December 2003 - cypherpunks-legacy

Kevin Mitnick RC5 Crack team - Join Us
by Rich Burroughs 17 Dec '03

17 Dec '03

Have your CPU fight for justice in it's spare time! Some of the folks from the mitnick(a)2600.com mailing list have set up an RC5 team in hopes of generating awareness about Kevin Mitnick's ordeal and possibly some cash for his defense. Details are at our site: http://www.paranoid.org/mitnick/ The site has more info about Mitnick and the RC5 crack if you're not familiar, as well as a gallery of graphics & banners you can put on your own site to show your support. We hope to have a stats page up soon. We're registered at both www.distributed.net and www.cyberian.org ... give us a hand!

1 0

Info Warthogs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Future Information Warfare Study Available San Francisco, Sept. 6, 1995 -- Computer Security Institute's "Special Report on Information Warfare" describes how war might be fought in the 21st century. The report will appear in the fall issue of the Computer Security Journal, but is available now on request. Patrice Rapalus, director of Computer Security Institute (CSI), told Newsbytes, "In recent weeks, mass media organizations such as Time Magazine, the Washington Post, and National Public Radio have done stories on information warfare. This report is a timely, comprehensive and practical study on information warfare and its impact on our future." The report defines information warfare in contrast to simple computer crime, "A computer crime is an act that violates a law. It could be specifically targeted. It could be isolated, or it could be one element of an overall plan of attack. The conduct of information warfare, in contrast, is never random or isolated (and may not even violate a law). The term implies a concerted effort to utilize information as a weapon with which to wage war, whether on an actual battlefield or in economic, political, or social arenas." Four aspects of information warfare are listed in the report: the electronic battlefield; infrastructure attacks; industrial espionage; and personal privacy attacks. "It is important to understand that the term 'information warfare' originated in the military and in its purest sense refers to the grim and dangerous business of real...country shattering war," says the report. Computer Security Institute is located in San Francisco, California, and is a wholly owned subsidiary of Miller Freeman Publishing. Miller Freeman publishes over fifty trade magazines including Dr. Dobbs Journal, Unix Review, and LAN Magazine. Computer Security Institute publishes, along with random studies like the "Special Report on Information Warfare," a monthly newsletter, a semi-annual Journal, an annual Buyers Guide, and a on-line bulletin board. To obtain an advance copy of "Special Report on Information Warfare," call 415-905-2310. ------ "Snooper" Software Digs Into Computers San Francisco, Sept. 6, 1995 -- Vias & Associates Inc. said it has introduced a new version of its "Snooper" system information utility. The author of the software said it is called Snooper because the program "snoops" around the computer to report its configuration and operating characteristics. John Vias of Vias & Associates said his company's program goes farther than other system information programs, including Microsoft's MSD (Microsoft System Detection), which is included in higher versions of the company's DOS operating systems. "I think Snooper is about the most accurate system information utility you can get," he said. "People say it's easy to use. It takes just one keystroke to go from the main screen to any other screen. It also has a built-in editor for 'autoexec' and 'config' files." In all, Snooper can detect more than 150 details about a person's computer, including CMOS settings, hard drive type and capacity, any installed Micro Channel cards, fax-modems, memory types and amount available to the user, and video memory and type. Snooper is targeted to all markets, Vias officials said, including the average user, network administrators, consultants, and technicians. In the provided documentation is a wish list regarding new features for future versions of Snooper, including brand detection of additional non-Intel central processing units (CPUs), detection of local bus cards and tapes, and the ability to differentiate among different types of hard drives. Although Snooper can run in either DOS or Windows, Vias said the program works best in the DOS environment. In Windows, some of the software's reports must be disabled. In addition, some of the test results may be in error or unpredictable. Snooper requires an IBM PC or 100% compatible machine, with at least 256 kilobytes (KB) of RAM, a DOS with version 3.1 or higher, and some kind of video card. Snooper retails for around $39, and is available as both a full version and as shareware. Vias also said he is working hard on a Windows 95 version of Snooper. When tested the software on a Windows 95 machine running in DOS mode, no problems were experienced. But running it in Windows mode made the program very unpredictable. ------- UK - PCMCIA Encryption Card Introduced London, Sept. 5, 1995 -- PPCP, a PCMCIA (Personal Computer Memory Card International Association) specialist, has begun shipping the Session Key, a PCMCIA Type II card from SCI Canada. According to John Nolan, the company's managing director, the card allows users to encrypt data on their PC hard disk, as well as across serial port linked devices, such as modems, using the DES algorithm. DES stands for Data Encryption Standard, a US-originated high security encryption system that is virtually unbreakable. According to Nolan, the Session Key allows users to protect their data on a selective basis. "Many of the competing systems out there are only capable of encrypting the user's entire hard disk. That obviously protects the user's data, but if you forget your password, you have serious problems," he explained. "With the Session Key card, you create a new drive, the 'D' drive, to store the encrypted data. The card also allows data to be transmitted by modem in DES format. That allows a user maximum flexibility," he said. When used to encrypt data on a user's hard disk, once the Session Key is removed from the PCMCIA slot, all data on the disk that is encrypted is protected against unauthorized access. The encrypted data cannot be read or used without reinserting the UKP349 card. Nolan said that SCI has developed a second-generation version of the Session Key, which will be available later this year. "That version will use RSA encryption techniques, as well Triple DES and a whole host of other encryption systems," he said. One of the problems with encryption devices like the Session Key is the fact that the US Government currently bans the export of certain types of encryption technologies, as well as restricts the sale of many technologies to "known parties." According to Nolan, this approval system can cause the company a few administrative problems. "We need to find out who is the actual end-user and pass their details back to SCI. My understanding is that the vetting is then carried out at a government level in Canada or the US," he said. He added that, apart from a short delay, typically a week or so before the card can be shipped to the customer, there is usually no problem. Reader Contact: PPCP, tel +44-181-893-2277, fax +44-181-893-1182, Internet e-mail 100302.1470(a)compuserve.com/PPCP950905/PHOTO) ------

1 0

Re: Sit, Bubu. Sit! / Re: Stay issued; modified stay to follow
by Jonathan Wienke 17 Dec '03

17 Dec '03

At 09:03 AM 8/29/97 -0700, Dan Goodin wrote: >I'm very interested in finding out how extensively Snuffle was posted >during the two-and-a-half days it was legal to do so. Do you have any idea >how many sites posted it, and if it's still available online today, now >that such posts are once again against the law? > >Please respond ASAP. > >Thanks, > >Dan Goodin >415-395-7805, x5223 >dang(a)cnet.com I posted Snuffle to the Coderpunks list: Date: Tue, 26 Aug 1997 18:25:10 -0700 To: coderpunks(a)toad.com From: Jonathan Wienke <JonWienk(a)ix.netcom.com> Subject: Snuffle! (In celebration of the Bernstein decision) Sender: owner-coderpunks(a)toad.com [Snuffle source code deleted, check Coderpunk archives for details.] I don't know how many foreigners subscribe to the list, but I have see postings from UK, Australia, and India. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) When everyone is armed, criminals fear everyone, not just the police. PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Commercial version of PGP 5.0 and related products at http://www.pgp.com Eudora Light + PGP = Free, Convenient Communication Privacy

1 0

Re: GAK
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Davis Wrote: > >I, of course, know of the "dislike" of GAK here. I am curious to know, >however, if the "dislike" is because government would have access under >any circumstances or if the primary worry is that government will cheat >and get access when most would agree that they shouldn't (either by the >judge "cheating" or a TLA stealing it). > >In other words ... if it took agreement by a review board composed of >non-LEA members of this list, would the escrow be acceptable?? > Looking at it simply as a cryptosystem, I'd have to vote no, since the security of the system can be "easily" (in a cryptographic sense) compromised. I feel safer knowing my privacy is protected by the laws of mathematics, instead of the laws of the USA. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBME9jIs3xoLPBSgtxAQEndAf/V9hJEyMIHe6/h2UmEWT4KH81Y/HuBHZr kuiHIRNFRGgsYKFIk72YGBltZvbPeWcX15RmGB6DO+91ecfmRMplW14RYAQyPpcx AGC3rQ966hZ/mRHRi7Ygtw1tbRKgbDAaNzx468TRZGwl2LxexpbxzOZoy2kMR18M +Kj6sLahlQxyTO6jx26uoj5uqmfdnxFAfjUDWAjLyhjH5x7XzqpJHQHKSFGIsdKY X1tw7IPPDUElXJkdx0aVMhOFwEen3XGm3qrx/kJRmnG7Q9WoAHE5xqOLSAHyYImd PaUT63Uzgop7euL4FROHqrIrlh70IPiWCk7t7OEwT8CS3MbbL/WgjQ== =hYy7 -----END PGP SIGNATURE-----

1 0

Fate of Jews in America (fwd)
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

----- Forwarded message from nikst ----- >From nikst(a)glasnet.ru Fri Aug 29 20:52:44 1997 Message-Id: <m0x4ccf-001A94N(a)mail.glas.apc.org> X-SMTP-Spy: Real message sender is nikst(a)glasnet.ru via ppp686.glas.apc.org From: "nikst" <nikst(a)glasnet.ru> Subject: Sud'ba yevreyev v Amerike Date: Sat, 30 Aug 1997 05:40:27 +0400 X-MSMail-Priority: Normal X-Priority: 3 X-Mailer: Microsoft Internet Mail 4.70.1155 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=Windows-1251 THE WASHINGTON TIMES August 29, 1997 The end for U.S. Jewry? By Richard Grenier You know this is a Protestant country," Franklin D. Roosevelt once said to economist Leo Crowley and Henry Morgenthau, his treasury secretary, "and the Catholics and Jews are here under sufferance. It is up to you to go along with anything I want." ... . . . The Presidency of Jack Kennedy abolished forever the notion that American Catholics are here under sufferance. And Jews? On this 100th anniversary of the founding of the Zionist movement, the position of our Jewish minority is singular. The danger for Jews, oddly, is that in the foreseeable future they might be so well assimilated they become extinct. ..... . . . This might surprise many gentiles as never before have so many Jews occupied high positions in American politics, giant corporations, the media, the academy, science, law, medicine, intellectual life, not to mention Wall Street. Both U.S. senators from California are Jews, and last year a Jew, Sen. Arlen Specter, was a serious candidate for the presidency. A generation ago this would have been unthinkable. .... . . . But the eminence of our Jewish high-achievers is deceptive. Not long ago Jews represented something under four percent of the American population. Today they represent two percent. Jews once lived in dense urban settlements in the Northeast, half of them in New York alone. Today 40 percent of Jews live in the South and West. In Denver and Phoenix the intermarriage rate with gentiles is 72 percent -- the harbinger of doom. For as the Jewish population spreads over the country, and assimilates ever more readily, synagogue affiliation declines steadily. ...... . . . Of the 6.8 million people of Jewish descent in this country, almost 20 percent are now practicing Christians, and another 16 percent profess no religion and consider themselves secular Jews or not Jews at all. For centuries persecution paradoxically helped preserve Judaism, while many Jews now expect that tolerance, in the end, will do them in. ... . . . Elliott Abrams, assistant secretary of state under Ronald Reagan and now president of the Ethics and Public Policy Center, alarmed by this drift, has just published a brilliant book, "Faith or Fear" (The Free Press). In Mr. Abrams' view, Jews in America, as things are going, are headed straight for extinction. The only thing that will preserve them, he writes, is true religious faith. Without it they're in danger of disappearing like the ten lost tribes of ancient Israel. ...... . . . Meanwhile, a special issue of The New Republic has appeared devoted to "Zionism at 100." The magazine's editor-in-chief, Martin Peretz has written a grand celebratory article on "The God That Did Not Fail." Mr. Peretz once told me he doesn't believe in God but believes in "the Jewish people," describing for me the funeral service for an eminent Jew during which a friend whispered to him, "Do you realize that of the country's ten leading micro-biologists (I forget the profession) eight are in this room?" To which Mr. Peretz replied pungently, "Praying to a God in whom they do not believe." .... . . . Mr. Peretz is thus a splendid, highly articulate example of Mr. Abrams' "secular Jew" -- and a passionate zionist. Indignant at people who believe that the state of Israel would never have come into being if it hadn't been for the Holocaust, he declares with deep regret that but for the Holocaust there would now be in the world, not 13 million Jews, but "scores of millions." At the end of World War II the gates of Israel would have been stormed, not by thousands of Jews, but by millions. The god that failed, of course, was communism. Whereas zionism grew and triumphed. ...... . . . Supreme Court Justice Louis Brandeis was the most prominent American to hold high position in our government while throwing himself heart and soul into the zionist movement. Brandeis refused to resign from the Court to assume the titular leadership of the World Zionist Organization because he wanted to demonstrate that there was no contradiction between remaining "attached to America while working for a Jewish homeland in Palestine." Justice Brandeis saw no conflict in his position: holding high office in America while deeply involved in the political, financial, and intellectual affairs of a nation in the making --which was after all to become a foreign country. I'm not sure how many Americans today would agree with him. .... . . . But the question isn't what other Americans would think of this kind of double allegiance, or whether the two allegiances might some day be in conflict, but whether Jews, without God, defining themselves as simply an ethnic subgroup, will even survive. One of the reasons there has been such loss of religious faith among America's Jews lies in the nature of their religious practices, to which the practices of Islam (Sunni) bear a strong resemblance: circumcision, prayer, special dietary rules, no pork, no graven images, no musical instruments in the house of worship, concentration on living a godly life here below with little talk of the hereafter and absolutely no messianic talk of eternal life. .... . . . I thus fully agree with Mr. Abrams. Jews will certainly survive in America for a time, but without God, on their present course, they'll eventually be gone. *************** "Bednaya-bednaya" Amerika! U nas ne tak. I eto xorosho illustriruyet sleduyushchij anekdot: Umirayet staryj armyanin. I vot sobral on vsyu svoyu bol'shuyu semyu u svoyego smertnogo lozha. Oni vse dumali, chto rech pojdyot o nasledstve. No tot povyol rech o drugom. K udivleniyu sobravshixsya, on stal goryacho ubezhdat' ix: "Beregite yevreyev!" "Beregite yevreyev!" I kogda on zametil udivlenie na licax sobravshixsya, on iz poslednix sil poyasnil: "Kogda ischeznet poslednij yevrej, oni voz'mutsya za nas, armyan"... I ispustil dux. Tut vot pishut, chto v Amerike, vrode, k etomu idyot. Neuzheli pravda?..;-) *************** RFE/RL NEWSLINE Vol 1, No. 106, Part I, 29 August 1997 ARMENIAN, RUSSIAN PRESIDENTS SIGN TREATY. Levon Ter- Petrossyan and Yeltsin, meeting on the second day of Ter- Petrossyan's state visit to Moscow, signed a treaty on friendship, cooperation, and mutual assistance, Russian media reported on 29 August. Yeltsin commented that the treaty "meets the vital and lasting interests of the two states." The two leaders also signed several agreements, including on the transit of oil across Armenia. ************* K chemu by eto? ----- End of forwarded message from nikst ----- - Igor.

1 0

Hacking banking (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 8 Sep 95 15:21:00 UTC From: d.wiesner(a)genie.geis.com Subject: Hacking banking An interesting article appeared on Page B1 of the 9/7/95 San Francisco Examiner. Titled "Keystroke Cops," it discusses the FBI's new cyberswat team. In the midst of a routine discussion of whether law enforcement needs to keep up with cyberspace criminals, the following intriguing quote appeared. "Already, Fuentes said, federal authorities in New York are investigating whether programmers hired to write software for a financial institution may have left a 'back door' open in the program, one through which money may have been diverted to foreign bank accounts." Does anyone know what this federal investigation in New York is about? How about copying this note around and seeing what people can find out? David Wiesner ---- My pleasure, Dave. bd

1 0

Re: GAK Hacks
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Hal writes: > One would be to create a patcher which would let you change the > set of certificate authorities accepted by the browser. Currently > the browser accepts at least one (an internal Netscape test CA) > which is not needed by end users. Maybe its public key could be > statically overwritten by the patch program with the public key of > the replacement CA. This sounds simple and safe. The patch program > can confirm that the data being changed matches the test CA. This is an excellent idea, assuming the new CA's key will fit in the same amount of space or less than the test CA. How big is the test key? Of course, Netscape could decide to remove the test CA certificate from future versions of the browser. However, you could probably replace the Verisign certificate with your CA certificate and then have your CA sign the Verisign certificate so the browser can still use both. :-) > This second patch is more advantageous for end users as it allows > them to have strong encryption rather than the weak 40 bits which > we have been breaking. The first would be a more direct demonstration > of the difficulties of using certificate restrictions to limit > functionality. I don't think this is necessary as domestic versions of Netscape have already been exported and are available on non-U.S. FTP sites... > The criteria.txt paper suggests checksumming the cryptographic > routines to prevent patches like this, but generally I think such > checksums can be defeated pretty easily. I doubt that Netscape > currently has any such thing, though. It only makes it harder to patch. Anyone with a clue knows that there is no such software-only protection that can't be defeated. Even hardware/software dongle type protection can be defeated by altering the software to not check. andrew

1 0

Patel decision page 19 handled
by Antonomasia 17 Dec '03

17 Dec '03

Patel decision page 19 handled -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # #### !!! PGP 5.0 beta available now at ftp.replay.com !!! ####

1 0

Car rentals, Driver's Licenses, Ecash, & Net Access
by Duncan Frissell 17 Dec '03

17 Dec '03

Lucky Green's reply to someone else motivated me to comment: >>Suppose you have acquired a million dollars worth of legal, above-board >>DigiCash dollars and you want to surreptitiously transfer this wealth to a >>below-board friend. Your friend creates a temporary anonymous account at an >>understanding bank. Y > >Won't work. Ecash, except as used for frequent flyer like points, will >exist in only *one* world wide e$ currency, issued by a single entity >composed of various major banks and subject to US laws. Getting Ecash >accounts will therefore be subject to the same legal requirements that >apply to normal US checking accounts. For the holiday weekend, I rented a car at a major agency in the state where I usually sleep. To secure the rental, I presented a driver's license from another state and a secured VISA card. The agency presented me with a car bearing the license plates of a Southern state far away from the rental location. In the past, this agency (one of the majors BTW) had given me a car registered in yet another Southern state for a week's rental bearing a registration that expired halfway through that week. No problems in any case. Interestingly enough, the agency refuses to rent to local citizens of the state where it is located and where I often sleep. My posession of a "foreign" DL makes it easier for me to rent cars. Money and imagination overcomes many of the "social control" aspects of licensing and registration requirements. Now what this all has to do with transaction controls is the following. It is suggested that governments and private parties will cooperate in imposing absolute restrictions on people's ability to complete "unlicensed" transactions. Thus it is suggested that driving, posession of a motor vehicle, working for pay, having a bank account, having a phone account, having a net account can all be rigidly controlled. We've all read the stories about the DMV and how various states are pulling licenses for child support arrears, tax evasion, overdue library books, etc. The Feds have proposed a National SS# Database that would have to be consulted before the 60 Million people who annually change jobs would be allowed to do so. And it is easy to imagine that additional restrictions would soon be placed on job changes. After all, we don't want deadbeat dad-tax evading-library book hoarders working in this country, do we? Likewise the Bank Secrecy Act of 1970, et seq was supposed to end anonymous bank accounts. And a lot of the recent porn on the nets agitation has involved attacks on anonymity. Suggestions have been made for licensing net access. Finally, electronic check proposals are supposed to be traceable because those who open accounts will be identified. The readers of this list can apply what they already know about the difficulty involved in restricting net access to the analysis of these other existing and proposed restrictions. The problem with the theory of transaction blocking is that it requires millions of potential sellers of goods, services, and jobs around the world to turn away customers. Something that most people are unwilling to do. Thus, if some entity tries to control net access by restricting it to "licensed" users --- a real legal problem in the US BTW --- all that you have to do is open an account somewhere else on earth and dial out to it or use a connection via an X25 network. All the Great Enemy can do is make you spend a little more money. Eventually of course, encrypted untraceable TCP/IP sessions will be possible and domestic ISPs could -- without risk --- offer "encrypted only" pipes out to the nets. "Once you get there it's up to you what you do but we don't/can't know about it." Note that soon, millions of people will have high-speed, cable-based, full-time net access. These people will be one mouse click away from being a full-service ISP. Stick the ISP in a Box BSD CD-ROM in the drive and double-click on setup.exe. If the CD-ROM is produced by the right parties, it will automatically support encrypted TCP/IP. These millions of ISPs can offer net-access accounts right away and add dial up later for the neighbors if they feel like it. It is the vast number of vendors and the cheapness of the connection that makes it so hard to control net access. The computer and telecoms revolution has the same effect on banking and other services to which the authorities hope to block access. Thus cheap telecoms, computing power, and well-developed electronic funds transfer systems are easily turned into free banking. We all know that every node/user on the net is a potential gateway to another network (potentially of great size) on the "other side" of his connection. In the same way, every user of "cheap, easy, and open" electronic funds transfer system is a potential bank, a potential money "switch". The famous Fort Lee Switch located in Fort Lee, New Jersey at the West end of the George Washington Bridge is an important switch for the financial funds transfer networks going into and out of NYC. Think of it as the IBM 360 running a proprietary operating system on a somewhat closed loop. The future open funds transfer systems will be like the personal computers that can far exceed the performance of the old monopoly mainframes. Since everyone will be able to switch funds (and every *one* includes every fictitious entity, software agent, corporation, trust, organization, or firm anyone can create on earth) they will be able to switch funds for anyone else. Controlling a system with an almost unlimited number of switch points will not prove possible. Individuals and the entities they control can be counted on to protect themselves from the financial losses occasioned by fraud or theft. They can be their own auditors. But they can't be counted on to forego profit so that the governments of the world can try and prevent some people from engaging in mutually beneficial private transactions. An attempted cartel of that sort --- one that tries to enlist the billion or so people who will be easily and reliably switching funds within a few years --- is doomed to failure. Too many potential 'cheaters.' Too much money to be made by breaking with the cartel and offering financial services to others who wish to use them. And where money leads, other forms of human interaction will follow. Once money is free it can buy, bribe, or finagle it's way past the other attempted restrictions on voluntary transactions. DCF "If you can figure out a way to keep 1 billion people who have cheap, powerful, uncensored, computers and telecommunications from being free; you're a better man than I am Gunga Din."

1 0

Re: Scientology tries to break PGP - and fails?
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 8 Sep 1995, Tom Rollins wrote: > I took a look at the FACTNet web page. There is a file encrypted with > PGP using the "-c" option. They are asking for people to help guess > the Pass Phrase. Why would anyone bother if they had no clue that the > file contained anything 'interesting'. I can only assume one of two things - either this is a joke, as the decrypted contents are nothing special as far as I can see (though 'interesting' in a sense), or that someone is very, very clever and managed to hide two different messages in there with different passphrases. > If this is the file that the Co$ is trying to crack, then what the > is being asked for is a pass phrase that can be handed to the Co$ that > will pass the PGP valid key check and still not decrypt the data to > anything usefull. If this is the file the Co$ want to crack, they're a) clearly cryptographically inept, and b) the joke's clearly on them 8-).. Any hacker worthy of the name ought to get the passphrase within three attempts (I got it first time). Note for paranoids: Of course, this message may just be a ruse to put the Co$ off the scent ;-).. Mark

2 1