August 2004 - cypherpunks-legacy

Re: yes, they look for stego, as a "Hacker Tool"
by Major Variola (ret) 15 Aug '04

15 Aug '04

At 02:43 AM 8/15/04 +0200, Thomas Shaddack wrote: >On Sat, 14 Aug 2004, Major Variola (ret) wrote: >> It was disturbing that, as the bottom fell out of telecom, and handsets >> became commoditized, faceplates and ringtones were highly profitable. >> Faceplates are at least made of atoms. There are several lessons there, >> from economic to sociobiological (if there's a difference), none of >> which are terribly pleasing in my aesthetic. > >Care to elaborate further, please? I found it troubling that the tech was becoming commoditized, since this disturbs the innovation that I find attractive. OTOH cheap products are nice. And commoditization is the end-game for tech anyway. Selling ringtones (static bits, not even a service) struck me as oldschool as selling music, enforced in this case by proprietary cellphone "standards". That "personalization" features were lucrative I found to be a comment on human nature. Or human-teens' nature. Since I tend to have an engineer's aesthetic, which I take to be fairly spartan/functional, as well as believing that personalization should be done by the person desiring it, I found mass-market faceplates kind of silly. But then I don't own any Nike baseball caps or Coke t-shirts to express myself. I am un-Amerikan, clearly. There is something I clearly don't "get". Herd mentality, perhaps. Besides, the phones should be covered in conformal photocells to trickle charge them. >> Fortunately the whole PDA vs. cell vs. camera vs GPS vs. smartcard vs >> MP3 player vs. email-pager etc bat-belt [1] frenzy will resolve in a few >> years, and perhaps some of the Linux based solutions will not be >> involuntary citizen-tracking devices and will support privacy of data >> stored, and in transit, including voice data. And free ring tones :-) >> All that's needed is one of the hardware-selling companies to start the >> process, making money off the atoms, and possibly Sharp's Zaurus (?) >> already has? > >Or buy an Enfora Enabler GSM/GPRS module, add a Gumstix module with >built-in bluetooth, slap in a suitable display and keyboard, eventually >add a GPS receiver, and we're set. All features and security modes we can >imagine, and then some. I liked the Handspring's modularity, but don't know how they did in the marketplace. I do think that the cell makers have a decent enough market share to take over the PDA/camera/email etc. market, and they know that and are working on it. I read recently that in 5 years only pros will own digital cameras that do nothing else. Similarly with GPS, PDAs, MP3 renderers & recorders, calculators, authentication tokens, smart cards, etc. How much extra does a hifi audio ADC or DAC cost than an 8 Khz telecom one? Why not let users see their location, even if its only triangulated and not satellite based? Non-volitile memory is only getting cheaper, smaller, with less power requirements or awkward properties like page-based access. >Preventing spatial tracking is difficult though, as we're dependent on the >cellular network for staying online. Though if the given area has wifi >mesh coverage, it could be easier. (And if the device becomes widely >popular, the handsets can serve as mesh nodes themselves - but that's a >song of rather far future.) Yes, but a nice Heinleinian corollary. >> Perhaps there's a biz model in buying a 3-D color prototyping machine >> for $40K and setting up a custom faceplate biz for the integrated gizmo >> of the near future. Hmm, with freedom-enabling software being >> distributed on the side, it sounds like a Heinlein novel... > >Why not? :) Isn't the main purpose of science-fiction (at least its >certain kinds) to be the inspiration for the future? > >On the other hand, perhaps it's cheaper to just get a bulk supply of >"blank" faceplates and hire an artist with an airbrush and a talent. > >It's also possibly easier (and cheaper) to make the parts in more >classical way, eg. by casting them from resin. The rapid prototyping >machines so far usually don't provide parts that are both nice-looking, >accurate, and with suitable mechanical properties at once. I was thinking there are too many models to keep the things in stock on a little beachside storefront; and you could add custom textures with a prototyping machine. Its also possible I'm enamoured of 3D printers which have no place right now in making consumer products. >> [1] Batman (tm) wore a belt with too many gizmos. Some widget-fetishist >> friends/early adopters are similarly afflicted. > >There is nothing like "too many" gizmos! (Well, you could call such >situation "almost enough", but never "too many".) Aesthetics and convenience. OTOH when your Everything Gizmo dies, you are seriously out of luck. Much like when your combo fax/printer/copier/scanner power supply dies, you have zero functionality, instead of the degraded functionality you'd have if each were a separate machine. And sometimes the integrated gizmo does nothing very well, eg early cell-phone cameras. But integration (done well, and reliably) does sell. My $50 prepaid cell phone does voice recognition. Its the 21st century, and I want my Dick Tracy watch now! And it better run Java, or Python, damnit! (I was impressed that the Zaurus PDA can be a web server, BTW.)

1 0

Websites, Passwords, and Consumers (Re: CRYPTO-GRAM, August 15, 2004)
by R. A. Hettinga 15 Aug '04

15 Aug '04

At 11:26 PM -0500 8/14/04, Bruce Schneier wrote: > Websites, Passwords, and Consumers > > > >Criminals follow the money. Today, more and more money is on the >Internet. Millions of people manage their bank accounts, PayPal >accounts, stock portfolios, or other payment accounts online. It's a >tempting target: if a criminal can gain access to one of these >accounts, he can steal money. > >And almost all these accounts are protected only by passwords. > >If you're reading this essay, you probably already know that passwords >are insecure. In my book "Secrets and Lies" (way back in 2000), I >wrote: "Over the past several decades, Moore's Law has made it >possible to brute-force larger and larger entropy keys. At the same >time, there is a maximum to the entropy that the average computer user >(or even the above-average computer user) is willing to >remember.... These two numbers have crossed; password crackers can now >break anything that you can reasonably expect a user to memorize." > >On the Internet, password security is actually much better than that, >because dictionary attacks work best offline. It's one thing to test >every possible key on your own computer when you have the actual >ciphertext, but it's a much slower process when you have to do it >remotely across the Internet. And if the website is halfway clever, >it'll shut down an account if there are too many -- 5?, 10? -- >incorrect password attempts in a row. If you shut accounts down soon >enough, you can even make four-digit PINs work on websites. > >This is why the criminals have taken to stealing passwords instead. > >Phishing is now a very popular attack, and it's amazingly >effective. Think about how the attack works. You get an e-mail from >your bank. It has a plausible message body, and contains a URL that >looks like it's from your bank. You click on it and up pops your bank >website. When asked for your username and password, you type it >in. Okay, maybe you or I are aware enough not to type it in. But the >average home banking customer doesn't stand a chance against this kind >of social engineering attack. > >And in June 2004, a Trojan horse appeared that captured passwords. It >looked like an image file, but it was actually an executable that >installed an add-on to Internet Explorer. That add-on monitored and >recorded outbound connections to the websites of several dozen major >financial institutions and then sent usernames and passwords to a >computer in Russia. Using SSL didn't help; the Trojan monitored >keystrokes before they were encrypted. > >The computer security industry has several solutions that are better >than passwords: secure tokens that provide one-time passwords, >biometric readers, etc. But issuing hardware to millions of electronic >banking customers is prohibitively expensive, both in initial cost and >in customer support. And customers hate these systems. If you're a >bank, the last thing you want to do is to annoy your customers. > >But having money stolen out of your account is even more annoying, and >banks are increasingly fielding calls from customer victims. Even >though the security problem has nothing to do with the bank, even >though the customer is the one who made the security mistake, banks are >having to make good on the customers' losses. It's one of the most >important lessons of Internet security: sometimes your biggest security >problems are ones that you have no control over. > >The problem is serious. In a May survey report, Gartner estimated that >about 3 million Americans have fallen victim to phishing >attacks. "Direct losses from identity theft fraud against phishing >attack victims -- including new-account, checking account and credit >card account fraud -- cost U.S. banks and credit card issuers about >$1.2 billion last year" (in 2003). Keyboard sniffers and Trojans will >help make this number even greater in 2004. > >Even if financial institutions reimburse customers, the inevitable >result is that people will begin to distrust the Internet. The average >Internet user doesn't understand security; he thinks that a gold lock >icon in the lower-right-hand corner of his browser means that he's >secure. If it doesn't -- and we all know that it doesn't -- he'll stop >using Internet financial websites and applications. > >The solutions are not easy. The never-ending stream of Windows >vulnerabilities limits the effectiveness of any customer-based software >solution -- digital certificates, plug-ins, and so on -- and the ease >with which malicious software can run on Windows limits the >effectiveness of other solutions. Point solutions might force >attackers to change tactics, but won't solve the underlying >insecurities. Computer security is an arms race, and money creates >very motivated attackers. Unsolved, this type of security problem can >change the way people interact with the Internet. It'll prove that the >naysayers were right all along, that the Internet isn't safe for >electronic commerce. > >Phishing: ><http://www.msnbc.msn.com/id/5184077/> ><http://www.internetweek.com/e-business/showArticle.jhtml?articleID=2210 >0149> or <http://tinyurl.com/54b4g> > >The Trojan: ><http://news.com.com/Pop-up+program+reads+keystrokes%2C+steals+passwords >/2100-7349_3-5251981.html> or <http://tinyurl.com/yqeoe> ><http://www.pcworld.com/news/article/0%2Caid%2C116761%2C00.asp> > >A shorter version of this essay originally appeared in IEEE Security >and Privacy: ><http://csdl.computer.org/comp/mags/sp/2004/04/j4088abs.htm> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Apparently one can spell "Snake Oil" in Capital Letters, too (Re: CRYPTO-GRAM, August 15, 2004)
by R. A. Hettinga 15 Aug '04

15 Aug '04

At 11:26 PM -0500 8/14/04, Bruce Schneier wrote: >From: "Ken Lavender" <ICS_Atlanta(a)Charter.Net> >Subject: ICS Atlanta > >I am APPAULED at your "comments" that you had made on your website: > > <http://www.schneier.com/crypto-gram-0407.html#9> > >You have statements are nothing but slander & defamation. They shall >be dealt with accordingly. > >Lie #1: "How do they demonstrate Tree's security? 'Over 100 >professionals in mathematics & in computer science at Massachusetts >Institute of Technology & at Georgia Tech, had sample encoded messages >submitted to them. Not a single person could break this code!'" That >is not the ONLY way we prove it. We have examples & offer to allow >people to submit their OWN messages to have encoded to SEE how good the >code is. So there are THREE methods, NOT just ONE as you IMPLY. > >Lie #2: "These guys sent unsolicited e-mails..." HOW do you KNOW that >this was the case? Have any PROOF of such? NO! > >Lie #3: "And if all that isn't enough to make you run screaming from >these guys, their website proudly proclaims: 'Tree Encoded Files Can Be >"Zipped."'" Because they can be "zipped" does NOT mean that it is "bad >encoding." The "code talkers" of ww2 used LANGUAGE to "code" the >messages, and THOSE COULD BE "ZIPPED"!!! And that code was NEVER BROKEN!!! > >Lie #4: "That's right; their encryption is so lousy that the >ciphertext doesn't even look random." AGAIN, HOW would you >KNOW??? Did you break it? NO! And what is "random"??? > > random : without definite aim, direction, rule, or method > >"So lousy"? HOW WOULD YOU KNOW??? You would have to KNOW how we >encode BEFORE you can make such a statement, & YOU DO NOT KNOW >HOW!!! If it is SO LOUSY, how come NOBODY HAS BROKEN IT YET??? And we >have people ALL THE TIME trying to, with ZERO SUCCESS. > >I do not like you slandering something that you do not >understand. ATALL!!! > >The ONLY question you asked was "how long is the key" AND THAT WAS >IT! HOW long was the key that the 'code talkers' used? ZERO!!! JUST AS >OUR IS. The encoding routine was created, tested, & verified on PAPER >& PENCIL WITHOUT COMPUTERS! A child could encode data using our >routine. The computer is merely used to "speed-up" the process, NOT TO >CREATE IT. Our routine is based on LANGUAGE, NOT MATH. So all of you >"comments" are just false, misleading & just plain ole lies! SHOW & >PROVE that it is NOT random. What is the PATTERN THEN??? > >I am DEMANDING A FULL RETRACTION OF YOUR COMMENTS & A FULL, COMPLETE >APOLOGY TO THESE AND ALL STATEMENTS. > >I am a person who tries to work with people as a man w/o having to >"drag" others into the mess. Others? THE COURTS. You have violated >Calf law by your statements. > >[Text of California Civil Code Section 46 deleted.] > >Your LIES have damaged my respect in my job & has damaged any sales of >this routine. You have ZERO proof of your "comments," ANY OF >THEM!!! I beseech of you, do the RIGHT THING and comply. I DO NOT >wish to escalate this matter any higher. And remember this, Tree is >based on LANGUAGE, NOT MATH!!!!!!!!!!!!!!!!! > >[Phone number deleted out of mercy.] -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[osint] FBI Warns Storage Unit Operators
by R. A. Hettinga 14 Aug '04

14 Aug '04

--- begin forwarded text To: "Bruce Tefft" <btefft(a)community-research.com> Thread-Index: AcSAr6Y/Mj9PmYHqQZO/G2/Eo29FYgAgaLTg From: "Bruce Tefft" <btefft(a)community-research.com> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Fri, 13 Aug 2004 08:30:35 -0400 Subject: [osint] FBI Warns Storage Unit Operators Reply-To: osint(a)yahoogroups.com FBI Warns Storage Unit Operators Terrorist alert is extended to self-storage units Joyce Lavoy is a manager for South Toledo Self Storage. Lavoy says she was stunned when an FBI agent walked into her office and told her to be on the lookout for possible terrorist activity. Local FBI agents are visiting about 350 storage places in 19 northwest Ohio communities, including Toledo, Lucas County, and Sandusky. They're handing out alerts to owners and employees on potential terrorist activity in storage facilities. Federal sources tell 13 Action News in the past, terror suspects have been known to use storage units to devise their plans. Everytime Joyce Lavoy unlocks an empty storage unit and lifts the door, she's looking for the warning signs of possible terrorist activity. Lavoy has worked in the storage business for five years. She says she's never had an FBI agent walk into her office. "I thought there was someone renting a storage unit he was looking for." That wasn't the case. Lavoy says FBI agents wanted to put managers on alert that terrorists have been known to store and mix deadly chemicals in storage units. The FBI alert cautions storage owners and employees to be on the lookout for: suspicious people who visit the storage facility late at night or at unusual times. unusual fumes, liquids, residues or odors emanating from their storage unit. explosives, blasting caps, fuses, weapons, and ammunition. flight manuals or other similar materials. Lavoy says security cameras are in place and she's taking extra trips around the building with her employees looking for anything suspicious. Source: _http://abclocal.go.com/wtvg/news/811_storageunits.html_ (http://abclocal.go.com/wtvg/news/811_storageunits.html) This information is provided by PURE PURSUIT as a service to members of the Military and Air Defense Community with the purpose of offering relevant and timely information on defense, aviation, emergency, law enforcement and terrorism issues. Posts may be forwarded to other individuals, organizations and lists for non-commercial purposes. For new subscriptions please send an e-mail with "Pure Pursuit" in the subject line to Nena Wiley at : coyotearz(a)aol.com ------------------------ Yahoo! Groups Sponsor --------------------~--> Yahoo! Domains - Claim yours for only $14.70 http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: yes, they look for stego, as a "Hacker Tool"
by Major Variola (ret) 14 Aug '04

14 Aug '04

At 05:30 AM 8/14/04 +0200, Thomas Shaddack wrote: >On Fri, 13 Aug 2004, Major Variola (ret) wrote: > >> Even if you map a particular hash into one of a million known-benign >> values, which takes work, there are multiple orthagonal hash algorithms >> included on the NIST CD. (Eg good luck finding values that collide in >> MD5 & SHA-1 & SHA-256 simultaneously!) > >Argh. You misunderstood me. I don't want to find hash collisions, to >create a false known hash - that is just too difficult. I want to make >every file in the machine recognized as "unidentifiable". No, I understood this. In a later post it was brought up that this is essentially watermarking your content with a unique ID, which can be bad for P2P tracing purposes. So I was suggesting that by using a finite set of 'watermarks' one could avoid essentially embedding a unique label to one's copy of some content, at some cost in Cycles. >The signature busting of MP3s has a disadvantage, though: makes their >sharing back to the P2P pool more difficult, and a lot of programs relying >on their hash (emule, Kazaa(?),...) instead of their file name will >consider them a different file, which causes problems with multisource >download (though the problem won't be on your side). True. But I've found some manual intervention to be required anyway, sometimes you find a few copies of the same content stored as independent files due to slight differences in naming or truncation. >> Sorta like the National Forests... resource of many uses... may as well >> include a mixmaster payload in that worm :-) which also provides some >> other overt free benefit like antivirus or anti-helmetic or defrag or >> game or bayesian spamfilter or chat or screensaver or anon remailing >> client or free ringtone :-) > >Free ringtones. Good attractant these days. I tend to forget about them as >I tend to shun fancy tones - telephones should have a distinctive ring but >"distinctive" does not have to mean "orchestral". But apparently there are >large sets of people who like it. Weird... It was disturbing that, as the bottom fell out of telecom, and handsets became commoditized, faceplates and ringtones were highly profitable. Faceplates are at least made of atoms. There are several lessons there, from economic to sociobiological (if there's a difference), none of which are terribly pleasing in my aesthetic. Fortunately the whole PDA vs. cell vs. camera vs GPS vs. smartcard vs MP3 player vs. email-pager etc bat-belt [1] frenzy will resolve in a few years, and perhaps some of the Linux based solutions will not be involuntary citizen-tracking devices and will support privacy of data stored, and in transit, including voice data. And free ring tones :-) All that's needed is one of the hardware-selling companies to start the process, making money off the atoms, and possibly Sharp's Zaurus (?) already has? Perhaps there's a biz model in buying a 3-D color prototyping machine for $40K and setting up a custom faceplate biz for the integrated gizmo of the near future. Hmm, with freedom-enabling software being distributed on the side, it sounds like a Heinlein novel... [1] Batman (tm) wore a belt with too many gizmos. Some widget-fetishist friends/early adopters are similarly afflicted.

2 1

Re: yes, they look for stego, as a "Hacker Tool"
by Tyler Durden 14 Aug '04

14 Aug '04

>Sorta like the National Forests... resource of many uses... may as well >include a mixmaster payload in that worm :-) which also provides some >other >overt free benefit like antivirus or anti-helmetic or defrag or game or >bayesian spamfilter >or chat or screensaver or anon remailing client or free ringtone :-)" Well, shit there's an idea. Particularly if the virus is benign enough not to get noticed too often. A mini-mixmaster is a particularly wonderful idea, if you could get it to work....in fact, imagine a mixmaster network where each node only exists for a short amount of time. Your P2P ID messages for the mixmaster network should be invisible to users of the ostensible services of course. -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: yes, they look for stego, as a "Hacker Tool" >Date: Fri, 13 Aug 2004 20:14:19 -0700 > >At 01:48 AM 8/14/04 +0200, Thomas Shaddack wrote: > >Then you have > >the forest where every tree is marked and the leprechaun is laughing. > >Love that story. But the self-watermarking you later mention is a >problem. >Even if you map a particular hash into one of a million known-benign >values, which takes work, there are multiple orthagonal hash algorithms >included on the NIST CD. (Eg good luck finding values that collide in >MD5 & SHA-1 & SHA-256 simultaneously!) > > > >> These hash-CDROMs are also useful for finding unlicensed software and > > >> music.... > > > >Another reason for making your data unique. > >In that case, yes, although ultimately the RIAA could hire offshore >Indians to listen >to your stego'd/uniquified Madonna song and identify it. (Of course, >they don't >know if you own the vinyl for it... and software can be sold by the >original purchaser, too, right?) > > >> And keep your tools encrypted, or on memory sticks you can flush or > >> snap with your fingers. > > > >Beware of destruction of memory sticks > >Yes something like a Tomlinson (_Big Breach_) sleight of hand with a >Psion >card is a good idea, as is the microwave oven trash can next to your >machine :-) > > >A neat trick to lower the suspicion-factor for stego in JPEG or video > >could be releasing a closed-source program for Windows as either >freeware > >... and there still is a segment of consumers who think that > >when it is free, it's worthless) > >And a larger segment which will stick any CD they get in the mail into >their >bootable drive.. LOL > > >The sheeple don't have to be only a threat. They can be useful, if >their > >gullibility is properly exploited. > >Sorta like the National Forests... resource of many uses... may as well >include a mixmaster payload in that worm :-) which also provides some >other >overt free benefit like antivirus or anti-helmetic or defrag or game or >bayesian spamfilter >or chat or screensaver or anon remailing client or free ringtone :-) > > > > > _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

1 0

Re: yes, they look for stego, as a "Hacker Tool"
by Major Variola (ret) 13 Aug '04

13 Aug '04

At 01:48 AM 8/14/04 +0200, Thomas Shaddack wrote: >Then you have >the forest where every tree is marked and the leprechaun is laughing. Love that story. But the self-watermarking you later mention is a problem. Even if you map a particular hash into one of a million known-benign values, which takes work, there are multiple orthagonal hash algorithms included on the NIST CD. (Eg good luck finding values that collide in MD5 & SHA-1 & SHA-256 simultaneously!) >> These hash-CDROMs are also useful for finding unlicensed software and >> music.... > >Another reason for making your data unique. In that case, yes, although ultimately the RIAA could hire offshore Indians to listen to your stego'd/uniquified Madonna song and identify it. (Of course, they don't know if you own the vinyl for it... and software can be sold by the original purchaser, too, right?) >> And keep your tools encrypted, or on memory sticks you can flush or >> snap with your fingers. > >Beware of destruction of memory sticks Yes something like a Tomlinson (_Big Breach_) sleight of hand with a Psion card is a good idea, as is the microwave oven trash can next to your machine :-) >A neat trick to lower the suspicion-factor for stego in JPEG or video >could be releasing a closed-source program for Windows as either freeware >... and there still is a segment of consumers who think that >when it is free, it's worthless) And a larger segment which will stick any CD they get in the mail into their bootable drive.. LOL >The sheeple don't have to be only a threat. They can be useful, if their >gullibility is properly exploited. Sorta like the National Forests... resource of many uses... may as well include a mixmaster payload in that worm :-) which also provides some other overt free benefit like antivirus or anti-helmetic or defrag or game or bayesian spamfilter or chat or screensaver or anon remailing client or free ringtone :-)

2 1

Bush backs banks' appeal of Calif's financial privacy law
by R. A. Hettinga 13 Aug '04

13 Aug '04

<http://www.kesq.com/global/story.asp?s=2163114&ClientType=Printable> KESQ NewsChannel 3 Palm Springs, CA: Bush backs banks' appeal of Calif's financial privacy law SACRAMENTO The Bush administration stepped into a lawsuit challenging California's landmark financial privacy law today. The administration is urging a federal judge to side with banks that want to overturn restrictions on how they can share customer information. The new state law requires banks to get permission from customers before giving nonaffiliated companies customers' financial information like their bank balance or spending habits. Copyright 2004 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. All content ) Copyright 2002 - 2004 WorldNow and KESQ. All Rights Reserved. For more information on this site, please read our Privacy Policy and Terms of Service. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

yes, they look for stego, as a "Hacker Tool"
by Major Variola (ret) 13 Aug '04

13 Aug '04

>> A cool thing for this purpose could be a patch for gcc to produce unique >> code every time, perhaps using some of the polymorphic methods used by >> viruses. > >The purpose would be that they do not figure out that you are using some >security program, so they don't suspect that noise in the file or look for >stego, right? Yes, they do. Check the link. The CDROM of file hashes contains a category "Hacker Tools" that includes the Stego tools they could download from the 'net. Any jpg which looks like noise will be of interest. And any stego program will make them look at your images (etc) more closely :-) Most of the programs they've hashed is so the forensic pigs can discount them. But they would find known-stego tools very interesting. And they would find them, even if renamed, from their sigs; but not if polymorphic or encrypted, but then they would be in the "unknown" category, along with user-created files. And programs :-) To be manually inspected by a forensic dude. These hash-CDROMs are also useful for finding unlicensed software and music.... ---- Osama sez: Always use original images and sounds as stego carriers. And keep your tools encrypted, or on memory sticks you can flush or snap with your fingers.

2 2

Re: Forensics on PDAs, notes from the field (your teenage son's homemade porn)
by Major Variola (ret) 13 Aug '04

13 Aug '04

At 10:07 PM 8/13/04 +0200, Thomas Shaddack wrote: >On Fri, 13 Aug 2004, Tyler Durden wrote: > >> And it seems to me to be a difficult task getting ahold of enough photos >> that would be believably worth encrypting. > >Homemade porn? Your 16 year old son's homemade porn. [google on Heidl & rape; a deputy sheriff's teen son makes a porn movie with a passed out teen and gets busted]

1 0