July 2003 - cypherpunks-legacy

Re: A firewall problem?
by Major Variola (ret) 05 Jul '03

05 Jul '03

At 01:55 AM 7/4/03 -0700, Sarad AV wrote: >Wont the following cause a firewall breach- > >First we capture inbound packets to a firewall >assuming we have a man in the middle(M). > >If (M) use block replay on packets he can inject bits >and pieces of his own information to an inbound >firewall and can go undetected? > >M doesn't alter the source and destination ip's and is >perfectly acceptable to the firewall.Even a timestamp >won't work since a packet is expected at any time. > >We can still re-calculate the CRC of Checksum field by >the same attack and replace the old crc/checksum after >changing various required bit positions. > >Do firewall programs use initialisation vectors and a >chaning mode to prevent this attack? You are confusing a firewall with a protocol like IPsec that provides authentication and replay resistance (using crypto). A firewall is just a packet filter --if this field is that, do this. (Steve Bellovin has an online book about them you might enjoy.) Sometimes they're clever and look inside the streams, but this won't resist the attacks you're talking about. Various components of IPsec will. Read up on how it does that. ----- http://www.geocities.com/the_irvine_observer/

1 0

[Reverse panopticon] Govt Information Awareness
by Major Variola (ret.) 05 Jul '03

05 Jul '03

http://www.wired.com/news/privacy/0,1848,59495,00.html Researchers at the MIT Media Lab unveiled the Government Information Awareness, or GIA, website Friday. Using applications developed at the Media Lab, GIA collects and collates information about government programs, plans and politicians from the general public and numerous online sources. Currently the database contains information on more than 3,000 public figures. The premise of GIA is that if the government has a right to know personal details about citizens, then citizens have a right to similar information about the government.

1 0

Brinword on again in Kelowna, BC: CanPrivComm's replacement drops police surveillence camera lawsuit
by Tim Meehan 05 Jul '03

05 Jul '03

Too bad George Radwanski didn't just bring his lunch to work more often. This was one of his more prominent causes, an important one, which his successor is just rolling over on. --- http://tinyurl.com/g30t The Toronto Star Jul. 5, 2003. 01:00 AM Radwanski stand-in cleans house Sidelines aides, ends pricey B.C. court challenge Staff co-operating with auditors: Robert Marleau TONDA MACCHARLES OTTAWA BUREAU OTTAWARobert Marleau, the man replacing former privacy commissioner George Radwanski, has moved quickly to overhaul the beleaguered office, halting a $250,000 court challenge to RCMP surveillance cameras yesterday and sidelining two of Radwanski's most controversial senior aides. Marleau, a former clerk of the Commons who is filling the job on an interim basis, said in an interview he dropped the high-profile court action in Kelowna, B.C., that Radwanski had undertaken as a crusade because it was not "a useful way of spending public funds." Marleau also accepted on Wednesday the resignation and early retirement of Art Lamarche, Radwanski's chief of corporate services. Marleau said there was no special incentive package offered to Lamarche to retire July 31; it was Lamarche's own decision. The interim privacy commissioner also ordered Dona Vallieres, Radwanski's director of communications and frequent travel companion, to take "special leave" with full pay pending the outcome of Auditor-General Sheila Fraser's financial probe. "When I came in, I took stock of the situation and thought it was in her best interests and our best interests while the audit was ongoing, and pending its results, that she go on special leave," Marleau said. He would not speculate on the likelihood of Vallieres returning to her job. "The audit will dictate the outcome," he said. Vallieres travelled extensively with her former boss to Paris, Madrid, London, Rome, New York and New Zealand among other destinations. Her expense claims show she often dined at the same Ottawa restaurants preferred by the ex-commissioner. A self-described sufferer of chronic fatigue syndrome, Vallieres had refused to appear before the Commons committee investigating Radwanski's expenses, saying she was ill. She did, however, appear at Radwanski's news conference the following day. Vallieres has declined interviews, but indignantly denied to a CTV reporter she had any improper relationship with Radwanski. In 2001-2002, documents show Radwanski claimed $182,777 in domestic and foreign travel expenses. Vallieres claimed a total of $129,542 for the same period. Marleau declined to reveal the salaries of Vallieres and Lamarche, who is on "special leave" with full pay until his July 31 retirement, but both are considered senior executives in the public service. Under recently announced pay increases, an executive's salary ranges from $102,200 to $165,000. The NDP's Pat Martin said he was pleased with the moves by Marleau, and said the results of the auditor general's investigation may mean future sanction for Radwanski's former aides. "(Canadians) should be comforted by the fact that any maladministration of public funds may be considered a criminal matter," he said. Neither Lamarche nor Vallieres returned the Star's calls yesterday. Marleau, and all senior officials in the privacy office, have already met with and provided documents to federal auditors from Fraser's office, and more interviews are set for Monday, he said. As well, a "broad" audit of staffing practices by the Public Service Commission is underway. "As far as I'm concerned, they have complete access," Marleau said. "I look forward to their findings." As for the Kelowna surveillance camera court challenge Radwanski had launched, Marleau said he made a "risk assessment" of the likelihood of success and the future legal costs, and believed it was "not reasonable" to proceed. Up to now, the merits of the case hadn't been argued, yet the challenge had already cost $250,000 to litigate, mostly in fees to Toronto lawyer Morris Manning. The challenge, Marleau said, was not "the best use of funds of this small office." The federal justice department opposed Radwanski's efforts to bring the matter to court, and Radwanski had lost his first bid for standing to intervene. Marleau said the office still has concerns about the privacy implications of surveillance cameras, and if it received a complaint from an individual Kelowna resident, which it has not, it would "pursue" the matter, and apply a test of "reasonableness" to the use of surveillance equipment. -- Tim Meehan, Communications Director Ontario Consumers for Safe Access to Recreational Cannabis tim(a)ocsarc.org * http://www.ocsarc.org * 416-854-6343

1 0

Radiation Sniffer
by John Young 04 Jul '03

04 Jul '03

The radiation sniffer in NYC and proposed for elsewhere in the US is described in this DOE doc: http://www.eml.doe.gov/factsheets/HS_Platform.pdf Here's the aircraft monitoring program: http://www.eml.doe.gov/factsheets/rampscan.pdf There's more on a variety of homeland security monitoring programs at http://www.eml.doe.gov/factsheets/ EML is the DOE's Environmental Monitoring Laboratory located in NYC, whose history goes back to the earliest days of the nuclear age when it was set up to track medical and health effects of nuclear weapons. It now does worldwide monitoring of nuclear activities. Why is it located in NYC? Up on the 7th Floor of a non-descript office building, along with a batch of federal agencies such as a passport office, social security and what not. The classified work of the lab must account for the amazing entrance security you have to go through to get a passport renewed. Reminds of going to a plain-jane office building at an outer edge of DC a while back, heading for a meeting with a construction firm, when, bam, step inside the lobby and there you are facing a heavily armed phalanx of federal police and camouflaged soldiers. You ask the M-16 bristling receptionist about the firm and she barks for the team to surround the perp, demands ID, says you know where your are. Uh, sure, I say, this is the capital of the free world. Smart ass, she says, not any more. This country is ours. Show me what's in that bag. So I did. She screamed when it dawned on her what she was seeing in my tote. The troops jumped back as if electroshocked. Sir, she said, we would appreciate it if you would just leave. Yes, sir, the troops chorused, just please leave the premises, what's in that bag is not what we enlisted to handle. Here, I said, taking the device out of the tote, have a taste. No, no, no, they all yelped, and backed against the wall, legs shaking, weapons clattering to the floor, please take it away. Have mercy, sir. Well, I said, okay, if it scares you, and put away the gleaming jewel of kryptonite, titled fine print US Constitution, printed in China.

1 0

A firewall problem?
by Sarad AV 04 Jul '03

04 Jul '03

hi, Wont the following cause a firewall breach- First we capture inbound packets to a firewall assuming we have a man in the middle(M). If (M) use block replay on packets he can inject bits and pieces of his own information to an inbound firewall and can go undetected? M doesn't alter the source and destination ip's and is perfectly acceptable to the firewall.Even a timestamp won't work since a packet is expected at any time. We can still re-calculate the CRC of Checksum field by the same attack and replace the old crc/checksum after changing various required bit positions. Do firewall programs use initialisation vectors and a chaning mode to prevent this attack? Regards Sarath. __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

2 1

A firewall problem?
by Sarad AV 04 Jul '03

04 Jul '03

hi, Wont the following cause a firewall breach- First we capture inbound packets to a firewall assuming we have a man in the middle(M). If (M) use block replay on packets he can inject bits and pieces of his own information to an inbound firewall and can go undetected? M doesn't alter the source and destination ip's and is perfectly acceptable to the firewall.Even a timestamp won't work since a packet is expected at any time. We can still re-calculate the CRC of Checksum field by the same attack and replace the old crc/checksum after changing various required bit positions. Do firewall programs use initialisation vectors and a chaning mode to prevent this attack? Regards Sarath. __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

1 0

Re: All quiet on the western front
by Tyler Durden 03 Jul '03

03 Jul '03

A. Melon wrote... "There are very few in the general population that are cut to be true dissenters and act upon it. Now this age brings in the additional requirement: they have to also be decent engineers. As a result, there are very few left." I agree with this assessment, but would also suggest that Tim May's old-fogeyism has some validity to it. As far as I'm concerned, the state has successfully bonded with big media to pretty much stifle a lot of critical thinking, particularly about what other Americans believe. We saw it with the war protests--despite the fact that the numbers were larger than during Vietnam, the media was successful in (first of all) convincing Americans that the vast majority of Americans supported the war/troops/president. After that, since most Americans believed the right thing was to support the war (because "everybody else supports it"), they then came to quasi-support it, or at least shut up about it. And still, no Osama, no Saddam, and no WMD, but only "kooks" and "commies" are screaming about it. Thus, to go back o your point, you're starting off with a small population of dissenters, so that once you pass down through the needs for engineering and math skills, you're left with very little. On the other hand, the only thing that's stopping me from coding up my "eJector" is a full time job and trying to live in the little spare time I have. So I guess I'm in the population you describe and will be, as long as I remain employed. But then again...if someone I actually know gets tortured or whatever, that could change at any minute. Then I'll be the REAL... -Tyler Durden >From: "A.Melon" <juicy(a)melontraffickers.com> >To: cypherpunks(a)lne.com >Subject: Re: All quiet on the western front >Date: Wed, 2 Jul 2003 23:06:14 -0700 (PDT) > >Hi, Tim, > >I'm glad that you have a bout of lucidity. > >The government essentially won the crypto battle, marginalizing crypto >proponents, quietly getting media and corporations under control when >crypto is concerned, and generally rising the stakes. Those of you who >have access to corporate product development documents that relate to >communications know what I am talking about. CALEA etcl. It's there, >it's real and I think that about 5-10% of development resources are >taken by it. > >Most cypherpunks were relatively highly paid engineers with >comfortable lives and some time on their hands, so while crypto was >fashionable it was cool to hang out at meetings and have pipe dreams >about taking on the state. Even then, scum like del Torto started to >bank ahead and sell to the "freedom fighters" and "good cops". > >But then it got much worse. After the WTC theater, being present at >essentially anti-state meetings was not considered totally benign. And >also the salaries were gone, so this beer and TV Saturday alternative >suddenly stopped being alternative at all. > >So we're back to the fact that highly paid engineers in crypto field >are really not automatically revolutionaries. On the contrary. > >There are very few in the general population that are cut to be true >dissenters and act upon it. Now this age brings in the additional >requirement: they have to also be decent engineers. As a result, there >are very few left. _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

Web Privacy War
by John Young 03 Jul '03

03 Jul '03

WSJ today reports on the war between web privacy firms and the feds: http://cryptome.org/web-priv-war.htm Lance Cottrell and other privacy protection firms are featured -- does Anonymizer really bring in up to a $1M a year? Lance says he doesn't keep logs thus cannot respond to subpoenas. Other privacy firms are said to cooperate with the feds. One brags that national security trumps making money. As if they natsec is not the biggest money maker of all time, though homesec is coming on strong. Privsec in the race, though deniability is mandatory. It notes the demise of Zero Knowledge just before the Patriot Act started the boom in people seeking protection from official spies. Darn. But then we don't know what ZK is doing black with the contacts it eagerly gathered in its meetings with the feds.

1 0

Re: Reporter writing article on proffr/mattd and threats
by Major Variola (ret) 03 Jul '03

03 Jul '03

At 04:09 PM 7/2/03 -0400, Declan McCullagh wrote: >I received a phone call today from a newspaper reporter who's writing an >article on mattd/proffr and wanted background on the cypherpunks group or >movement, as he put it. The reporter -- who covers crime, law enforcement, >and the courts How does one authenticate that a voice on a phone is a reporter? Or is my sarcasm/wryness detector stuck? --- We are all reporters, we are all book sellers. We are all first class objects. --Tim May

2 1

talking to coworkers = deemed exports
by Major Variola (ret) 03 Jul '03

03 Jul '03

http://www.eetimes.com/story/OEG20030623S0011 The Commerce Department considers some U.S. transfers of commercial technologies to foreign workers as exports. In some cases, U.S. companies may be required to obtain a deemed-export license before giving foreign-born employees access to sensitive technologies. [shades of the old crypto days, where you couldn't ask a colleage from another country to review your code.. this time its China, India they're freaking about]

1 0