December 2003 - cypherpunks-legacy

Re: Identity
by nobody＠rahul.net 17 Dec '03

17 Dec '03

sorr(a)eznet.net wrote: > To whomever: > I'm a reporter at the daily newspapers in Rochester, N.Y., researching a > story on the recent spate of IP-spoof hack events. Supposedly a toad.com > address was used by a person who broke into the San Diego supercomputer center > a month ago. What's toad.com? I got your name from a web search that found an > old communique. > Can you be any help? I'm simply trying to reconstruct what happened. > Steve Orr > Gannett Rochester Newspapers Fuck Gannett.

4 3

anonymous IRC access....
by Vinod Valloppillil 17 Dec '03

17 Dec '03

Is there anyway to get anon irc access? there used to be a way to get it a couple of years ago but I can't find any ways to do it now.... sounds like a problem for cypherpunks.. ------------------------------+----------------------------------------------- Vinod Valloppillil | LibertarianismTelecommunicationsFreeMarketEnvi Engineering/Wharton | ronmentalismTechnologyExtropianismElectronicCa University of Pennsylvania | shInteractiveTelevisionEconomicsPhilosophyDigi vvallopp(a)eniac.seas.upenn.edu | talPrivacyAnarchoCapitalismRuggedIndividualism ------------------------------+-----------------------------------------------

2 1

(Fwd) Information Superhighway - GAO Report
by Richard F. Dutcher 17 Dec '03

17 Dec '03

Old news, I'm sure, but certain to be cited in the legal & regulatory debates ... ------- Forwarded Message Follows ------- Date: Wed, 25 Jan 1995 11:49:42 EST Reply-to: gao-docs <gao-docs(a)MAILHOST.GAO.GOV> From: gao-docs <gao-docs(a)MAILHOST.GAO.GOV> Subject: Information Superhighway - GAO Report To: Multiple recipients of list PUBPOL-L <PUBPOL-L(a)UMINN1.BITNET> GAO Report - Information Superhighway The U.S. General Accounting Office, the Congressional watchdog agency, has recently released the following report: *** ASCII Full Text Access and Ordering Info Follows *** TITLE: Information Superhighway: An Overview of Technology Challenges RPTNO: AIMD-95-23 DOCUMENT DATE: 01/23/95 BACKGROUND: GAO reviewed the technical issues associated with protecting the information superhighway from unauthorized access. FINDINGS: GAO found that: (1) the information superhighway poses technical challenges concerning the security, privacy, and reliability of personal and proprietary information; (2) a large proportion of the information that will traverse the superhighway will be sensitive and a tempting target for hackers, foreign governments conducting political and military intelligence operations, domestic and foreign enterprises engaged in industrial espionage, or terrorist groups seeking to disrupt society or the economy; (3) significant effort will be needed to define, develop, test, and implement measures to prevent unauthorized access to the superhighway; (4) although the federal government could play a leading role in ensuring the superhighway's security, critics argue that individuals should be free to choose the technical means for meeting their security requirements; (5) a major challenge facing the development of the information superhighway will be creating a consensus between the federal government, computer and communications industry, business community, and civil liberties groups on how to ensure information security and privacy; (6) federal and private sectors have begun establishing uniform standards to ensure the superhighway's interoperability; and (7) questions remain about how to protect the superhighway from large network failures and encourage the telecommunications industry to develop a secure and reliable infrastructure. *************************************************************** This report is available both in print and electronically. *************************************************************** [junk deleted] ***************** ELECTRONIC ORDER INFORMATION **************** To access GAO reports as FULL TEXT ASCII electronic files from the Government Printing Office (GPO) BBS, follow these steps: 1) TELNET to <federal.bbs.gpo.gov> and designate "port 3001" or dial 202-512-1387 (Menu Selection #22 on FEDWORLD); (***NOTE*** Depending on how your system accesses the TELNET feature, you may need to TELNET to this address: <federal.bbs.gpo.gov 3001> ^^^^^ and hit return a few times after connecting. You should receive a greeting screen. If you receive a prompt for "PASSWORD", something is wrong. Either re-try or contact GPO at the phone number below.) 2) Log in or register on system (type: "NEW" if first time user); 3) From the Main Menu, select "File Library System - 6"; 4) Select "S - Select Library"; 5) Type: "GAO_RPTS"; 6) Select file name: Information Superhighway: AI95023.TXT ***************************************************************** Any questions on using the GPO system should be referred to GPO at 202-512-1530. Please do NOT use this e-mail address for questions about the GPO system or for ordering reports. GPO charges a fee to download each file. Exact costs are listed on the GPO system. NOTE: All Federal Depository Libraries are authorized to download files at no charge. FDL's must first be registered on the GPO system in order to be authorized free download access. **************************************************************** PRINTED COPY ORDER INFORMATION Printed copies via U.S. Mail are also available by calling 202-512-6000 (TDD number is 301-413-0006), sending a FAX to 301-258-4066, or by writing to: P.O. Box 6015, Gaithersburg, MD 20884-6015. Please include the report number and complete postal mailing information in your request. Telephone requests can be made 24 hours a day, seven days a week. During non-business hours, leave a voice mail message with complete information, including the report number and postal mailing information. Copies may also be picked up at the GAO headquarters at: 700 - 4th St., NW, Washington, DC. Sorry, we are NOT able to accept electronic orders for printed documents at this time. The first printed copy is FREE of charge. Additional copies are $2.00. **************************************************************** [more junk deleted] Please forward comments and suggestions to: <gao-docs(a)gao.gov> Thank you. *************************************************************** Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ...

1 0

RE:sorr
by KJC＠cityscape.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- sorr(a)eznet.net wrote: > To whomever: > I'm a reporter at the daily newspapers in Rochester, N.Y., researching a > story on the recent spate of IP-spoof hack events. Supposedly a toad.com > address was used by a person who broke into the San Diego supercomputer center > a month ago. What's toad.com? ....I'm simply trying to reconstruct.. someone wrote anonymously: > Fuck Gannett. L. Futplex McCarthy wrote: >This belongs in private email, assuming that isolated epithets are worth sharing with anyone outside your primal scream therapy group. Are you related to Detweiler, perchance ? etc,etc. Yep - A shame about being anonymous...because it was succinctly put - but explanations to Steve Orr unnecessary - surely? Nevertheless, I'm glad it was said, Keith Cross -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLycKfhZrmpTDhsYFAQHxpgQApvnrBVvnR6CzwF9t5dPYnsPu+laI3Q50 xNTdC3GInnBUXWscf9V/5mPETFUC8Pv+YG+umwHP1fxsnVG+yooRQvy7Vh4gyqvK zB64Jsc+HLLRiee1vnczZ0kaBZJn6ajCzmGpJ1Q5Pof+GD4OirO9pZAAeUz88tPv 2EIFOxuT8z0= =c7cc -----END PGP SIGNATURE-----

2 1

Remailer
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Louis Cypher (alt.anonymous.messages) In this message I will analyze message reordering in remailers, and traffic analysis in remailer webs. Remailers which immediately resend incoming messages provide no security against an attacker who is able to watch all traffic to and from the remailer. Two proposals have been suggested to solve this problem, latency and reordering. In recent discussions, the consensus was that message reordering was superior to (and the actual intent of) latency. Reordering is not sufficient, a form of latency is required to make it effective. In this analysis, I assume that the reordering is accomplished by keeping a group of n messages at the remailer, and sending a random one whenever a new message comes. This is superior to simply waiting for n messages to arrive, then sending them all at once (I will show this later). The attack on the reordering remailer is simple. The attacker sends a stream of marked messages through the remailer. After the waiting messages have been flushed out, any incoming real message will be flushed out of the remailer before more arrive, allowing it to be uniquely identified coming and going. The defense against this is to only check the group and send excess messages after a time delay. This delay should be the typical time for n real messages to arrive. A mixing of approximately n messages is ensured by this process. If there is no attack, then the mixing is not quite as good as keeping a group of 2n messages. Here is the math on the reordering schemes: 1) Wait for n messages, then mix and send them all. The message is known to be one of those 10 (duh). 2) Keep a group of n messages. Send one of the n+1 when a new one arrives. The message could be any message ever sent after arrival. That is not useful. How many messages does it take before we are 90% sure that the message has been sent? prob that the message has not been sent after x messages is (n/n+1)^x Prob that it has been sent = 1 - (n/n+1)^x Messages till 90% prob: x=ln(.1)/ln(n/n+1) For n=10, x=24, which is much better then 10 for scheme 1. 3) Accumulate b messages, then send a of them (Scheme 2 is a=1, b=n) x = ln(.1)/(ln(a) - ln(b)) This gives the largest x for a=1. In my example of how to defend against the flood attack, a=n, b=2n x = 33 This is misleading, because it will introduce twice the delay as scheme 2. Given the same delay, a=n/2, b=n, one finds that x=16.6 That is better than batching, but not as good as scheme 2. The smaller x is worth it, because a reordering of at least some minimum number of messages is ensured. Some writer proposed changing n randomly to protect against this attack. Obviously that would not work. The attack will consist of many many more than n messages. The second issue for consideration is: Given a web of perfect remailers, how easy is it to identify corespondents? Tim has been asking this one for a while. I assume that there is sufficient traffic through all remailers that any message entering the web could be any message leaving the web. This can be achieved, even with light traffic, by sending fake messages through the web to bit buckets. While they do not improve the security of the web as a whole, they help ensure that no tracking of messages within the web is possible, forcing it to be treated as a black box. I assume that no correspondents are remailers themselves, and that all communications are random (random times with random people). This assumtion that all communications are uniformly distributed is terrible but.... This analysis only applies to indistinguishable messages. Each standard packet size can be thought of as having its own black box (a good argument for message splitting and having only one packet size). To simplify the problem, I am going to treat the web as though it were clock driven. Some number of messages enter and leave the web each "tick" with no messages staying in the web between ticks. This is a reasonable approximation, with the "tick" being the mean time of passage through the web. Define "f" as the fraction of remailer using population sending a message in a given tick. This is also the probability that any individual will send a message in a given tick. The probability of a given pair of corespondents in a given tick is f^2 The probability of a pair of corespondents occurring m times in n ticks is m p= 1 - Sum [(f^2)^i (1 - f^2)^(n-i) n! / (i! (n-i)!)] i=0 Lets put some numbers in there. If people send 1 message per day on average, and one tick is 30 min., then f=1/48. If you watch the web for a month you will see 1440 ticks. If the chance probability of your sending m messages to your co-conspirator is too small then you have been nabbed. The condition for that is: p << (1/population) The results for m=0 to 12 (using the above numbers) are: m = 0 p = 4.64811E-1 m = 1 p = 1.30173E-1 m = 2 p = 2.56257E-2 m = 3 p = 3.86587E-3 m = 4 p = 4.71498E-4 m = 5 p = 4.81967E-5 m = 6 p = 4.23687E-6 m = 7 p = 3.26538E-7 m = 8 p = 2.23961E-8 m = 9 p = 1.38336E-9 m = 10 p = 7.77044E-11 m = 11 p = 4.00273E-12 m = 12 p = 1.91774E-13 So, for a remailer using population of 10,000 you had better send less than 5 messages per month to your accomplice. This only gets worse the longer you keep it up. You can not send 4 per month, month after month. Louis Cypher -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLybfL6yHUAO76TvRAQFhEwP+OMBMyESk97mVPNJMsoECl0YiJY+xnOqs PHu3OT6j7igdu64NsAHxduwBLmArpgOFXEtrMBwXTkxzUZq6holJdQ+GPtQi787x WtXhV2KkipW6z67TMxzjdSN7cVluQiMpnNhTSOpGUDcM8no3JD8/Ti1ficwljVkH 5kNx6RWFEpI= =pRy3 -----END PGP SIGNATURE-----

5 4

Identity
by sorr＠eznet.net 17 Dec '03

17 Dec '03

To whomever: I'm a reporter at the daily newspapers in Rochester, N.Y., researching a story on the recent spate of IP-spoof hack events. Supposedly a toad.com address was used by a person who broke into the San Diego supercomputer center a month ago. What's toad.com? I got your name from a web search that found an old communique. Can you be any help? I'm simply trying to reconstruct what happened. Steve Orr Gannett Rochester Newspapers

2 1

Re: The Remailer Crisis
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Tim writes: > One thing I should've noted is that a Linux-based cheap remailer is > mostly useless without a "live connection" to the Net. I disagree - live connections are great for fast-response systems, but we got along just fine in the uucp dialup world with occasional connections; in an environment like remailers where you _want_ batchy performance, the clunkiness can even be a "feature". I don't know how many providers are offerring uucp or ip dialout from their servers, or whether they're much cheaper than real ip, but you can do ok with, say, hourly polling to a TIA or term connection to fill your mailbox from a POP server, or nightly if that's enough. TIA also has the advantage over SLIP/PPP that outgoing mail from your system will _always_ have unverifiable IP addresses - you look like netcom.com, just like everyone else TIA-connecting from netcom does. And connections from shared-IP-address-pool systems like netcruiser or dialup PPP systems probably don't do much logging of who's used what IP address beyond when nameserver caches clear. Bill

6 7

Clinton freezes U.S. assets of Mideast groups
by joshua geller 17 Dec '03

17 Dec '03

here's something I found in my mailbox: ___ WASHINGTON (Reuter) - President Clinton has ordered a freeze on the U.S. assets of 12 Middle East ``terrorist'' groups, the White House said Tuesday. White House spokesman Mike McCurry said Clinton had signed an executive order ``to block the assets in the United States of certain terrorist organizations that threaten to disrupt the peace process'' in the Middle East. ``The action will specifically prohibit certain kinds of financial transactions with these groups,'' McCurry said. The groups include Hamas, Hizbollah, Islamic Jihad, Abu Nidal, Black September, the Fatah Revolutionary Council, Kach, the Palestine Liberation Front, and the Islamic Group, McCurry said. He did not name the others, but said there would be more information released at a 2 p.m. EST White House briefing with officials from the Treasury, State and Justice departments and the National Security Council. Under the order, charitable contributions to these groups in the United States will also be blocked, McCurry said. He said Clinton had also frozen the U.S. assets of 18 individuals suspected of involvement in Middle East terrorism, but McCurry did not name them. Clinton signed the order Monday night and it took effect at midnight EST the same day, McCurry said. He said the president acted under the authority of the International Emergency Economic Powers Act. Clinton plans to discuss the matter in his State of the Union address to Congress Tuesday night, McCurry said. ``One of the things the president will address in the State of the Union tonight is the new world in which we live, in which there are new types of threats to our security and to global security,'' he told reporters in his office. ``We just had a very painful and tragic reminder of that in Israel in recent days, and that's the impact of terrorism,'' McCurry said, referring to a weekend terrorist bombing that killed 18 Israeli soldiers and a civilian. Islamic Jihad claimed responsibility for the bombing. McCurry said the decision was the result of a detailed and lengthy review within the U.S. government of how to combat terrorism. The goal was to make it harder for these groups to finance their activities by cutting off their U.S. sources of support and blocking their access to the U.S. financial system, he said. Clinton is also preparing anti-terrorist legislation, McCurry said. ``We do need additional legislation that would further assist the efforts to combat terrorism, and the president will soon send the Congress a comprehensive anti-terrorism package that would stregnthen our ability to prevent terrorist acts, to identify those who perpetrate violent acts and bring them to justice,'' McCurry said.

8 7

Re: CD-ROM [brief addition]
by Alex de Joode 17 Dec '03

17 Dec '03

In article <199502010224.SAA24809(a)infinity.c2.org> sameer stated: : I forgot to mention that the CD-ROM in development will be : export restricted. It isn't going to be sold outside the united states : and canada. Why not produce it outside the US and import it ? Regards, -- Alex de Joode usura(a)replay.com Hate mail appreciated, http://www.xs4all.nl/~usura weekly contest for best death threat.

1 0

Re: CD-ROM [brief addition]
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> Why not produce it outside the US and import it ? :-)

1 0