January 2005 - cypherpunks-legacy

Adware for Windows Media Player spreading by P2P
by Bill Stewart 10 Jan '05

10 Jan '05

http://www.theregister.com/2004/12/31/p2p_adware_threat/ According to an article in The Register, Overpeer is spreading adware-infected Windows Media Audio and Windows Media Video files via P2P. PC World Magazine did some research, ran Etherpeek, and found that the adware was going to Overpeer, which is owned by Loudeye, who strongly defend the practice, saying music pirates deserve what they get. Of course, what the article isn't mentioning is that this means that the WMA and WMV file formats have features that can be used with the Windows Media Player to support adware, so a good chunk of the blame belongs back in Redmond. (Remind me again why closed-source DRMware is a good idea?) Now, it wouldn't bother me if the Windows Media Player's silly trippy visuals that you get when playing audio that doesn't have a video track were replaced by some advertising video, as long as it's all self-contained and doesn't phone home to tell advertisers what I'm listening to. But this one seems to be pretty chatty. ---- Bill Stewart bill.stewart(a)pobox.com

1 0

RE: Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire
by Trei, Peter 10 Jan '05

10 Jan '05

John Kelsey > >Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire > > By ANNE EISENBERG > > I just wonder what the false negative rates are. Seem like a > gun that has a 1% chance of refusing to fire when you *really > need it* might not be worth all that much. Similarly, one > that you can't get to work if you've got a band-aid on your > finger, or a cut on your hand, or whatever, loses a lot of > its value. On the other hand, a gun that can't be made to go > off by your toddler is a pretty huge win, assuming you're > willing to trust the technology, but a 90% accuracy level > sounds to me like 10% of the time, your three year old can, > in fact, cause the thing to go off. That's not worth much, > but maybe they'll get it better. And the "suspect struggles > with cop, gets gun, and shoots cop" problem would definitely > be helped by a guy that wouldn't go off for 90% of attackers. > > --John A remarkable number of police deaths are 'own gun' incidents, so the police do have a strong motivation to use 'smart guns' if they are reliable. In New Jersey, there is some kind of legislation in place to restrict sales to 'smart guns', once they exist. Other types would be banned. (Actually, getting a carry permit in NJ is already almost impossible, unless you're politically connected.) This particular model seems to rely on pressure sensors on the grip. This bothers me - under the stress of a gunfight, you're likely to have a somewhat different pattern than during the enrollment process. Many 'smart guns' also have big problems with issues which arise in real life gun fights - shooting from awkward positions behind cover, one-handed vs two-handed, weak hand (righthander using left hand, and vice versa, which can happen if dictated by cover or injury), point vs sighted shooting, and passing a gun to a disarmed partner. There are other systems which have been proposed; magnetic or RFID rings, fingerprint sensors, etc. The one thing that seems to be common to all of the 'smart gun' designs is that they are conceived by people with little experience in how guns are actually used. To look at a particularly ludicrous example, try http://www.wmsa.net/other/thumb_gun.htm For a gun to work, it is just as important that it fires when it should, as that it does not fire when it shouldn't. A safety system which delays firing by even half a second, or which introduces a significant false rejection rate (and 1% is way over the line), is a positive hazard. When the police switch to smart guns, and have used them successfully for some time (say, a year at least) without problems, I'll beleive them ready for prime time. Peter Trei

3 3

RE: Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire
by Trei, Peter 10 Jan '05

10 Jan '05

Justin wrote: > > On 2005-01-10T15:04:21-0500, Trei, Peter wrote: > > > > John Kelsey > > > > > >Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire > > > > By ANNE EISENBERG > > > > > > I just wonder what the false negative rates are. Seem like a > > > > A remarkable number of police deaths are 'own gun' > > incidents, so the police do have a strong motivation > > to use 'smart guns' if they are reliable. > > The NJ law specifically exempts the police from the smart gun > requirement (which for civilians goes into effect in 2007 or 2008). > Regardless, the legislature doesn't need to get involved for law > enforcement to change their weapons policy and require "smart guns." Cynically, I'm not the slightest bit suprised that the police are exempted: 'safety for the government, not for the people'. > False positives may also present a problem. If the only way to get an > acceptable identification rate (99%, for instance) is to create a 50% > false positive rate for unauthorized users, that's reduces utilitarian > benefit by half. A 1% false negative rate is too high. A 50% false positive rate is *much* too high. > "Smart guns" are a ploy to raise the cost of guns, make them require > more maintenance, annoy owners, and as a result decrease gun > ownership. If it's combined with a rule to ban the transfer and/or ownership of 'dumb' (ie, reliable) guns, then it's also a backdoor gun confiscation policy. I'm afraid that they may get away with it. Here in MA, the only handguns which can legally be bought new are those on a fairly short list compiled by the State Attorney General which meet his arbitrary 'safety standards'. If I wanted, say, a Pardini (a very expensive special purpose .22short target pistol) I'm SOL. In fact, it's almost impossible for MA residents to participate in some of the shooting sports competitively, due to the AG's list. Peter Trei

1 0

RE: Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire
by Bill Stewart 10 Jan '05

10 Jan '05

At 12:04 PM 1/10/2005, Trei, Peter wrote: >For a gun to work, it is just as important that >it fires when it should, as that it does not >fire when it shouldn't. A safety system >which delays firing by even half a second, >or which introduces a significant false >rejection rate (and 1% is way over the line), >is a positive hazard. I'd rather not have to rely on a gun that's acting like typical Artificial Intelligence software - "Out of Virtual Memory - Garbage-Collecting - Back in a minute" - "Tea? You mean Leaves, boiled in water? That's a tough one!" - "Low on Entropy - please wave the gun around and pull the trigger a few times" Police have enough problems with situations where guns are too slow, such as a guy with a knife ten feet away, and ostensibly smart guns that aren't reliable are really bad. And slowly-responding guns just encourage cops to pull them out early and start shooting early just in case, which is the kind of thing most gun-grabbing liberals want to avoid. ---- Bill Stewart bill.stewart(a)pobox.com

1 0

Re: Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire
by John Kelsey 10 Jan '05

10 Jan '05

>From: "R.A. Hettinga" <rah(a)shipwright.com> >Sent: Jan 6, 2005 11:47 AM >To: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire ... >Ready, Aim, ID Check: In Wrong Hands, Gun Won't Fire > By ANNE EISENBERG I just wonder what the false negative rates are. Seem like a gun that has a 1% chance of refusing to fire when you *really need it* might not be worth all that much. Similarly, one that you can't get to work if you've got a band-aid on your finger, or a cut on your hand, or whatever, loses a lot of its value. On the other hand, a gun that can't be made to go off by your toddler is a pretty huge win, assuming you're willing to trust the technology, but a 90% accuracy level sounds to me like 10% of the time, your three year old can, in fact, cause the thing to go off. That's not worth much, but maybe they'll get it better. And the "suspect struggles with cop, gets gun, and shoots cop" problem would definitely be helped by a guy that wouldn't go off for 90% of attackers. --John

1 0

A new license fee for every smart card?
by R.A. Hettinga 10 Jan '05

10 Jan '05

<http://www.cr80news.com/library/2005/01/10/a-new-license-fee-for-every-smar…> : CR80 News A new license fee for every smart card? Monday, January 10 2005 Cyptography Research asks chip or card manufacturers to pay for use of its patented security measures In the late 1990s, a scare tore through the smart card community when the media began running articles attacking the security of the cards and calling into question the vulnerability of chip card-enabled systems. The threat had a very serious sounding name, differential power analysis (DPA), and the concern spread quickly. The Australian Financial Review broke the story on June 6, 1998 leading with the ominous statement, "A ruinous security problem has jeopardized the viability of millions of smartcards in GSM mobile phones as well as the recently introduced Telstra Phonecard." A series of doom and gloom articles followed in technology publications and major newspapers and periodicals. According to the accounts, a group of young cryptographers in San Francisco had discovered a way to extract the encryption keys protecting data in a chip, thus opening its contents for unintended use. The ramifications for the burgeoning GSM market and highly touted stored value programs such as Mondex, Proton, and VisaCash seemed significant. The smart card industry attempted to brush off the significance of the threat pointing to the fact that the attack was confined to laboratory environments and that no actual issued cards had been compromised. But the damage was done it was another public relations hit to an industry trying to define itself in the eyes of the average consumer. Thankfully, the average consumer is fickle. Within months, DPA was forgotten about by all but the most security-focused in the chip and related industries. The media was on to the next story and the crisis disappeared as quickly as it had materialized. Fast forward to November 2004 San Francisco-based Cryptography Research, which specializes in developing and licensing technology to solve complex data security problems, officially announced that it had established a licensing program for its patented DPA countermeasures and, according to Kit Rodgers, VP of Licensing for Cryptography Research, virtually every chip card issued in the market uses the patented countermeasures. But wait a minute. To the casual observer of the smart card industry, it seemed that DPA's "15 minutes of fame" had passed before the millennium. What happened? It turns out that DPA really was a credible threat to chip security, and it turns out that Paul Kocher, one of the young cryptographers that discovered DPA, is the founder of Cryptography Research. At first blush, this might seem odd - the same guy that discovered the threat is selling countermeasures to defend against it. In reality, this is not uncommon in data security circles. It stands to reason that the people discovering the weakness are often in the best position to fix it. If the threat is deemed real following scrutiny by the industry, the protection against the threat is necessary and has inherent value to the industry. That is exactly what happened in this case, says to Mr. Rodgers. So what happened during the 6-plus years that passed between the Australian Financial Review article and the announcement of the licensing program? It turns out that Mr. Kocher and Cryptography Research had shown the vulnerabilities they discovered to Mondex, Visa, and others prior to the 1998 media storm. These card issuers then brought the silicon and card suppliers to see the DPA demonstration. According to Mr. Rodgers, "Under NDA we showed them how to mask and minimize the vulnerabilities. We told them we would be coming back for licensing once the patents were issued." In April 2004, the company announced that it had been granted a series of patents broadly covering countermeasures to DPA attacks. These include: * U.S. Patent #6,654,884: Hardware-level mitigation and DPA countermeasures for cryptographic devices; * U.S. Patent #6,539,092: Leak-resistant cryptographic indexed key update; * U.S. Patent #6,510,518: Balanced cryptographic computational method and apparatus for leak minimization in smartcards and other cryptosystems; * U.S. Patent #6,381,699: Leak-resistant cryptographic method and apparatus; * U.S. Patent #6,327,661: Using unpredictable information to minimize leakage from smartcards and other cryptosystems; * U.S. Patent #6,304,658: Leak-resistant cryptographic method and apparatus; * U.S. Patent #6,298,442: Secure modular exponentiation with leak minimization for smartcards and other cryptosystems; and * U.S. Patent #6,278,783: DES and other cryptographic, processes with leak minimization for smartcards and other cryptosystems. So, it seemed, the time had come for Cryptography Research to go back to the manufacturers with a licensing program. "We began talking to the chip and card suppliers in the spring (2004)," said Mr. Rodgers. "They all knew us so we were not coming from out of the blue." Their message is clear. "You need a secure smart card and for a smart card to be secure it needs to be secure against DPA attacks," says Mr. Rodgers. "We want to be viewed as helping the industry against a major vulnerability." What does the licensing program really mean? Cryptography Research expects companies utilizing the patented countermeasures in their products to pay for its use. But with card products, this could include several companies in the supply chain. The chip manufacturer can employ the countermeasures, the card manufacturer as well, and the card issuer certainly benefits as the end supplier of the finished product. So who pays? According to Mr. Rodgers, "we want (the licensing) to be cost appropriate so only one party in the chain will pay. We don't care which phase (pays the license) so it could be silicon or card manufacturers." In reality, a large smart card manufacturer would likely want the flexibility to choose from a variety of silicon manufacturers-both large and small. Such a manufacturer says Mr. Rodgers, "may want to lock in the price at a great rate. If they get it from a licensed silicon manufacturer, they wouldn't pay again." In short, both chip and card suppliers may be licensed but if a card manufacturer bought chips that had already been licensed, they would not pay a second fee for the cards created with those chips. While it might seem difficult to manage such a process, the pool of potential licensees is not large. According to Mr. Rodgers, "six manufacturers account for about 96% of the chips and five smart card manufacturers supply most of the cards." The question of price How much will the license fees cost? The company is being purposefully vague as they are currently in the discussion phases with industry. Hinting at the cost, Mr. Rodgers says, "we are trying to price this in a way that gives us the appropriate amount of money for the value the technology provides. We think smart cards are an excellent solution for certain security applications and want to succeed along with the market." He mentions that early adopters will receive favorable pricing to give them a competitive advantage. As well, he suggested that they have discussed amnesty for past cards issued without license fees, suggesting the potential that they might seek reparations for products issued in the past. Mr. Rodgers mentions that the company has "allocated $20 million to launch and sustain the licensing program." As with any such program, some portion of those dollars is certain to be earmarked for legal pursuits, either reactive or proactive. In summary, he says, "pricing terms will be appropriate for their (chip and card manufacturers) business. We don't want this to have a negative impact on the industry as that will ultimately hurt our business over the long term." About Cryptography Research: According to Kit Rodgers, Cryptography Research develops and licenses technology solutions, provides services, and conducts applied research to solve some of the world's most complex data security problems. Founded in 1995, they help evaluate and design secure products in the financial security sector and other industries, and are currently focused on helping movie studios secure the forthcoming HD DVD and Blu-ray formats. The company licenses technology in three main areas: DPA countermeasures, CryptoFirewall for set-top pay TV, and content protection mechanisms for next-generation HD discs. To learn more visit them on the web at www.cryptography.com. Additional Resources: To read an article on the DPA threat that appeared on CNET on June 10, 1998, click here. To access a primer on Differential Power Analysis produced by Cryptography Research, click here. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] The DNA round-up on Cape Cod (fwd from dave@farber.net)
by Eugen Leitl 10 Jan '05

10 Jan '05

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Momentum Is Gaining for Cellphones as Credit Cards
by R.A. Hettinga 10 Jan '05

10 Jan '05

<http://www.nytimes.com/2005/01/10/technology/10cellphone.html?th=&pagewante…> The New York Times January 10, 2005 Momentum Is Gaining for Cellphones as Credit Cards By MATT RICHTEL eople already use their cellphones to read e-mail messages, take pictures and play video games. Before long, they may use them in place of their wallets. By embedding in the cellphone a computer chip or other type of memory device, a phone can double as a credit card. The chip performs the same function as the magnetic strip on the back of a credit card, storing account information and other data necessary to make a purchase. In Asia, phone makers are already selling phones that users can swipe against credit or debit card readers, in much the same way they would swipe plastic MasterCard or Visa cards. Trials are now under way to bring the technology to America, industry executives said. Ron Brown, executive director of the Infrared Data Association, a trade group representing companies pushing the technology for cellphone credit cards, said that the new handsets could become "a major form of payment, because cellphones are the most ubiquitous device in the world." He added, though, that "cash will never go away." Advocates say that consumers will readily embrace the technology as a way to pay for even small purchases, because it is less bother than taking a credit card out of a purse or parting with cash. The impending changes to the cellphone happen to coincide with major shifts taking place in the banking industry. Since credit cards are still considered somewhat inconvenient, particularly for quick, small purchases, major credit card companies have developed "contactless payment" technologies for checkout counters that allow customers to wave their cards near an electronic reader without having to swipe the card or sign their name. MasterCard, for example, has introduced a system called PayPass that lets cardholders wave a card in front of a reader to initiate a payment, much as motorists use E-ZPass and similar systems to pay tolls and ExxonMobil customers use SpeedPass to buy gas. Several major credit card companies issue PayPass cards; McDonald's has agreed to accept them at some restaurants. And American Express announced late last year that it would have its system, ExpressPay, in more than 5,000 CVS drugstores by the middle of this year. Judy Tenzer, a spokeswoman for American Express, said the technology made it more likely that customers would use credit cards to pay for small items. Cellphone makers are hoping these new payment systems will also make it easier to market handsets with credit card functions, although they could just as easily represent competition for the practice of paying by cellphone. The marriage of cellphone and charge card poses some significant challenges, including security problems. To reduce fraud from stolen phones, consumers may be required to punch an authorization code into their phone each time a charge is made. For more than a year, phone makers, software companies and computer chip manufacturers have been working to develop secure and reliable payment technology for cellphones. After the phone's chip is recognized by the electronic reader, the credit card account number will be verified, as it is now, and the price of the purchase will be added to the consumer's credit card bill. The new phones may also be capable of being programmed for a prepaid sum from which payments could be deducted. But there have been some glitches in the product trials, according to Jorge Fernandes, chief executive of Vivotech, a cellphone software company based in Santa Clara, Calif. In two trials, one at a corporation in the Midwest and the other at Santa Clara University, Vivotech used infrared technology for communications between the phone and the card reader. Participants had to aim the cellphone at the reader in a certain way for the infrared beam to be picked up. "People got very upset," Mr. Fernandes said. "Pointing your cellphone at a target is very difficult." Mr. Fernandes said the company believed it might have solved that problem by switching to a technology that uses low-level radio signals. Last month, Vivotech began testing the technology, which allows users to wave the phone within a couple of inches of a reader, at a sports arena in the Atlanta area. Cellphones are becoming mainstream payment devices in Korea and Japan. In Japan, NTT DoCoMo, the mobile phone operator, said that it had already sold more than a million phones equipped with chips that include the payment function. More than 13,000 Japanese shops have electronic readers capable of communicating with the phones. For now, the phones are used mostly to debit a prepaid amount, which is deposited by plugging the phone into a machine similar to an A.T.M. that takes cash and credits the handset. In South Korea, people are already using cellphones as credit cards, said Sue Gordon-Lathrop, vice president for the consumer products platform for Visa International. She said American consumers would eventually embrace these new functions, but acceptance could be slower than in Japan and Korea, where people are more comfortable with using phones for many purposes. Also, she said, there are more cellphone operators in America, making it harder to set standard technology and business practices. "The phones are exciting, but it's going to be a long time" before a widespread base of merchants and consumers in America are equipped to use them, she said. For now, some of the major American cellphone companies are monitoring the technology without committing to it. Jim Ryan, senior vice president of product development for Cingular Wireless, the country's largest cellphone provider, said the company was "closely watching" the progress in this field. Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

"The Reader of Gentlemen's Mail", by David Kahn
by Bill Stewart 09 Jan '05

09 Jan '05

My wife was channel-surfing and ran across David Kahn talking about his recent book "The Reader of Gentlemen's Mail: Herbert O. Yardley and the Birth of American Codebreaking". ISBN 0300098464 , Yale University Press, March 2004 Amazon's page has a couple of good detailed reviews http://www.amazon.com/exec/obidos/ASIN/0300098464/qid=1105254301/sr=2-1/ref… ---- Bill Stewart bill.stewart(a)pobox.com

3 2

Police seek missing trucker, nickels
by R.A. Hettinga 09 Jan '05

09 Jan '05

<http://www.chicagotribune.com/news/nationworld/chi-0501090059jan09,1,312977…> The Chicago Tribune Police seek missing trucker, nickels Advertisement Items compiled from Tribune news services January 9, 2005 MIAMI, FLORIDA -- A truck driver has disappeared with the 3.6 million nickels he was hauling to the Federal Reserve Bank in New Orleans, police said Friday. Angel Ricardo Mendoza, 43, picked up the coins, worth $180,000, Dec. 17 from the Federal Reserve in New Jersey and was supposed to haul the cargo--weighing 45,000 pounds--to New Orleans for a trucking company subcontracted by the Federal Reserve, police said. On Dec. 21, Mendoza's empty truck and trailer turned up at a truck stop in Ft. Pierce, Fla. Miami-Dade police, the FBI and the Federal Reserve police are investigating. "We are concerned for his safety because he's missing," Miami-Dade Detective Randy Rossman said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

4 5