December 2003 - cypherpunks-legacy

bernstein results?
by sameer 17 Dec '03

17 Dec '03

So when do we find out what the judge had to say about the hearing on Friday? -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

big bust
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Feds Bust Huge Cell Phone "Cloning" Ring NEW YORK, NEW YORK, U.S.A., 1995 OCT 20 (NB) -- New York officials have cracked what they call "the biggest illegal cellular telephone cloning operation in the country" with the arrest of three individuals this week. If convicted the suspects could receive up to 15 years in state prison. "Cloning" is the process of retrieving the electronic serial numbers (ESNs) of legitimate phones off the airwaves and programming the purloined numbers into stolen phones. Thieves capture the numbers using special scanners placed near busy highways and airports. ESNs can also be obtained from stolen phones. Denver-based Secret Service agent Bill Bresnahan told Newsbytes the Secret Service is tasked with investigating cellular phone fraud, Bresnahan says investigative techniques include monitoring cell activity for an unusually high number of long distance calls, and the use of direction finding equipment to track down the illicit phones while they are in operation. US West spokesperson Wendy Carver-Herbert and Bresnahan say there are some steps that cell phone users can employ to help foil phone theft or catch thieves. They encourage cell phone users to step up the physical security they provide their phones. "If you are going to leave your car with a parking attendant or parked on the street for several days, remove the handset and the antenna to avoid drawing attention," says Carver-Herbert. She also recommends activating the electronic lock when you are away from the phone. They also recommend monitoring your cell phone bill closely. If you see calls you are sure you didn't place, contact your service provider immediately, and if your phone is stolen the company can block calls from that number. US West Cellular has programmed its computers to watch for anomalies in each customer's calling pattern as another way to foil this high tech crime, and the company employs security personnel to contact customers when calls fall outside the normal pattern. The New York raid seized cloning software, 46 cell phones and various equipment including computers officials said contained legitimate cell phone access numbers which when programmed into cloned phones allows the purchaser to illegally use cellular service without paying. They often make expensive long distance calls to other parts of the world. Officials said as many as 27,000 phones have been cloned over the last seven months and at least 3,000 usable legitimate access numbers were stored in the computers seized in the raid. Authorities estimate losses from the latest scam may have cost phone companies as much as $27 million. Cell phone service providers lose an estimated $1.5 million a day nationwide because of phone cloning. Authorities said it costs a thief about $50 to get a stolen cell phone activated with a cloned number. The phone can then be sold on the street for about $100. The Manhattan District Attorney, Robert Morgenthau, was particularly interested in this case. He said his own phone has been cloned twice by thieves recently. The first time the bill exceeded $3,000 and the second time more than $5,000 in calls were charged to his number. The legitimate holder of the cell phone number that is cloned isn't aware the phone has been cloned until the bill arrives. In an attempt to stop losses cell service provider Bell Atlantic NYNEX Mobile (NYSE: NYN) recently introduced the use of personal identification numbers, which the company said has cut phone fraud by an estimated 80 percent. The user punches in the unique PIN and presses the send button on the phone after dialing the desired number. Authorities say the cellular phone industry spends $5 million annually to stop sophisticated cellular phone fraud. (Jim Mallory/19951020/Press contact: Kim Ancin, 914-365-7573, or Jim Gerace, 914-365-7712, both of NYNEX) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Encrypted TCP Tunneler
by Wei Dai 17 Dec '03

17 Dec '03

I am writting a program called Encrypted TCP Tunneler, which I hope to finish in a month or so. It will allow a secure link to be set up between an ETT client and an ETT server, using Diffie-Hellman and DSA for authenticated key exchange, and Blowfish for encryption. A user will be able to open a TCP connection to the client and have that connection transparently tunnel across the secure link to a TCP address on the other side. I see several uses for this program, such as secure telnet, secure web access, and access to a secure network across an insecure network. I realize the program will no be as useful when IPv6 becomes widely available, but that may not happen for a while. Also, this program can be used on top of IP security to give users (as opposed to system admins) more control over their own security. Please send comments and suggestions. Wei Dai

10 14

Re: digital cash and identity disclosure
by Stephan Somogyi 17 Dec '03

17 Dec '03

At 12:20 21.10.95, Adam Shostack wrote: >Michael Froomkin wrote: > >| i would like to propose the following radical idea: Chaumian digicash is >| a nice curiosity. The future in the mdeium term (10+ years) for better >| or worse belongs to Mondex. > > Deploying hardware is VERY expensive. Expense of deployment for this type of scheme does not seem to be a consideration for banks; they stand to make a ton of money as a result. There are areas where banks will resist spending money on new hardware, but smart-card stuff isn't one of them. > 30m internet users at $100 (half hardware, half tech support) is 3 > billion dollars to deploy today. Secure commerce on the internet would > drive that 30m figure (which will probably double this year anyway) way > up. Adding hardware to a personal computer to read from and write to smart cards will cost money, but the majority of bank customers will not be interested in Internet-based transactions for quite some time. So while the potential market of Internet consumer financial transactors seems large, it is dwarfed by the sum total of bank customers who are likely to wind up with some form of non-pilot smart card-based payment system within the next 2 years. I've been told that a PCMCIA card that reads smart cards would around $30ish; I've not had the time to follow this claim up, so it could be off by a bit. Assuming it's accurate, the price doesn't present a significant hurdle to the typical PC-based consumer. And if there is enough demand, I'm sure that smart card readers will find their way into desktop and laptop machines over time. For example, Catapult's XBAND modem for Genesis and SNES has an ISO smart-card reader/writer in it; such a consumer device's manufacturing cost is sensitive to even a few pennies, so it can't've cost much to put it in there. I consider it much likelier that non-Internet specific payment systems will adapt to the Net, instead of Net-specific payment schemes seeing broad deployment. To clarify: I consider CyberCash and FV to be Net-adaptations of conventional schemes, rather than brand new payment systems. > Digicash doesn't need observer cards, which gives them a huge advantage. > If they ever sign with a real bank. There is a US law called the Bank Secrecy Act that defines the responsibilities of banks with regard to audit trails, record keeping, and disclosure of financial transaction information. After talking to quite a few people both in the regulatory and business realms recently, I am convinced that truly anonymous e-cash simply isn't going happen in the US. And the US is going to have considerable influence on how things go in the rest of the world; whether this is a good thing or not is, unfortunately, an unrelated and purely philosophical debating point. Based on my knowledge of the backing behind Mondex at this relatively early stage in the game, I am inclined to agree with Michael. _______________________________________________________________________ Stephan Somogyi Senior Editor Digital Media

1 0

Re: Anonymity: A Modest Proposal
by James A. Donald 17 Dec '03

17 Dec '03

At 12:59 PM 10/19/95 -0400, Thomas Grant Edwards wrote: >This would require the remailer to examine entropy of messages passing >through. Anything not random enough gets tossed. A simple entropy measuring algorithm: Generate N random pointers into a file. (or extract N random short strings from the file) Sort them into order of the strings, Find the number of bits in common between one string and the next string. Total up S, the number of bits in common Calculate (N * lg N)/S For an encrypted file, this quantity should be close to unity, because the order in an encrypted file should not be easily detectable. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

experimental socks5 gateway
by sameer 17 Dec '03

17 Dec '03

so I've installed a socks5 server on infinity.c2.org, port 1080. Socks5 is available from coast.cs.purdue.edu:/pub/tools/unix/socks This is for experimental purposes only. Full logs are kept. It may go down at any time. It may not work. Your computer might blow up. etc. etc. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Re: Sun speaks out - but not to the cypherpunks
by todd＠lgt.com 17 Dec '03

17 Dec '03

Pardon the flame but I really have just about heard enough of this BS... >This response came from Sun to Risks: > >> Date: Mon, 16 Oct 1995 21:22:40 -0700 >> From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) >> Subject: Re: Risks in Java >> >> If we are going to "analyze" java security, let's keep in mind that there is >> an important distinction between the language (java) and the machinery which >> runs the java program. >> >> Java is a general-purpose programming language along the lines of C/C++. >> So, there is no doubt that its expressive power overwhelms our >> theoretician's abilities to predict java-programs behavior -- this is where >> we start getting into the halting problem, computability and other black >> magic. Basically, i don't think we can "trust" programs written in any >> *useful* programming language. > >Read: We can't trust Java programs. > >> The area where we can (must) build trust is the computing base. >> Traditionally, this has been the OS, but in the case of java, it is the java >> interpreter (such as netscape 2.0 and hotjava). The browser is now the TCB >> (trusted computer base) for all practical purposes... > >Read: The Java interpreter is supposed to be a TCB > >> And, to address the specific concern about applets spamming the net -- from >> what I've seen, applets are only allowed to connect to the server that >> supplied the applet in the first place (by default). The worst thing one >> could probably pull off is to spam oneself. > >Read: By default only - also note, none of this invalidates attacks 30-49 >from the previously posted list. > >Who here truly believes that the implementations of Java meet the >requirements of a TCB? > >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Dr. Fred, you seem to spend a lot of engery slamming Java and HotJava. Are you unaware that the HotJava Platform is the first generation pass at an inline extensible GUI harness. Underline the total concept "extensible GUI harness". This includes a series of tool functions to *help* perform secure messeging (like those supplied iun Netscape 2.0/Java.), but because of the enormity of the task and the number of facets on the face of this gem it will be some time before the final versions of the first generation will be available. No one else had been working on this piece of technology before SMCC started their effort. From the word floating about the SMCC labs they didn't even know what they had. So rather than slamming them, SMCC, or their PR folks for - releasing a version of a development tool far beyond what the "big boy's - doing what PR people do - Minimize and Maximize concepts in the press I hope that you understand my point?. The net/net is that OLTP needs to be scaleable to be a saleable commodity and without the ability to do "java-ish" like local applets... There is no clean way to do this, ***period***. Also that OLTP requires transport level security, transaction level security , and a whole lot of systems security and authtication. The browser is the harness not the complete tool suite at this juncture. As an aside - What blows my mind is the number of cycles people spend bitching and moaning about Java itself rather than working to create a better solution. I just want to say "Get a clue. Moan about something that is important and pertinent to the technologies at hand". These comments are my own - Sincereley, Todd Glassey todd(a)lgt.com

1 0

Lack of secrecy in U.S. Banks
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ph(a)netcom.com (Peter Hendrickson) writes: > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records As a former bank employee, I can assure all readers that privacy of banking records is non-existant. All you need is a friend who works in the computer, auditing, bookkeeping, or loan department (in that order of preference). If your friend has worked there long enough, he/she can probably also get informmation from any other bank in the community. (Don't suggest the security department. As far as bank transactions are involved, the Auditor normally handles that.) To reassure the excessively paranoid, bank employees are normally flooded with so much information per day that they normally take no interest in any more of it than their job forces them to. Moreover, when you consider that it is commonplace for a teller to handle total transactions daily than run well into six figures, few if any individual transaction attract any attention. Banking trivia #1: Banks are the only businesses that close their books daily rather than monthly or quarterly. Banking trivia #2: When choosing a bank, check out the Cash Over/Cash Under account on their balance sheets. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIpbMd74r4kaz3mVAQEi5QP+KYftQ3jKjWFbqqgH65tUB7sONx1poZV0 w8g5OdHlwpG+lU0HeqZlVPlJv+iqmGGo4hCN1sZ5z0LB3FDyeLlO8AQwBHPGadGB dYUtMhq4gpJEpjJba9jdH7neu57j94/S+3Y0lYA0y/ZqJxbwRRntLMJzAZ0RozDH SsJsLn/tOlo= =N8mQ -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

No Subject
by ibg＠oro.net 17 Dec '03

17 Dec '03

Very interesting article on offshore banking. Can you suggest a reading list or source of additional information?

1 0

Reducing the Flames, Attacks, and Nit-Pickings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:18 AM 10/22/95, Todd Glassey wrote: >As an aside - What blows my mind is the number of cycles people spend >bitching and moaning about Java itself rather than working to create a >better solution. The recent flames and attacks are pretty typical of mailing lists, especially mailing lists having 1200 highly-opinionated subscribers (gulp!). Not that I like the flames, but they're not the problem I want to really talk about. A trend that bothers me--and others too, from comments here--is the intense "feeding frenzy" that is going on with each and every new product, from Netscape, to Microsoft Network, to Java, to Digicash. Don't get me wrong--finding flaws is a useful thing to do. But this list is becoming _consumed_ by the _process_ of attacking products. Worse, many of the attacks are by innuendo, by rumors and speculations about what features a product has. My comments will likely vanish without a trace, but I urge folks to hold back a bit on jumping in with attacks and reports of problems. Be sure something is _really_ a flaw before sounding the alarms. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0