December 2003 - cypherpunks-legacy

Re: Newt's phone calls
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Bill Stewart writes: > >>Tapping cellphones is more trouble than tapping wired phones - >>they move around, and to tap them from the phone company end >>requires taps everywhere that you activate when you know where >>somebody is. > >Exactly. So how come mom&pop with a scanner were able to record BOTH sides >of the conversation without interruption? This seems pretty suspicious to >me. I think Old Newt was targeted by someone inside the phone company, who >was eavesdropping on all of his cell calls. Both sides of a conversation are audible on a single channel due to its use for sidetone. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development 1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future! --Adolf Hitler

1 0

Re: Newt's phone calls
by azur＠netcom.com 17 Dec '03

17 Dec '03

>If the person with the cell phone doesn't move, then they don't >get handed off to a different cell. That means that they >stay on the same frquency. No need to scan channels if they don't switch. Wrong Eric, cells are constantly expanding and contracting as subscribers in motion are transferred in and out. Thus you can be stationary, holding a conversation, and assigned to cell A when all of a sudden subscribers enter from adjacent cells B and C threatening to fill cell A beyond capacity. To keep from dropping calls in cell A the MTS will determine which calls can safely, due to signal strength and adjacent cell capacity, be transferred to another cell. If your conversation is selected then off you go to another, geographically overlapping, cell. The MTS can't be sure which subscribers are stationary and which are in motion (it really doesn't care). We saw this unexpected phenomenon frequently during development of Cylink's SecureCell and finally had to recommend our users be stationary during use, because our modems did not tolerate handoffs well without retraining, in order to offer the best chance of uninterupted communication. > >What Bill's saying is that it is difficult to tap the cell phone of >a _particular_ person with just a scanner. However the people >who taped Newt were just scanning for whatever they could get. That's easy. Yes, you need a device which can simultaneously listen to the paging/controll channels and determine, when a handoff to a monitored conversation occurs,to which new channel pair they have been assigned. I seem to recall such a device was for sale a few years back using a ISA/EISA card and some DOS compatible software. It connected to the ubiquitous and well characterized Oki 900 cell phone. >-- >Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm >PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

2 1

Re: Newt's phone calls
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> >Tapping cellphones is more trouble than tapping wired phones - >> >they move around, and to tap them from the phone company end >> >requires taps everywhere that you activate when you know where >> >somebody is. >> >> Exactly. So how come mom&pop with a scanner were able to record BOTH sides >> of the conversation without interruption? This seems pretty suspicious to >> me. I think Old Newt was targeted by someone inside the phone company, who >> was eavesdropping on all of his cell calls. >> > >It is also possible that somewhere in the chain of information between >mom&pop, the media, and us, the distinction between "cordless phone" >and cellular phone. I gather it was a conference call that was >intercepted. All it takes is one participant using a cordless phone in >range of one scanner, and the whole conversation is compromised. > >(Someone mentioned that they thought cordless phone intercepts weren't >illegal the way cellular phone intercepts are. IANAL, but I recall that >intercepting both was made illegal by the same legislation.) Sorry Alan, they were right. The Supreme Court ruled that unlike cell phones, cordless phone users could presume privacy. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development 1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future! --Adolf Hitler

1 0

Re: New US regs ban downloadable data-security software
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> shamrock(a)netcom.com (Lucky Green) writes: >> > Commercial data security software of any kind, regardless if it uses crypto >> > or not, is however prohibited from being distributed via the Internet or >> > being exported by any other means. >> But does it ban commercial companies from benefiting from their software if it is illegally exported (e.g., via the Net). Should, for example, PGP find users of its new software (who might be outside the U.S.) paying via ecash, should they accept the payment? -- Steve

1 0

Re: MAJOR MSIE SECURITY BUG
by Bill Stewart 17 Dec '03

17 Dec '03

It's rather self-serving to call this major lack-of-feature a MAJOR SECURITY BUG. Sure, it limits what you can do, but if it does what it claims to do, it's not a bug, it's just lack of vision, and there are _far_ more targets at Microsoft for complaints about that :-) MAJOR SECURITY BUGs are things like ActiveX and JavaScript-you-can't-turn- off. At least they seem to take a fail-secure approach to unknown CAs (even if it is fail-hostilely) rather than a more typical Microsoft fail-insecure-but-friendly fallback. The interesting capability that setting your own CAs isn't just that it lets you choose which service providers can be roots of a hierarchical tree-of-CAs model - it's that it lets you go beyond that model to support a web-of-trust model like PGP's, which is a Good Thing. You can duplicate this in a hierarchical world (if you must :-) by being the your own CA tree root, and certifying the other CAs you like. Netscape's original SSL implementations also only supported one CA root (Verisign), but after they got that working, they added user-selected CAs as well. Maybe MS will add this later? At 11:23 AM 1/10/97 GMT+2, source(a)iaccess.za wrote: >MSIE has a MAJOR security flaw in that it limits MSIE users to a very >restricted set of secure sites ONLY. Netscape Navigator does not have > this MAJOR limitation. >The bugs prevents access to Secure Servers other that those which MS >has decided to grant a monopoly to. This is both limiting to users >and inhibits Servers to their choice of Certificate Authorities. ...... >When MSIE does not recognise a Certificate Authority, it prompts the >user by saying it cannot connect to that site and gives the user no >opportunity to connect or access the Certificate Authority. >One of the ways the Certificate authorities are getting around this >problem is to publish a page listing their certificates. >The problem however is that users have to know this in advance and >MSIE gives no indication that this is >what needs to be done or where to go. .... >CompuSource in South Africa tries to accomnodate MSIE users by [.....] >https://www.compusource.co.za [.....] >Regards, >The Power Team >SMTP: source(a)iaccess.za Tel: +27-21-75-9197 >HTTP: http://www.compusource.co.za FAX: +27-21-72-8005 >FTP: ftp://ftp.compusource.co.za Postal: Building 6, Room 201 > CompuSource (Pty) Ltd # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

A Special Offer!
by dozer＠netwizards.net 17 Dec '03

17 Dec '03

Are you interested in making Millions in your spare time? Any housewife could do it and so can you! Just email me at dozer(a)netwizards.net to receive your FREE information packet. Thanks for your attention, and I'll be talking with you soon. Bill dozer(a)netwizards.net

1 0

Re: Newt's phone calls
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:58 PM 1/14/97 -0600, Michael Tighe SUN IMP wrote: >Bill Stewart writes: >>Tapping cellphones is more trouble than tapping wired phones - >>they move around, and to tap them from the phone company end >>requires taps everywhere that you activate when you know where >>somebody is. >Exactly. So how come mom&pop with a scanner were able to record BOTH sides >of the conversation without interruption? Tapping the wire part is what's hard; the radio part (for analog cell phones) isn't that tough. That makes the "legitimate needs of law enforcement" (blech!) at some disadvantage compared to people who just want to have fun listening in on the radio. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Newt's phone calls
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:58 PM 1/14/97 -0800, Eric Blossom wrote, correctly: >> Eavesdropping on cellphones is illegal, since there's an expectation of >> privacy. >Ummm, Eavesdropping on cellphones is illegal, because it's illegal. >See the Electronic Communication Privacy Act (ECPA). Since when does >anybody talking on a *radio* have an expectation of privacy? OK, more precisely, the justification for cellphone eavesdropping being illegal and cordless phone eavesdropping not being illegal was that there's an expectation of privacy from cellphones ("they're from the Phone Company") but not from cordless (everybody with early cordless phones knew they could receive their neighbor's calls if they used the same channel.) >Listening in on normal cordless phones is also now illegal, as a >result of the Communication Assistance to Law Enforcement Act >(Digital Telephony). Good point. The latest word from Louis Freeh is that he's all gung-ho to investigate the CRIMINAL grandma&grandpa who were EAVESDROPPING on Newt's phone calls. Of course, if _he'd_ been eavesdropping on Newt's phone calls, or yours, it would have been the "legitimate needs of law enforcement" at work. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Airport security [no such thing]
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:23 PM 1/14/97 -0800, Lucky Green wrote: >As most readers probably know, laptops are often subject to manual >scrutiny. From my non-representative sample, about four out of five tote >bags clearly containing laptops will be manually searched. It's extremely airport, guard, and moon-phase dependent. Some places are real picky, some aren't. I've started following someone's advice about having the laptop go through vertically; it doesn't look like a big opaque block to them, and they can see the rest of the stuff. When I tried it in Orlando, they said "It has to go through lying down", ran it back through lying down, said "Computer", I said "Yup", and they handed it to me :-) >Typically, the attendant requires that the laptop is powered up. >In none of the 20+ manual searches I witnessed did the security personnel >wait past the RAM check before clearing the passenger. I could not help >but contemplate how much of the insides of the laptop could be replaced >while still obtaining an identical display. I've convinced a number of guards to be satisfied by the little LCD-battery-status display that shows it's on and charged (and asleep) without having to actually boot it up (which now that I'm running NT, which doesn't really understand power-management, is a big win...) The two batteries could be replaced with <illegal joke deleted> and the little 5-minute keepalive battery could run that display just fine. It wouldn't take much more to get the main LCD screen to look convincing. On the other hand, there are places that have Real Security Guards; I have a photo of the ceiling of an Israeli bus station where I had to demonstrate that my camera really was camera-like. >Then came the big one: A man wearing a beer truck driver uniform approached >the checkpoint. On his hand truck were two kegs of beer. .... >I was flabbergasted. They let a man with two *large steel containers* enter >unchecked? No asking for ID, no X-ray? I struck up a conversation with the >beer truck driver. I asked him why the kegs did not get X-rayed. He looked >at me with an expression of utter lack of understanding and answered: "They >are too heavy to be put on the [conveyor] belt." Yow! (And also - it's nice that people can occasionally do sensible things even if they're against regulations :-) But you would expect them to have a guard escort the guy to the bar (requiring someone to come back later and take the beer out of the false bottom of the keg. You can already get away with being almost anywhere by being dressed as a pizza deliverer or air-conditioner mechanic or clipboard-carrier; I guess beer-deliverer needs to be added to the list. As long as you act like you belong somewhere.... A more serious example of getting away with things by looking like you're doing something your supposed to be doing was the man who walked out of Nazi Germany carrying a ladder (as told to me by someone else who'd left Germany.) Nobody thought to question him, and it was an era that a laborer not having a truck was normal... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Airport security [no such thing]
by Krenn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 14 Jan 1997, Lucky Green wrote: > I recently took a domestic flight from the Oakland, CA airport. While > waiting for the airplane, I spent some time observing the security measures > at the X-ray machine. > > As most readers probably know, laptops are often subject to manual > scrutiny. From my non-representative sample, about four out of five tote > bags clearly containing laptops will be manually searched. Typically, the > attendant requires that the laptop is powered up. In none of the 20+ manual > searches I witnessed did the security personnel wait past the RAM check > before clearing the passenger. I could not help but contemplate how much of > the insides of the laptop could be replaced while still obtaining an > identical display. I have had the same experience. I am sure that removing all components of the laptop not required for its functioning would yield a significant amount of room inside, especially for larger (non-"notebook") machines. I'm not an expert on explosives, but I would imagine a laptop-full of whatever could be pretty nasty. Someone with determination could even make it look like it had a floppy, a CDROM, etc, just by replacing the devices themselves with facades. Not that the airport security would notice, but anyway. But wait - won't the all-important "did you pack your bags yourself" and "did anyone give you bags to take on the plane" stop them? ;-) It just obviates the fact that airport security is really useless against a determined attacker, but manages to be extremely annoying to everyone else. Krenn -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMtyOLknqfwPpt/QVAQF5PAQArUhAYtLjoSwsKspwysZYvwP0kCEs9ncS xN5VaZTi/ow5xOcoVXbRhGQPlu5v1sL+04yLz+1AWnYX2UdtIdSBlZAhtNufOCQg Au0cDp6vKeL/GIGEYX3/HEsDjicpbfXSuq+OZ79hhhButM+5jlsXz972nhLkmEvM aeVSFjB9WHY= =FYTH -----END PGP SIGNATURE-----

2 1