December 2004 - cypherpunks-legacy

Re: Off-the-Record Messaging (IM plugin)
by hal＠finney.org 16 Dec '04

16 Dec '04

> Nikita Borisov and Ian Goldberg have released > Off-the-Record Messaging (http://www.xelerance.com/mirror/otr/) It looks like Ian Goldberg's site might be a more authoritative source, http://www.cypherpunks.ca/otr/ . One interesting feature is authentication + deniability. You know who you are talking to, but afterwards anyone who captured a transcript can't prove who said it. Usually we do authentication with digital signatures, but the problem is that binds you to what you say and it can be used against you afterwards. OTR does it by signing the key exchange which creates a MAC key for each direction. (A MAC is a keyed hash which is then applied to each message.) Each message gets MAC'd and this way you know that the messages are authentic and untampered. This already protects you against your conversant; both of you know the MAC keys in each direction (one knows them in order to MAC new messages; the other knows them in order to verify the MAC), so each guy can forge messages created by the other guy and create a bogus transcript. That means that neither person can publish a transcript and credibly claim that it authentically represents what was said. Then, there's another trick: when you are through with them you publish your MAC keys, in the clear. This does not compromise secrecy; all of the data is encrypted with a different key. But it means that now, anyone could in retrospect forge a transcript showing you saying anything at all. And that of course means that no such transcript has any credibility in terms of providing cryptographic evidence of what you said. Hal

1 0

Off-the-Record Messaging (IM plugin)
by lcs Mixmaster Remailer 16 Dec '04

16 Dec '04

Nikita Borisov and Ian Goldberg have released Off-the-Record Messaging (http://www.xelerance.com/mirror/otr/) an IM plugin for private communication providing not only the usual encryption and authentication, but also deniability and perfect forward secrecy. Deniability avoids digital signatures on messages (while preserving authenticity and integrity), so there is no hard-to-deny proof you wrote anything in particular; in fact, there is a toolkit to help people forge messages, making it extra-hard to pin things on you. Perfect forward secrecy means that your past messages and conversations remain protected even if your keys are compromised. You can read the OTR protocol description, download the source code for the gaim-otr plugin, or grab a gaim-otr binary package for Debian or Fedora Core.

1 0

[ISN] An Indonesian's Prison Memoir Takes Holy War Into Cyberspace
by R.A. Hettinga 16 Dec '04

16 Dec '04

--- begin forwarded text

1 0

Blunkett hands in cards after prints found on visa
by R.A. Hettinga 16 Dec '04

16 Dec '04

<http://www.theregister.co.uk/2004/12/15/blunkett_checks_out/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/12/15/blunkett_checks_out/ Blunkett hands in cards after prints found on visa By John Lettice (john.lettice at theregister.co.uk) Published Wednesday 15th December 2004 23:11 GMT David Blunkett, UK Home Secretary and prime mover behind the British ID card scheme, resigned this evening after further revelations concerning the residency application of his lover's nanny. Emails seen by Sir Alan Budd's enquiry made it clear that - contrary to Home Office denials - the letter to the nanny warning of a possible 12 month delay had been dealt with by his office. This was critical to Blunkett's defence. He had claimed that he merely checked over the initial application, and when over the weekend it was claimed (http://www.theregister.co.uk/2004/12/13/blunkett_bashes_dti/) that he had produced the letter from the immigration service in a meeting with senior civil servants, a Home Office spokesman insisted that he had had "no contact with the letter at all, at any stage." In a statement (http://news.bbc.co.uk/1/hi/uk_politics/4099761.stm) tonight, Blunkett concedes that Budd's enquiry has identified "a fax and an exchange of emails between my office and the Immigration and Nationality Directorate" based on the letter that he had had "no contact" with. He says that he was "always aware"of this letter, "but did not remember holding a copy. I have no recollection of dealing with this in any way... I have no recollection of issuing instructions to deal with the application, but only to continuing the elimination of the backlog in general". The email is reported to have said "no favours but slightly quicker." We at The Register feel that we would have trouble figuring out how that works even if we were sober. Which we are not entirely; but, since you ask, this evening's Privacy International Christmas bash went rather better than one could possibly have expected. Education Secretary Charles Clarke wins the ID scheme poisoned chalice. He commented that there would be continuity between his approach and Blunkett's; the immigration status of any paramours which Clarke may or may not have is not known at time of press. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] An Indonesian's Prison Memoir Takes Holy War Into Cyberspace
by InfoSec News 16 Dec '04

16 Dec '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.washingtonpost.com/wp-dyn/articles/A62095-2004Dec13.html By Alan Sipress Washington Post Foreign Service December 14, 2004 JAKARTA, Indonesia -- After Imam Samudra was charged with engineering the devastating Bali nightclub bombings two years ago, he taunted his police accusers in court, then greeted his death sentence with the cry, "Infidels die!" So when Samudra published a jailhouse autobiography this fall, it was not surprising that it contained virulent justifications for the Bali attacks, which killed 202 people, most of them foreign tourists. But tucked into the back of the 280-page book is a chapter of an entirely different cast titled "Hacking, Why Not?" There, Samudra urges fellow Muslim radicals to take the holy war into cyberspace by attacking U.S. computers, with the particular aim of committing credit card fraud, called "carding." The chapter then provides an outline on how to get started. The primer on carding is rudimentary, according to U.S. and Indonesian cybercrime experts, but they said the chapter provides a rare glimpse into the mounting threat posed by terrorists using Internet fraud to finance their operations. "The worry is that an army of people doing cybercrime could raise a great deal of money for other activities that terrorists are carrying out," said Alan Paller, research director of the Sans Institute, a U.S. Internet-security training company. Samudra, 34, is among the most technologically savvy members of Jemaah Islamiah, an underground Islamic radical movement in Southeast Asia that is linked to al Qaeda. He sought to fund the Bali attacks in part through online credit card fraud, according to Indonesian police. They said Samudra's laptop computer revealed an attempt at carding, but it was unclear whether he had succeeded. Internet crime experts said Samudra's book seems unprecedented as a tool for recruiting radical Muslims into a campaign of online fraud and building networks of fundraisers. "This is exactly the kind of advice you would give someone who wanted to get started in cybercrime," said Paller, who reviewed a translation of the chapter. "It doesn't focus on a specific technique, but focuses on how you find techniques and focuses on connecting with other people to act loosely together." Titled "Me Against the Terrorist!" the book depicts Samudra on the cover in a now-classic pose from his trial last year in Bali. He is clad in a white shirt and white Muslim skullcap, with his right arm outstretched and a single finger raised as he lectures the judges. Four thousand copies in Indonesian have been issued by a small publisher and are selling for about $4 each in at least seven cities across the islands of Java and Sumatra, said Achmad Michdan, Samudra's attorney, who wrote the forward. Michdan said the publisher is planning a second run and is considering translating the book into English, French and Arabic. Profits benefit Samudra's wife and children. Samudra remains on death row. Most of the book is a memoir that tracks Samudra from his early schooling in Java, through his arms training in the Afghan mountains, his exile in Malaysia and his return to Indonesia. It includes arguments for killing Western civilians and bitter critiques of U.S. policy in Israel, Afghanistan and Iraq, including photographs of Muslim civilian casualties. Toward the end, Samudra informs readers that the United States is not as invincible as they might think. "It would not be America if the country were secure. It would not be America if its computer network were impenetrable," he writes at the beginning of the hacking chapter. He continues by urging fellow militants to exploit this opening: "Any man-made product contains weakness because man himself is a weak creature. So it is with the Americans, who boast they are a strong nation." The chapter is less a how-to manual than a course of study for aspiring hackers and carders. Samudra directs them to specific Indonesian-language Web sites that provide instruction. For those who find these sites too sophisticated, he counsels first learning computer programming languages, in particular Linux, and suggests several other Web sites, including one run by young Muslims. Then he advises learning about hacking by finding mentors through online chats. He lists six chat rooms as sources. Next, Samudra discusses the process of scanning for Web sites vulnerable to hacking, then moves on to a three-page discussion on the basics of online credit card fraud and money laundering. "This is hacking for dummies," said Evan F. Kohlmann, a U.S. consultant on international terrorism who also reviewed the chapter. "But in this day and age, you don't have to be an expert hacker to have a tremendous impact." Kohlmann and other cyberterrorism experts said the kind of online fraud preached by Samudra is becoming increasingly attractive as a source of funding for al Qaeda operatives in several regions of the world. One of the chief hazards posed by Samudra's book is that it could direct religious extremists into the company of more accomplished hackers. Indonesian police assert their country now has more online credit card fraud than any other in the world. "If you succeed at hacking and get into carding, be ready to make more money within three to six hours than the income of a policeman in six months," Samudra tells his readers. "But don't do it just for the sake of money." He adds, "Remember, the main duty of Muslims is jihad in the name of God, to raise arms against the infidels, especially now the United States and its allies." Samudra had first sought to finance the Bali nightclub attacks by ordering the robbery of a shop selling gold jewelry in western Java. The heist allegedly netted five pounds of gold and $500. Then he turned to more lucrative targets on the Internet, police and prosecutors said. At Samudra's trial, police testified that his computer had been used to communicate in chat rooms with others involved in online credit card fraud and contained information on ways to obtain credit card details. Petrus Reinhard Golose, head of cybercrimes investigations for the Indonesian police, said in an interview that Samudra had asked for religious permission to conduct carding from Abubakar Baasyir, the radical cleric and alleged head of Jemaah Islamiah now on trial in Jakarta in connection with terrorist bombings, including the one in Bali. Golose said police did not know whether Baasyir had blessed Samudra's Internet activities. Special correspondent Noor Huda Ismail contributed to this report. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] An Indonesian's Prison Memoir Takes Holy War Into Cyberspace
by InfoSec News 16 Dec '04

16 Dec '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.washingtonpost.com/wp-dyn/articles/A62095-2004Dec13.html By Alan Sipress Washington Post Foreign Service December 14, 2004 JAKARTA, Indonesia -- After Imam Samudra was charged with engineering the devastating Bali nightclub bombings two years ago, he taunted his police accusers in court, then greeted his death sentence with the cry, "Infidels die!" So when Samudra published a jailhouse autobiography this fall, it was not surprising that it contained virulent justifications for the Bali attacks, which killed 202 people, most of them foreign tourists. But tucked into the back of the 280-page book is a chapter of an entirely different cast titled "Hacking, Why Not?" There, Samudra urges fellow Muslim radicals to take the holy war into cyberspace by attacking U.S. computers, with the particular aim of committing credit card fraud, called "carding." The chapter then provides an outline on how to get started. The primer on carding is rudimentary, according to U.S. and Indonesian cybercrime experts, but they said the chapter provides a rare glimpse into the mounting threat posed by terrorists using Internet fraud to finance their operations. "The worry is that an army of people doing cybercrime could raise a great deal of money for other activities that terrorists are carrying out," said Alan Paller, research director of the Sans Institute, a U.S. Internet-security training company. Samudra, 34, is among the most technologically savvy members of Jemaah Islamiah, an underground Islamic radical movement in Southeast Asia that is linked to al Qaeda. He sought to fund the Bali attacks in part through online credit card fraud, according to Indonesian police. They said Samudra's laptop computer revealed an attempt at carding, but it was unclear whether he had succeeded. Internet crime experts said Samudra's book seems unprecedented as a tool for recruiting radical Muslims into a campaign of online fraud and building networks of fundraisers. "This is exactly the kind of advice you would give someone who wanted to get started in cybercrime," said Paller, who reviewed a translation of the chapter. "It doesn't focus on a specific technique, but focuses on how you find techniques and focuses on connecting with other people to act loosely together." Titled "Me Against the Terrorist!" the book depicts Samudra on the cover in a now-classic pose from his trial last year in Bali. He is clad in a white shirt and white Muslim skullcap, with his right arm outstretched and a single finger raised as he lectures the judges. Four thousand copies in Indonesian have been issued by a small publisher and are selling for about $4 each in at least seven cities across the islands of Java and Sumatra, said Achmad Michdan, Samudra's attorney, who wrote the forward. Michdan said the publisher is planning a second run and is considering translating the book into English, French and Arabic. Profits benefit Samudra's wife and children. Samudra remains on death row. Most of the book is a memoir that tracks Samudra from his early schooling in Java, through his arms training in the Afghan mountains, his exile in Malaysia and his return to Indonesia. It includes arguments for killing Western civilians and bitter critiques of U.S. policy in Israel, Afghanistan and Iraq, including photographs of Muslim civilian casualties. Toward the end, Samudra informs readers that the United States is not as invincible as they might think. "It would not be America if the country were secure. It would not be America if its computer network were impenetrable," he writes at the beginning of the hacking chapter. He continues by urging fellow militants to exploit this opening: "Any man-made product contains weakness because man himself is a weak creature. So it is with the Americans, who boast they are a strong nation." The chapter is less a how-to manual than a course of study for aspiring hackers and carders. Samudra directs them to specific Indonesian-language Web sites that provide instruction. For those who find these sites too sophisticated, he counsels first learning computer programming languages, in particular Linux, and suggests several other Web sites, including one run by young Muslims. Then he advises learning about hacking by finding mentors through online chats. He lists six chat rooms as sources. Next, Samudra discusses the process of scanning for Web sites vulnerable to hacking, then moves on to a three-page discussion on the basics of online credit card fraud and money laundering. "This is hacking for dummies," said Evan F. Kohlmann, a U.S. consultant on international terrorism who also reviewed the chapter. "But in this day and age, you don't have to be an expert hacker to have a tremendous impact." Kohlmann and other cyberterrorism experts said the kind of online fraud preached by Samudra is becoming increasingly attractive as a source of funding for al Qaeda operatives in several regions of the world. One of the chief hazards posed by Samudra's book is that it could direct religious extremists into the company of more accomplished hackers. Indonesian police assert their country now has more online credit card fraud than any other in the world. "If you succeed at hacking and get into carding, be ready to make more money within three to six hours than the income of a policeman in six months," Samudra tells his readers. "But don't do it just for the sake of money." He adds, "Remember, the main duty of Muslims is jihad in the name of God, to raise arms against the infidels, especially now the United States and its allies." Samudra had first sought to finance the Bali nightclub attacks by ordering the robbery of a shop selling gold jewelry in western Java. The heist allegedly netted five pounds of gold and $500. Then he turned to more lucrative targets on the Internet, police and prosecutors said. At Samudra's trial, police testified that his computer had been used to communicate in chat rooms with others involved in online credit card fraud and contained information on ways to obtain credit card details. Petrus Reinhard Golose, head of cybercrimes investigations for the Indonesian police, said in an interview that Samudra had asked for religious permission to conduct carding from Abubakar Baasyir, the radical cleric and alleged head of Jemaah Islamiah now on trial in Jakarta in connection with terrorist bombings, including the one in Bali. Golose said police did not know whether Baasyir had blessed Samudra's Internet activities. Special correspondent Noor Huda Ismail contributed to this report. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Gait advances in emerging biometrics
by Major Variola (ret) 16 Dec '04

16 Dec '04

At 12:31 PM 12/14/04 -0500, Sunder wrote: >Original URL: http://www.theregister.co.uk/2004/12/14/alt_biometrics/ >Gait advances in emerging biometrics > >By John Leyden (john.leyden at theregister.co.uk) >Published Tuesday 14th December 2004 15:07 GMT > >"Great Juno comes; I know her by her gait." >William Shakespeare, The Tempest > >Retinal scans, finger printing or facial recognition get most of the >publicity but researchers across the world are quietly labouring away at >alternative types of biometrics. > >Recognition by the way someone walk (their gait), the shape of their ears, >the rhythm they make when they tap and the involuntary response of ears to >sounds all have the potential to raise the stock of biometric techniques. >According to Professor Mark Nixon, of the Image Speech and Recognition >Research Group at the University of Southampton, each has unique >advantages which makes them worth exploring. Look up Johansson, et al. Point light displays. Yes you can tell sex, age, etc., from the ratios of rotational axes, etc, but a stone in the shoe is a bitch. All faith is in drivers' licenses, a total joke, I got gummies on your 'prints, all your time-derivatives are mine. But grant$ are good, and flavor$ of DARPA be bitchin.

2 1

EU Moves Forward with Data Retention
by Eugen Leitl 16 Dec '04

16 Dec '04

Link: http://slashdot.org/article.pl?sid=04/12/16/0052222 Posted by: samzenpus, on 2004-12-16 07:47:00 from the find-out-what-you-said-last-week dept. KokoBonobo writes " euobserver.com reports on [1]controversial proposals to require EU service operators to retain data about telephone calls and e-mails as part of an overall fight against crime and terrorism. The retained data would not only consist of logs, but of entire conversations and contents of the e-mails and SMS messages. This [2]document from the [3]European Commission's Information Society goes into further detail." [4]Click Here References 1. http://www.euobserver.com/?aid=17906&sid=9 2. http://europa.eu.int/information_society/topics/ecomm/doc/useful_informatio… library/public_consult/data_retention/consultation_data_retention_30_7_04.pdf 3. http://europa.eu.int/information_society/index_en.htm 4. http://ads.osdn.com/?ad_id=5671&alloc_id=12342&site_id=1&request_id=1128523… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[wearables] Nokia cellular cameras (fwd from ew206@cam.ac.uk)
by Eugen Leitl 16 Dec '04

16 Dec '04

----- Forwarded message from Mr Ellis Weinberger <ew206(a)cam.ac.uk> -----

1 0

Re: The Values-Vote Myth
by Nomen Nescio 15 Dec '04

15 Dec '04

J.A. Terranson schrieb: > This election *proves* that at least half the electorate, about 60 > million people, are just Useless Eaters, who should be eagerly > awaiting their Trip Up The Chimneys. Wow! A Tim May copycat! (Both the 'useless eaters' and the 'chimney'!)

2 1