July 2003 - cypherpunks-legacy

Swiss cheese by Microsoft
by Major Variola (ret.) 17 Jul '03

17 Jul '03

Microsoft Admits Flaw in Windows Software WASHINGTON - Microsoft Corp. acknowledged a critical vulnerability Wednesday in nearly all versions of its flagship Windows operating system software, the first such design flaw to affect its latest Windows Server 2003 software. ... Microsoft said corporate firewalls commonly block the type of data connections that hackers outside a company would need for these attacks. The flaw affects Windows technology used to share data files across computer networks. [Yes but a virus can exploit from *within* the system.] ... But four Polish researchers, known as the "Last Stage of Delirium Research Group," said they discovered how to bypass the additional protections Microsoft added, just three months after the software went on sale. [Gotta love that acronym..] ------ Router attack, ca. 1954: Bikers disable a town's router infrastructure in _The Wild Ones_. Her name is Dorothy, she runs a plugboard, she runs off scared.

1 0

Slashdot | WiFi Hotspots Elude RIAA Dragnet (fwd)
by Jim Choate 16 Jul '03

16 Jul '03

http://yro.slashdot.org/yro/03/07/17/0010225.shtml?tid=141&tid=188 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Slashdot | Intrusion Tolerance - Security's Next Big Thing? (fwd)
by Jim Choate 16 Jul '03

16 Jul '03

http://slashdot.org/articles/03/07/17/002250.shtml?tid=126&tid=172 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Funding for TIA All But Dead
by Steve Schear 16 Jul '03

16 Jul '03

The controversial Terrorism Information Awareness program, which would troll Americans' personal records to find terrorists before they strike, may soon face the same fate Congress meted out to John Ashcroft in his attempt to create a corps of volunteer domestic spies: death by legislation. http://www.wired.com/news/politics/0,1283,59606,00.html "There is no protection or safety in anticipatory servility." Craig Spencer

3 2

Re: Sealing wax & eKeyboard
by Tyler Durden 16 Jul '03

16 Jul '03

I don't think a virtual keyboard is necessarily a bad idea in this case. I live in a densely populated neighborhood in NYC. SOmeone is ALWAYS in my home, and in the rare cases nobody's here we turn on our alarm. This does not mean some visual surveillance of my keyboard is impossible, but it greatly reduces the number of parties with the desire and resources to attempt such a surveillance. And the reason this matters is because I can download such a virtual keyboard for pennies (thus causing the need for VERY costly forms of surveillance by nullifying keystroke loggers), and cause the cost of surveillance to rise probably far more than exponentially. This is a good thing (from my point of view!) in and of itself, but imagine if a large number of people thought this way, encrypting even the most trivial of communications. -TD >From: Sunder <sunder(a)sunder.net> >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: shaddack(a)ns.arachne.cz, timcmay(a)got.net, cypherpunks(a)minder.net >Subject: Re: Sealing wax & eKeyboard >Date: Wed, 16 Jul 2003 15:01:22 -0400 (edt) > > >On Wed, 16 Jul 2003, Tyler Durden wrote: > > > "Anything displayed on your screen is visible to the guy across the >street > > with a TEMPEST detector unless you work in a Faraday cage. " > > > > No, no you have the whole thing wrong. As May recently stated, "crypto >is > > economics". > >Well, ok, it "all depends on your security model" is certainly the 1st >factor to consider with how much you're willing to spend on it being a >constraint to that. > >If your threat model is simply to have generic good security incase >someone steals your machine, then so long as all your files are encrypted, >the theif just gets whatever the hardware is worth at "it fell of a >truck" prices, and no more. > >If your threat model is the fully armed and armorded ninja attack at >3:00am -- which was what I gathered was what Sampo's originally presented >question, then you can assume your attacker would have enough resources to >pull off a TEMPEST van across the street, etc. > >So do you want crypto to keep a rogue government out of your fiels, or >keep your kid sister from reading your email? etc... > >An on screen virtual keyboard is much easier to see than a real keyboard >even by a shitty pinhole camera. A real keyboard would have to be viewed >from above, otherwise, all you can do is infer the keystrokes - which >gives you a hint of what they are for a passphrase, but not much else. >On screen keyboard can be seen much easier and your mouse pointer gives >you away. > >So it all depends on who "they" is. Either way, if "they" believe you are >a nice jucy target, and their chances to net lots of data off your machine >are high, they will park the TEMPEST SUV outside your door. Not much >question of that... > >If "they" are watching everyone for patterns and you don't stick out like >a sore thumb, there's not much need for any of the above. > > > Empire State building, I'll probably work harder to hide it. If I'm >sharing > > mp3's on Kazaa or whatever and I don't want to have RIAA make an example >out > > of me, that virtual keyboard may be just right. > >No, virtual keyboard won't save your ass. Your ISP will had it over on a >plate along with trimmings (traffic logs, etc.) If you're sharing MP3's >on Kazaa, you're easy to find, and logs are proof enough. All the RIAA >troll has to do is download one song off your IP, prove it came from >your IP, and get the ISP to give them logs, and you're toast. Doesn't >matter that your hard drive has since been wiped or encrypted or is >unreadable. > >Using crypto to protect files you have already shared with the public is >neurotic as a security measure. > > > The real danger of crypto and, I'd argue, a virtual keyboard in this >case, > > is that by spending tiny fractions of money we can make it prohibitively > > costly for "them" to monitor a large number of transactions. > >And if you do and are noticed, "they" will spend that money because you >will be an obvious and clear target. If they can get away with "why don't >you just show us what you have - what do you have something to hide?" line >to cow sheeple into giving them access, in their mind, you'd be the one to >make their careers. > > > Forget > > unbreakability. Forget Faraday cages (you don't have anything that >important > > to hide anyway). Cheap, easy and scalable is the only way to bumrush >this > > show. > >Again, what's your threat model, who is your attacker, how much are you >willing to spend on it? > > >----------------------Kaos-Keraunos-Kybernetos--------------------------- > + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ > \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ ><--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ > /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ > + v + : The look on Sadam's face - priceless! >--------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------ > > > _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Re: Sealing wax & eKeyboard
by Justin 16 Jul '03

16 Jul '03

Sunder (2003-07-16 17:23Z) wrote: > Anything displayed on your screen is visible to the guy across the street > with a TEMPEST detector unless you work in a Faraday cage. Failing that a > hidden pinhole camera, or an RF transmitter attached to your cable -- hell > these are available for hobbist use right now: x10.com has small devices > that you can use to broadcast video from one room to another. Getting the > same done for VGA, XVGA, etc. shouldn't be any harder. > > Using IR or RF is one of the stupidest things you could possibly > do. Think! IR and RF are detectable from a distance! If you want to get picky, a clever brain could probably figure out keystrokes from across the street with a laser mic if the target has a loud keyboard, considering each key will probably make a slightly different sound. I'd think an attacker could determine spacebar hits, at least, and pauses, which alone might lead to a complete keystroke log. [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Re: Sealing wax & eKeyboard
by Major Variola (ret) 16 Jul '03

16 Jul '03

(resent) At 11:15 AM 7/16/03 -0700, Tim May wrote: >We've talked many times about using laptops, heads-up displays (like >the Sony glasses), and even putting mesh bags over a user and his >laptop. Actual Faraday cage rooms are not really needed. Don't forget the 3M screen-addons which are basically a miniature venetian blinds. They prevent others from reading your screen at off-angles. Very useful if you run your laptop on an airplane. Even if you take private notes at a meeting.

1 0

Re: Sealing wax & eKeyboard
by Freematt357＠aol.com 16 Jul '03

16 Jul '03

Sighb&You know fellows this is why Isser Harel, Mossadbs fabled spy chief was noted for face to face meetings that were prearranged as he didnbt trust electronic communication. He incidentally liked to use public transit to get here and there even while conducting various operations- Like the abduction from Argentina of Adolf Eichmann. Regards, Matt Gaylor-

1 0

Re: CRYPTO-GRAM, July 15, 2003
by J.A. Terranson 16 Jul '03

16 Jul '03

On Tue, 15 Jul 2003, Bruce Schneier wrote: > [This is the strangest piece of mail I have ever received, by several > orders of magnitude. I reprint it here solely for entertainment purposes.] <snip of email from an obviously disturbed person> > ... It might be a hoax, > but the writing seems too authentic. It's hard to fake delusional > paranoia that well.] And you find the sharing of this woman's problems has legitimate "Entertainment" value? She is not the *only* disturbed person represented by your email. -- Yours, J.A. Terranson sysadmin(a)mfn.org "Every living thing dies alone." Donnie Darko

2 1

Re: Sealing wax & eKeyboard
by Tim May 16 Jul '03

16 Jul '03

On Wednesday, July 16, 2003, at 10:15 AM, Sunder wrote: > > And TEMPEST monitoring equipment (or again, a hidden pinhole camera > behind > you, or a transmitter hidden in your monitor) won't see what's on your > screen because???? From a purely optical perspective, pinhole cameras have terrible spatial resolution. I doubt a pinhole camera behind a user, probably on a wall 10 feet behind the user, could resolve 12-point type. Resolving a large "virtual keyboard" on a screen would be a lot easier, of course. We've talked many times about using laptops, heads-up displays (like the Sony glasses), and even putting mesh bags over a user and his laptop. Actual Faraday cage rooms are not really needed. All security is economics, so I would think a lot of bang for the buck happens with solving the most pressing problems people have with security: leaving their machines unattended, not using any crypto at all, writing passphrases down on Post-It notes, not checking for audio bugs, etc. --Tim May "We are at war with Oceania. We have always been at war with Oceania." "We are at war with Eurasia. We have always been at war with Eurasia." "We are at war with Iraq. We have always been at war with Iraq. "We are at war with France. We have always been at war with France."

1 0