30 minutes (including questions) for the talk. Panel proposals should include a title, proposed chair, tentative panelists, a description (under 300 words), format of the presentation, and short rationale for the panel. Panel sessions must fit into one hour time slots. Each proposed participant must include his or her name, organization, position, e-mail address, facsimile and telephone number, and a brief biography. All proposals must be in English. Plan to give all panels and talks in English. We must receive all proposals before June 15, 1998. We strongly prefer they be submitted by e-mail to raid98(a)zurich.ibm.com. Various formats (ASCII, postscript, Word, WordPro, Framemaker, and LaTex) are acceptable. If necessary, hardcopy proposals may be sent to: Marc Dacier Global Security Analysis Lab IBM Zurich Research Laboratory Saeumerstrasse 4, CH-8803 Rueschlikon, Switzerland IMPORTANT DATES: ---------------- Deadline for submission: June 15, 1998 Notification of acceptance or rejection: August 1, 1998 GENERAL CO-CHAIRS: ------------------ Marc Dacier (IBM Zurich Research Laboratory, Switzerland) Kathleen A. Jackson (Los Alamos National Laboratory, USA) PROGRAM COMMITTEE: ------------------ Matt Bishop (University of California at Davis, USA) Dick Brackney (National Security Agency, USA) Yves Deswarte (LAAS-CNRS & INRIA, France) Baudouin Le Charlier (Universite de Namur, Belgium) Stuart Staniford-Chen (University of California at Davis, USA) Rowena Chester (University of Tennessee, USA) Deborah Frincke (University of Idaho, USA) Tim Grance (National Institute of Standards and Technology, USA) Sokratis Katsikas (University of Athens, University of Aegeans, Greece) Jean-Jacques Quisquater (Universite Catholique de Louvain, Belgium) Mark Schneider (National Security Agency, USA) Peter Sommer (London School of Economics & Political Science, England) Steve Smaha (Trusted Information Systems, USA) Gene Spafford (Purdue University, USA) Chris Wee (University of California at Davis, USA) Kevin Ziese (WheelGroup Corporation, USA) For further information contact one of the General Co-chairs: Marc Dacier Kathleen A. Jackson IBM Zurich Research Laboratory Los Alamos National Laboratory Switzerland USA E-mail: dac(a)zurich.ibm.com E-mail: kaj(a)lanl.gov Tel.: +41-1-724-85-62 Tel.: +1-505/667-5927 Fax.: +41-1-724-89-53 Fax: +1-505/665-5220 More information will be available at: <URL:http://www.zurich.ibm.com/~dac/raid98/>. Information about ESORICS'98 is available at: ESORICS 98 home page: <http://www.dice.ucl.ac.be/esorics98> ESORICS series home page: <http://www.laas.fr/~esorics> Note: Papers and panel proposals for ESORICS'98 are due before February 28, 1998. Information about CARDIS'98 will be available at: <http://www.dice.ucl.ac.be/cardis98> -- Marc Dacier Mgr. Global Security Analysis Lab (GSAL) IBM Zurich Research Laboratory Saeumerstrasse 4 - CH-8803 Rueschlikon - Switzerland E-mail: dac(a)zurich.ibm.com Tel.:+41-1-724-85-62 Fax.:+41-1-724-89-53

1 0

How to TEMPEST for less
by Bill Frantz 17 Dec '03

17 Dec '03

>From my archives: ---------------------------------------- Preventing Electromagnetic Eavesdropping --------- NOTE: Even though the author of this document uses the term "TEMPEST" at various points, he certifies that his text consists of general concepts to reduce electromagnetic emissions, and was not based on any actual TEMPEST specifications or data. Further questions on this topic should be directed to the author, "grady(a)netcom.com". -- PRIVACY Forum Moderator --------- Abstract Eavesdropping on personal computers is not limited to looking over the shoulder of the operator or physically tapping in to an Ethernet cable. U.S. Government standards relating to the prevention of information capture via the emission of electromagnetic radiation from computers and peripherals are known as TEMPEST. However, actual TEMPEST specifications are classified. TEMPEST aside, there are inexpensive and easily applied means for individuals to minimize unintentional emissions from equipment. My document "Preventing Electromagnetic Eavesdropping," discusses these techniques. Grady Ward <grady(a)netcom.com> --------- Preventing Electromagnetic Eavesdropping A note discussing the prevention of electromagnetic eavesdropping of personal computers. Grady Ward <grady(a)netcom.com> public key verification by PK server, finger, or by request Version 1.0 22 March 93 TEMPEST is the code name for technology related to limiting unwanted electromagnetic emissions from data processing and related equipment. Its goal is to limit an opponent's capability to collect information about the internal data flow of computer equipment. Most information concerning TEMPEST specifications is classified by the United States Government and is not available for use by its citizens. The reason why TEMPEST technology is particularly important for computers and other data processing equipment is the kinds of signals components in a computer use to talk to each other ("square waves") and their clock speeds (measured in megahertz) produce a particularly rich set of unintentional signals in a wide portion of the electromagnetic spectrum. Because the spurious emissions occupy so wide a portion of that spectrum, technologies used to block one portion of the spectrum (as pulling the shades closed on a window to stop the visible light portion) are not necessarily effective in another portion. Unintentional emissions from a computer system can be captured and processed to reveal information about the target systems from simple levels of activity to even remotely copying keystrokes or capturing monitor information. It is speculated that poorly protected systems can be effectively monitored up to the order of one kilometer from the target equipment. This note will examine some practical aspects of reducing the susceptibility of your personal computer equipment to remote monitoring using easily-installed, widely available after-market components. I One way of looking at TEMPEST from the lay person's point-of-view is that it is virtually identical to the problem of preventing electromagnetic interference ("EMI") by your computer system to others' radios, televisions, or other consumer electronics. That is, preventing the emission of wide-band radio "hash" from your computers, cabling, and peripherals both prevents interference to you and your neighbors television set and limits the useful signal available to a person surreptitiously monitoring. Viewing the problem in this light, there are quite a few useful documents available form the government and elsewhere attacking this problem and providing a wealth of practical solutions and resources. Very useful for the lay person are: Radio Frequency Interference: How to Find It and Fix It. Ed Hare, KA1CV and Robert Schetgen, KU7G, editors The American Radio Relay League, Newington , CT ISBN 0-87259-375-4 (c) 1991, second printing 1992 Federal Communications Commission Interference Handbook (1991) FCC Consumers Assistance Branch Gettysburg, PA 17326 717-337-1212 and MIL-STD-188-124B in preparation (includes information on military shielding of tactical communications systems) Superintendent of Documents US Government Printing Office Washington, DC 20402 202-783-3238 Information on shielding a particular piece of consumer electronic equipment may be available from the: Electronic Industries Association (EIA) 2001 Pennsylvania Ave NW Washington, DC 20006 Preventing unintended electromagnetic emissions is a relative term. It is not feasible to reduce to zero all unintended emissions. My personal goal, for example, might be to reduce the amount and quality of spurious emission until the monitoring van a kilometer away would have to be in my front yard before it could effectively eavesdrop on my computer. Apartment dwellers with unknown neighbors only inches away (through a wall) might want to even more carefully adopt as many of the following suggestions as possible since signal available for detection decreases as approximately the inverse square of the distance from the monitoring equipment to your computer. II Start with computer equipment that meets modern standards for emission. In the United States, the "quietest" standard for computers and peripherals is known as the "class B" level. (Class A level is a less stringent standard for computers to be use in a business environment.). You want to verify that all computers and peripherals you use meet the class B standard which permits only one-tenth the power of spurious emissions than the class A standard. If you already own computer equipment with an FCC ID, you can find out which standard applies. Contact the FCC Consumers Assistance Branch at 1-717-337-1212 for details in accessing their database. Once you own good equipment, follow the manufacturer's recommendations for preserving the shielding integrity of the system. Don't operated the system with the cover off and keep "slot covers" in the back of the computer in place. III Use only shielded cable for all system interconnections. A shielded cable surrounds the core of control wires with a metal braid or foil to keep signals confined to that core. In the late seventies it was common to use unshielded cable such as "ribbon" cable to connect the computer with, say, a diskette drive. Unshielded cable acts just like an antenna for signals generated by your computer and peripherals. Most computer manufacturer supply shielded cable for use with their computers in order to meet FCC standards. Cables bought from third-parties are an unknown and should be avoided (unless you are willing to take one apart to see for yourself!) Try to avoid a "rat's nest" of wire and cabling behind your equipment and by keeping all cables as short as possible. You want to reduced the length of unintended antennas and to more easily predict the likely paths of electric and magnetic coupling from cable to cable so that it can be more effectively filtered. IV Block radiation from the power cord(s) into the house wiring. Most computers have an EMI filter built into their body where the AC line cord enters the power supply. This filter is generally insufficient to prevent substantial re-radiation of EMI voltages back into the power wiring of your house and neighborhood. To reduce the power retransmitted down the AC power cords of your equipment, plug them in to special EMI filters that are in turn plugged into the wall socket. I use a model 475-3 overvoltage and EMI filter manufactured by Industrial Communication Engineers, Ltd. P.O. Box 18495 Indianapolis, IN 46218-0495 1-800-ICE-COMM ask for their package of free information sheets (AC and other filters mentioned in this note are available from a wide variety of sources including, for example, Radio Shack. I am enthusiastic about ICE because of the "over-designed" quality of their equipment. Standard disclaimers apply.) This particular filter from ICE is specified to reduce retransmission of EMI by a factor of at least 1000 in its high-frequency design range. Although ideally every computer component using an AC line cord ought to be filtered, it is especially important for the monitor and computer CPU to be filtered in this manner as the most useful information available to opponents is believed to come from these sources. V Block retransmitted information from entering your fax/modem or telephone line. Telephone line is generally very poorly shielded. EMI from your computer can be retransmitted directly into the phone line through your modem or can be unintentionally picked up by the magnetic portion of the EMI spectrum through magnetic induction from power supplies or the yoke of your cathode ray tube "CRT" monitor. To prevent direct retransmission, EMI filters are specifically designed for modular telephone jacks to mount at the telephone or modem, and for mounting directly at the service entrance to the house. Sources of well-designed telephone-line filter products include ICE (address above) and K-COM Box 82 Randolph, OH 44265 216-325-2110 Your phone company or telephone manufacturer may be able to supply you with free modular filters, although the design frequencies of these filters may not be high enough to be effective through much of the EMI spectrum of interest. Keep telephone lines away from power supplies of computers or peripherals and the rear of CRTs: the magnetic field often associated with those device can inductively transfer to unshielded lines just as if the telephone line were directly electrically connected to them. Since this kind of coupling decreases rapidly with distance, this kind of magnetic induction can be virtually eliminated by keeping as much distance (several feet or more) as possible between the power supply/monitor yoke and cabling. VI Use ferrite toroids and split beads to prevent EMI from escaping on the surface of your cables. Ferrites are magnetic materials that, for certain ranges of EMI frequencies, attenuate the EMI by causing it to spend itself in heat in the material rather than continuing down the cable. They can be applied without cutting the cable by snapping together a "split bead" form over a thick cable such as a power cord or by threading thinner cable such as telephone several times around the donut-shaped ferrite form. Every cable leaving your monitor, computer, mouse, keyboard, and other computer peripherals should have at least one ferrite core attentuator. Don't forget the telephone lines from your fax, modem, telephone or the unshielded DC power cord to your modem. Ferrites are applied as close to the EMI emitting device as possible so as to afford the least amount of cable that can act as an antenna for the EMI. Good sources for ferrite split beads and toroids include Amidon Associates, Inc. P.O. Box 956 Torrance, CA 90508 310-763-5770 (ask for their free information sheet) Palomar Engineers P.O. Box 462222 Escondido, CA 92046 619-747-3343 (ask for their free RFI information sheet) and Radio Shack. VII Other practical remedies. Other remedies that are somewhat more difficult to correctly apply include providing a good EMI "ground" shield for your computer equipment and other more intrusive filters such as bypass capacitor filters. You probably ought not to think about adding bypass capacitors unless you are familiar with electronic circuits and digital design. While quite effective, added improperly to the motherboard or cabling of a computer they can "smooth out" the square wave digital waveform -- perhaps to the extent that signals are interpreted erroneously causing mysterious "crashes" of your system. In other cases, bypass capacitors can cause unwanted parasitic oscillation on the transistorized output drivers of certain circuits which could damage or destroy those circuits in the computer or peripherals. Also, unlike ferrite toroids, adding capacitors requires actually physically splicing them in or soldering them into circuits. This opens up the possibility of electric shock, damage to other electronic components or voiding the warranty on the computer equipment. A good EMI ground is difficult to achieve. Unlike an electrical safety ground, such as the third wire in a three-wire AC power system, the EMI ground must operate effectively over a much wider part of the EMI spectrum. This effectiveness is related to a quality known as electrical impedance. You desire to reduce the impedance to as low a value as possible over the entire range of EMI frequencies. Unlike the AC safety ground, important factors in achieving low impedance include having as short a lead from the equipment to a good EMI earth ground as possible (must be just a few feet); the gauge of the connecting lead (the best EMI ground lead is not wire but woven grounding "strap" or wide copper flashing sheets; and the physical coupling of the EMI into the actual earth ground. An 8 ft. copper-plated ground may be fine for AC safety ground, but may present appreciable impedance resistance to an EMI voltage. Much better would be to connect a network of six to eight copper pipes arranged in a six-foot diameter circle driven in a foot or two into the ground, electrically bonded together with heavy ground strap and connected to the equipment to be grounded via a short (at most, several feet), heavy (at least 3/4-1" wide) ground strap. If you can achieve a good EMI ground, then further shielding possibilities open up for you such as surrounding your monitor and computer equipment in a wire-screen Faraday cage. You want to use mesh rather than solid sheet because you must preserve the free flow of cooling air to your equipment. Buy aluminum (not nylon) screen netting at your local hardware store. This netting typically comes in rolls 36" wide by several feet long. Completely surround your equipment you want to reduce the EMI being careful to make good electrical bonds between the different panels of netting and your good earth ground. I use stainless steel nuts, bolts, and lock washers along with special non-oxidizing electrical paste (available from Electrical contractors supply houses or from ICE) to secure my ground strapping to my net "cages". A good Faraday cage will add several orders of magnitude of EMI attenuation to your system. VIII Checking the effectiveness of your work. It is easy to get a general feeling about the effectiveness of your EMI shielding work with an ordinary portable AM radio. Bring it very close to the body of your computer and its cables in turn. Ideally, you should not hear an increased level of static. If you do hear relatively more at one cable than at another, apply more ferrite split beads or obtain better shielded cable for this component. The practice of determining what kind of operating system code is executing by listening to a nearby AM radio is definitely obsolete for an well-shielded EMI-proof system! To get an idea of the power and scope of your magnetic field emissions, an ordinary compass is quite sensitive in detecting fields. Bring a compass within a few inches of the back of your monitor and see whether it is deflected. Notice that the amount of deflection decreases rapidly with distance. You want to keep cables away from magnetic sources about as far as required not to see an appreciable deflection on the compass. VIIII Summary If you start with good, shielded equipment that has passed the FCC level B emission standard then you are off to a great start. You may even be able to do even better with stock OEM equipment by specifying "low-emission" monitors that have recently come on the market in response to consumer fears of extremely low frequency ("ELF") and other electromagnetic radiation. Consistently use shielded cables, apply filtering and ferrite toroids to all cabling entering or leaving your computer equipment. Finally, consider a good EMI ground and Faraday cages. Beyond this there are even more effective means of confining the electrical and magnetic components of your system through the use of copper foil adhesive tapes, conductive paint sprays, "mu metal" and other less common components. Copyright (c) 1993 by Grady Ward. All Rights Reserved. Permission is granted for free electronic distribution. ------------------------------------------------------------------------- Bill Frantz | Market research shows the | Periwinkle -- Consulting (408)356-8506 | average customer has one | 16345 Englewood Ave. frantz(a)netcom.com | teat and one testicle. | Los Gatos, CA 95032, USA

1 0

Vulis is asking for it
by Information Security 17 Dec '03

17 Dec '03

> From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > A psychopath like Guy Polis could just call a TV station and claim that > he put some poison in the water supply which would take a few days to > test for. > I recall that there was a bunch of bomb threates at Salomon Brothers last > year, right after Guy Polis was fired from his contractor job. Do you > suppose the psychotic pedophile did it? > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps Your continued defamation is going to get you in a lot of trouble. Cease it now, asshole. Or you'll be the next Tawana Brawley defamation trial. > From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > # Guy Polis (guy(a)panix.com, eviljay(a)bway.net) is a pedophile child ^^^^^^^^^^^^^ > # molester who was fired from his consulting position at Salomon Brothers > # after he was caught masturbating in his cubicle at the child pornography > # JPEGs that he downloaded from the Internet. > # > # In retaliation, Guy Polis spammed the firewalls mailing list with megabytes > # of e-mail logs that he "intercepted" at Salomon Brothers, and accused > # several of his former co-workers and supervisors of various crimes. > # > # As far as I can determine, Guy Polis has been unemployed since the time > # he was fired from Salomon. If anyone knows otherwise, please let me know. Besides the obvious, you've got _everything_ wrong. o I was not fired o I am not a psychopath o I did not download child porno o I am not AIDS-infected o I am not a faggot o I have been continuously employed since completing my Salomon contract o no one (name them) at Salomon or any other firm has stated otherwise. o I am not a pedophile You'd better stop lying. ---guy Don't cross the line again.

1 0