December 2003 - cypherpunks-legacy

Cell Phone Code Cracked
by John Young 17 Dec '03

17 Dec '03

For details of the crack see the cryptographers' press release at: http://www.counterpane.com/cmea.html The New York Times, March 20, 1997, pp. A1, D2. Code Set Up to Shield Privacy Of Cellular Calls Is Breached By John Markoff San Francisco, March 19 -- A team of well-known computer security experts will announce on Thursday that they have cracked a key part of the electronic code meant to protect the privacy of calls made with the new, digital generation of cellular telephones. The announcement, intended as a public warning, means that -- despite their greater potential for privacy protection -- the new cellular telephones, which transmit streams of digital information in code similar to computer data, may in practice be little more secure from eavesdropping than the analog cellular phones, which send voice as electronic patterns mimicking sound waves, that have been in use the last 15 years. It was such eavesdropping, for example, that caused trouble for Newt Gingrich when a Florida couple listened to his cellular phone conversation in December about the Congressional ethics inquiry. Now that digital wireless networks are coming into use around the nation, the breaking of the digital code by the team of two computer security consultants and a university researcher confirms fears about privacy that were raised five years ago when the communications industry agreed under Government pressure to adopt a watered-down privacy technology. Several telecommunications industry officials said the pressure came from the National Security Agency, which feared that stronger encryption technology might allow criminals or terrorists to conspire with impunity by cellular phones. But independent security experts now say that the code is easy enough to crack that anyone with sufficient technical skills could make and sell a monitoring device that would be as easy to use as a police scanner is. Such a device would enable a listener to scan hundreds of wireless channels to listen in randomly on any digital call within a radius ranging from 1,000 feet to a number of miles. Or, as with current cellular technology, if a specific person was the target of an eavesdropper, the device could be programmed to listen for any nearby digital call to that person's telephone number. Other possible transgressions would include using the device to automatically harvest all calling card or credit-card data transmitted with nearby digital wireless phones. And, because of a loophole in the Communications Act of 1934, making and selling such devices would not be illegal, though actually using one would technically be against the law. These monitoring devices are not yet available, but security experts said that a thriving gray market was certain to develop. And with technical details of the security system already circulating on the Internet instructions for cracking it will almost certainly make their way into the computer underground, where code breaking and eavesdropping are pursued for fun and profit. Technical details of the security system were supposed to be a closely guarded secret, known only to a tight circle of industry engineers. But the researchers performed their work based on technical documents that were leaked from within the communications industry and disseminated over the Internet late last year. "The industry design process is at fault," said David Wagner, a University of California at Berkeley researcher who was a member of the team that broke the code. "We can use this as a lesson, and save ourselves from more serious vulnerabilities in the future." Communications industry technical experts, made aware of the security flaw earlier this year, have been meeting to determine whether it is too late to improve the system's privacy protections. Already the digital technology is in use in metropolitan areas, including New York and Washington, where either the local cellular networks have been modified to support digital technology or where new so called wireless personal communications services are being offered. "We're already in the process of correcting this flaw," said Chris Carroll, an engineer at GTE Laboratories, who is chairman of the industry committee that oversees privacy standards for cellular phones. But Greg Rose, a software designer for the Qualcomm Inc. a leader in digital cellular systems said that fixing the flaw would be "a nightmare." Tightening the security system, Mr. Rose said, would involve modifying software already used in the computerized network switching equipment that routes wireless digital telephone calls, as well as the software within individual phones. Currently, about 45 million Americans have cellular phones, though most of them so far are based on an older analog standard that offers no communications privacy. But cellular companies are gradually converting their networks to the new digital standard, and the new personal communications services networks going into operation around the country also employ the digital encryption system. Nearly a million P.C.S. phones have been sold in the United States, according to cellular industry figures. Besides Mr. Wagner, the other researchers who cracked the code were Bruce Schneier and John Kelsey of Counterpane Systems, a Minneapolis consulting firm. Mr. Schneier is the author of a standard textbook on cryptography. The new digital wireless security system, which was designed by cellular telephone industry engineers was never intended to stop the most determined wiretappers. But because digital calls are transmitted in a format corresponding to the one's and zero's of computer language, they are more difficult to eavesdrop on than conventional analog calls, which are transmitted in electronic patterns. And digital calls protected with encryption technology -- basically a mathematical formula in the software that scrambles the signal -- would be all the harder for a third party to listen to surreptitiously. Because the encryption system that the industry adopted in 1992 was deliberately made less secure than many experts had recommended at the time, privacy rights advocates have been warning since that the code could be broken too easily. An announcement Thursday that the code has indeed been cracked would seem to bear out those concerns. "This should serve as a wake-up call," said James X. Dempsey, senior staff counsel for the Center for Democracy and Technology, a public interest group. "This shows that Government's effort to control encryption technology is now hindering the voice communications industry as well as the data and electronic communication realm." Industry executives acknowledged that steps must be taken to address the problem. "We need strict laws that say it is illegal to manufacture or to modify a device which is designed to perpetrate the illegal interception of P.C.S. telephone calls," said Thomas E. Wheeler, president of the Cellular Telephone Industry Association, a Washington-based trade group. Mr. Wheeler said the weaker privacy technology had been adopted not just to appease the Government but because makers of wireless communications hardware and software wanted to embrace a technical standard that would meet export regulations. Those rules, based on national security considerations, sharply curtail the potency of American-made encryption technology. The three computer researchers who broke the code belong to an informal group of technologists who believe strongly that powerful data-scrambling technologies are essential to protect individual privacy in the information age. These technologists, who planned to release their findings in a news release on Thursday, argue that the best way to insure that the strongest security codes are developed is to conduct the work in a public forum. And so they are sharply critical of the current industry standard setting process which has made a trade secret of the underlying mathematical formulas used to create the security codes. "Our work shows clearly why you don't do this behind closed doors," Mr. Schneier said. "I'm angry at the cell phone industry because when they changed to the new technology, they had a chance to protect privacy and they failed." Mr. Carroll, head of the industry's privacy committee, said it planned to revise the process for reviewing proposed technical standards. [End]

1 0

WebWorld 7-8
by Bubba 17 Dec '03

17 Dec '03

1 0

FBI Wiretap Payments
by John Young 17 Dec '03

17 Dec '03

The FBI has published in the Federal Register today: Implementation of Section 109 of the Communications Assistance for Law Enforcement Act AGENCY: Federal Bureau of Investigation, DOJ. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: This rule implements section 109 of the Communications Assistance for Law Enforcement Act (CALEA), which requires the Attorney General to establish regulations which set forth the procedures that telecommunications carriers must follow in order to receive reimbursement under Sections 109 and 104 of CALEA. CALEA requires that this rule enable carriers to receive payments in a timely and cost- efficient manner while minimizing the cost to the Federal Government. Specifically, this rule sets forth the means of determining allowable costs, reasonable costs, and disallowed costs. Furthermore, it establishes the requirements carriers must meet in their submission of cost estimates and requests for payment to the Federal Government for the disbursement of CALEA funds. In addition, this rule protects the confidentiality of trade secrets and proprietary information from unnecessary disclosure. Finally, it sets forth the means for alternative dispute resolution. ----- http://jya.com/fbi032097.txt (177K)

1 0

Re: U.S Mint Electronic Cash Study
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Thu, 20 Mar 1997 08:38:05 -0800 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: U.S Mint Electronic Cash Study Federal Reserve Governor Kelley and New York Fed President McDonough have both stated that the Fed has no plans to issue electronic money. See: http://www.bog.frb.fed.us/BOARDDOCS/SPEECHES/19960618.htm http://www.ny.frb.org/pihome/news/speeches/sp961008.html ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

ONK?: SANS Network Security Digest?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: ploshin(a)pop.tiac.net Date: Thu, 20 Mar 1997 11:39:22 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: Pete Loshin <pete(a)loshin.com> Subject: Re: DCSB: Stewart Baker on Clinton Administration Crypto Policy and Digital Commerce Mime-Version: 1.0 Bob, just a quick question, have you heard/seen anything on this: | The SANS Network Security Digest | | Contributing Editors: | | Michele Crabb, Matt Bishop, Steve Bellovin, Rob Kolstad | | Gene Spaford, Marcus Ranum, Gene Schultz, Dorothy Denning | ----A Resource for Computer and Network Security Professionals--- It's an $80/yr e-mail newsletter; there are a lot of recognizable names there, but the thing isn't digitally signed. Also, isn't it "Spafford"? Anyway, anything you know would be appreciated, and if you don't know anything, could you ask around (e.g., some of the likelier mailing lists which I no longer subscribe to.) <snip> Thanks, -pl /-------------------------\ | Pete Loshin | | BYTE | | 24 Hartwell Ave | | Lexington, MA 02173 | | vox +1 617/860-6830 | | fax +1 617/860-6522 | | pete(a)loshin.com | \-------------------------/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

3 2

Isn't this like a bad idea?
by Lile Elam 17 Dec '03

17 Dec '03

Hi folks, Selling email addresses seems to me to be a bad idea. Wouldn't it be better to have people sign up instead of this? I mean, it looks like this is for spammers. Who can I contact about this abuse? thanks, -lile >From mick3(a)concentric.net Wed Mar 19 21:18:24 1997 Date: Thu, 20 Mar 1997 00:17:18 -0500 (EST) Comments: Authenticated sender is <mick3(a)pop3.concentric.net> From: "mick3(a)concentric.net" <mick3(a)concentric.net> To: you(a)concentric.net Subject: 1 MIO e-mail addresses for sale Hello, and sorry to bug you... If you are not a business owner, we apologize. For Sale: 1 MILLION E-MAIL ADDRESSES FOR $95.00 or 2million for $ 155.00 - or 3 million for $ 195.00 Available on 3.5" disk or e-mail download. These are fresh lists, no BS...plain ASCI format, one per line. This is a one time mailing, you will not be contacted again. Send check or money order to: YMR - ADDRESS LIST P.O. Box 654 Marysville, Ca 95901 ( please specify, if you want 3.5" disk or have it sent via e-mail as *.zip file) Questions? call Mick at (916) 741-2622 TO BE PROMTLY REMOVED, TYPE "REMOVE"

2 1

PGP on AOL
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I want to help a friend of mine to set up PGP. She's using Win 95 and is on AOL. Can anybody recommend some good shells, that would make make it easier for her? Thanks already in advance... Ciao Harka -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMzJqzTltEBIEF0MBAQHIqwf/R5pOkHW87Nvjk2zSiVk9NRTbzrrPLaaG lOsGmY5m6t0A5wLLaIAYiVYG0ygF00Zau8YvUUkEB8dBw2ufItMWAcSMeYQnkKTU m3koJo6miy0EH3wyaaL2I44IM9q77b0jpZPxX+8kfYry2tLTYoCCyHdC/BGDdYTd M0jwM+VXPmrw+xnX3TUr2y5ggweR0zIBCuD+V0JodHiXg8x5GYsQ/uXKhtd9a4rJ QkIm9MU6gf0lPvzXFA6mjk6DDz7YqM4hoywn+4Dc4wJ/DaO6ZU5EXhkg2Q1vYBSN Jp7k6ZAoBPl8rsPem0C5t7Q7V3YRp3qeD6jV/K3YuMW6VgYJynDs6Q== =B09F -----END PGP SIGNATURE-----

4 3

NSA responds to criticism over weakening cellular crypto
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 20 Mar 1997 15:50:40 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: NSA responds to criticism over weakening cellular crypto John Markoff writes in today's NYT: Several telecommunications industry officials said the pressure came from the National Security Agency, which feared that stronger encryption technology might allow criminals or terrorists to conspire with impunity by cellular phones. But independent security experts now say that the code is easy enough to crack that anyone with sufficient technical skills could make and sell a monitoring device that would be as easy to use as a police scanner is. Below the NSA's Clint Brooks responds to Dave Banisar. -Declan ---------- Forwarded message ---------- Date: Thu, 20 Mar 1997 18:08:28 -0500 From: Dave Banisar <Banisar(a)epic.org> >Date: Thu, 20 Mar 1997 17:35:44 -0500 >From: Clinton Brooks <cbrooks(a)romulus.ncsc.mil> >Reply-To: cbrooks(a)romulus.ncsc.mil >MIME-Version: 1.0 >To: banisar(a)epic.org >CC: "Brooks, Clinton" <cbrooks(a)romulus.ncsc.mil> >Subject: Cellular Phone Flaw > >Dave, > > Re your comments on the flaw apparently found in cellular phones: > > We have released the following statement: > > "NSA had no role in the design or selection of the encryption >algorithm chosen by the Telecommunications Industry Association (TIA). >NSA also had no role in the design or manufacture of the telephones >themselves. As we understand the researchers' claim, it appears that >the algorithm selected and the way it was implemented in the system has >led to the stated flaws. > >NSA provided the TIA with technical advice on the exportability of these >devices under U.S. export regulations and processes." > > > Clint > ========================================================================= David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 PGP Key: http://www.epic.org/staff/banisar/key.html =========================================================================

1 0

WOW-COM Registration
by wow-com＠wow-com.com 17 Dec '03

17 Dec '03

Dear cypherpunks: Welcome to WOW-COM. By now you have had a chance to explore WOW-COM's rich content and features. Here are a few items to check out during your next visit. * The Wireless Daily News - updated three times a day. * WOW-COM's Career Center - The Wireless Workplace is the premiere source of wireless jobs. * Fraud and Antenna Siting Micro sites - latest news, legal developments, resources, and analyses from experts at CTIA. >From time to time WOW-COM will use email to inform you of new features. Please let us know if you do not want to receive these updates. WOW-COM does not sell or distribute its mailing lists. Sincerely, The WOW-COM Team wowcom(a)ctia.org http://www.wow-com.com

1 0

5.9 CENT PER MINUTE
by danny58＠speedydelivery.net 17 Dec '03

17 Dec '03

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ S P E C T R U M C O M M U N I C A T I O N S !!! 5.9 CPM (cents per minute) LONG DISTANCE!! BRAND NEW --- JUST ANNOUNCED!! NO BLACK BOX NEEDED!! YOU DO NOT HAVE TO PRE-PAY FOR LD!! _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ FREE PERSONALIZED WEB PAGE WHEN YOU JOIN OUR SUCCESS TEAM ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Tag-Team Email support in place ready to go! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ => * 5.9 CPM LONG DISTANCE - 24 hours every day * Billed in 6 second increments * NO black box required! NO minimum usage! * NO pre-payment on LD required * ONE TIME $50 to sign up * Sponsor just 2 to recoup your $50 investment * NO Minimum monthly purchase required * Commissions paid WEEKLY, not monthly * Phone cards available for your convenience * Fantastic pay plan ===> $300/day and $1000/day ============================================ COMING SOON * PrePaid Cellular * Nationwide Internet Services * Virtual Office Technology * International Call Back Service * TV Internet Devices (Web TV) * Discount residential/business 800 numbers * Satellite TV Equipment programming ============================================ We've signed up folks EVERY DAY since we joined! All our top leaders and heavy hitters are fully qualified and waiting for our next batch of NEW sign-ups to place people under. You sign up with us ... and you'll have the BEST upline support you've ever dreamed of. We have already given away over 100 people to our downline already ... you can be next!! From day one you'll qualify for group volume on all your levels down through INFINITY!!! We are co-op advertising to huge amounts of people. Once you respond to this email ... you will see why folks are flocking to us for the sharpest web pages and tag-team script email support. Folks, this blows away everything else out there! Spearheaded by an accomplished attorney and full staff with over 18 years of telecommunications experience and major carriers on board. Currently 3,000+ daily application processing ability about to triple in capability. This offers all the security you could want with the best opportunity on the market!!! There will be many multimillionaires created literally almost overnight with this program! You've seen the incredible explosion created over 7.9 LD, you can imagine how fast this will spread at only 5.9 with none of the hassles!!!! DON'T MISS OUT ON THIS EXTRAORDINARY OPPORTUNITY!!! Get details NOW and join before everyone else you know does!!! => We'll send you the Fast Fax on Demand giving you all the details => We'll send you the Phone number for a 3 minute introduction => We'll send you the Company conference call info => We'll send you the info on OUR upline/downline conf calls => We'll show you how easy and fast YOUR web page can be up $$ Yes, we are already getting checks! $$ Yes, we already have our packets from the company Don't join any group til you see the web page they will offer you!! Our web pages are fantastically and beautifully designed. Our web masters have encorportated technologies in this web page that others only hope for. We have it NOW and ready for you to use! HIT THE REPLY BUTTON and we'll immediately send out details so you can sign up FIRST and get into the BEST POSITION POSSIBLE! You have never found a better time than NOW !!

1 0