December 2003 - cypherpunks-legacy

Re: trusting the processor chip
by Rick Smith 17 Dec '03

17 Dec '03

cwe(a)it.kth.se (Christian Wettergren) writes: >Take a look at the IEEE Symp on Security and Privacy Proceedings from >1995, I believe it was. There was a paper there about security bugs in >the Intel processors, enumerating a number of them in 80386 for example. >There where at least one or two byte sequences that plainly stopped >the processor. Yes, and this is where the real risks are. The original question was entirely about explicit subversion. The larger risk is accidental flaws. Same with software in most cases. Rick. smith(a)sctc.com secure computing corporation

2 1

About your online business.
by 05551984＠turboma.dyn.ml.org 17 Dec '03

17 Dec '03

---> Do you run an online BUSINESS? ---> Are you interested in electronic MARKETING? ---> Do you want to dramatically INCREASE your SALES? Keep reading... we will explain you how your business can take advantage of bulk e-mail's incredible power! Dear fellow online entrepreneur, If you're like me, you're certainly very enthusiast about the Internet's possibilities. However, we all know that the biggest challenge is to give our sales material a decent visibility. With all those competitors around, you must take action to reach out for customers, to directly reach your potential buyer. You probably already tried dozens of different ways to promote your online business... Search Engines are now overloaded and unlikely to bring much business... Online Malls are expensive and they often won't bring you sales... Newsgroups promotion is now out of question. You need a media that directly reaches out for the customer. You need to use bulk e-mail. Imagine... your sales pitch sent to thousands of potential buyers. It's almost like a virtual flyer distribution. And the best part is that you won't have to spend much to take advantage of this incredible marketing tool. Here's a glimpse at our prices: - 100,000 mailings: only $69.95 - 1,000,000 mailings: only $249.95 To get full details and contact information, just write any message to our automatic autoresponder: siminfo(a)answerme.com Again, all you have to do is to send us any e-mail at siminfo(a)answerme.com You will then receive all information via e-mail within minutes. Bulk E-Mail will turbocharge your business. Don't delay. Act now! Yours trully, Pierre Roussil - SIM Inc. PS: Request the information NOW to take advantage of our HOT limited time offer! ***************************************************************** If you wish to be removed from our mailing list, please write us at simrem(a)answerme.com . You will receive a removal confirmation via e-mail. Thank you. *****************************************************************

1 0

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 10:50 AM 4/26/96 -0500, Rick Smith wrote: >Having penned the response to Jeffrey Flinn on the unlikelihood of >processor back doors, I'll comment on jim bell's response: >> More likely,I think, an organization like the NSA >>might build a pin-compatible version of an existing, commonly-used product >>like a keyboard encoder chip that is designed to transmit (by RFI signals) >>the contents of what is typed at the keyboard. It's simple, it's hard to >>detect, and it gets what they want. > >Simple, no. By NSA standards, it is simple. NSA has probably had its own semiconductor fabs for 30+ years. Even if we assume that their capabilities lag commercial production in terms of density or quality, keyboard encoder chips were trivial 20+ years ago and could presumably be easily duplicated/modified today by even the oldest operating fabs. They probably had far less than 10,000 transistors. Even modern keyboard controllers probably "waste" a microcontroller with far more capability than you'd need for the task, and microcontrollers usually have substantially more code area than would be necessary to add some sort of surreptitious function. >Hard to detect, somewhat. You'd have to know what to look for. >Gets what they want, unclear. If there was one single data stream you'd like to get, it's the keyboard. This doesn't get you everything, but close.

1 0

APPLIED CRYPTOGRAPHY 2nd EDITION Errata version 1.3
by Bruce Schneier 17 Dec '03

17 Dec '03

I just mailed a copy of the new errata to everyone on my mailing list. If you didn't get one, it means that you are not on my mailing list. Send me e-mail to correct that oversight immediately. Wiley has not yet committed to making an updated version of the book. If you want to complain to my editor, he is psutherl(a)jwiley.com. Bruce ************************************************************************** * Bruce Schneier APPLIED CRYPTOGRAPHY, 2nd EDITION is * Counterpane Systems available. For info on a 15% * schneier(a)counterpane.com discount offer, send me e-mail. * * For Blowfish C code, see ftp.ox.ac.uk:/pub/crypto/misc/blowfish.c.gz **************************************************************************

1 0

NEW ON THE NET
by goldencareers.com＠renoir.webservices.net 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> NEW ON THE NET. How would you like to have been part of the first group to join Amway in the 60s or purchased stock from a small company called Wal-Mart in the 70s or had invested in a small computer chip maker called Intel of the 80s. Anybody that made these decisions above are sitting pretty good at the moment Here in the 90s a new company, was launched on the net, This young company has positioned itself to be among the major players for years to come. This is not a get rich scheme. This is simply a new company, with fresh ideas, a new company that people are going to hear a lot about. If you would care to become a part of all the excitement, and learn more, just simply send e-mail to sales(a)scarlett.org Please put MORE INFO. in the subject field.You will have info. vary soon. THIS IS TRULY A COMPANY AHEAD OF IT'S TIME. Thank You For Your Time. </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:01 AM 4/26/96, Christian Wettergren wrote: ... >They "promised" to build their own "processor tester" to try to find >the most obvious ones at least. But it will be very hard to find all of >these bugs, judging from the released bugs. Some of them are only >appearing sporadically under a pretty complicated set of circumstances, >like what is in the pipeline, the cache etc... > >The processor is ever important, if it is illdefined or flakey, it is >almost impossible to build security on top of it. Maybe true in theory, under special circumstances, but not something of immediate importance. Finding bugs is important, but no modern processor chip set (including the peripheral chips) is likely to be "100% secure," whatever that means. (The NSA and its minions put out the "Rainbow Books" to define this, and few machines come close to the top rating...) There was a British plan some years back to develop a "provably secure" microprocessor for life-critical applications, e.g. train controllers. It was called "Viper." Last I heard, the project was not progressing. It seems that most people would rather use the hundreds of MIPS of processing power of a modern, high-density processor that the sub-MIPS power of a Viper-type chip. (I'm not of course saying that processing power and security are inverses of each other, only noting that they haven't gone together so far.) The most famed chip flaw of all time had no security implications, nor would it ever have affected a single life. (Except stock market lives.) I'm glad Intel offered a recall and fixed the bug, but the plain fact is that the bug truly was obscure and could only be demonstrated under contrived conditions. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Click here to become an International Arms Trafficker
by Vincent Cate 17 Dec '03

17 Dec '03

"Click here to become an International Arms Trafficker" Offshore Information Services Ltd. has set up a web page to make it really easy for people to become International Arms Traffickers. All they have to do is fill in their name and email address and then click. Check out: http://online.offshore.com.ai/arms-trafficker/ If you think this is half as funny as I do, please make a link from one of your pages to this one. -- Vince

1 0

Re: US law - World Law - Secret Banking
by jim bell 17 Dec '03

17 Dec '03

At 02:13 AM 4/26/96 -0700, Rich Graves wrote: >On Fri, 26 Apr 1996, Michael Loomis wrote: > >> I have been reading this list to get an idea where Declan gets some >> of his lunatic ideas and what Rich Graves says when he is not up to >> Holocaust fetishism. Despite Timothy's claim to the contrary, it seems >> that the basic point of this list is some libertarian notion that tax >> evasion is a good thing. > >That might be one view, but not mine. I think people who evade income >taxes are bad -- they're stealing from the rest of society. If a criminal mugs you for $10 each morning for a month, and on the 32nd day you decide you've had enough and pull a gun and defend yourself, does that mean that you're stealing from him?!?

1 0

Re: trusting the processor chip
by Rick Smith 17 Dec '03

17 Dec '03

Having penned the response to Jeffrey Flinn on the unlikelihood of processor back doors, I'll comment on jim bell's response: >This analysis seems to assume that the entire production run of a standard >product is subverted. Actually, I perceived two models: either all processors are subverted or a subset of them are. Both require a reasonably complete design team to reliably achieve the objective of a well hidden and reliable back door. The cost effective thing to do is use the original design team since they have the knowledge you need to pull it off. A different and/or much smaller team has a lower likelihood of success. > More likely,I think, an organization like the NSA >might build a pin-compatible version of an existing, commonly-used product >like a keyboard encoder chip that is designed to transmit (by RFI signals) >the contents of what is typed at the keyboard. It's simple, it's hard to >detect, and it gets what they want. Simple, no. Hard to detect, somewhat. Gets what they want, unclear. My experience with processor design and development is rather ancient and my knowledge of IC work is third hand, so I'll gladly defer to someone with closer knowledge of the process (Tim?). However, I've never heard anything to imply that a processor architecture can be cleverly and reliably dinked with in this manner without lots of expensive engineering. Where does the chip real estate come from? Is there room in the microcode for this? Will it destabilize other behaviors? Will the victim detect it through RFI testing? No, it's not impossible. The risk vs reward tradeoff is shaky. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

My 9th grade classmate Rick Smith wrote: >Having penned the response to Jeffrey Flinn on the unlikelihood of >processor back doors, I'll comment on jim bell's response: >> More likely,I think, an organization like the NSA >>might build a pin-compatible version of an existing, commonly-used product >>like a keyboard encoder chip that is designed to transmit (by RFI signals) >>the contents of what is typed at the keyboard. It's simple, it's hard to >>detect, and it gets what they want. > >Simple, no. Hard to detect, somewhat. Gets what they want, unclear. I haven't been commenting on this part of the thread, but since I am asked to (below), I'll say that I agree with Rick on these points. Though there have been fictional accounts--e.g. the French novel "Softwar"--about replacement of chips with TLA versions, this tack is very hard to pull off. (The Infoworld "April Fool's Day" 1991 report that the NSA had arranged for printers entering Iraq to be modified so as to send intelligence info was gullibly picked up by several outfits that should've known better and reported as fact.) >My experience with processor design and development is rather ancient >and my knowledge of IC work is third hand, so I'll gladly defer to >someone with closer knowledge of the process (Tim?). However, I've >never heard anything to imply that a processor architecture can be >cleverly and reliably dinked with in this manner without lots of >expensive engineering. Where does the chip real estate come from? Is >there room in the microcode for this? Will it destabilize other >behaviors? Will the victim detect it through RFI testing? For high-volume parts, such as the chips in the usual PCs we all use, such a replacement would almost certainly need the cooperation of the chip makers. Not impossible to obtain, but not easy. A new "stepping" of the chip would probably be needed, though I suppose a chip with downloadable microcode could be used. Much more like, in my opinion, would be subversion of the software, a la Thompson's point about subverting compilers. And the work already done on "subliminal channels" that leak information (deliberately in this case) is apropos. I know that such channels were a major concern during the discussions of nuclear arms treaties. Speculatively, if such a hardware replacement is likely, this is where I would look first; but of course the parties to nuclear arms agreements know this as well. Anyway, there are all sorts of "maybes" and "possibles" here. Certainly there is no _technical_ reason why a "Pentium--NSA-enabled" variant of the Pentium could not be made...all things are possible. But how likely? And where in the spectrum of real concerns does it lie? And would Intel dare to cooperate with such a plan? And so on. This'll have to be my last word on this topic. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2