March 2004 - cypherpunks-legacy

Re: research paper
by Sandy Harris 03 Mar '04

03 Mar '04

someone wrote: > I'm currently doing a research paper, with the topic of cryptography > being essiantial for society, ... > > I was wondering if there where any particular books, websites, ... One web page with a lot of links: http://www.freeswan.org/freeswan_trees/freeswan-2.05/doc/politics.html

2 1

How Tiny Swiss Cellphone Chips Helped Track Global Terror Web
by R. A. Hettinga 03 Mar '04

03 Mar '04

<http://nytimes.com/2004/03/04/international/europe/04PHON.html?hp=&pagewant…> The New York Times March 4, 2004 How Tiny Swiss Cellphone Chips Helped Track Global Terror Web By DON VAN NATTA Jr. and DESMOND BUTLER ONDON, March 2 - The terrorism investigation code-named Mont Blanc began almost by accident in April 2002, when authorities intercepted a cellphone call that lasted less than a minute and involved not a single word of conversation. Investigators, suspicious that the call was a signal between terrorists, followed the trail first to one terror suspect, then to others, and eventually to terror cells on three continents. What tied them together was a computer chip smaller than a fingernail. But before the investigation wound down in recent weeks, its global net caught dozens of suspected Qaeda members and disrupted at least three planned attacks in Saudi Arabia and Indonesia, according to counterterrorism and intelligence officials in Europe and the United States. The investigation helped narrow the search for one of the most wanted men in the world, Khalid Shaikh Mohammed, who is accused of being the mastermind of the Sept. 11 attacks, according to three intelligence officials based in Europe. American authorities arrested Mr. Mohammed in Pakistan last March. For two years, investigators now say, they were able to track the conversations and movements of several Qaeda leaders and dozens of operatives after determining that the suspects favored a particular brand of cellphone chip. The chips carry prepaid minutes and allow phone use around the world. Investigators said they believed that the chips, made by Swisscom of Switzerland, were popular with terrorists because they could buy the chips without giving their names. "They thought these phones protected their anonymity, but they didn't," said a senior intelligence official based in Europe. Even without personal information, the authorities were able to conduct routine monitoring of phone conversations. A half dozen senior officials in the United States and Europe agreed to talk in detail about the previously undisclosed investigation because, they said, it was completed. They also said they had strong indications that terror suspects, alert to the phones' vulnerability, had largely abandoned them for important communications and instead were using e-mail, Internet phone calls and hand-delivered messages. "This was one of the most effective tools we had to locate Al Qaeda," said a senior counterterrorism official in Europe. "The perception of anonymity may have lulled them into a false sense of security. We now believe that Al Qaeda has figured out that we were monitoring them through these phones." The officials called the operation one of the most successful investigations since Sept. 11, 2001, and an example of unusual cooperation between agencies in different countries. Led by the Swiss, the investigation involved agents from more than a dozen countries, including the United States, Pakistan, Saudi Arabia, Germany, Britain and Italy. Cellphones have played a major role in the constant jousting between terrorists and intelligence agencies. In their requests for more investigative powers, Attorney General John Ashcroft and other officials have repeatedly cited the importance of monitoring portable phones. Each success by investigators seems to drive terrorists either to more advanced - or to more primitive - communications. During the American bombing of Tora Bora in Afghanistan in December 2001, American authorities reported hearing Osama bin Laden speaking to his associates on a satellite phone. Since then, Mr. bin Laden has communicated with handwritten messages delivered by trusted couriers, officials said. In 2002 the German authorities broke up a cell after monitoring calls by Abu Musab al-Zarqawi, who has been linked by some top American officials to Al Qaeda, in which he could be heard ordering attacks on Jewish targets in Germany. Since then, investigators say, Mr. Zarqawi has been more cautious. "If you beat terrorists over the head enough, they learn," said Col. Nick Pratt, a counterterrorism expert and professor at the George C. Marshall European Center for Security Studies in Garmisch-Partenkirchen, Germany. "They are smart." Officials say that on the rare occasion when operatives still use mobile phones, they keep the calls brief and use code words. "They know we are on to them and they keep evolving and using new methods, and we keep finding ways to make life miserable for them," said a senior Saudi official. "In many ways, it's like a cat-and-mouse game." Some Qaeda lieutenants used cellphones only to arrange a conversation on a more secure telephone. It was one such brief cellphone call that set off the Mont Blanc investigation. The call was placed on April 11, 2002, by Christian Ganczarski, a 36-year-old Polish-born German Muslim whom the German authorities suspected was a member of Al Qaeda. From Germany, Mr. Ganczarski called Khalid Shaikh Mohammed, said to be Al Qaeda's military commander, who was running operations at the time from a safe house in Karachi, Pakistan, according to two officials involved in the investigation. The two men did not speak during the call, counterterrorism officials said. Instead, the call was intended to alert Mr. Mohammed of a Qaeda suicide bombing mission at a synagogue in Tunisia, which took place that day, according to two senior officials. The attack killed 21 people, mostly German tourists. Through electronic surveillance, the German authorities traced the call to Mr. Mohammed's Swisscom cellphone, but at first they did not know it belonged to him. Two weeks after the Tunisian bombing, the German police searched Mr. Ganczarski's house and found a log of his many numbers, including one in Pakistan that was eventually traced to Mr. Mohammed. The German police had been monitoring Mr. Ganczarski because he had been seen in the company of militants at a mosque in Duisburg, and last June the French police arrested him in Paris. Mr. Mohammed's cellphone number, and many others, were given to the Swiss authorities for further investigation. By checking Swisscom's records, Swiss officials discovered that many other Qaeda suspects used the Swisscom chips, known as Subscriber Identity Module cards, which allow phones to connect to cellular networks. For months the Swiss, working closely with counterparts in the United States and Pakistan, used this information in an effort to track Mr. Mohammed's movements inside Pakistan. By monitoring the cellphone traffic, they were able to get a fix on Mr. Mohammed, but the investigators did not know his specific location, officials said. Once Swiss agents had established that Mr. Mohammed was in Karachi, the American and Pakistani security services took over the hunt with the aid of technology at the United States National Security Agency, said two senior European intelligence officials. But it took months for them to actually find Mr. Mohammed "because he wasn't always using that phone," an official said. "He had many, many other phones." Mr. Mohammed was a victim of his own sloppiness, said a senior European intelligence official. He was meticulous about changing cellphones, but apparently he kept using the same SIM card. In the end, the authorities were led directly to Mr. Mohammed by a C.I.A. spy, the director of central intelligence, George J. Tenet, said in a speech last month. A senior American intelligence official said this week that the capture of Mr. Mohammed "was entirely the result of excellent human operations." When Swiss and other European officials heard that American agents had captured Mr. Mohammed last March, "we opened a big bottle of Champagne," a senior intelligence official said. Among Mr. Mohammed's belongings, the authorities seized computers, cellphones and a personal phone book that contained hundreds of numbers. Tracing those numbers led investigators to as many as 6,000 phone numbers, which amounted to a virtual road map of Al Qaeda's operations, officials said. The authorities noticed that many of Mr. Mohammed's communications were with operatives in Indonesia and Saudi Arabia. Last April, using the phone numbers, officials in Jakarta broke up a terror cell connected to Mr. Mohammed, officials said. After the suicide bombings of three housing compounds in Riyadh, Saudi Arabia, on May 12, the Saudi authorities used the phone numbers to track down two "live sleeper cells." Some members were killed in shootouts with the authorities; others were arrested. Meanwhile, the Swiss had used Mr. Mohammed's phone list to begin monitoring the communications and activities of nearly two dozen of his associates. "Huge resources were devoted to this," a senior official said. "Many countries were constantly doing surveillance, monitoring the chatter." Investigators were particularly alarmed by one call they overheard last June. The message: "The big guy is coming. He will be here soon." An official familiar with the calls said, "We did not know who he was, but there was a lot of chatter." Whoever "the big guy" was, the authorities had his number. A Swisscom chip was in the phone. "Then we waited and waited, and we were increasingly anxious and worried because we didn't know who it was or what he had intended to do," an official said. But in July, the man believed to be "the big guy," Abdullah Oweis, who was born in Saudi Arabia, was arrested in Qatar. "He is one of those people able to move within Western societies and to help the mujahedeen, who have lesser experience," an official said. "He was at the very center of the Al Qaeda hierarchy. He was a major facilitator." In January, the operation led to the arrests of eight people accused of being members of a Qaeda logistical cell in Switzerland. Some are suspected of helping with the suicide bombings of the housing compounds in Riyadh, which killed 35 people, including 8 Americans. Later, European authorities discovered that Mr. Mohammed had contacted a company in Geneva that sells Swisscom phone cards. Investigators said he ordered the cards in bulk. The Mont Blanc inquiry has wound down, although investigators are still monitoring the communications of a few people. Christian Neuhaus, a spokesman for Swisscom, confirmed that the company had cooperated with the inquiry, but declined to comment. Last year, Switzerland's legislature passed a law making it illegal to purchase cellphone chips without providing personal information, following testimony from a Swiss federal prosecutor, Claude Nicati, that the Swisscom cards had become popular with Qaeda operatives. The law goes into effect on July 1. One senior official said the authorities were grateful that Qaeda members were so loyal to Swisscom. Another official agreed: "They'd switch phones but use the same cards. The people were stupid enough to use the same cards all of the time. It was a very good thing for us." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Virus with encrypted zip file - Important notify about your e-mail account.
by sunder 03 Mar '04

03 Mar '04

Interesting virus - anyone know what this one is called and what it's payload does? Haven't seen this one before today... It attaches a zip file with a password containing an executable. (No worries, I've not run it, and only extracted it on a SPARC machine, so it can't use buffer overflows designed for intel in unzip -- if any exist.) I've seen several of these from various cypherpunk nodes, and initially thought someone was attacking cypherpunks nodes again... So what it is likely grabbing the domian name and capitalizing the first letter and inserting "The" and "team." around it to make it look like it's from the ISP... It's also using various random reasons (mailbox is full, spamming, account about to expire, account abuse, can't go out with you tonight, have to wash hamster's hair, etc.) Interesting that a virus would use an encrypted ZIP file. Of course it does a dumb thing in terms of "security purposes" of sending the password with the attachment. Certainly that isn't something a security wise person would do, *BUT* the true purpose of this ploy is likely an attempt for it to get past virus scanners which demime/unzip files through multiple layers, and would be able to detect the attachment is malware. So this thing is probably carrying code to ZIP+encrypt files as well as MIME and possibly it's own SMTP client... Pretty amazing for a 12K binary... Well, not really. :) I guess I'm used to seeing bloatware like Office 2000 - oh, yeah, forgot, MSFT products are virii.. :-D Many, many, years ago, I recall there were polymorphic virii which encrypted their main body, but used various methods to build the extractor such that you (as an antivirus writer) couldn't easily get signatures from the extractor portion. I believe they used permutations of opcodes which did the same thing under x86, but enough random combinations to prevent getting a useful virus signature. It probably won't be long before we'll start seeing those again in modern virii... Certainly email virus scanners shouldn't allow .EXE - even if inside of .ZIP archives anyway, but it's still interesting to see how the evil virus writers find new ways to push their crud on the "If it's got dancing nude hippos, I'll click on it gladly, safety be damned" sheeple. Now it's just exploiting the "I'll obey any instruction from any so called authority if you throw in the magic word 'reasons of security' in it." What's really funny to me personally is that at my last job we were asked to send self decrypting PGP EXE's that contained the actual data to clients who didn't have PGP, and wouldn't know it from a hole in a wall. We'd then tell them the (usually lame) password over the phone. If any of those clients receive one of these, I can absolutely guarantee that they'll open it and spread this evil crap. A virus pretending to be administration(a)minder.net wrote: > For security reasons attached file is password protected. The password is "10361". > > Kind regards, > The Minder.net team http://www.minder.net

2 1

Vote changing gizmos (paid for by feds)
by Major Variola (ret) 03 Mar '04

03 Mar '04

At 09:54 PM 3/2/04 -0500, R. A. Hettinga wrote: >From: Tim May <timcmay(a)removethis.got.net> >Or enter a voting place with a "gizmo" and aim it at the electronic >polling stations. Turn to the little old biddies who run our polling >places and smile. If they ask what you just did, tell them "I just >changed the votes. Have a nice day!" Leave before they can call the >cops. ..slow exhale.. thanks for the hit, Bob, that's the good shit.. I miss it. Of course, the e-election rubes contribute to the vote changing too: Glitches Hinder Casting of Votes Problems with new electronic systems in Orange and San Diego counties frustrate voters. Officials call the harm minimal. Problems with new electronic voting systems caused some Orange County residents to vote in the wrong district elections Tuesday and prevented some San Diego County voters from casting any ballot at all. http://www.latimes.com/news/local/la-me-machines3mar03,1,3468893.story?coll…

1 0

Fwd: Re: The Neocon Case for Imprisoning War Opponents
by R. A. Hettinga 03 Mar '04

03 Mar '04

NNTP-Posting-Date: Fri, 23 Jan 2004 15:17:31 -0600 Subject: Re: The Neocon Case for Imprisoning War Opponents Date: Fri, 23 Jan 2004 13:17:27 -0800 From: Tim May <timcmay(a)removethis.got.net> Newsgroups: alt.conspiracy,alt.politics.bush,alt.politics.democrats,talk.politics.guns,misc.survivalism MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8bit Mail-Copies-To: nobody User-Agent: Thoth/1.6.0 (Carbon/OS X) Lines: 29 NNTP-Posting-Host: 204.31.188.217 In article <burtcj08k0(a)enews1.newsguy.com>, mellstrr <mellster(a)nospam.com> wrote: The founding principles are in ruins, unless we can verify our elections this November. I've had it with talk about touch-screen voting. It's time for non-violent protest at the polls... Carry a fancy metal briefcase with some stenciled lettering: "E-Vote Compliance Monitoring Station." Or park a van across the street with an antenna on the roof (easily faked-up out of old satellite dish junk and t.v. yagis). Do this near some minority voting polls and watch them scatter...could help suppress the welfare monkey vote a bit, and sow unrest and paranoia. Or enter a voting place with a "gizmo" and aim it at the electronic polling stations. Turn to the little old biddies who run our polling places and smile. If they ask what you just did, tell them "I just changed the votes. Have a nice day!" Leave before they can call the cops. Launch a fake virus (be careful it's not a real replicator!) and send it to some journalists. Give it some catchy title which suggests it's a virus being spread to disrupt, change, or stuff the e-vote system. With luck, some journalists will write about the "Grabber" virus and how e-voting is clearly not safe. --Tim May -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 2

Teachers Union declared a "Terrorist Organization"
by R. A. Hettinga 02 Mar '04

02 Mar '04

NNTP-Posting-Date: Mon, 23 Feb 2004 20:32:07 -0600 Subject: Teachers Union declared a "Terrorist Organization" Date: Mon, 23 Feb 2004 18:32:08 -0800 From: Tim May <timcmay(a)removethis.got.net> Newsgroups: alt.teachers,misc.education,misc.survivalism,scruz.general,la.general, Lines: 27 NNTP-Posting-Host: 69.19.240.173 WASHINGTON (Routers) - Education Secretary Rod Paige called the nation's largest teachers' union a "terrorist organization" during a meeting on Monday with U.S. governors. "It is important that terrorists and the groups which harbor them not be given the rights intended by the Constitution," he added. Administration officials declined to state how many of the so-called "teachers" have been apprehended, but confirmed that they are being held without bail, without access to lawyers, and without their First, Fourth, Fifth, Sixth, Ninth, Tenth, Fourteenth, and other Bill of Rights rights. "As terrorists, they have no rights." Citizens are urged to make citizen's arrests of any members of the National Teachers Union or similar terrorist cells they may run across. EdSec Paige acknowledged that some terrorists may be killed in firefights with citizens, but he said this is the price which must be paid. "We encourage citizen-units to "bag" these terrorists. Kill them. Shoot them in their homes, shoot them in their cars, kill them as they enter their terrorist training camps, the so-called "schools," he added. "We took away the rights of those who protested our actions in Afghanistan, Iraq, Sudan, Syria, and Jordan, so why should we give more pribleges to, like, some teachers?" -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Negroes in Haiti want "Billions" in Aid--FUCK THAT
by R. A. Hettinga 02 Mar '04

02 Mar '04

NNTP-Posting-Date: Sun, 29 Feb 2004 14:00:49 -0600 Subject: Negroes in Haiti want "Billions" in Aid--FUCK THAT Date: Sun, 29 Feb 2004 12:00:53 -0800 From: Tim May <timcmay(a)removethis.got.net> Newsgroups: misc.survivalism,la.general,scruz.general Message-ID: <290220041200537144%timcmay(a)removethis.got.net> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8bit Mail-Copies-To: nobody User-Agent: Thoth/1.6.0 (Carbon/OS X) Lines: 63 NNTP-Posting-Host: 69.19.185.221 The negro mobs and hooligans, led by the usual corrupt drug barons, are seeking Uncle Sugar's handouts. Billions in aid for Haiti. Fuck that. Money stolen from U.S. taxpayers should not be sent to Haiti...or to Egypt, Iraq, Sudan, Taiwan, Israel, Russia, India, or any of the other hundred satrapies we "bail out" (translation: most of the stolen money the U.S. government gives them in "grants" and "development loans" is sent into Swiss and Cayman Island bank accounts). Let the Bloods and Crips of Haiti battle it out for the scraps of food looted from the few remaining stores. Let the cannibals swing their machetes, necklace their opponents, burn down their neighborhoods in the same way the negro ghetto mutants burned down their neighborhoods in South-Central LA, in Oakland, in Liberty City (lots of Haitians there, not surprisingly), Watts, and Detroit. The U.S. has a _stated_ national debt of $7 trillion ($7,000,000,000,000), and an _actual_ national debt of approximately $35 trillion, counting "unfunded liabilities," loans which are are not carried as debt but which stand a nil chance of ever being repaid, the Socialist InSecurity black hole, and various other "suicide with a fountain pen" co-signing agreements on loans which are worthless. This $35 trillion national debt represents an amortized personal debt of about $125,000 for each of America's roughly 275 million citizens/residents (no longer the same thing, but I digress). However, not all of those 275 million are taxpayers. Many are children, many are prisoners, many are spouses or other non-filing family members. And many simply don't file tax returns. Approximately 100 million taxpayers are visible, meaning the above $125,000 number is actually about $350,000 for each actual taxpayer. (Further, most taxpayers pay very little--60% of all taxes are paid by the wealthiest 3%. The debt load is thus enormous on our most productive members.) Uncle Sam has been Uncle Sugar for too many of the nations of the world. And he has been Uncle Sugar for too many bums and layabouts and welfare breeders who think money miraculously is owed to them so they can sit at home, in subsidized apartments, collecting welfare checks and listening to Oprah Winfrey and Jesse Jackson tell them that have an "entitlement" to their handouts. Meanwhile, a $7 trillion official national debt, and a looming $35 trillion _actual_ national debt. Corporations are moving jobs out of this collapsing house of cards as fast as they can. This will make the coming generation of burger flippers and Starbucks latte slingers carry the full burden of paying for the retirement of the Baby Boomers...and paying 80% taxes on their meager service economy salaries to pay off the ever-mounting national debt. And to send more billions in aid dollars to Haiti, Egypt, Israel, Poland, Sudan, Georgia, Kazhakstan, Baluchistan, India, Thailand, Taiwan, South Korea, North Korea, and a hundred other countries. It's not a sustainable situation. The chickens are coming home to roost. --Tim May -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [Users] Announce: FreeS/WAN Project Ending (fwd from eugen@leitl.org)
by Eugen Leitl 02 Mar '04

02 Mar '04

Can we demime the mails on this node? ----- Forwarded message from Eugen Leitl <eugen(a)leitl.org> -----

2 1

[Users] Announce: FreeS/WAN Project Ending
by R. A. Hettinga 02 Mar '04

02 Mar '04

--- begin forwarded text

4 7

Re: Gentlemen reading mail part II
by Tyler Durden 02 Mar '04

02 Mar '04

"How about a pseudo random "conversation" generator appliance for the person trying to mask their speech. If it closely models the vocal tract, language and language characteristics of the speaker it might be extremely difficult to remove as background noise." There are plenty of CDs of conversations out there. Moreover, it would be easy to simply record a fairly banal conversation oneself was having. Then put it on a CD player that has repeat mode. Of course, I'm willing to believe this can still be chopped through with the appropriate eavesdropping gear. But the point is that with about $10 bucks of investment, you now force eavesdroppers to deploy $1000s (or more) of gear and people. Adds a kind of reverse DC-bias to the situation, no? Now, only the determined will be going after you, not someone merely fishing for levers to be used against you. Now, they have to send a truck....' -TD >From: Steve Schear <s.schear(a)comcast.net> >To: sunder <sunder(a)sunder.net> >CC: cypherpunks(a)minder.net >Subject: Re: Gentlemen reading mail part II >Date: Mon, 01 Mar 2004 22:11:42 -0800 > >At 07:42 AM 3/1/2004, sunder wrote: >>>Interesting. >>>I guess my basic question is, is there a subset of counter-surveillance >>>actions that can be taken that, while not ensuring secure communications, >>>forces eavesdropping parties to take 'radical' measures in order to >>>obtain the desired information? In other words, if they have to deploy a >>>black-bag operation every few weeks, then that makes the odds of them >>>being 'outed' sooner rather than later much greater. It might even deter >>>survelliance except "when it really counts". >>>But then again, if the walls really have ears, then there's not much that >>>can be done. Perhaps Koffi Annan was completely aware of this but counted >>>on normal diplomatic protocol to prevent embarrasing and public >>>exposures...(and that may be all that's really needed at the UN after >>>all...) > >How about a pseudo random "conversation" generator appliance for the person >trying to mask their speech. If it closely models the vocal tract, >language and language characteristics of the speaker it might be extremely >difficult to remove as background noise. > >steve > >--- >Outgoing mail is certified Virus Free. >Checked by AVG anti-virus system (http://www.grisoft.com) >Version: 6.0.605 / Virus Database: 385 - Release Date: 3/1/2004 _________________________________________________________________ Find things fast with the new MSN Toolbar includes FREE pop-up blocking! http://clk.atdmt.com/AVE/go/onm00200414ave/direct/01/

2 1