December 2003 - cypherpunks-legacy

security auditing class (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

Wow. Looks like fun. ----- Forwarded message from Dan ----- >From firewalls-owner(a)GreatCircle.COM Thu Apr 11 06:54:33 1996 Message-Id: <199604102045.NAA29570(a)flying.fish.com> X-Authentication-Warning: flying.fish.com: Host zen@localhost didn't use HELO protocol To: firewalls(a)GreatCircle.COM Subject: security auditing class reply-to: /dev/null(a)flying.fish.com Date: Wed, 10 Apr 96 13:45:46 -0700 From: Dan <zen(a)flying.fish.com> Sender: firewalls-owner(a)GreatCircle.COM Precedence: bulk Announcement of Free Class on Internet Security Auditing and Risk Assessment *** Sponsored by Sun *** TIME & LOCATION Tuesday, April 30th, 1996 ***** This class will be given *one* time; it will *not* be repeated ***** The class will last all day - 8 or more hours [Exact building/location TBA, but will be in Mountain View, CA, USA INSTRUCTORS Dan Farmer Wietse Venema Sun Microsystems Eindhoven University of Technology GENERAL OVERVIEW *** WARNING *** *** This class will be aimed at experienced system administrators or *** *** security auditing professionals. 8 hours of class in one day is not *** *** for the faint of heart! However, there are no requirements or *** *** prerequisites needed to attend. *** *** *** Wietse and I are going to give a class on security auditing. In something like 8 hours, we are going to try and cover everything we know (or at least the highlights) on how to do an Internet security audit. Neither of us have any formal auditing training, but we feel that with our combined experience (we are the authors of the TCP wrappers, COPS, and SATAN, among other tools and papers) that we have a fair amount to say about the subject. If the class goes well, we plan on giving another talk in the summer, probably in europe next time, on securing your Unix system. CLASS TOPICS (selected, not exhaustive) Definition and purpose of security auditing Software and hardware tools used Our general philosophy about auditing Tiger teams Types of auditing/systems What to examine/ignore "Perfect" vs. incomplete data Micro vs. macro auditing Auditing large networks Passive vs. active data collection Interpretation of data collection Auditing the security policy *Our* auditing and security standards Scoring methods Overall data analysis System design analysis The report REGISTRATION NOTES & INFORMATION We don't know how many people will show up; we will try to accomodate everyone, but with finite space, we might have to limit the class size. It will be filled in a more-or-less first come, first serve basis. We will be placing some notes on the web; registered participants will be notified of where to find them. To register, you must send a *physical* letter with your name and e-mail address to my wonderful Sun administrator: Diana Behjou 2550 Garcia Avenue, MS PAL01-550 Mountain View, CA 94043-1100 USA And request a position in the Internet Security Auditing and Risk Assessment class. You will receive an e-mail reply to confirm your registration. Again, there is no charge, but *please* don't register unless you are certain that you'll be there, because others will suffer if the class fills up. E-mail will probably be ignored, unless I know you, and then I'll be pissed off that you asked me to add you to the list instead of sending a stupid letter, and you'll owe me a bottle of fine port or something. There is no ulterior motive to this, other than the fact that wietse and I are trying to write a book, and we're using this as a motivational tool. Enjoy. ----- End of forwarded message from Dan ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Protocols at the Point of a Gun
by Bill Stewart 17 Dec '03

17 Dec '03

>At 9:48 4/10/96, Duncan Frissell wrote: >[...] >>We know that governments would like to impose things like the Simple >>Tax Transfer Protocol on the Net as well as Is A Person (and Is A Minor) >>Protocols. There was a recent discussion on a radio talk show that the IRS is now requiring some large class of taxpayers who submit estimated taxes to do so electronically. The host and callers weren't sure of any of the details (such as exactly who's covered and whether you can deduct the computer you had to buy to submit your taxes electronically :-) but obviously they read Duncan's phrase about Simple Tax Transfer Protocol and decided to implement it real fast.... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Possible problems caused by Brown death?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Given that Commerce is the main force within the administration pushing for freeing up the escrow rules, the below article is of interest. -Allen > WASHINGTON (Apr 8, 1996 10:48 a.m. EDT) -- When Ron Brown died in a > plane crash, American capitalism lost its staunchest ally in the > Clinton administration. Now business executives wonder who will > champion their cause the next time commercial interests clash with > other priorities. [...] > With the Cold War over, Brown believed the United States no longer > should sacrifice economic interests to other foreign policy goals and > he used his close friendship with Clinton to push a business agenda > inside the administration. [...] > He succeeded in battles with the Defense Department in loosening Cold > War-era export controls that American companies had long complained > severely limited their ability to sell high-technology products such > as computers and telecommunications equipment. > Copyright &copy 1996 Nando.net

1 0

Re: Scientologists may subpoena anonymous remailer records
by um＠c2.org 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: >some details. (To Jim Byrd, that "alumni account at Cal Tech" that you >mentioned was one of the Cypherpunks remailers at Caltech that our own >pioneering Hal Finney runs.) From: noring(a)netcom.com (Jon Noring) Subject: [X-Post, Caltech OFFICIALLY Speaks] -AB-,penet, and Caltech ******************************************************* In article <3smmv3$ard(a)gap.cco.caltech.edu> rich(a)cco.caltech.edu (Richard E. Fagen) writes: On Wednesday afternoon, February 8th, three private investigators visited the Caltech Security Office and the Campus Computing Organization. The P.I.s wanted to know the identity of the holder of the account "tc" on the Caltech Alumni Association computer system (alumni.caltech.edu) They claimed to have gotten the account name from the anon.penet.fi server via the Helsinki police. Due to the unusual nature of this request, the P.I.s were told that Caltech would need more information before this type of information could be given out. Later that day, an attorney representing the Church of Scientology called the campus computing support office demanding the name of the account holder. The attorney claimed that a document had been stolen from a CoS computer system, and that the document had been posted to the a.r.s newsgroup from alumni.caltech.edu via the anon remailer. (The claim was the document was created on Jan. 21 and appeared in a.r.s. on Jan. 24). The computing support staff did not divulge the name of the account holder, and the CoS attorney was referred to the Caltech General Counsel's office. The Computer Crime Unit of the Bunco-Forgery Division of the LAPD subsequently contacted Caltech security and asked for more information on the case. The LAPD wanted to know if a breakin to the CoS computer had occurred from the alumni system. Caltech told the LAPD that no evidence of such a break in could be found. The LAPD requested and was given the name of the "tc" account holder with the understanding that this information would not be divulged. A couple days after that Caltech was informed that the LAPD could find no evidence that a crime had been committed. In the ensuing several days, the attorney and P.I.s representing CoS made repeated attempts (both via phone and by physically appearing on the Caltech and JPL campuses) to obtain the contents of the tc account and also the tape backups (the account holder had admitted to deleting most of the contents of the account). The CoS attorney produced a letter allegedly signed by the tc account holder allowing CoS permission to get the data stored on that account and the backups. Due to irregularities with both the letter and a phone conversation with the account holder, permission for CoS to have access to the data in the account was denied by Caltech. After the CoS attorney and P.I.s continued their attempts to get the data, Caltech retained the counsel of an independent law firm. Soon after that, all communication with the CoS ended. One phone call from the tc account holder requesting the backup data was received by the computing support staff. This request was also denied. That was the last communication with the account holder. Our analysis is that Caltech was caught in the middle of what appears to be an internal matter between the Church of Scientology and one of its members, who also happened to be an account holder on the Caltech alumni computer. No evidence that a Caltech computer was used to break into another computer, or was used to store stolen documents could ever be found. I hope this serves to shine a little light on this chain of events. Rich Fagen Director, Campus Computing Organization Caltech ****************** end of cross-post ******************** -- OmniMedia | The Electronic Bookstore. Come in and browse! Two 9671 S. 1600 West St. | locations: ftp.netcom.com /pub/Om/OmniMedia/books South Jordan, UT 84095 | and ftp.awa.com /pub/softlock/pc/products/OmniMedia 801-253-4037 | E-book publishing service follows NWU recommendations.

1 0

Re: Digital Cash Escrow
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:11 PM 4/10/96 -0700, Tim May wrote: >At 10:14 PM 4/10/96, Bill Stewart wrote: > >>Of course, if you happen to become dead while you're storing it, >>the paper cash is far more useful to your heirs, so I assume we'll have >>a government-sponsored cash-escrow system announced soon to protect >>the government's interest in collection of inheritance taxes... > >Don't give them ideas, Bill! They are known to monitor our list for >insights into what to regulate next, and I can see the 15-watt lightbulbs >going on over their heads as they ponder the wonderful opportunities >presented by "digital cash escrow." You're one to talk, Tim :-) A couple years back you joked about a "Position Escrow System", and now Dorothy's proposing the technology to actually implement it! # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: GPS-based authentication
by jim bell 17 Dec '03

17 Dec '03

At 11:33 AM 4/11/96 -6, Peter Trei wrote: >I've read with interest your proposed GPS-based authentication >mechanism (it was posted to the cypherpunks mailing list). Can you >confirm that you wrote this? Some people on the list think it may be >a forgery. [deleted] >You say: >" The signature ... is formed from bandwidth compressed raw >observations of all the GPS satellites in view." > >" The location signature is virtually impossible to forge at the required >accuracy. This is because the GPS observations at any given time are >essentially unpredictable to high precision due to subtle satellite orbit >perturbations, which are unknowable in real-time, and intentional >signal instabilities (dithering) imposed by the U.S. Department of >Defense selective availability (SA)." I think that Denning's paragraph is misleading. S/A is stated; what I think they probably mean is closer to A/S, the anti-spoofing signal. The S/A error is small and changes only slowly, the A/S signal is far faster and could hold the data to implement the signatures. Even so, I think it would be comparatively easy to fake a signal if you are in view of most of the satellites in the area you wish to fake; attempting to fake something around the world would be harder. Aside from the technical difficulties associated with this system (everyone has to have a GPS receiver, for instance) there is an obvious political problem associated with trusting the government. After all, only its agents are supposed to know the dithering code which will be transmitted by the GPS satellite; its agents would presumably be able to fake their location since they can anticipate the data being transmitted. Which raises an interesting issue, I think: Would it be possible to remove the ability of the government to fake these signals, even if the rest of the system worked? The goal would be to prevent anybody (including the operators of the GPS system) from being able to anticipate the dithering codes the GPS satellites would send. One way to do that is to combine multiple random/pseudorandom bit streams (from hundreds, thousands, or maybe even millions of independent sources, perhaps you and me) into an overall stream, in such a way (XOR) that no data contributor could know how the result came out until he saw it. Each contributor would be able to verify, however, that his data stream was used to form the eventual bit stream, and he is confident of the randomness of the system he uses to generate that stream. (If he isn't, he should just change systems, or add another system to his equipment and XOR the results before he sends them off, crypted, to the central data combiner.) Release of the decrypt keys could be delayed "just long enough" to prevent faking. BTW, I'm not endorsing the underlying idea. I think it's a leap backwards for freedom. Jim Bell jimbell(a)pacifier.com

1 0

Re: On computer face recognition:
by geeman＠best.com 17 Dec '03

17 Dec '03

There was a piece, I _think_ in Scientific American, tho it might have been an AI journal, on face recognition by use of neural nets together with what were called "eigenface" images: These eigenfaces each have specific characteristics, which when combined together can closely approximate a specific face image. The target face was analyzed in terms of closeness-of-match to a small set of eigenfaces, on the order of 5 to 8, I think. Results of course were promising (else why write about it, eh?) if not excellent. At 12:14 PM 4/11/96 -0700, you wrote: >At 10:02 PM 4/10/96 -0700, you wrote: >> >>On computer face recognition: >> >> >>>> Shaving probably will not be a problem, but holding your head at a >>>> slightly different angle... will screw up the system totally, >>>> unless the system has radically improved since the last time I read >>>> up on it. >> >>At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >>> Well, the systems I have seen are quite good at finding people's eyes. >>> Scaling (for distance), and rotation (for the angle of your head) >>> therefore don't really confuse the system once it has your eyes. >> >>Finding the eyes can only control for rotations in the plane of >>the image, when you tilt your head to one side. They cannot >>handle the much more common case of 3D rotations, where you >>look slightly to the right or slightly to the left of camera. >>Facial expressions also throw them badly. >> > >Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of >Lawences papers is on using Neural networks to recognize faces. Methinks >that the state of the art is advancing rapidly and such problems as not >looking at the camera or changing your expression are rapidly being overcome. > > >===================================== >dwl(a)hnc.com > >Zippity do da, zippity ah, my oh my what a wonderful day. >Ya right, and hear I am without time to finish a cup of coffee. > >

4 3

Pub Key patent update
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

The battle over the public key patents continues, with no end in sight. Recent events: * Cylink tried to get a preliminary injunction against RSADSI shipping BSAFE for contributory infringement of the Stanford patents. The judge denied it, saying there was doubt about the validity of Diffie-Hellman and about the scope of Hellman-Merkle. * Cylink is appealing the preliminary injunction denial to the Federal Circuit. * Cylink's lawsuit to break the MIT RSA patent on obviousness and other grounds is scheduled to goto trial on July 9 before an LA judge. I don't know where the trial will be held. * RSADSI had a license to the Stanford patents dating back to around 1987, and it argues that it covers BSAFE customers. Cylink recently demanded a 5% royalty, and when RSADSI refused, Cylink unilaterally terminated the license. Cylink is now adding a direct infringement claim against RSADSI. * RSADSI and PKP motions for dismissal of my charges have left most of them intact. In particular, the antitrust charge is still alive. * My motion for summary judgment on the invalidity of the patents is technically still pending, but the judge shows no sign of ruling anytime soon. If my arguments were either clearly correct or clearly incorrect, he would have ruled by now. I cannot predict what will happen. * Trial on the Stanford patents is likely this summer. RSADSI is trying to postpone it. Roger Schlafly phone: 408-476-3550 CompuServe: 76646,323 US Mail: PO Box 1680, Soquel, CA 95073 USA Internet: rschlafly(a)attmail.com

1 0

First Seven-Year-Old to Encrypt Solo!
by tcmay＠got.net 17 Dec '03

17 Dec '03

I know Perry dislikes anything that smacks of mention of our personal lives and that is not related to the IPv95 specs, but this is of interest, I think. If not, ignore it and go back to reading the thread du jour. On Saturday many of us--several dozen Cypherpunks, at least--had a beach party/cookout on Tunitas beach, between Pescadero and Half Moon Bay, roughly 30 miles south of San Francisco and 50 miles north of Santa Cruz. Arranged by Doug Barnes, with help from Jim McCoy amongst others, it was a blast. We looked at Comet Hyakutake, though no longer at peak brightness, and even used the night vision scope provided by Jay Holovacs. Numerous CPs in attendance, including Sandy Sandfort, Eric Hughes, Bill Stewart, Sameer Perekh, Jude Milhon, Jay Campbell, Eric Hollander, Russell Whittaker, Romana Machado, and on and on. (Sorry if I left anyone out...it got dark and I didn't seen everyone, anyway.) Ironically, the little girl who died today in a plane crash stunt was from Pescadero, and took off yesterday from Half Moon Bay's airport. It has no direct relevance to us, but is an interesting coincidence, given the small sizes of these towns. Synchronicity happens. If Sameer can paraphrase Freud, I can paraphrase Jung. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Add me (Net.Enemies List)
by smith＠sctc.com 17 Dec '03

17 Dec '03

Please add my name to your list of Net Enemies. I'd rather start out branded as subversive and retain the freedom to be myself. Otherwise I might be tempted to keep silent and feign political correctness. Rick. smith(a)sctc.com secure computing corporation

1 0