July 2004 - cypherpunks-legacy

Re: Email tapping by ISPs, forwarder addresses, and crypto proxies
by hal＠finney.org 25 Jul '04

25 Jul '04

Thomas Shaddack writes: > Reading some news about the email wiretapping by ISPs, and getting an > idea. > > There are various email forwarding services, which are nothing more than a > SMTP server with pairs of recipient(a)forwarder.com -- > recipient(a)hiscurrentisp.com. Right, mostly for use as disposable email addresses. I've used spamgourmet to good effect, myself. > Messages in storage have much lower judicial protection than messages in > transit. (This does not have much technical merit, in the current > atmosphere of "damn the laws - there are terrorists around the corner", > but can be seen as a nice little potential benefit.) One thing I haven't understood in all the commentary is whether law enforcment still needs a warrant to access emails stored in this way. Apparently the ISP can read them without any notice or liability, but what about the police? Also, what if you run your own mail spool, so the email is never stored at the ISP, it just passes through the routers controlled by the ISP (just like it passed through a dozen other routers on the internet). Does this give the ISP (and all the other router owners) the right to read your email? I don't think so, it seems like that would definitely cross over the line from "mail in storage" to "mail in transit". > There can be an easy enhancement for such forwarder service; GnuPG proxy. > Every email that arrives to the forwarder address, before it is forwarded > to the real recipient, is piped through a GnuPG script; the recipient has > then to upload his public key during the registration of the target > address, otherwise the function is the same. That's a great idea. You'd want to be sure and encrypt the whole message including headers, and make the whole thing an encrypted attachment. Has the added side benefits of compressing the email, and you could even have the server do some spam filtering. > For added benefit, the > forwarder should support SMTP/TLS (STARTTLS) extension, so the connections > from security-minded owners of their own mailservers would be protected. STARTTLS support at the proxy should pretty much go without saying these days, so you might as well do it, but if you're already PGP encrypting then it's not adding that much security. Well, maybe it does, but you're talking about a different threat. For the problem that ISPs can read your email in storage, STARTLS doesn't help much because it will only protect the email until it gets to your local ISP, who will store your email for you and can read it then (which is where the PGP comes in). Where STARTTLS would help is with power users who run their own mail servers. But those people don't suffer from the problem we are talking about here, legal access to the email by the ISP (I think, see above). Nevertheless a mail-receiving proxy that uses STARTTLS connections to power users would be kind of cool because it would keep anyone local from knowing anything about the incoming mail. Hopefully, STARTTLS will eventually become so widespread that this functionality will be redundant, but we are not there yet. > The recipient himself then can either run his own mailserver and download > mails through fetchmail, or receive mails using SMTP/ETRN (both methods > allow automated decryption of such wrapped mail during its receiving), or > use a POP/IMAP decryption proxy, or have a plugin in mail client. > > (I know, auto-decryption is dangerous, but we now talk about the system > for one's grandma, transparent to use.) Absolutely, look at the threat model. You're not worried about someone breaking into your computer, you're worried about your ISP legally reading your email. To address this threat, auto-decryption is a perfect solution. Recently there was a proposal for a nym receiving service, http://www.freehaven.net/doc/pynchon-gate/, by Bran Cohen and Len Sassaman. They have a complicated protocol for downloading email anonymously. To hide the complexity, they propose to set up a POP compatible mail server agent on the user's computer running as a daemon process (Windows service). He would configure his mailer to connect to localhost:4949 or whatever, just like any other POP server. The service would periodically go out and poll for email using the fancy protocol, but then it would make it available to the local mail agent in perfectly vanilla form. The point is that this architecture hides the complexity and makes it transparent for end users to use arbitrarily complex crypto for mail receiving. Something similar would be perfect for your idea. > The only vulnerable parts of the mail route then will be the sender's > computer, the pathway between the sender and the forwarder server (if > SMTP/TLS is not used correctly or at all), the forwarder server (if > compromised), and the recipient's computer. The way between the forwarder > and the recipient's ISP, including the recipient's mailbox, is secured. > > What do you think about this scheme? I think it's a great idea. Of course as you say there is still the problem that the forwarding server could read your email, so you have only moved the threat from the ISP to another operator. The difference I suppose is that the forwarder would be selling privacy services, hence different ones would compete to get a good reputation. Any cheating might be detected by insider whistle blowers or perhaps some kind of audit. Hal Finney

6 6

RE: Texas oil refineries, a White Van, and Al Qaeda
by Trei, Peter 25 Jul '04

25 Jul '04

> -----Original Message----- > From: owner-cypherpunks(a)minder.net > [mailto:owner-cypherpunks@minder.net]On Behalf Of Thomas Shaddack > Sent: Tuesday, July 20, 2004 3:48 PM > To: Justin > Cc: cypherpunks(a)minder.net > Subject: Re: Texas oil refineries, a White Van, and Al Qaeda > > > > On Tue, 20 Jul 2004, Justin wrote: > > > HOUSTON (Reuters) - Law enforcement officials said on > Monday they are > > looking for a man seen taking pictures of two refineries in > Texas City, > > Texas. > > > The person in question was just somebody with a weakness for > industrial > architecture. Indeed. Among the endless variety of things people do with their spare time are trainspotters and planespotters. This seems to be more popular in Britain than in the US, but I wonder if even over there people who park themselves near airports railway statiions, obsessively noting the arrival and departure of each vehicle, attract the attention of security? Peter

4 3

Re: Email tapping by ISPs, forwarder addresses, and crypto proxies
by Major Variola (ret) 25 Jul '04

25 Jul '04

At 12:39 AM 7/22/04 -0500, J.A. Terranson wrote: >On Wed, 21 Jul 2004, Major Variola (ret) wrote: > >> I'm following the Principle of not underestimating the >> adversary, > >Don't go overboard: remember that there is a difference between >underestimating your adversary and unrealistically *over*estimating your >adversary. Good point. Channelling Hettinga, crypto is economics. >I (and I suspect you) live in the "high tech" world, Um, yes :-) >while a large part of academia tends to believe that the USG is around ten >years *behind* them (oh, to have such an ego!). In my personal >experience, they tend to have roughly a five year lead on what my >world considers "bleeding edge". That said, I'm willing to cut them a few >more years of slack when doing the necessary threat assessment, but I just >do not believe they are 20, or even 10 years ahead. And that is not an >"idle" belief, it's a considered, long formed opinion, based on an awful >lot of input data. Fair 'nuff. You know that 5 year predictions are too conservative, and 20 year predictions too liberal. Ask Orwell. My point is only that they will be killed should they leak their actual capabilities. >> Perhaps that grants the Maryland trogdyltes too much, but again, >> conservatism rules in this game. > >Conservatism in the real world, unreasonable paranoia in the academic >world (a necessary thing in that context). My academic experience had nothing to do with networking. I'm just a manic mechanic, okay? >> They also get radioisotope power supplies, etc. > >This is actually a *very* good point. It would also address the off-shore >splice vs power issue nicely. But we are still constrained by backhaul. Ergo my dark fiber remark, even if naif. >Yes, VA and DC have gluts of glass. In fact, that is one of the most >concentrated glut areas. And most worth observing... >While this cannot be discounted in toto, the tech comes to them from >academia (most of the time), so generally, if you are widely read, you'll >have a pretty good idea of what's *possible*. You are likely dead-on >accurate about the fabs though. In the *public* lit. >> Albeit, "Nortel" (even if Canadian, eh?) > >Yup. The Irony Meter is hanging out at the right of the scale again :-) Bent so many needles, I don't even know my real name... >Undersea taps are hard. No matter how you figure it. You think subs are just toys? >The actual intel/counterintel guys make shit for money. What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB got Ames' wife as part of the package, whereas the FBI CI dude let his wife off as part of the deal he cut. Nice xian that he was, he was into strippers. All under $2e6, all capable of reading their own records. Go figure, eh? See you in Athens, or before :-)

4 3

More American vigilantes may be in Afghanistan, U.S. military says
by R. A. Hettinga 25 Jul '04

25 Jul '04

<http://www.billingsgazette.com/printer.php?id=1&display=rednews/2004/07/24/…> BillingsGazette.com printable article More American vigilantes may be in Afghanistan, U.S. military says Associated Press KABUL, Afghanistan - The U.S. military said Saturday there could be more vigilantes hunting terror suspects here after a group of Americans were arrested for allegedly abusing Afghans in a private jail. The U.S. government is offering big rewards for the capture of top terrorist suspects, including a US$50 million bounty on al-Qaida leader Osama bin Laden. It remains unclear if the three Americans who went on trial in the Afghan capital on Wednesday charged with hostage-taking and torture were hoping to cash in _ or if they were the only such group in the country. "It is entirely possible that there are others acting independently," military spokesman Maj. Jon Siepmann said. Afghanistan is awash with shadowy foreign security operatives. Some work for private contractors protecting reconstruction workers, others apparently with the military or secret services. The U.S. military has tried to distance itself from the three detained Americans, led by a former U.S. soldier on a self-appointed counter-terrorism mission. But both the Americans and NATO peacekeepers acknowledge contact with the group, which dressed in army fatigues and wore the beards and dark glasses favored by special forces soldiers. NATO troops helped the trio with three raids in the capital last month, while the U.S. military gratefully accepted a detainee at Bagram Air Field, north of Kabul, in May. Afghan authorities, who also mistook the men for U.S. special forces, arrested them only in July after NATO troops and the U.S. military denounced them as impostors and raised the alarm. Siepmann didn't say whether the military knew of any other freelancers or bounty-hunters in Afghanistan. "However, I think the issue of Mr. Idema has brought a heightened awareness to everyone involved ... to be on the lookout for this kind of behavior," Siepmann said. "I think Mr. Idema's arrest and current judicial process will serve as a warning to others who will attempt to do this in Afghanistan," he said. The three face up to 20 years in jail if convicted. Afghan security forces freed eight prisoners from the group's makeshift jail in a house in downtown Kabul. Firearms were also seized in the house. Idema, who claims to have fought with Afghan forces against the Taliban in 2001-2002, says the men were arrested to avert an al-Qaida plot to attack foreign troops and assassinate a string of Afghan political leaders. He told reporters in court on Wednesday that he had support from within the U.S. Department of Defense and that he could produce evidence to prove it _ a claim Pentagon officials dispute. The trial is expected to resume early next month. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Internet providers test ways to outsmart spam
by R. A. Hettinga 25 Jul '04

25 Jul '04

"A whitelist for my friends..." ...which, in the meantime, will probably suffice for the time being, at least as far as Mr. Pareto is concerned. Cheers, RAH "...all others pay cash." When that 20% becomes 80% again, anyway... -------- <http://www.post-gazette.com/pg/pp/04207/350858.stm> Internet providers test ways to outsmart spam Sunday, July 25, 2004 By Chris Gaither, Los Angeles Times Be liberal in what you accept and conservative in what you send. That was the philosophy when computer scientists sent the first electronic-mail messages over the Internet more than 30 years ago. At the time, the Internet was in its infancy, used by a few hundred researchers at universities, government labs and high-tech companies. Today, hundreds of millions of people have e-mail addresses, and junk e-mailers send out billions of messages every day. And Internet service providers are racing to figure out how to force spammers to abide by that old golden rule. Microsoft Corp., Yahoo Inc. and other companies are taking different approaches, but they all have the same objective: finding a way to verify that people who send e-mail are who they say they are. That would plug the biggest hole in Simple Mail Transfer Protocol, the system that has been shuttling messages around the Net since 1983. The designers of SMTP knew their protocol didn't have a built-in authentication system. But they saw no reason to worry. "There was very little attention paid to nasty people because we all knew and trusted each other," said David Farber, an Internet pioneer who is now a Carnegie Mellon University professor of computer science and public policy. "It was understood that it was easy to forge mail, but who would forge mail among your friends?" Spammers have taken full advantage of that oversight. They falsify their names and reply-to addresses to bypass junk e-mail filters and trick recipients into opening messages. They copy corporate logos to send fake messages purporting to be from companies such as eBay and Citibank to fool people into handing over their credit card numbers and other personal information in so-called "phishing" attacks. "Accountability is really the missing link for many of the problems we have on the Internet," said Phillip Hallam-Baker, principal scientist for VeriSign Inc., the company that maintains the master list of commercial Internet addresses. The Federal Trade Commission last month cited the lack of authentication standards when it declined to create a "do-not-e-mail" registry modeled after the "do-not-call" list for telemarketers. Without knowing for sure who is sending a message, the FTC said, Internet service providers and other spam fighters wouldn't be able to punish violators. The big Internet service providers don't agree on how to best fix the authentication problem. Two systems being tested now are Yahoo's DomainKeys standard and Sender ID, which is backed by Microsoft and the Pobox.com e-mail service. Sender ID has attracted the most interest. It counts on the fact that although e-mail headers are easy to forge, IP addresses -- the unique set of numbers attached to every Internet domain -- are not. Here's how it works: A company like Amazon.com Inc. publishes its IP address in a public database. When a message arrives that claims to be from the online retailer, the recipient's e-mail program automatically checks the information in the header and compares it with the information in the database. If it matches, the message goes through. If it doesn't match, the message is quarantined or blocked. ISPs including EarthLink Inc. and Time Warner Inc.'s America Online are testing a component of Sender ID called SPF, or Sender Policy Framework. AOL has started publishing the list of IP addresses from which it sends its members' e-mail, so that other e-mail service providers can block messages from spoofed AOL addresses. By the end of the summer, the country's biggest ISP hopes to begin blocking e-mail that purports to come from companies often impersonated in phishing attacks -- such as eBay's PayPal division -- but that can't be verified as legitimate. Authenticating e-mail "is the single most important thing we can do to enhance the SMTP," said Carl Hutzler, AOL's director of anti-spam operations. DomainKeys takes an approach that is based on public-private key cryptography. Sent messages include an encrypted digital signature created by the e-mail provider's private key. When the message arrives at the recipient's e-mail server, the server checks a database for the sender's public key. If the public and private keys match up, the signature can be decrypted, and the sender's identity validated. If not, the message can be blocked by spam filters. Yahoo began testing DomainKeys in March. The company said it planned to implement it for outbound messages from its Yahoo Mail customers and at least some incoming messages by the end of the year. If the ISPs succeed, e-mail marketers will have no choice but to authenticate their messages to prevent them from being blocked. And if they authenticate, ISPs and other spam fighters will be able to keep track of senders and their reputations. Companies would be held accountable for the sending habits of their employees, and ISPs would be responsible for their customers' e-mail. Those that developed a reputation for generating spam could find their e-mail blocked -- a situation that could force e-mail providers to ensure that their customers' computers are secured, so spammers couldn't hijack them to send junk mail. Legitimate e-mail marketers that allow recipients to remove themselves from mailing lists and that obey other professional codes of conduct would have their messages whisked around spam filters instead of getting blocked. Technologies like DomainKeys and Sender ID are needed to "take SMTP from being dangerously wide open to being much more controlled," said Steve Jillings, chief executive of FrontBridge Technologies Inc., a Marina del Rey, Calif., e-mail security company that plans to implement Sender ID. The catch is that an authentication standard has to be widely adopted to be effective. Getting companies across the world to agree on a standard and implement it seems highly unlikely to technologists such as Carnegie Mellon's Farber. But the future of e-mail depends on it, said Scott Weiss, chief executive of the anti-spam company IronPort Systems Inc. "The innovation of e-mail now needs to catch up with many of the rich features that have now been rendered virtually unusable." Back Copyright )1997-2004 PG Publishing Co., Inc. All Rights Reserved. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Fink-announce] FINK-2004-07-24 Security Announcement - Samba
by R. A. Hettinga 24 Jul '04

24 Jul '04

--- begin forwarded text

1 0

Energy Dept. Shelves Removable Disks
by R. A. Hettinga 24 Jul '04

24 Jul '04

<http://www.washingtonpost.com/ac2/wp-dyn/A10205-2004Jul23?language=printer> The Washington Post washingtonpost.com Energy Dept. Shelves Removable Disks Response to Security Breach at Lab Associated Press Saturday, July 24, 2004; Page A02 The Energy Department, in response to a security scandal at the Los Alamos weapons lab, ordered a halt yesterday to classified work at as many as two dozen facilities that use removable computer disks like those missing at the New Mexico lab. Energy Secretary Spencer Abraham said the "stand-down" at operations using the disks, containing classified material involving nuclear weapons research, is needed to get better control over the devices. The disks, known as "controlled removable electronic media," or CREM, have been at the heart of an uproar over lax security at the Los Alamos National Laboratory, where work has been stopped as scientists search for two of the disks reported missing on July 7. Nineteen workers have been suspended pending the outcome of an investigation into the missing data devices and an incident in which an intern was injured recently in a laser accident. The missing Los Alamos disks raised concern at the Energy Department about the handling of the devices at other facilities involved in nuclear weapons research, department officials said. Abraham said he wants to "minimize the risk of human error or malfeasance" that could compromise the classified nuclear-related information held in the devices, which are used at Energy Department facilities nationwide in nuclear-related work. "While we have no evidence that the problems currently being investigated are present elsewhere, we have a responsibility to take all necessary action to prevent such problems from occurring at all," Abraham said in a statement. The stand-down involves classified work across the government's nuclear weapons complex wherever the CREM storage devices are used, the official said. It will continue until an inventory of the devices is completed and new control measures on their use is put in place, said Energy Department spokesman Joe Davis. Employees using the disks must also undergo security training. Among the facilities that are preparing for an interruption of classified work are the Argonne National Laboratory outside Chicago; the nuclear weapons plant in Oak Ridge, Tenn.; and the Sandia National Laboratories in Albuquerque, where a missing classified disk was reported found last week. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Texas oil refineries, a White Van, and Al Qaeda
by Tyler Durden 24 Jul '04

24 Jul '04

>The person in question was just somebody with a weakness for industrial >architecture. > Either that, or they wanted to see if there'd be ANOTHER apocalyptic chain reaction decimating Texas City, just in the off chance someone hits just one of the tanks.* In other words, does public safety still boil down to "just trust us"? *: A year or two ago someone posted about the blow up of Texas City back in the early 1950s. Apparently, some kind of tanker hit something else and set of a chain reaction killing thousands and wiping out the town (I know someone who walked over to Texas City right after it happened and looked around.) _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

Texas oil refineries, a White Van, and Al Qaeda
by Justin 24 Jul '04

24 Jul '04

http://news.myway.com/top/article/id/415877|top|07-19-2004::15:07|reuters.h… Jul 19, 2:57 PM (ET) HOUSTON (Reuters) - Law enforcement officials said on Monday they are looking for a man seen taking pictures of two refineries in Texas City, Texas. Texas City, located on the Texas Gulf coast about 30 miles south of Houston, has three refineries including the largest U.S. plant operated by BP Plc., which is the third-largest U.S. refinery, processing 470,000 barrels of crude oil per day. The man, described as white with dark hair, was seen taking pictures outside the refineries, all located on the same highway, at about 5 p.m. CDT on Saturday, said Bruce Clawson, emergency management and homeland security director for Texas City. While it is not illegal to take pictures of a refinery from a highway or street, officials would like to talk to the man to find out his reason for taking the photographs. "This is based on the idea that al Qaeda does its homework," Clawson said. "That's not to say we don't have enough home-grown idiots already who might want to do something." The man was seen driving a white van. Valero Energy Corp. operates a 243,000 barrel per day (bpd) refinery in Texas City. Marathon Ashland Petroleum LLC, a joint venture between Marathon Oil Corp., and Ashland Inc., operates a 76,000 bpd refinery in Texas City. The U.S. Federal Bureau of Investigation has repeatedly warned refiners that they are possible targets for would-be terrorists. U.S. refinery security officials say their security guards regularly report people observing or taking pictures of refineries. During the Independence Day holiday, ExxonMobil Corp. tightened security at the largest U.S. refinery, the 538,000 bpd plant in Baytown, Texas, 30 miles east of Houston, because of general warnings about possible terrorist activity. -- "When in our age we hear these words: It will be judged by the result--then we know at once with whom we have the honor of speaking. Those who talk this way are a numerous type whom I shall designate under the common name of assistant professors." -- Kierkegaard, Fear and Trembling (Wong tr.), III, 112

3 3

FIPS chassis/linux security engineer?
by Eric Murray 24 Jul '04

24 Jul '04

Does anyone know of a manufacturer of FIPS 140 certified or certifiable 1u/2u rack mount chassis? For a seperate project, does anyone know of a small linux-ready/able box with ethernet? Gumstix looks cool but I need hardwire networking. Last, I'm looking for a Linux expert security engineer in the SF bay area. (I'm managing a security group at a startup that has been shipping products to paying customers for a few years. No its not lne.com, this just address I use to post). This person will need to know linux/unix OS security/hardening _in depth_ and also have an understanding of crypto APIs (writing them not using them) plus significant industry experience. Sorry, no relocation assistance. Eric

4 4