December 2003 - cypherpunks-legacy

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 06:44 PM 6/1/96 +0000, Deranged Mutant wrote: >There was a story on CNN about how anonymous people on IRC (and other >commercial online chats) giving stock tips is a Bad Thing (tm). >Actually had some guy saying that a law should ban anonymous >discussions of stocks online. > >Yeesh. What ever happened to caveat emptor? (Like a recommendation >on IRC is automatically more trustworthy than overhearing a >conversation in a public bathroom?) One of the oldest tricks for running a stock up (or down) is to put rumor teams on elevators in the financial district of major cities. All day long, they ride up and down elevators having whispered, but not unintelligable, conversations about the target company. Of course, they "accidentally" drop what sounds like important insider information. Just think how much more efficient the Net can be for such activities. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Compressed data vulnerable to known-plaintext?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Someone who claimed to be Mark M. said on Sat, 1 Jun 1996: (I said:) > > Why not simply use two session keys, and encrypt the headers with one > > while encrypting the actual data with the other? That seems to solve both > > problems, except that more CPU cycles are required. > > An easier solution would be to just strip of the headers. If the header is > always the same, then it is redundant. If it varies, then it cannot be used > as known-plaintext. But then you still have the problem of identifying the contents. If there were no headers, one could not tell if the message was compressed using ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, or even if it was left alone. One could also not tell if the decryption happened successfully. ( * Yes, I know tar is not compression. )

2 1

Reply to anonymous ping.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

Your code name is: an611909(a)anon.penet.fi.

1 0

Re: [Off-Topic] "Curfews"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:59 AM 6/2/96, Duncan Frissell wrote: >Of course curfew laws only control the inarticulate and scruffy. Well >dressed children (coat and tie for the boys dress or suit for the girls) who >can claim that they are out doing tons of protected things like work and >school and worship and political campaigning and "trying to save street >children for Jesus" will not be picked up. They can also say things like This, by the way, is the main thing that concerns certain civil rights groups (including the Santa Cruz chapter of the ACLU). They say they'll be monitoring enforcement patterns to see if more "children of color" are picked up than their percentage in the population represents. >"Ossifer, I'm peaceably assembling to petition the government for redress of >grievances. It's in the First Amendment. You could read about it and >everything." Personally, I liked my "religious exemption" example. The Baal worshippers can claim that they are engaging in their religion by grokking the darkness. If picked up and held, they can claim they are "being held without Baal." >to be accused of "owning slaves just like Thomas Jefferson." Parents can >also give their kids blanket notes of permission to be out on the streets. > Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. (It's this taking control from both the kids and their parents and putting it in the hands of cops that really bugs me.) By the way, if being out after curfew is breaking the law, can I make a "citizen's arrest" of some of those nice young chicas in Watsonville? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RISKS: Pachinko card counterfeit background
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------ ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

RE: [Off-Topic] "Curfews"
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. ................................................................................... (sigh) Once again, the individual is backed up against the wall and made to answer to the State ("specifically") for their behavior in the world of human action. ("so who are you that I must explain myself to you?") I was considering the inclination of the list membership to focus upon technological, rather than political, solutions to certain social problems. Would a focus upon the idea of individual self-ownership & authority have any effect upon the State? (who *are* those people, anyway) The State resorts to the use of forcible methods in order to keep their non-valuable citizens in line. The citizens who feel themselves unfairly included resort to the use of technology to deal with impositions of the State upon them when their own ideas on morality are not accepted as legitimate. A lot of people talk about morality and justice, but really who gives a flip. The place of these ideas in the everyday life of each person reduces to irrelevance in the face of all the ignorance and cynicism, and in consideration of the alternative technologies which can be used in place of reasoning, when reasoning makes no difference (when you can't force people to think, as often happens). "I think it's time we re-evaluate the nature of our relationship". .. Blanc

1 0

RISKS: Pachinko card counterfeiting update
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

No Subject
by ezekiel＠alpha.c2.org 17 Dec '03

17 Dec '03

winn(a)Infowar.Com wrote: > > The article discussed the advanced information warfare techniques used by the > perpetrators. "According to the American National Security Agency (NSA), they > have penetrated computer systems using 'logic bombs' (coded devices that can be > remotely detonated), electromagnetic pulses and 'high emission radio frequency > guns' which blow a devastating electronic 'wind' through the computer systems." > [For a complete description of HERF Guns (coined by Schwartau in 1990), see > "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth > Press, 1994] > Thanks for the info (and for the excellent book, by the way). Can you explain in little detail what are these logic bombs? Also, why these institutions do not install protection from HERF radiation and TEMPEST-type protection from information leaks? Do they think that paying ransom is cheaper than all investment in IW-protection? thanx

1 0

Riding online elevators (Was CNN: Anonymous Stock Tips)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In my mail this morning was this bit of spam, I never heard of this guy before, Likely scooped my mailing address from misc.invest.stocks. -Newman --Fwd-- >http://chancellor.stockpick.com > >I just got wind that Chancellor Group is reporting big quarterly earnings. >SGA Goldstar is just sending out a "buy" recommendation. I understand other >investment advisors are looking to recommend CHAG. The company has a >strong book value. The short sellers need to cover. This looks like a >good situation to me. What do you think? They are located at: > >http://chancellor.stockpick.com > >Bruce Keller, 203-869-8137 > >To terminate from my Internet Investment Opportunities, Reply to >term(a)portlandweb.com with "remove" in the subject field.

3 2

Re: Multiple Remailers at a site?
by Bill Stewart 17 Dec '03

17 Dec '03

>I don't think multiple remailers at the same site help anything. Assume Alice, Bob, and Carol are on abc.com and Xenu, Yak, and Zut are on xyz.com. Remailing between Alice, Bob, and Carol doesn't make appear to make much difference, but it does reduce the damage if one of the remailer's keys is compromised. On the other hand, mail from Alice -> Xenu -> Bob -> Yak -> Carol -> Zut adds traffic to the system, and makes traffic analysis more difficult, even if the Bad Guys are watching site abc.com and have stolen Alice, Bob, and Carol's keys. The other threat it helps with is that if XYZ.COM gets complaints about that evil user Zut, she can kick her off (Bad Zut!) and still leave Xenu and Yak alone; if the remailer service were provided by the machine owner herself she might be directly liable. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Rescind Authority!

3 7