December 2003 - cypherpunks-legacy

Re: Attack Simulator
by Patrick Lamb 17 Dec '03

17 Dec '03

At 03:50 1/18/96 +0100, you wrote: > >Internet Scanner Software Checks Network Security > >Atlanta, Jan. 17 -- Internet Security Systems has >released version 3.2 of its Internet Scanner software. >The company said the program is an "attack simulator" >that tests your organization's network for security >holes. > ...remainder of ad elided Is it just me, or does this sound like a commercial version of SATAN? I wonder what makes SATAN unacceptable (besides the name) while something like this is apparently acceptable? Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

3 2

Keyboard & Mouse Recorder
by Steve Makrecky 17 Dec '03

17 Dec '03

Does anyone know where I can get a keyboard recorder for WIN95 and OS/2 I would like to record the mouse and keyboard strokes. Then re-run the host program at a pre-determined time.

1 0

[NOISY 'cept to Peter et al] Potential Windows hack (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

Yes, this would seem to be an intriguing new way to intruduce a trojan horse. -rich ---------- Forwarded message ---------- Date: Thu, 18 Jan 96 10:57:40 -0500 To: hackmsoft(a)c2.org Subject: Potential Windows hack I was messing around with Delphi last night, and for the first time checked out the help files for creating Windows help. I was surprised to find that a Windows Help file can call functions from any DLL. Is it just me, or does this seem like a hole big enough to drive a truck through?

1 0

Netscape and NSA
by rishab＠m-net.arbornet.org 17 Dec '03

17 Dec '03

Any special reason why Netscape is working with the NSA to support their Fortezza encryption card? ObConspiracyTheory: Hmmmmm.... Nice government-friendly Jim Clark quote, with the rest of the story http://www-e1c.gnn.com/gnn/wr/96/01/12/features/nsa/index.html -Rishab

4 4

Re: Article on E-money
by James M. Cobb 17 Dec '03

17 Dec '03

Jim, Thank you for an exceptionally well thought out message. I notice your point that ....governments will do their best to insure that anonymous e-money systems fail in the marketplace. Perhaps by...subsi- dizing identified e-money systems.... 12 26 95 / 01 02 96 Computerworld 38 reports: CyberCash...is a more comfortable partner to banks and offers an easier system for regulators to audit than those of some rivals, says John Pescatore, research director for information security at International Data Group in Falls Church, Va. A Netherlands-based firm called DigiCash BV...offers a system that ensures a buyer's anonymity.... "An approach like CyberCash would still keep financial insti- tutions in the loop. That's much more palatable to governments and banks and their lobbyists," he says. Publicizing the palatable is one form of subsidizing. Another is suggested: CyberCash...earns transaction fees from banks. Regulating those fees can be an exercise in ingenuity. But there may be more... In Implementing Internet Security, a 1995 book recommended by Pournelle, Lisa Morgan writes at page 199: Currently, DigiCash technology is being used in electronic wallets and smart cards; but in the long-term, the technology will be used for many more applications. In the long-term? Lisa writes at page 195: Internet commerce, when it becomes big business several years from now.... By then "NSA's pet Fortezza card project" may be all the rage. Stephen Pizzo, Web Review's senior reporter, says: The agency is also heavily subsidizing through private com- panies the development of a commercial version to be sold worldwide. Cordially, Jim NOTES: The Computerworld newsstory is headlined "Virtual credit-card swiper makes banks feel secure." The book is by Frederic Cooper et al. Its publisher: New Riders Publishing. Pizzo's report can be accessed beginning at: http://gnn.com/gnn/wr/96/01/12/features/nsa/index.html

1 0

Re: Ozzie Apes Jim Clark, Fix Is In to Cave and Cry
by david d `zoo' zuhn 17 Dec '03

17 Dec '03

// : >The new overseas version of Notes, tagged Release 4, will give // : >foreign users 64-bit security. But to get permission to export // : >the software, Lotus agreed to give the government access to 24 // : >of those bits by using a special 24-bit key supplied by the // That was the question that came to mind when I read the article, too. // How exactly are they planning on implementing this? Looks straightforward to me. Any time a bulk key is generated (aka session key), take a known number of bits in a known location (top n or bottom n) and encrypt those with the public key of the agent you want to give the n key bits to. Then send the encrypted key bits as part of the message protocol. This is similar to what Netscape's SSL does, except that the top n bits of an SSL key are a public part of the exchange, and the top n bits of a Notes key are only readable by the private key holder (which is presumably in the hands of every major government agency that cares). Neither give away the entire key directly, so it's not a trivial decoding operation. But 40 bits isn't terribly difficult to decode either. The advantage, as seen by many people, is that the full key is much larger in the Notes implementation style so non-governmental attackers have a much harder problem to solve in order to crack the message. This is roughly akin to what ViaCrypt has announced for their next PGP release. You have a public key for the "escrow" agent, and every person who encrypts using PGP would add (or would have added by PGP) the agent to the list of recipients. The message might not be given to the agent, but if it lands in their hands, they will be able to decrypt it. GAK is reasonable, to those who trust the government. Now the subset of this list who do so may be a much smaller percentage than the subset of the VPs of IS that do. But that's a different message. -- - david d `zoo' zuhn -| armadillo zoo software -- St. Paul, Minnesota -- zoo(a)armadillo.com --| unix generalist (and occasional specialist) ------------------------+ http://www.armadillo.com/ for more information pgp key upon request +----------------------------------------------------

2 2

[noise] Re: Attack Simulator
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:04 PM 1/18/96 -0600, Patrick Lamb wrote: >Is it just me, or does this sound like a commercial version of SATAN? I >wonder what makes SATAN unacceptable (besides the name) while something like >this is apparently acceptable? It is very similar, both in tests and in basic principle, to Satan. The differences between the two are hype and Satan is free to anyone who can figure how to make it work. (Not always an easy task... Especially on Linux.) Such tools are very useful for system admin types to fix holes and for hackers to find them. It is not the "all powerful hacker tool" the media makes it out to be. What this has to do with crypto, I have no idea... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

POINTER: 01 17 96 CDT Policy Post
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related item in 01 17 96 CDT Policy Post: FBI Surveillance Capacity Request Fails to Meet Public Accountability Requirements of Digital Telephony Bill. CDT = The Center for Democracy and Technology. To subscribe to CDT's Policy Post list, send mail to: policy-posts-request(a)cdt.org with the subject: subscribe policy-posts Cordially, Jim

1 0

Re: Espionage-enabled Lotus notes.
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Peter Trei writes: > >It's specifically built for export, and has a backdoor to enable USG agents > >to read the messages more easily. From the viewpoint of a foreign purchaser, > >'espionage-enabled' seems an appropriate term. TC May responds: > I like this idea, and have already begun to use it. Even adding it to my > already long .sig. I think it's also time to break out the old "Big Brother Inside" stickers and start applying them to copies of Notes... andrew

2 1

Single computer breaks 40-bit RC4 in under 8 days
by daveg＠pakse.mit.edu 17 Dec '03

17 Dec '03

MIT Student Uses ICE Graphics Computer To Break Netscape Security in Less Than 8 Days Cost to crack Netscape security falls from $10,000 to $584 CAMBRIDGE, Mass., January 10, 1996 -- An MIT undergraduate and part-time programmer used a single $83,000 graphics computer from Integrated Computing Engines (ICE) to crack Netscape's export encryption code in less than eight days. The effort by student Andrew Twyman demonstrated that ICE's advances in hardware price/performance ratios make it relatively inexpensive -- $584 per session -- to break the code. While being an active proponent of stronger export encryption, Netscape Communications (NSCP), developer of the SSL security protocol, has said that to decrypt an Internet session would cost at least $10,000 in computing time. Twyman used the same brute-force algorithm as Damien Doligez, the French researcher who was one of the first to crack the original SSL Challenge. The challenge presented the encrypted data of a Netscape session, using the default exportable mode, 40-bit RC4 encryption. Doligez broke the code in eight days using 112 workstations. "The U.S. government has drastically underestimated the pace of technology development," says Jonas Lee, ICE's general manager. "It doesn't take a hundred workstations more than a week to break the code -- it takes one ICE graphics computer. This shuts the door on any argument against stronger export encryption." Breaking the code relies more on raw computing power than hacking expertise. Twyman modified Doligez's algorithm to run on ICE's Desktop RealTime Engine (DRE), a briefcase-size graphics computer that connects to a PC host to deliver performance of 6.3 Gflops (billions of floating point instructions per second). According to Twyman, the program tests each of the trillion 40-bit keys until it finds the correct one. Twyman's program averaged more than 830,000 keys per second, so it would take 15 days to test every key. The average time to find a key, however, was 7.7 days. Using more than 100 workstations, Doligez averaged 850,000 keys per second.ICE used the following formula to determine its $584 cost of computing power: the total cost of the computer divided by the number of days in a three-year lifespan (1,095), multiplied by the number of days (7.7) it takes to break the code. ICE's Desktop RealTime Engine combines the power of a supercomputer with the price of a workstation. Designed for high-end graphics, virtual reality, simulations and compression, it reduces the cost of computing from $160 per Mflop (millions of floating point instructions per second) to $13 per Mflop. ICE, founded in 1994, is the exclusive licensee of MeshSP technology from the Massachusetts Institute of Technology (MIT). ### INTEGRATED COMPUTING ENGINES, INC. 460 Totten Pond Road, 6th Floor Waltham, MA 02154 Voice: 617-768-2300, Fax: 617-768-2301 FOR FURTHER INFORMATION CONTACT: Bob Cramblitt, Cramblitt & Company (919) 481-4599; cramco(a)interpath.com Jonas Lee, Integrated Computing Engines (617) 768-2300, X1961; jonas(a)iced.com Note: Andrew Twyman can be reached at kurgan(a)mit.edu.

3 2