December 2003 - cypherpunks-legacy

TEMPEST open-source definition version 0.1alpha (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: TEMPEST open-source definition version 0.1alpha > Date: Tue, 10 Feb 1998 20:19:46 EST > From: Ryan Lackey <rdl(a)MIT.EDU> > time to reverse engineer the practical TEMPEST systems (and in so doing > perhaps the classified TEMPEST spec) out there. Next time I find a > TEMPEST case at swapfest, or at a con, I'll pick it up (if someone wants to > ship me one, so much the better). You *can* buy them from some vendors, Are you possibly confusing Tempest with a NEMA certified case? Educalc used to sell a case for the HP-41C calculator that they touted as NBC certified. I would suggest looking for one of the NIST certified environmental test cases that are available. They'll cook or chill your electronics and block the emissions quite handily. Be shure to get a supply for the copper door gaskets, they wear out under daily use about 3-4 times a year. ____________________________________________________________________ | | | The obvious is sometimes false; | | The unexpected sometimes true. | | | | Anonymous | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

TEMPEST open-source definition version 0.1alpha
by Ryan Lackey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- So, if we're going to try to protect computers from TEMPEST threats, and we don't have access to the multiple government classified standards, we should come up with the Cypherpunks TEMPEST standard. A theoretical definition of what we want to do (strong) is that we should be able to put the equipment in a virtual box, have an empty virtual box, and then nothing anything which is not in the TCB can do can distinguish one box from the other. Perhaps the "empty" box should also contain simulators for the ethernet, visible light output, and straight power draw (harmonics are still to be avoided), or in some other definitional way they should be accounted for. This prevents non-TCB programs from utilizing the EM spectrum as a covert channel. Additionally, we need to protect the user from divulging state information about his TCB. I guess this condition can best be met by simply saying "take the target system and clone its state perfectly. Separate the two systems. Allow the user to modify the state of the target system while you retain the clone -- you do not have a non-negiligible improvement in matching future state using the EM emissions of the first system over not using the EM emissions." I think there is a better way of stating this, though. So, given a workable theoretical definition which defines perfection, it's time to reverse engineer the practical TEMPEST systems (and in so doing perhaps the classified TEMPEST spec) out there. Next time I find a TEMPEST case at swapfest, or at a con, I'll pick it up (if someone wants to ship me one, so much the better). You *can* buy them from some vendors, although they often refuse to sell them to non-government affiliated entities). MIT's quasi-affiliated Draper Labs has proper TEMPEST verification equipment, and I think some places on MIT's campus have some general purpose equipment which can be used for such purposes. If not, I have a copy of NI LabView and some DAQ hardware which, coupled with some antenna frobbery, can be used to do a quick spectrum analyzer, and there's the capacity to do some serious analysis once the data are on the computer. It would be nice to know how good government TEMPEST systems really are. In practice, matching them would probably be enough. The above theoretical definition doesn't really help that much -- in practice, there's going to be some information coming out, and just because you can't figure out how to use it, doesn't mean no one can. I think preventing the covert channel attack might actually go beyond the government's TEMPEST spec -- certainly if a non-TCB program can cause a system reboot, or power up a peripheral, you can detect the change in power draw, unless the system naturally throws away the difference between its max power consumption and its present power consumption all the time. Being able to telegraph even 1 bit of information might be enough, and if you've got an arbitrary precision clock, you could use this method to send an arbitrary codeword from an arbitrary-length codebook given an arbitrary time interval. The rainbow books talked about covert channel elimination being a really hard problem. Now I see even more why they were right. IIRC, it's only at the not-really-commercially-available levels (A1) that covert channels are utterly eliminated; usually they are comfortable just documenting them. Of course, it would probably make a lot of sense to do TEMPEST reverse engineering in a country that has neither an OSA nor the ability to randomly classify research. Yet another project for cypherpunks.to, Lucky? A practical way of approaching theoretical TEMPEST-perfection is just a decent faraday cage with a lead-glass monitor cover, shielded or eliminated cables, and a serious double-conversion UPS. From the government TEMPEST products I've seen, that's all they are (or they use mesh). I've mainly seen thinks like the SafeKeyper, not general purpose computers, though. I don't think Jim was that far off the mark in thinking class B machines are a worthwhile starting point, but it doesn't go anywhere near far enough. ObCrypto: I've been looking at implementing a cipher in a reconfigurable processor. I might even customize one. Yay. ObGuns: I got to use a .22cal nail gun. It was fun. ObPersonalAttacks: There are a lot of people who are not Real US Citizens on this list. Beware the evil multinationalist conspiacy in our midst, good followers of Bill Clinton! ObQuestion: Can the US government deny a passport for no reason to a random US citizen who is not a felon? - -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNOD8sawefxtEUY69AQG3NQf9GWJjz3pwORa4y5V1YQA/BBAebDJNlnhd gauYxwALwsEIID20Da3x7f/ZZ/ipVH1fhk9SJYGgPK+mtc7HMpPA7WhEfR1awuyE FaP6VrJ18vKy6Cf+JlUbag2w5luQfSlo4o1jK0v6Os3D+PpuDyRN3GUI05dTxKyC +VfS8oiw+SaM455l1knHGnegLZzivCKGS/xXDFD71dl5QCRQsAMBaGrjg0pej8gJ ByiO4X7ae8OdlUytdQpfaNOtJTdSQJ7C3FLjczp9dQKvb7msfQUWzAWG9L8XneUP b6xRF5Ra1JaixfFEJisnP+CfZbtJknvNlffUh+//b17ql8Jz5WsFJg== =IRsn -----END PGP SIGNATURE-----

2 1

Someone find Jim Choate a job!
by David Miller 17 Dec '03

17 Dec '03

Sensory deprivation has caused Mr.Choate to finally go haywire. I suggest that someone from the state of TX (who have IDs from Hell) transport him to the nearest University. --David Miller middle rival devil rim lad

1 0

re: Driver Licenses
by Uhh...this is Joe [Randall Farmer] 17 Dec '03

17 Dec '03

> > Either should work...I'll bet that scratching the shit off with his keys > worked too ;) > I'll have to remember that when it's time to get mine done. Shouldn't take much if all you need is to stop regular folks from scanning it -- if it's like some other systems, changing a couple bits will keep the checksum from checking and the reader will report the card as invalid. > > That was a good question, though, does anyone know how much data those > little stripes can hold? It can (emphasis on can; most stripes don't) store 300 bytes according to some -- 1846 characters of English in theory, 600 in practice, 480 uncompressed, 300 ASCII. 300 bytes is six monochrome compressed mugshots or a 2400-pixel (about 50x50) uncompressed monochrome photo, or it could hold 33 military-grade biometric IDs. A study of el33t h@qu3r ph1|ez show that actual credit and ATM cards don't use nearly 300 bytes. That might be because error rates would be astronomical, or it might just be because they can't use all the extra space. [After writing this, I saw another web site with a figure of 226 bytes, not 300. Don't know who's right, so I'm going with the paranoid estimate...] > > Scott R. Brower > http://www.infowar.com > http://www.efflorida.org --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

1 0

Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

Loop Test [No Reply] ____________________________________________________________________ | | | The obvious is sometimes false; | | The unexpected sometimes true. | | | | Anonymous | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

[Fwd: Russia/Iraq]
by WebWarrior3＠InfoWar.Com 17 Dec '03

17 Dec '03

A bit off of our regularly scheduled program, but with Yeltsin saying that Clinton might be starting a 3rd World War last week, I thought I would pass this on. To: webwarrior3(a)infowar.com Subject: Russia/Iraq From: alert(a)stratfor.com Date: Tue, 10 Feb 1998 19:59:26 -0600 (CST) ______________________________________ Check out our newest product: Santizer Give away your computer, not your data ______________________________________ Global Intelligence Update Red Alert February 11, 1998 Russia Threatens to Arm Baghdad But will Saddam Remain in Power? According to a report on Tuesday in the online edition of the Egyptian newspaper Al-sha'b, the Russian government has warned Washington that Russia will supply arms and humanitarian aid to Iraq if the United States chooses to abandon diplomatic efforts and attacks Iraq. Al-Sha'b reported that Baghdad requested 20 billion dollars in urgent military and humanitarian aid from Russia. Baghdad, which already owes Russia 80 billion dollars, hopes to be able to pay off its debt once sanctions are lifted. Al-Sha'b went on to report that Washington has monitored heightened states of alert and increased military preparedness throughout the Middle East, and has warned neighboring Arab states against providing Iraq with military support. If the Egyptian report is factual, then Russia has just moved even closer to confrontation with the United States. Its previous threats of world war are clearly not credible. Sending aid to Iraq is, on the other hand, quite credible and therefore is in many ways more dangerous. The question is, will Hussein be there after the U.S. attack to receive the arms? We have noticed a curious juxtaposition of official U.S. statements on the crisis in Iraq with the emerging balance of U.S. forces in the region, suggesting that Washington may be expecting an Iraqi coup d'etat. U.S. Secretary of State Madeleine Albright testified before the Senate on Tuesday that, in the event U.S. air strikes contributed to toppling Saddam Hussein, "it would create a situation which, for a time, would require the presence of troops." The United States has accelerated its deployment of ground troops to the region. Three thousand troops from Ft. Stewart are being deployed to reinforce the 1,500 U.S. ground troops already in Kuwait. The USS Tarawa and the USS Guam, amphibious assault ships each carrying a 2,000-man Marine Expeditionary Unit, are headed for the Persian Gulf. Other U.S. ground forces in the region include 6,000 soldiers at the Prince Sultan Air Base in Saudi Arabia and 10,000 soldiers engaged in military exercises in Egypt. Additionally, the list of potential U.S. targets has grown from suspected chemical and biological agent sites to include command and control installations, the Iraqi air force, and the Republican Guard. This suggests a decapitation strike, aimed at disrupting Hussein's capability to coordinate a defense of his hold on power. Iraqi opposition forces also appear to be preparing for an altered post-air strike environment. The rival Kurdish Democratic Party and Patriotic Union of Kurdestan are planning a meeting on February 12 to settle outstanding differences and stabilize their cease-fire. Iraqi Kurdestan's Conservative Party public relations officer, Aram Muhammad Sa'id, declared in an interview on Monday with the Iranian News Agency that Turkey's latest entry into northern Iraq had the "green light" from the United States, and was part of a U.S. plan to use air strikes to topple Hussein and dismember Iraq. Finally, the Iraqi National Congress has reported that Baath Party and military officials have begun evacuating southern Iraq, lest an uprising follow U.S. air strikes. Many in the U.S. Congress have asserted the need for an "end game" that removes Saddam Hussein from power, but thus far the U.S. has been unable to foment or coordinate an overthrow of Hussein. If it is to be successful, we will not know for certain about a coup plot's existence until it is underway. But circumstances do hint that something may be in the works. Baghdad has evidently noticed this, as Iraqi Foreign Minister Saeed al- Sahhaf asserted on Tuesday that the U.S. would fail to topple the Iraqi regime, since Hussein had the support of the Iraqi people. The question is this: is there a real possibility of a coup in Baghdad or is this part of U.S. psychological warfare against Iraq? In a way, the possibility of a coup is more reasonable an explanation for U.S. behavior than the idea that the U.S. is going to mount an air campaign against chemical and biological weapons. What is not clear is whether a coup has a real chance or whether this is just wishful thinking on the part of the United States. And it is not clear what Russia would do if the coup turned into a protracted internal struggle. ___________________________________________________ To receive free daily Global Intelligence Updates or Computer Security Alerts, sign up on the web at http://www.stratfor.com/mail/, or send your name, organization, position, mailing address, phone number, and e-mail address to info(a)stratfor.com ___________________________________________________ STRATFOR Systems, Inc. 3301 Northland Drive, Suite 500 Austin, TX 78731-4939 Phone: 512-454-3626 Fax: 512-454-1614 Internet: http://www.stratfor.com/ Email: info(a)stratfor.com

1 0

Re: Deriving economic profits from writing FREE software?
by Zooko Journeyman 17 Dec '03

17 Dec '03

I have an idea for a model for deriving economic profits from writing free software. It requires dcash (specifically, some money that is cheaply and easily transferrable in small amounts). People submit requests for changes to a "wishlist"/"bug report list". Along with these requests they send dcash. Various mechanisms of market and/or trusted intermediary ensure that, on the whole, the hackers who satisfy the most highly valued wishes get the most money. See Grigg 1997 for one good idea of how such a market could operate. We already have extensive networks of wishlists, bug tracking systems, and the rest of an integrated open, distributed software development system (e.g. Linux, Debian, many others). Given the ability to pay (perhaps credit cards could be made to work here? Low cost credit card transactions? Cybercash?), we could start trying to add this kind of flow of cash to some such systems. Unfortunately, i fear that such attempts may fail and disrupt currently working systems... --Zooko P.S. Hi, y'all. I've switched continents, contexts, CPUs, sensitivities and perhaps more, but i'm fine. Thanks for missing me. p.p.s. as per <a href="http://www.slashdot.org/slashdot.cgi?mode=article&artnum=685"> this slashdot.org article</a>, it is called "Open Software" from now on, not "Free Software". Tell the kids.

1 0

Re: Anti-Asian E-Mail
by Mixmaster 17 Dec '03

17 Dec '03

"Gennaco said prosecutors may suggest that Machado attend a racial awareness program as part of his sentence." Political re-education, anyone? Take names, take names, take names.

1 0

[Fwd: SpookTech98]
by sunder 17 Dec '03

17 Dec '03

To: (Recipient list suppressed) Subject: SpookTech98 From: SpyKing <spyking(a)thecodex.com> Date: Sun, 08 Feb 1998 06:26:52 -0500 SpyKing, with a little help from his friends, is pleased to announce: SpookTech98 The Methods of Eavesdropping & Surveillance Seminar II Live from New York City Friday, June 5, 1998 Location: The Crown Plaza at the United Nations 304 East 42nd Street, New York, NY 10017 Sponsered by the Codex Surveillance & Privacy News, A.L.M.I.E. Association of Legal, Medical & Investigative Experts and W.A.S.P. World Association of Surveillance Professionals. If you missed it last year... Don't make the same mistake twice... You'll meet lots of great people and you'll learn a lot... In our "Methods of Eavesdropping & Surveillance" Seminar II you'll learn how various surveillance devices work... and how to protect against them... You will also learn how the spies among us access confidential information sources and learn everything there is to know about YOU... If you're serious about protecting your privacy... you can't afford to miss this seminar... enrollment is VERY limited... You will see ACTUAL Demonstrations... of the latest Surveillance equipment & Investigative techniques... We will have some vendors this year displaying their wares... If you are a vendor and would like to exhibit let us know... You will learn how: Offices/Homes are bugged Phones are tapped Cellular Calls are monitored People/Vehicles are followed Computers are eavesdropped on You will also learn how to PROTECT yourself from these surveillance techniques... We will also give a "live" demonstration of computer data interception... something everyone who "surfs" the net needs to be aware of... AND... We will "crack" a PGP message, show the targets passphrase AND the content of the message... If you're interested in privacy you shouldn't miss SpookTech98! You do NOT have to be a victim... You will receive a Wealth of Handout Material... This is no nonsense information packed seminar taught by seasoned professionals with a lifetime of surveillance experience in the field... You will ALSO Learn How the Spies Among us Obtain: Non-published telephone numbers Addresses from Non published numbers Utility Company information Health insurance information Records of Toll calls Cable company information Bank Accounts & balances Cellular Toll records Pager/Beeper user information and as an added bonus... ALL attendees will receive a FREE micro video pinhole camera and we'll show you HOW to use it to PROTECT your person and/or assets... If you're serious about protecting your privacy... you can't afford to miss this seminar... enrollment is VERY limited... Seminar Date: Friday, June 5, 1998 Hours: 9:00 AM to 6PM Location: The Crown Plaza at the United Nations 304 East 42nd Street, New York, NY 10017 Cost: Advanced Registration SLF & W.A.S.P. Members $295.00 Non-Members $350.00 Day of Seminar Registration at the Door $375.00 (Cash or Money Order Only) We have created a SpookTech98 powerpoint presentation for information purposes if anyone would like... just hit reply and request SpookTech98.ppt Refreshments will be served ALL day during the seminar including a FREE buffet lunch and SpyKing will host a FREE party for all attendees afterwards SOMEWHERE IN NEW YORK CITY... and I'll pick up the tab again ;-) Please printout this form and send with reservation. Your reservation will be confirmed to guarantee your seat. Seating is LIMITED. ************************************************************************ Registration Form SpookTech98 ************************************************************************ Name: Company: Street Address: City: State: Postal Code: Country: E-Mail: Tel: Fax: Amount Enclosed: *************************************************************************** *************************************************************************** The information supplied in this registration form is STRICTLY confidential and will NOT be supplied to anyone. It is strictly for inhouse registration confirmation. **************************************************************************** **************************************************************************** Send Registration Form & Payment to: Codex Publishing 2472 Broadway, Suite 328 New York, New York 10025 USA 917-277-1983 **************************************************************************** **************************************************************************** ************************************************************************* The Codex Surveillance & Privacy News - http://www.thecodex.com Moderator of "The Surveillance List"... http://www.thecodex.com/list.html The FIRST & ONLY list dedicated to Surveillance & Investigative Technology... "We don't spy on you... but we DO keep an eye on those that do..." *************************************************************************

1 0

PGP 5.5 BS upgrade
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Has anyone got the upgrade/bugfix for PGP 5.5 Business Security? I think it's 5.5.2 (?) I'm looking for the Win platform upgrade if anyone can help. Perhaps someone could upload it to a c'punk FTP site or post the URL. Thanks in advance!

1 0