July 2003 - cypherpunks-legacy

Re: Sealing wax & eKeyboard
by Thomas Shaddack 16 Jul '03

16 Jul '03

> Geez! You guys have the DUMBEST ideas ever! For fuck's sake, go and > RTFA! (For the dumb: READ THE FUCKING ARCHIVES!) Behold your dogs of war for a moment more, please. :) > Anything displayed on your screen is visible to the guy across the street > with a TEMPEST detector unless you work in a Faraday cage. So far, this is orders of magnitude more expensive than a keylogger. I am not aware there is too high amount of the receiver units in use (nor I suppose they are easy to operate by a non-specialist), so the number of targets being threatened this way is much more limited than if some software or comparably cheap hardware is used. For now, at least. Then there is the shielding... > Failing that a hidden pinhole camera, or an RF transmitter attached to > your cable -- hell these are available for hobbist use right now: > x10.com has small devices that you can use to broadcast video from one > room to another. Getting the same done for VGA, XVGA, etc. shouldn't > be any harder. Specified it as a threat. But this is what physical security is for. Again, this brings the threat of being discovered. Also, a TSCM sweep can reduce the risk. > Using IR or RF is one of the stupidest things you could possibly > do. Think! IR and RF are detectable from a distance! > > Ok, some IR auth is ok, provided it's in a sealed chamber and no photons > leak out. i.e. think of a two cylinders, sealed at the ends where the > cables go, where one fits inside the other... sort of like fiber optic > cables and connectors. No leaks. Use challenge-response. Immune against replay attack. With proper algorithm, reasonably immune against cryptographic attack on intercepted transactions. If it works over the Wild Wild Net, it should work over an IR/RF connection as well. > Direct contact's obviously fine, so long as your alleged attacker can't > tap into it. True. Again, physical security / tamperproofness issue.

1 0

Re: Sealing wax & eKeyboard
by Tyler Durden 16 Jul '03

16 Jul '03

This reminds me of another thing that occurred to me, but as I'm no computer engineer I can't tell how much of a defense it would be. (At the very least a nice stopgap for a while...) To get around keystroke loggers, it would be nice to have some fom of onscreen keyboard, perhaps available over the web. The keyboard would likely work only with the mouse (making it slow to use, of course), and each time the keyboard appears (and at periodic intervals) the keyboard scrambles its keys. I suspect it would be MUCH harder to figure out what has been typed. -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: Sealing wax >Date: Tue, 15 Jul 2003 12:08:20 -0700 > >On Tuesday, July 15, 2003, at 09:05 AM, Major Variola (ret) wrote: > >>At 09:29 AM 7/15/03 -0400, Sunder wrote: >>>So, the best way to avoid that situation and not being able to reach >>the >>>big red switch, is simply not to attract their attention in the first >>>place by not following the footsteps of Jim Bell. :) >> >>Stego + broadcast is indeed your friend. >> >>>A more likely, and far more important, scenario to worry about is the >>>black bag job whereby a hardware keystroke recorder can get installed >>>without your knowledge... >>> >>>There may be ways to prevent/detect this... Software (open or closed >>>source) alone won't help very much. >> >>Epoxy and other conformal coatings are also your friends. >> > >Thinking about this brief comment, I assume MV means sealing a PC to make >black bag opening more apparent. > >But this suggest a return to _sealing wax_. Seriously. > >A dab of sealing wax (available in most stationery stores, save for >Staples, Office Depot, OfficeMax, Paper Barn, StaplerWorld, Nothing But >Rubber Bands, and other warehouses masquerading as stationery stores) over >the side panels and other access points, even over the floppy and CD-ROM >ports (carefully!), and a distinctive signet ring or other such seal-making >device could be quite easy to use. > >(As we all know, CIA and other spook agency "flaps and seals" specialists >are well-versed in duplicating such seals...but probably only after >collecting good information. An FBI black bag job is likely to encounter >the sealing wax and seal and be unable to duplicate it. There may be tools >now to take a fairly good impression, perhaps with a fast-setting polymer, >and then make a convincing duplicate of the seal. All crypto is economics, >though, and simple seals probably work against most attackers.) > >There are other methods: > >-- keep key material on a USB or PCMCIA flash card dongle. > >-- wear this around your neck or otherwise make it secure against >girlfriends, wives, others who may try to copy it > >-- use a small handheld PC (like the HP machines) or Palm OS device as the >"front-end" for security apps: at the simplest level, use it to store very >long keys which don't get typed-in, but instead are cut-and-pasted in a way >to bypass the keyboard driver completely. > >Note: It is common in military crypto for their to be different levels of >"security tokens" to increase physical security. Rarely are the keys to the >kingdom gotten merely by sitting down and typing stuff into a computer. For >one thing, this encourages people to get lazy and write the passwords and >keys down on Post-It notes or on pieces of tape stuck to the underside of >paperclip holders or other entropically-obvious things. For another thing, >it makes remote attacks or keystroke logging much more of an attack mode. >Finally, the rigamarole or ritual of having physical tokens on chains >around one's neck tends to make the process of security seem more serious, >which can cause more care to be taken. > >(All of this slows down the process. The rigamarole that a shipboard crypto >shack will put up with is not the same as what Joe Sixpack will put up, as >we all know. RSA-like crypto makes crypto a lot less expensive to deploy, >but it's wrong to think it makes it a no-brainer, point-and-click >process....except in things like SSL, where it does a specialized job >without human involvement.) > >-- the usual point about having a network with a secure machine locked up >very well in a closet or safe (I have a large gun safe, which I usually run >a small heating element into to prevent condensing conditions...I have >toyed with the idea of putting a small PC running on 25-40 watts, or less, >into this gun safe, with only a power cord and Ethernet wire coming out). > >-- and the usual point about having cameras watching the areas where the >PCs and keyboards are located. > >(Yeah, maybe the black bag types can find and disable the cameras, but then >Alice knows something unusual happened. But odds are pretty good they >_can't_ find all of the cameras or microphones or sensors, especially in a >building with many PCs and wires and other gadgets. They can cut the power, >but smart folks have things on battery backups, or self-powered, or on >laptops left plugged-in and able to run for 3-4 hours without AC power, >etc.) > >Were I setting up such a system, all sorts of inexpensive ideas suggest >themselves. > >By the way, I recommend the novels of Thomas Perry, especially "Pursuit," >"Vanishing Act," and his others in the "Jane Whitefield" series. All four >novels of his I have read so far deal centrally with issues of people >trying to escape those tracking them, kind of a private version of the >Witness Security Program (popularly called "Witness Protection"). The >novels are filled with good ideas, and a few glaring misses, about changing >identity, avoiding patterns, etc. > >If there's a weakness in his novels, it's that not enough modern technology >is used. I cringe when I see his characters not even using >readily-available throwaway cellphones to stay in contact, or not even >setting up Hotmail accounts to communicate. (He favors postal dead drops, >which in at least one of the novels allows an attacker to find out the home >and name of another....a determined opponent, like the government, would >know the names and addresses quickly.) > >Still, his series fits with the kind of security awareness and >hypervigilance we often discuss. > > >--Tim May _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

3 3

RE: Sealing wax & eKeyboard
by Vincent Penquerc'h 16 Jul '03

16 Jul '03

> To get around keystroke loggers, it would be nice to have some fom of > onscreen keyboard, perhaps available over the web. The > keyboard would likely > work only with the mouse (making it slow to use, of course), > and each time > the keyboard appears (and at periodic intervals) the keyboard > scrambles its > keys. The aptly named Tinfoil Hat Linux does this for GPG passphrase input :) -- Vincent Penquerc'h

1 0

The ideal computer for your gun safe
by Roy M. Silvernail 16 Jul '03

16 Jul '03

Since it's been mentioned several times, here's a good candidate for your gun safe computer: the CerfCube. http://www.intrinsyc.com/products/cerfcube405EP/ $399. I have an older one that's been running for 2 years and 4 updates. Mine runs Linux, but they do a WinCE version, too.

1 0

News: DMCA gives blueprint for Chile deal (fwd)
by Jim Choate 16 Jul '03

16 Jul '03

http://zdnet.com.com/2100-1105_2-1026116.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Senate to Kill Pentagon Surveillance Bill (washingtonpost.com) (fwd)
by Jim Choate 16 Jul '03

16 Jul '03

http://www.washingtonpost.com/wp-dyn/articles/A61146-2003Jul15.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

The 3rd Annual Nigerian EMail Conference
by Steve Schear 16 Jul '03

16 Jul '03

http://j-walk.com/other/conf/index.htm "There is no protection or safety in anticipatory servility." Craig Spencer

1 0

Cracking Data Hiding (fwd)
by Jim Choate 15 Jul '03

15 Jul '03

Stego taking a hit....??????? http://www.sciencedaily.com/releases/2003/07/030715090813.htm -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Sealing wax, funny looking dogtags
by Major Variola (ret) 15 Jul '03

15 Jul '03

At 12:08 PM 7/15/03 -0700, Tim May wrote: >On Tuesday, July 15, 2003, at 09:05 AM, Major Variola (ret) wrote: >> Epoxy and other conformal coatings are also your friends. >> >Thinking about this brief comment, I assume MV means sealing a PC to >make black bag opening more apparent. Both more apparent and more physically difficult. >But this suggest a return to _sealing wax_. Seriously. :-) Only modern sealing waxes don't melt, adhere extremely well, and make tampering evident. They also mean the Adversary has to spend a lot more time... maybe more than one visit. >(As we all know, CIA and other spook agency "flaps and seals" >specialists are well-versed in duplicating such seals... Yes. but probably >only after collecting good information. An FBI black bag job is likely >to encounter the sealing wax and seal and be unable to duplicate it. You seem to think I thought the epoxy would be used like a seal, with the signet ring and all, visually verified when you sit down. That's too lame, any hobbyist whose good with casting can dupe it. I just meant that if Scarfo had epoxied his keyboard to his chassis properly, (and epoxied the keyboard, etc.) he might still be free (to pick shitty passphrases, it turned out). And some "sealing waxes" such as those used on nuclear weapons and verification devices, are very difficult to duplicate. Given, they require special equipment to read. (Fine reflector particles dispersed in clear epoxies) Or, as has been discussed here before, if Nico did his crypto work on a handheld that stayed with him. (An epoxy-sealed one, of course.) Your suggestions re USB, PCMCIA, etc. are in the same line. Better, because they're smaller. However, I don't know of a card that you can *shower* with, which is frankly what's required. It can't ever leave you. A keychain fob is not good enough. Even a finger ring gets removed sometimes. >(All of this slows down the process. The rigamarole that a shipboard >crypto shack will put up with is not the same as what Joe Sixpack will >put up Yes, but Scarfo's DirOpSec should have been able to convince him that at the hourly rate the Company pays him, he should put up with it :-) He can surf for porn on a different machine. As long as he knows to use different passwords there... >-- the usual point about having a network with a secure machine locked >up very well in a closet or safe (I have a large gun safe, which I >usually run a small heating element into to prevent condensing >conditions...I have toyed with the idea of putting a small PC running >on 25-40 watts, or less, into this gun safe, with only a power cord and >Ethernet wire coming out). I like the dual use of keeping a security-sensitive PC in a gun safe which also keeps the guns dry :-) You could have the door opening silence the PC, too. A nice lead lining will keep the black bag x-ray team (they'll borrow a unit from the bomb squad) from seeing much. >Still, his series fits with the kind of security awareness and >hypervigilance we often discuss. "The ultimate in paranoia is not when everyone is against you but when everything is against you." PKD (and quite apropos here)

3 2

Will 'Distributed Cloud' Network Structures Prevent Censorship?
by Steve Schear 15 Jul '03

15 Jul '03

Bennett Haselton believes that de-centralized information storage and transmission systems - so called 'Distributed Cloud' networks like <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Fnews.bbc.co.uk%2…>Peekabooty, <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Ffreenet.sourcefo…>FreeNet and <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Fwww.google.com%2…>Gnutella - will not prevent Internet censorship in the long run. He has written a short essay http://www.peacefire.org/techpapers/distributed-cloud.html pointing out the flaws he perceives in these systems. Ian Clarke, the architect of the FreeNet project, responds here http://slashdot.org/~Sanity/journal/37275, defending Distributed Cloud systems and their abilities to prevent censorship, protect the identities of their users, and shield users from legal liability. steve "There is no protection or safety in anticipatory servility." Craig Spencer

1 0