October 2004 - cypherpunks-legacy

Federal program to monitor everyone on the road
by Sunder 01 Oct '04

01 Oct '04

http://www.boingboing.net/2004/10/01/federal_program_to_m.html Federal program to monitor everyone on the road Interesting article about the Fed's plans to develop an all-knowing intelligent highway system. Most people have probably never heard of the agency, called the Intelligent Transportation Systems Joint Program Office. And they haven't heard of its plans to add another dimension to our national road system, one that uses tracking and sensor technology to erase the lines between cars, the road and the government transportation management centers from which every aspect of transportation will be observed and managed. For 13 years, a powerful group of car manufacturers, technology companies and government interests has fought to bring this system to life. They envision a future in which massive databases will track the comings and goings of everyone who travels by car or mass transit. The only way for people to evade the national transportation tracking system they're creating will be to travel on foot. Drive your car, and your every movement could be recorded and archived. The federal government will know the exact route you drove to work, how many times you braked along the way, the precise moment you arrived -- and that every other Tuesday you opt to ride the bus. Link to actual story: http://charlotte.creativeloafing.com/news_cover.html ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

1 0

ShmooCon. 2005. No moose. We swear.
by R. A. Hettinga 01 Oct '04

01 Oct '04

<http://www.shmoocon.org/about.html> ShmooCon. 2005. No moose. We swear. ShmooCon will be an all-new, annual East coast hacker convention hell-bent on offering an interesting and new atmosphere for demonstrating technology exploitation, inventive software & hardware solutions, as well as open discussion of critical information security issues. The first annual ShmooCon will be held February 4-6 2005, at the Wardman Park Marriott Hotel, in Washington, D.C., just minutes from your choice of overly-curious 3-letter agencies. So register early to keep the feds from taking up all the space. ShmooCon will be a different breed of security convention. In a nutshell, over three days, there are three tracks: "Break It!" - a track dedicated to the demonstration of techniques, software, and devices devised with only one purpose in mind--technology exploitation. You will bear witness to some of the most devious minds, source code, and gadgets on the planet that focus their energies on breaking the technology we mindless sheep keep on buying. Baaaaa. "Build It!" - a track that showcases inventive software & hardware solutions--from distributed computing or stealth p2p networks to miniature form-factor community wireless network node hardware or robotics even. Let loose your inner geek, and feel free to gawk. With all the neat stuff, it's important to take notes--that way we all have evidence to shoot down some sleazeball patents 5 years from now. "BoF It!" - a track that promotes the open discussion of critical information security issues in a "birds of a feather" format. From lightning open source code audits or wireless insecurity discussion panels to DRM rants or anonymity & privacy strategies--it's down and dirty, with plenty of controversy for folks who like hashing it out with fellow hackers. Feel free to throw your Shmooball here, but no fisticuffs, please. Settle your differences at Hack-or-Halo in the evening, instead. ShmooCon will be thought provoking. Naturally, with one entire track dedicated to getting similar minds in one room to openly discuss interesting topics, and with each topic discussion being chaired by one or more intensely involved experts in that particular field, people who attend ShmooCon are bound to give the muscle between their ears a good workout. You see, that's a key goal of this conference--to get people thinking. Whether it's thinking about the future, thinking outside the box, thinking about where some of your freedom has run off to, or perhaps rethinking that uber-secure .gov architecture you just paid 5 million dollars to deploy that actually blows some serious swiss-cheese chunks--it's high time you contributed some CPU cycles to your own cause and future existence. And once you start thinking, or hell, maybe even before you start thinking, you can open your mouth and start gabbing with people that have the same concerns and interests as you. Get your two cents in, and pick up a lifetime's worth of experience and knowledge in return from the people around you. ShmooCon will be entertaining. We might not have DefCon debauchery, but we heavily stress the might part of that. Damn near anything could happen when nearly a thousand hackers descend upon the nation's capital. While the Winter chill is sure to keep most folks clothing on, the bar-crawls, club dancing, Hack-or-Halo tournament, WLAN Bash 4 Cash, Shmooball violence, and unsanctioned attempts at penetrating the 100+ .gov or Beltway Bandit wireless networks within 5 miles should make for quite an interesting time. We've even convinced the NFL to have the big game that weekend, so you and your buds can immediately follow up the convention watching terribly expensive and mind-numbing commercials while you try compiling all the cool code that was presented earlier in the day. ShmooCon will be affordable. As you can see, we're certainly not spending money on a web developer, but don't be fooled by our l33t html Fu, ShmooCon is about high-quality without the high price. If you wait to register until the last minute, oh yeah, you're going to pay out the ass--$250, in fact. However, if you're not a fed that has to wait until next fiscal year to get permission from your mommy, daddy, and Uncle Sam, and you positively know that you are going to ShmooCon, then we're down with that, as it were. And so is the cost--ShmooCon is $99 for anyone who registers before September 30, 2004! Aww, just shy of the new fiscal year, see? No, we're not sorry for the feds. They can afford full price--have you seen your paycheck lately? Uncle Sam and cousin FICA could pay for ALL of us to go to ShmooCon, but nooooooo. Regardless, space IS limited, so register before the feds do. Can't afford $99? Check out the call for papers! Selected speakers AND alternates get free admission to ShmooCon! ShmooCon will be accessible. Well, except for our West coast friends. Doh. ShmooCon will be at the Wardman Park Marriott Hotel in Washington, D.C., just a few steps from a Metro stop. That means you can catch a train from New York, Boston, or Philadelphia to Union Station, hop on the D.C. Metro, and voila, you're there. Or, if you intend to fly, you can land at Reagan National, wave to the good guys in uniform manning the mobile rocket launchers, grab a cab OR hop on the D.C. Metro, and you'll be at ShmooCon before you know it. Can't afford to fly? Submit your own ! The overall winner gets free admission AND airfare from anywhere in the continental U.S. to ShmooCon 2005! So check out the site, keep visiting for news and schedule updates, and tell your friends to register their asses for ShmooCon ASAP. It's going to be a blast, and we can't wait to see you there! news about registration cfp program schedule location sponsors links contact us . privacy policy )2004, The Shmoo Group -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Patriot Act Misinformation
by R. A. Hettinga 01 Oct '04

01 Oct '04

<http://online.wsj.com/article_print/0,,SB109659214177033379,00.html> The Wall Street Journal October 1, 2004 REVIEW & OUTLOOK Patriot Act Misinformation October 1, 2004; Page A14 The American Civil Liberties Union has been spinning its victory in a federal court in New York this week as a blow against the USA Patriot Act. One typical headline: "Federal Judge Calls Patriot Act Secret Searches Unconstitutional." An ACLU press release hails the decision as "a landmark victory against the Ashcroft Justice Department." Well, no. If reporters had bothered to read Judge Victor Marrero's decision, they would have learned that the law he actually struck down was a provision of the Electronic Communications Privacy Act of 1986. Section 2709 authorizes the FBI to issue "National Security Letters" to obtain information from wire communications companies about their subscribers. NSLs are issued secretly and the recipient is prohibited from notifying anyone about the request. As Judge Marrero noted in his ruling, "Section 2790 has been available to the FBI since 1986." He concludes that there must have been "hundreds" of NSLs issued since that time. The Patriot Act did amend Section 2790, but that amendment has nothing to do with the part that Judge Marrero says is unconstitutional. One more thing: The Electronics Communications Act was not the invention of John Ashcroft. It was sponsored by that famous and menacing right-winger, Vermont Senator Patrick Leahy, who said at the time that Section 2790 "provides a clear procedure for access to telephone toll records in counterintelligence investigations." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Call for Papers: ShmooCon. 2005. No moose. We swear.
by R. A. Hettinga 01 Oct '04

01 Oct '04

<http://www.shmoocon.org/cfp.html> Washington, D.C. Call for Papers [PDF] http://www.shmoocon.org The Shmoo Group is soliciting papers and presentations for the first annual ShmooCon. ShmooCon 2005 will be a highly-technical and entertaining East coast hacker convention focused on technology exploitation, inventive software and hardware solutions, as well as open discussion on a variety of technology and security topics. ShmooCon 2005 will be held on February 4-6, 2005 at the Wardman Park Marriott in Washington, D.C., just minutes from your choice of 3-letter agencies. ShmooCon 2005 will have three tracks, each dedicated to the following: Break It! - Technology Exploitation Build It! - Inventive Software and Hardware Solutions BoF It! - Open Discussion of Technology and Security Topics Topics for the "Break It!" track may include, but are not limited to, EXPLOITATION of: - Consumer electronic devices - Application, host, and network security - Telephony - Physical security Topics for the "Build It!" track may include, but are not limited to, inventive software and hardware SOLUTIONS in: - Robotics - Distributed computing - Community wireless networking - Mobile personal computing Topics for the "BoF It!" track may include, but are not limited to, open DISCUSSION of the following: - Privacy and anonymity - Exploit and vulnerability disclosure / databases - DRM (Digital Rights Management), fair use, copyright infringement - Open source software world domination strategies Presentation Format All presentations and discussions will be 55 minutes in length. Presentations in the "Break It!" and "Build It!" tracks must include demonstrations of personally developed techniques, working code, and/or devices, with code and/or schematics being open-source and released to the public for free. Initiating an open discussion for "BoF It!" requires subject matter expertise, active involvement with the topic at hand, and a brief presentation of the topic/problem scope. Shmooballs will be issued to the audience, to facilitate a frank and open discussion of opinions. Speakers are encouraged to present innovative ideas that not everyone agrees with. Submission Procedure To submit, email cfp(a)shmoocon.org with the following information: 1. Speaker name(s) and/or handle(s) 2. Presentation Title 3. Track preference 4. Two to three paragraph presentation description and/or outline 5. List facilities required. Projector for use with VGA input, flipchart, sound projection, Internet connectivity will be provided. 6. Speaker bio 7. Contact info for speaker (email AND mobile number, please) Accepted speakers will receive free admission to the conference, as well as a $100 honorarium after evaluation of their completed presentation. 6 runner-ups will receive free admission as hot-alternates. They should come to ShmooCon 2005 prepared to speak, and, if it becomes necessary for them to speak as an alternate, they too will receive a $100 honorarium after evaluation of their completed presentation. NOTE: select presentation submissions which are not accepted will be awarded a 50% discounted admission to ShmooCon 2005. Presentations must be designed to include source code, schematics, or other substantial details that demonstrate the topic being discussed. Presentation proposals will be reviewed by members of the Shmoo Group. A list of the reviewers will be posted on the ShmooCon 2005 web site when the Call For Papers is formally issued. If you feel you have a presentation that would be appropriate but that does not meet these guidelines, feel free to submit it anyway but be sure to include a cover letter explaining your reasoning so we can evaluate your proposal. All questions regarding this call for papers should be addressed to cfp(a)shmoocon.org. Schedule Check the web site for final dates July 30, 2004 CFP opens Early Fall 2004 papers for preferential first round consideration due Middle Fall 2004 final due date for all papers Late Fall 2004 speakers notified Submissions are due by late fall 2004. Preference will be given to submissions received by early fall 2004. Selected speakers will be notified by Halloween, 2004. We look forward to receiving your submissions as well as seeing you at ShmooCon 2005! ShmooCON 2005 CFP 1.0 RC6 news about registration cfp program schedule location sponsors links contact us . privacy policy )2004, The Shmoo Group -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: "ID Rules Exist, But Can't Be Seen"
by Tyler Durden 01 Oct '04

01 Oct '04

John Kelsey wrote... >Maybe. I guess the thing that's confusing about any of these answers is >that the rules as they're >applied must be propogated to thousands of >people. It's not like they could easily hide guidance >like "no more than >10 Arabs per flight" or "double-screen anyone with brown skin and a >Koran"-->someone would leak it. Perhaps the written rules include things >like this that they don't want to >subject to court scrutiny, but then how >do they get that down to the people doing the screening >at the gate? That's a good point. And those screeners ain't exactly the cream of the crop, if ya' know what I mean. A year ago they were making minimum wage, so if someone wanted a copy of those guidelines, it'd be easy as hell to con it out of one of em. (INVOKE SPIRIT OF TIM MAY HERE)...dress all official-like with a clipboard and some random badge, and start quizzing the locals about the current rules. Maybe that wouldn't work at JFK, but go to the airport at, say, Lexington So Carolina or Bumfuck Idaho and you'd get the information faster than a hillbilly can skin a possum for dinner. So no way they could keep such a big secret, and I would suspect that the Brazil-factor is not so great that the TSA doesn't already know that. I think you may be onto something w.r.t the Profiling issue. That may have more to do with it than anything. In other words, they don't want the thing contested in court, and the powers that be may not want to be personally liable. So in other words, this law is basically secret so that it can be secret. If nothing else, the Iraq WMD debacle should teach that they really don't have some deep, secret and "justifiable" information. -TD _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee. Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

Re: "ID Rules Exist, But Can't Be Seen"
by John Kelsey 01 Oct '04

01 Oct '04

>From: Tyler Durden <camera_lumina(a)hotmail.com> >Sent: Sep 30, 2004 5:06 PM >To: cypherpunks(a)al-qaeda.net >Subject: "ID Rules Exist, But Can't Be Seen" ... >For instance, is it indeed possible that revealing this rule would pose an >additional security risk? If such a rule exists (and it does) then hijackers >obviously already know about it. Could this rule also reveal some deeper >secrets about how hijackers can be detected? I seriously doubt it. One possibility raised by Dan Simon (I think) on Eric Rescorla's excellent blog is that the rule is part of some monthly briefing that is sent out, which might include some kind of information they'd rather not have published, e.g., "be especially careful about anyone carrying a guitar case; we've heard rumors about using one to bring a Tommy gun onboard." >Then of course, the argument may be that the government wanted to hide the >rule for the very reason of making it more unassailable. In other words, if >the rule were known, then it might be more easily contested in court. Hiding >the rule protects the law which in turn protects national security. Maybe. I guess the thing that's confusing about any of these answers is that the rules as they're applied must be propogated to thousands of people. It's not like they could easily hide guidance like "no more than 10 Arabs per flight" or "double-screen anyone with brown skin and a Koran"--someone would leak it. Perhaps the written rules include things like this that they don't want to subject to court scrutiny, but then how do they get that down to the people doing the screening at the gate? The whole idea of laws that the citizens aren't allowed to see just sounds like something you'd expect in some godawful third-world dictatorship, not in the US. >-TD --John Kelsey

1 0

Tor 0.0.9pre1 is out (fwd from arma@mit.edu)
by Eugen Leitl 01 Oct '04

01 Oct '04

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0