December 2003 - cypherpunks-legacy

Active processes monitoring?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I'm running on a first generation 486 ISA 4meg ram Win 3.11 I use realdeal /commercial and wipeswap.exe in an *.bat that launch Win3.11 How can I detect if another process is running on my system? I use MEM /c in a dos window. But is that sufficient? Can a hidden process detect MEM loading and hide itself somehow? Are there others applications like MEM that are not as universal? (here, I guess that such stealth behaviour have to rely on identifying the program being loaded, thus, a less common program has less chance of being fooled) Thanks JFA

2 1

parallel encryption
by Simon Spero 17 Dec '03

17 Dec '03

Ok, so I've got my BeBox and so finally have an SMP of my own again; anyone want to suggest any cool crypto stuff that parallelises well? Rogaways hashs look interesting, and nDES offers an obvious process network for pipelining, but what about things like running multiple interleaved CBC streams in parallel, with each stream starting off from a different IV? I can't think of any practical ways of speeding up a single RSA operation, although twice as many processors obviously gives twice the thruput. Simon ------ "GM spent $3.6 billion giving birth to the Saturn, and it doesn't even go supersonic." - Ben Rich, Skunk Works head (75-91)

2 1

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Mr. Bornenstein's press release ("FV's position on Merc article") was egregiously self-serving and embarrassingly over-inflated. Yet, First Virtual's CC-focused keyboard sniffer ("...a program which completely undermines the security of every known credit card encryption mechanism for Internet commerce") and his postulated widespread stealth attack on unprotected consumer PCs highlighted an obvious -- but oft forgotten, at least in non-CompSec circles -- vulnerability. An encrypted link is only as secure as the CPUs at either end. Not an unimportant consideration as we plunge into Internet commerce; and surely a valid point for one vendor to make, if it suggests unrecognized risks in a competitor's scheme for consumer purchases and payments. Borenstein is handling his inevitable mugging in C'punks with zest and considerable aplomb; even including an apology for submitting his sensationalistic attack on crypto-based competitors to this List. Before folks leap from FV's text to damning the San Jose Mercury New's articles by Simson Garfinkel, however, they should pause and read or maybe re-read Garfinkel's three articles. <http://www.sjmercury.com/clips/> Mr. Garfinkel is probably the single most technically-literate journalist writing about computer security for mainstream (or trade press) media. His Mercury News article is precisely focused on FV's initiative in developing this demo program (a trojan screen saver) and the campaign by the Southern California company to use the demo to illustrate a relatively unguarded aspect of Netscape's SSL-protected credit card transactions, which have been widely touted as the be-all of Network Commerce. It was, as Garfinkel bluntly put it: "a direct attack against the security promised by Netscape Communication Corp.'s popular Netscape Navigator..." Mr. Borenstein later expressed his regret that Garfinkel had cast the story as a competitive attack, but IMNSHO Garfinkle was right on target: the FV campaign was a targeted bombardment of their most prominent competitor. And a campaign it was -- well deserving media attention. FV apparently carted their demo code and attack model back and forth across the country. FV gave presentations to NIST, NSA, the US Treasury, and the White House, according to Garfinkel. The only silly comment in Garfinkel's article was a direct quote from FV's Bornenstein: "One of the things we've heard from people inside government were comments along the line, 'We thought only NSA knew how to do this....'" (And if a world-class CompSec/UNIX expert like Garkinkel wasn't chuckling when he wrote that -- and expecting knowledgeable readers to giggle and grin when they read it -- I'll stew and eat my beaver hat!) The Merc's quotes from independent security experts -- commenting on FV's attack model -- were notably dry and balanced. Yes, the attack and threat vectors were real -- but, noted the American Banker's Association's Kawika Daguio: "It is a classic attack." "I've seen it, and I've seen things like it before," said Mr. Daguio. Nothing new. Matt Bishop, the UC prof, also sounded less than awed by FV's creativity: "There is no reason why one could not write a program to monitor keystrokes, look for numbers which look like credit card numbers, and sent them out over the Internet," in an unobtrusive way, to a thief elsewhere. (Prof. Bishop might have had more to say, had he been told it took a FV programmer a _month_ to write a keyboard sniffer optimized for credit card data;-) As a newcomer to this List, I have the impression that C'punks are a little jaded when it comes to mass-market CompSec and ComSec threats -- and perhaps a little rabid when it comes to anyone rash enough to suggest that the first mass-market crypto product (in the hands of naive consumers, with unprotected PCs and poor CompSec habits) may have dangerous procedural vulnerabilities. A little perspective, guys! Crypto from an insecure base has risks that deserve to be highlighted; and credit cards numbers are uniquely negotiable passwords. FV is scare-mongering, sure -- but that's combat marketing. Mr. Borenstein's press release posted in C'punks was chumming with raw bloody beef -- and that was just dumb -- but it was striking how blithely many folks here acknowledged (and immediately dismissed) the threat he described. Nothing wrong with FV trying to slow the bandwagon of a major competitor by drawing attention to vulnerabilities or potential vulnerabilities of their technology in a mass market. This happens a lot -- although most corporate perpetrators try to hide their hand a lot more than FV did, and they generally sound a lot less self-righteous -- but a little brawling is not a bad thing, particularly in IS security. (Some markets, like firewalls, desperately need a little more competitive clarity.) On the other hand, Mr. Borenstein's hyper-inflated presentation of First Virtual's case all but begged for the C'punk lynch mob that has followed him down through several threads on this List. If he didn't expect the reception he got, he should fire his PR advisor and get someone who knows how to write without the purple prose and napham. Simson Garfinkel and the Mercury News are getting a bad rap from folks caught up in the mob chasing Mr. Borenstein. Read the three articles. The on-line version has a headline that is a bit overwrought ("Program shows ease of stealing credit information") but overall, it's a credible, savvy, and amusing piece of journalism about FV. Quite professional, I'd say. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

FV has 91 day lag between sales and payment
by Vincent Cate 17 Dec '03

17 Dec '03

FV seems to be the only Internet payment mechanism that lets buyers quickly open an account and use their credit card to cover purchases. Anyone know of any others? The FV 90 day lag is their main downside in my opinion (though defaulting to not paying if the customer does not answer email is another problem). So FV does not take any risk at all - and a merchant has to have enough extra capital to let 3 months worth of sales sit at FV. Some ideas for ways that they or someone else could improve on this: 1) reduce the 91 days after a merchant had been a merchant for awhile 2) reduce the 91 days when sales were to long time customers 3) verify customers with letters/phone calls when opening the account and then with digital signature on sales - and give very short clearing time -- Vince ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 15:11:02 -0800 From: morehelp(a)fv.com To: vince(a)offshore.com.ai Subject: <960130/vinc0328078> (Lag between sales and payment?) Your question has been answered by a help operator for FIRST VIRTUAL (TM). The operator assigned to your question is op106 (Christopher Arndt), That operator, or someone consulted by that operator, has provided the following answer to your question: ---------------- Hello, We put an escrow hold on a seller's money for 91 days to protect ourselves from buyer credit card charge backs. We realize this can be inconvenient for some of our sellers, but at this time, that is how the system works. Federal Regulation Z of the Credit Card Regulations entitles credit card holders to a 90 period during which they can charge back any purchase. Though buyers are obligated to return the goods, this does not always happen. The credit card company is obligated by federal law to pay the buyer back, and it is the merchant who is left without payment. In our system, because it is First Virtual that has the merchant credit card account, not you, First Virtual is at risk of losing money when your buyers issue charge backs on your sale items. Because we do not conduct any credit checks on a seller, and because any buyer can charge back any charge, if we didn't protect ourselves with this 91 day hold, we could easily fall victim to charge back fraud. But once 90 days have passed, it becomes significantly harder for a buyer to make a charge back. And it is at this point that we feel that the risk of a charge back is sufficiently low that we can deliver your funds to you. We hold your money for 91 days for our protection, but the flip side is that we allow our sellers the freedom of being allowed to sell without having to go through a credit check. Virtually anyone can sell using First Virtual, and this opens up many possibilities for people who otherwise would not be able to sell products through major credit cards over the Internet. Thank you for your interest in First Virtual -- ************************************************************* ...one flew east, one flew west, one flew over the cuckoo's nest... Christopher Arndt First Virtual Holdings carndt(a)fv.com http://www.fv.com ************************************************************* ---------------- You may communicate further with our operator by replying to this message. If you are unhappy with the service you get from operator op106, you may send mail to "helpescalator(a)fv.com". Your original question is included at the end of this message. Thank you for using FIRST VIRTUAL!

2 1

France to push for international net legislation
by bofur＠alpha.c2.org 17 Dec '03

17 Dec '03

According to radio reports here, the French government has just announced it's intention to pressure the European community to create international laws to control the Internet. This is in the wake of the net publication of a certain book that had been heavily censored in France. Does anyone have any more details - has an actual policy been put forward stating how they intend to control the net? And what do/will the laws cover? Bofur. -------------------------------------------------------------------------- Bofur bofur(a)alpha.c2.org PGP available from PGP key servers Key fingerprint = 81 0C 8F 88 0A 4F 67 3F ED 52 DE 3C 55 34 26 25

1 0

Questions about Anonymity, and the FAQ
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:00 AM 2/1/96, Anonymous wrote: >Are anon remailers the only way to send anon email without giving up the >source eventhough an organization has a wealth of dough/technology and >several class B addresses? Couldn't they just trick their mail servers or >would a nslookup/whois defeat that? "Trick the mail servers" is not a cryptographically strong approach...it is just a variant of "security through obscurity." In terms of "work factor" (a measure of the number of bits of protection, and thus the amount of work an opponent has to undertake), the various "Port 25" sorts of hacks are ridiculously easy to break. Maybe not for everyone (for example, moi would have no idea how to break it!), but for determined and knowledgeable adversaries, easily breakable. The Chaumian mix, semi-realized in Cypherpunks-style remailers, are the best hope for cryptographic security. >And are nym accounts the only way to receive email without giving up who >the intended recipient of tha mail/news post actually is? No, public message pools are an easy way to do this--it's what I used for my BlackNet experiment. Tell your sender to encrypt to the public key you provide--which isn't your key you usually associate with your true name!--and to post the resulting cyphertext in, say, alt.anonymous.messages. Since only you can read it, but no one knows who is reading the messages in alt.anonymous.messages, the implications are clear. I address many of these issues in my Cyphernomicon FAQ, available in various ways, including the Web URL of "http://www.oberlin.edu/~brchkind/cyphernomicon/". --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Greg Broiles <gbroiles(a)darkwing.uoregon.edu> opined: >NSB's messages have suggested, amongst the fear-mongering, that the real >target of the card-shark publicity campaign is not Joe Consumer but bankers, >investors, and other "big money" folks; people who care about the >large-scale fraud rate of credit card use. <snip> True enough. Of course, those are the folks who take the weight when credit card sales go sour... or the system is victimized by widespread automated fraud. >While, as Vin McLellan points out, Simson Garfinkel's articles were >technically accurate (modulo the quote from Daguio, where he's quoted as >suggesting an "out of hand" transaction, which is likely either a typo or a >misunderstanding - dollars to donuts he said "out of band"), they also >appeared as part of a marketing process. Actually, the most striking thing about the Garfinkel articles was the degree to which he made the First Virtual marketing/propaganda Campaign against consumer-PC-based credit card encryptors _the focus_ of the Mercury News articles. FV's attack-code demo was overtly presented as a propaganda ploy -- "a direct attack" on Netscape's security model -- by Garfinkel. There was nothing in the Merc text that carried the hysterial pitch of the press release FV posted to C'punks; nothing of the pious Crusade to Save Electronic Commerce that set everyone teeth on edge. FV's Stein and Borenstein were presented as competitive businessmen, out to rough up a competitor who had been getting too much uncritical attention. (The long sidebars on FV's technology are what you'd expect for the Mercury News' coverage of a local SoCal contender.) The Murky News' "Chief Scientist, FV" quote -- Borenstein recalling audiences in the White House, Treasury, etc., who declared, "We thought that only the NSA knew how to do this." -- was absolutely priceless. Everyone who didn't need a ten-page memo to supply the technical and historical context got the giggle. It's the Quote of the Week in Silicon Valley and NoHo. Deftly, with a straight face, Garfinkel left Nathaniel standing there with his pants down, wondering where the draft was coming from. (Mr. Borenstein, no slouch on-line, has faired far better in his give and take among the Cypherpunks -- who in their rabid majority only wanted to lynch him.) >....the implication of the Murky News articles, that one [FV] can be >trusted but not the >other.... <snip> >It's a shame that Garfinkel didn't spend more time/column space on >suggestions or observations from the independent people he interviewed and >less time on the "hot news - Netscape security broken by a competitor" >angle.... <snip> Your observations had me wondering if we read the same articles. My thought: would that all snow jobs were handled by journalists with the same dry perspicacity! >We should, however, learn from what FV did right - they wrote software which >(apparently) had or can have a real political effect. (It seems to have >worked on Garfinkel, anyway). Cypherpunks write code? FV wrote code and got >some attention for their otherwise unexciting message. <snip> Now _that's_ a useful and on-target observation. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: France to push for international net legislation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:27 AM 2/1/96, bofur(a)alpha.c2.org wrote: >According to radio reports here, the French government has just announced >it's intention to pressure the European community to create >international laws to control the Internet. > >This is in the wake of the net publication of a certain book that had >been heavily censored in France. I guess Declan M. won't be visting France or any of the other EU countries any time soon! --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

re: More FUD
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>The degree to which the attack you describe is a threat to online >commerce depends critically on the degree to which viruses and Trojan >horse programs can propagate through their potential base of platforms. Have to interject a comment: even real professionals (which virus writers are not) have trouble getting software to work on on machine, let alone all of the different platforms out there. Windows is worse (ever try to write a .VXD - not easy). Take Michelangelo (please) is a member of a class of viruses the is very difficult to detect: you have to read one word at 0:414 from DOS to know something is wrong. True, in early '92 when [Mich] came out things were more difficult - not everyone had 640k in their machine so the user acurally had to have a clue how much memory was supposed to be there. Today is there anyone with 512k ? Detection has *always* been easy, it is removal that is difficult and *automated* removal that is even more so - know what it takes to determine that there is a macro that might be a virus in a WORD document ? One bit. (Of course things are made a bit more difficult by the fact that MicroSoft considers that bit's location or even its *existance* to be "proprietary" and requires an NDA before they will discuss it - I refuse to sign it). In recent months I have had all sorts of software blow up in Windows. On this machine alone (a 486DX-100 w 8 Mb of RAM & Win 3.1, 1 Mb SVGA and nothing special), Reachout 5.0, FTP Onnet 2.0, QEMM 8.0 (Windows Manager), and several name brand programs have required massage to get to play together - and these are the programs from people I consider expert at what they do, in fact each is IMNSHO the best in their class. And you tell me that someone is going to spread a virus on the net that will capture keystrokes on any machine it hits without anyone noticing ? It is to laugh (and if they can, they are wasting their time with credit card numbers). (Did I mention that the documentation those signing the M$ NDA have been receiving has been *wrong* ?) Not going to say you could not make one machine act that way - that is easy, not even going to say you won't make a number of machines act that way, but spread with a virus enough will self-destruct on enough machines that intelligent people will get suspicious and some will react creatively. Fact is that the greatest protection the net has is that no two machines are alike, may even start that way but after six months, no way. Warmly, Padgett

2 1

RE: Netscape encrypted email!!
by Miguel Saraiva 17 Dec '03

17 Dec '03

I believe the new microsoft exchange (from msdn level 3 ) also has some sort of security built in. Haven't tried yet. (It needs (?) Exchange Server for it ) >> * Integrated email - Netscape Navigator 2.0 offers full-featured and rich >> email capabilities, allowing you to both read and send secure email >> messages without launching an external email application. >I downloaded it and checked it out. But it was not clear how to use this >secure email - so it may lack something yet in user friendlyness, or I may >have just missed it. Anyway, it should be much easier to use than PGP. >Are we all going to switch to Netscape for email? Is anyone using this? >Want to tell us how? > -- -- -> Leon : Miguel Angelo Saraiva : msaraiva(a)marktest.pt <- -- -- -- Vince

1 0