December 2003 - cypherpunks-legacy

[NOISE] Re: mailing list
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 19 Jan 1996 17:35:50 -0500 (EST), someone wrote: >You come recommended by the Happy Mutant Handbook. Was just wondering ^^^^^^^^^^^^^^^^ Uh-oh. I have nothing to do with that. More fodder for Alta-Vista....

1 0

good background on CitiBank/Russian caper
by attila 17 Dec '03

17 Dec '03

The folling article was culled from the current issue of the journal of internet banking. ---------- Forwarded message ---------- Date: Fri, 19 Jan 1996 18:01:32 -0500 Journal Of Internet Banking And Commerce Vol. 1, no. 1, January 19, 1996 --------------------------------------------- The Citibank Affair: A Purely Russian Crime? --------------------------------------------- Nahum Goldmann ARRAY Development Nahum.Goldmann(a)ARRAYdev.com> http://www.ARRAYdev.com/ --------------------------------------------------------------------- Nahum Goldmann has been employed as a manager, scientist and lecturer in leading industrial high-tech firms and academia. Mr. Goldmann has published several critically acclaimed books that deal with knowledge transfer issues. --------------------------------------------------------------------- Novoye Russkoe Slovo (NRS), a NY-published newspaper which acclaims itself as the largest Russian-language daily outside of the x-USSR, published an engaging account of the so-called Citibank Affair in September 1995. A fairly large article ("Purely Russian Crime..." NRS, Sept. 15, 1995, pp. 13-14) was written by Vladimir Strizhevsky but was actually based on the original investigative materials submitted by several contributors from Moscow and St. Petersburg, as well as from NY, London, Brussels and other world financial capitals. Undoubtedly, NRS have done quite a good job in clarifying and illuminating the background of the Citibank Affair. For whatever reasons, the English-language media have not covered the background of Russian participants that well. However, an expert in electronic banking and commerce on Internet might find utterly fascinating the very minute details of this complex crime scheme that involved many people and spread across several continents. The story at NRS starts at the end of August, 1994 in Tel-Aviv. A certain Alexei Lachmanov, a Georgian national and a holder of a false Greek passport to the name of Alexios Palmidis, had been arrested by Israeli police when he tried to withdraw nearly US$1M. The funds in question were electronically transferred to five Israeli banks from Invest-capital, an Argentinean subsidiary of the Citibank. The Israelis had been tipped by the Citibank through the FBI with the information that all the money transfers had been done with the illegal use of Invest-capital's own secret codes. The subsequent multinational investigation has shown that it was a leading St. Petersburg's, Russia computer expert Vladimir Levin who was able to conduct numerous electronic transfers from several Citibank's subsidiaries in Argentina and Indonesia to various financial institutions in San Francisco, Tel-Aviv, Amsterdam, Germany and Finland. According to NRS's speculations, Mr. Levin's succeeded so well because, in addition to Citibank's own electronic cash- management hub in NY, he was also able to crack down the electronic defense of several SWIFT's branch offices in the third-world countries. SWIFT, a secretive Belgium-based electronic telecommunication consortia of World-leading banks, is primarily involved in mutual settlement payments amongst its members. On the other hand, in the interview with an NRS correspondent V. Kaminsky, Citibank's spokesman rejected the newspaper's version of SWIFT's penetration. Instead he claimed that Citibank knew all along about Mr. Levin's infiltration, playing with him a sophisticated multistep deception game. Of course, the Citibank's face-saving version of events sounds not that convincing, taking into account a large number of uncontrollable players, a sizable amount of real cash involved, multicontinental reach of the overall crime scheme and the fact that the bank was ultimately unable to recover a substantial chunk of its own money. Not your ordinary self-taught hacker, Mr. Levin, 31, an aloof man and a graduate of a prestigious Department of Applied Mathematics, was considered somewhat of a computer genius in the St. Petersburg's University circles. The scheme started when Mr. Levin's acquaintance, a Russian-American wholesale trader, asked him to develop programming support for his international trading business. According to Mr. Levin's university friends, the idea of breaking into secure bank networks has been born somewhat spontaneously during a purely technical discussion on the advantages and disadvantages of different bank networking programs. The debaters were members of a St. Petersburg's group of elite computer experts that could best be described as a local response to the Internet's own Cypherpunk community. I found it fascinating and somewhat ironic that the infiltration plot had actually started as a low-key bet that the Russian famous resourcefulness would triumph where the famed Yankee ingenuity has already proven to be unsuccessful! In the overall crime scheme, Levin was supported by as many as 30 collaborators, at least some of them computer experts. Several of his partners-in-crime, arrested in the U.S., Russia, Israel and the Netherlands, were primarily involved in cash retrieval and laundering, ultimately the most vulnerable part in any grand scheme of electronic theft. It is hardly a secret that most professional bankers are routinely trained to contest, or at least report to authorities, any suspicious withdrawal of large sums of cash. Some of the U.S. arrests have been successfully kept in secret for many months, for the fear of alerting the criminals back in Russia. Mr. Levin himself was arrested in September 1995 in a UK airport, en- route through that country. Apparently, in the best tradition of this fledging industry, Citibank have already used the lessons obtained from Mr. Levin's penetration to beef up the security of its own electronic payment system. COPYRIGHT ========= The Journal Of Internet Banking And Commerce is Copyright (C) 1996 by ARRAY Development, Ottawa, Canada. All Rights Reserved. Copying is permitted for noncommercial, educational use by academic computer centers, individual scholars, and libraries. This message must appear on all copied material. All commercial use requires permission. __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches....

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:56 PM 1/21/96 EST, Dr. Dimitri Vulis wrote: >tcmay(a)got.net (Timothy C. May) writes: >> >Degaussing the media (running a household magnet over it :-) may be an optio >> >> Ordinary household magnets fail for a couple of reasons: > >I've just established experimentally that thoroughly running a household magnet >over a 3.5" floppy messed up less than 1/2 the sectors I tried to read. Was that with the floppy in the case, or with the case popped open... Also: Did you rotate the disk physically to expose the data normally partially shielded by the door slider? And was it an ordinary ferrite magnet, or an alnico, or...? >Not a good option even for floppies. Ditto! >(Actually, there _was a smiley up there) Yes, I noticed. <G> [stuff deleted] >Jim Bell mentioned the trick of hiding information into 'extra' tracks and >sectors not used by the usual DOS formatting. It's very old too. I will admit that at this point, even calling it a "trick" is giving it excessive credence. Actually, I think it wasn't really used initially for "data hiding" purposes. I'm talking about the early days of CP/M and other such systems, circa 1977 and such, when individuals "discovered" that floppy drives had no hard mechanical stop past the "last" good track, and they "stole" a few percent of extra capacity from a floppy by simply ignoring the recommended "last" track. Naturally, it would work okay on some drives but not on others... which is why it was a bad idea. In addition, I also discovered that it was possible to put a few more than 26 sectors on each track of an 8" single-density (240 kilobytes!) floppy disk. The main problem with using these "tricks" is that the floppy had no method of conveying formatting information to the system it was in, which meant that any floppy using this trick was by definition non-standard. ("feature" or "bug" depending on your goal...) > I think I saw >copy protection schemes circa 1982 that hid important data on tracks 41--43. >360K diskettes normally had 40 tracks. If the diskette was copies by DISKCOPY, >it didn't know about the extra tracks, and the copy didn't have the info >(usually, a piece of the program). It's very easy to do with just BIOS calls to >format/read/write the track. Problem is, many cheap floppy drives these days >aren't capable of seeking beyond track 80 when the FDC asks them to. You can >write the data there and give the floppy to a friend who won't be able to read >it from there. I started building my own 12.5 MHz Z-80 -based CP/M system in 1978, fully designed and wire-wrapped by myself, and wrote my own BIOS. (Used a WDC 1791 FDC) Had total control. I didn't try this trick even then because of compatibility reasons, but one thing I _DID_ do was to write a floppy formatter that "undid" the 6-sector skewing that standard CP/M had to do to keep up with the data read/write. (in other words, I physically re-skewed the sector numbering to make the next "desired" sector come faster...) I ended up with an effective skew-factor of 2. Even a skew factor of 1 worked on my system (no skew at all), but the problem was that when I gave the most extreme of these oddly skewed floppies to my friends with 8" floppies, they took A LONG TIME to read the data! (Their systems always missed the next sector because their systems were too slow, so they only ended up being able to read one sector per disk rotation.) All this helps to explain why I asked if PGP had ever been ported to CP/M. Nostalgia! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQMF6vqHVDBboB2dAQG1+QP7BpyrLaVbTJISLo12rWMo9sqyfwtpv6A2 r7GGTvQTw6MwACA3pTh6HnnjpllveQSznNLpHaUeEjfpQX9NUXuJc4Z63E+EBFYw Xp3c0rygdC4fHS2WJbrhn0JUpC1C5V+Cn/oEpL5qygfaoqE1mAvsw7cCAht44ne+ /dJvdnm+N9M= =CbtQ -----END PGP SIGNATURE-----

2 1

THE MIND OF A SERIAL HACKER
by Lou Zirko 17 Dec '03

17 Dec '03

Thought you might find this of interest. >From PATHFINDER Compass Issue 3: * THE MIND OF A SERIAL HACKER: Kevin Mitnick was cyberspace's most wanted hacker. But while Mitnick's alleged crimes have been publicized, his story has never been told. Until now. Chat live with Jonathan Littman, author of THE FUGITIVE GAME: ONLINE WITH KEVIN MITNICK on Monday, January 22nd at 2:00 pm (EST). http://pathfinder.com/Chat/chat.html Lou Z. Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBLJocAAAEEAMlDzYJPYq0pvfMuSiKU0Y65L2nJql+qEJHYGjO5Pys4prDw YW1ooPWaqrPQAy/eyqrM7I9KNFDCtmaPxtgcPw2oEDfc/w6cPkrVzvovKLfHQvtg V/hHUekptSf6j525omrVAoM9MxVL3sEGCjn9VrTeC3h9upkfntHOJeL88i2NAAUR tB5Mb3UgWmlya28gPHppcmtvbEBkYXRhdGVrLmNvbT4= =Qlxm -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

At 06:43 PM 1/21/96 -0800, Peter Monta wrote: >Tim May writes: > >> Much more expensive would be various electron microscope-based imaging >> methods to directly image the domains and extract subtle signs of past >> write cycles. > >I recently took a tour of Park Scientific, the scanning-probe >microscopy people, in Sunnyvale. One of their demo-stations >showed a small portion of a hard disk (taken with an AFM >tip fitted with a small magnet to generate the force). Most >impressive. (I did look closely at the edges of the track, >but saw no sign of previous writes.) >Peter Monta pmonta(a)qualcomm.com While I admit that I'm not particularly familiar with modern hard disk head design, I think it is futile to look for data in this way. If they "tunnel erase" the edges of the data track, even small misalignments will not allow remnants of data to remain. (And I assume that "all" modern hard disk drives employ high-precision data-read feedback mechanisms to maintain track alignment down to the submicron level... thermally-sensitive stepper motors and linear positioners of the 1980's are (or at least should be) gone!) Further, modern read-channel techniques (PRML; partial response, maximum likelihood) bring the normally readable signal closer to the noise level than ever before, and the PREVIOUSLY written signal is that much more difficult to resurrect. As a method for gathering intelligence on anyone, I think that this is dead and buried. However, I _still_ want to see brainless operating systems like MSDOS changed to erase (zero) allocated data buffers before and after use (and especially before re-use!), so that parts of vital files don't accidentally get written to the ends of other files.

1 0

Re: Wipe Swap File
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:23 AM 1/20/96 -0800, Timothy C. May wrote: >At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote: >>tallpaul(a)pipeline.com (tallpaul) writes: Interestingly, we wrote almost identical responses to Dmitri, although admittedly you won the "time race." Is it: 1. "Great minds run on the same path"? or 2. "Fools think alike" <G> >3. A time-varying field is preferred. Bulk erasers work this way, by >plugging into an a.c. socket and generating a time-varying field. And even >these are getting harder to use to erase video tapes, for example, due to >the high coercivity of modern media. Most folks I know no longer even try >to bulk erase tapes. Video tapes, yes. Audio cassette tapes, maybe. However, they should still be useful for floppies, for two reasons: 1. Distance to the media is far smaller than to the average distance to the inside of a videotape cartridge. (floppy cases are thinner.) 2. The volume of material to be erased is FAR smaller than a typical videotape cartridge. The middle of the tape of a 1/2" wide videotape spool is self-shielded by at least 1/4" of videotape; a 3.5" floppy disk is shielded only by distance. (actually, the sliding doo-hickey over 3.5" floppies probably acts as a shield, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQF04vqHVDBboB2dAQGlhwQAmS2fbPTCdcyRsqsKukaUfgesqultJ15J ZaAM0CUK1MH96szfHltSM7JkVr/t2wuDxY8gMZnmW5Jz1XUxDy+/a0NsJxkDWV+R 9eNOAKdsFaaV3xmIOBvZyIIU8RHgSw16Z0DZIDJhV/kZgACqfndn0YOHG4ESNe5T VrpCuKLBdSo= =T9tq -----END PGP SIGNATURE-----

1 0

You want to read MY e-mail?
by Scott Staedeli 17 Dec '03

17 Dec '03

from the Nando Times- DENVER (Jan 20, 1996 01:16 a.m. EST) -- A college student's request to look at the electronic mail of several high-profile state politicians got lawmakers' attention Friday. Becky O'Guin, a senior journalism student at Metropolitan State College of Denver and a reporter for The Capitol Reporter, a student newspaper that covers legislative action, stirred up the ruckus. She sent a letter to Sen. Charles Duke, R-Monument, asking for all of his e-mail messages from Jan. 1 to Jan. 16 and cited the Colorado Open Records Act as her right to get it. The letter noted that Colorado law would force him to pay court costs and attorney fees if a member of the public "has to take official action to enforce his or her right to view a public record." That really miffed legislators. Lawmakers said they'd get a legal opinion on whether they must disclose their electronic-age messages and may pass legislation to make sure their messages have some protection of privacy. Senate Majority Leader Jeff Wells, R-Colorado Springs, said he and Senate President Tom Norton, R-Greeley, got similar requests, but verbally. Personally, Wells said, he believes e-mail is privileged information unless it is specifically identified as public information under existing law. A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as telephone conversations was killed in a Senate committee. A somewhat stronger bill still rests in the House. O'Guin, meanwhile, was standing her ground, although she admitted to being a little surprised about the uproar. "The way I read the open records statute, those are open records," O'Guin said. "I was very serious about the request. What I was looking for was to find out how much public business is conducted through e-mail. "If they're using e-mail to send memos back and forth discussing public business, I see that as public record," she said. "Most of them don't (have e-mail), but about 30 people have software that allows them to send e-mail back and forth." She said only Duke and Gov. Roy Romer have been sent letters so far, but she intends to send them to other high-profile politicians. Jim Carpenter, press secretary for Romer, said his office was "looking at all the issues, all the options." Duke said he has always complied with requests for public records, but said the request for e- mail messages goes too far. "I'm disturbed by it," Duke said. (John Sanko writes for the Rocky Mountain News in Denver.) OK, if _I_ can't read your e-mail Mr. Legislator, why should you be able to read _mine_? - --scottst(a)ionet.net---------------------Scott Staedeli-- >~<^xXx | "There is no reason for any indiv- xX # | idual to have a computer in their (XXX) # | home." (XXXXXXX) | DON'T TREAD ON ME| -- Ken Olsen, president of DEC, 1977 ========================================================

2 1

Hassles taking App. Crypt. to Taiwan?
by Daniel A. Monjar 17 Dec '03

17 Dec '03

I've lurked for quite a while now. It is time to ask my first newbie question. I'll be going to Taiwan for three weeks in March. Is there likely to be any problems at US or Taiwan customs if I take Applied Cryptology 2/e along for personal study? Dan -- Daniel A. Monjar | "All opinions are my alone... dmonjar(a)vnet.net | and possibly my children's." PGP Public Key fingerable --

1 0

VTW: "Lotus blinks in industry/NSA crypt standoff"
by Declan B. McCullagh 17 Dec '03

17 Dec '03

=========================================================================== VTW BillWatch #33 VTW BillWatch: A weekly newsletter tracking US Federal legislation affecting civil liberties. BillWatch is published at the end of every week as long as Congress is in session. (Congress is in session) BillWatch is produced and published by the Voters Telecommunications Watch (vtw(a)vtw.org) (We're not the EFF :-) Issue #33, Date: Mon Jan 22 00:42:06 EST 1996 Do not remove this banner. See distribution instructions at the end. ___________________________________________________________________________ TABLE OF CONTENTS Announcements Oregon ISPs stand up for your rights Recap of ECHO Virtual Culture Event 1/21/96 Lotus blinks in industry/NSA crypt standoff Subscription Information (unchanged since 10/21/95) ___________________________________________________________________________ ANNOUNCEMENTS Each week never fails to bring us some interesting development in the world of telecommunications and civil liberties and this one is no different. Keep an eye on http://www.vtw.org/. We'll be posting an alert on the New York State cyberporn bill later tonight. Also, if you haven't yet scheduled a meeting with your legislator and your local ISP to talk about the Exon bill, you're wasting valuable time. Do so now! Shabbir J. Safdar Advisory Board Member Voters Telecommunications Watch This issue can be found in HTML form at URL:http://www.vtw.org/billwatch/issue.33.html ___________________________________________________________________________ [...] LOTUS BLINKS IN INDUSTRY/NSA CRYPT STANDOFF It's not clear why this hasn't made a larger impression on the net yet, because we think its of crucial importance in the ongoing debate about cryptography. For years since the original introduction of the Clipper Chip, the debate over cryptography has continued to gain momentum. Recently, the Administration, embarrassed by its defeat over the Clipper Chip proposal, put forth it's Commercial Key Escrow proposal. What is all the fuss about? It's about cryptography, and who has the right to encrypt information and who has the right to keep the key. Right now, you do, but that could all change. Think of cryptography as a really good front door on your house or apartment. The door key is yours to hold, isn't it? It's your right to give a copy to someone you trust, or if you choose, nobody at all. The Administration contends that this is not so. With their "commercial key escrow" scheme, they contend that you shouldn't be able to build a door they cannot break down, but they also contend that they should be able to order you to give a copy of the key to a government-approved individual, so that they can come enter your house (with a warrant, of course) when they wish. Industry, of course, panned this plan when it proposed late 1995, and continues to object to it. All the while, a standoff continues: the Administration refuses to allow cryptographic software with keys longer than 40 bits to be exported, and industry refuses to build Big Brother into their products. And this is where the standoff stayed until last Wednesday, when Lotus blinked. On Wed, Jan. 17th, 1996, Lotus announced that it had increased the key length of its International version of the Lotus Notes product to 64 bits. They did this by building in a back door for the Administration to use to decrypt any international traffic that it might desire to read. Although there are a lot of reasons why we think this is a terrible idea, the first one that springs to mind is the fact that the one public key that Lotus has embedded in all their software is a single point of failure for every International Lotus user throughout the world. Sure, this key is held with a high security clearance by the government, but then Aldritch Ames also had some of the most sensitive information available to him, and he proved untrustworthy. After all, if $1.5 million can buy a CIA counter-intelligence agent, I wonder how much a Lotus Notes key escrow holder goes for these days? You can find a copy of the Lotus press releases at http://www.lotus.com [...]

1 0

Why is blowfish so slow? Other fast algorithms?
by David Mazieres 17 Dec '03

17 Dec '03

First, can someone tell me if the latest version of blowfish (the one in Applied Crypto 2nd edition) is available online somewhere? I looked at a bunch of crypto ftp servers and could only find an older version of blowfish that did not have the blf_ctx structure allowing multiple keys to be active at a time. More importantly, however, on a 120 MHz Pentium, the old blowfish (compiled with gcc version 2.7.2 optimization -O6) seems to take about 12.6 microseconds for 1 M encryptions and decryptions, which works out to about 95 cycles per byte. This is significantly more than the 26 cycles/byte number cited in Applied Crypto 2nd edition. Can anyone suggest what I might do to speed this up? Failing that, can anyone suggest other secure, preferably unpatented, shared-key encryption algorithms that could encrypt at ethernet speeds (1 MByte/sec) without using most of the CPU on a fast Pentium or equivalent processor? Thanks a lot, David

2 2