July 2018 - cypherpunks-legacy

None
by mmotyka＠lsil.com 06 Jul '18

06 Jul '18

A writer for the Voice ( if I heard it correctly ) talked about a computer captured in Manila that was supposedly used by Ramzi Yousef. He said that there were documents that described hijacking planes and flying them into prominent buildings. This information was turned over to the FBI in 1995 or 1996. I hope with expanded powers for surveillance and searches that they can gather better information and shorten the analysis period. ----------- Let's see... THEY [TM] use ECHELON to listen to every electronic message in the history of the world... THEY [TM] have apparently already had advance information about all of the UnForSeen Tragedies that have occurred lately... THEY [TM] have failed to protect US&OR&U.S. from known threats, known enemies, known terrorist plans, yet they are using Their failure to do so as an excuse for needing to exercise even more intrusion into our privacy and constitutional rights... Next thing you know, THEY [TM] will be telling us they need to raise taxes, because they wasted the money we already gave them...or has this already happened? (I've been...uuhhh..away...) CJ Parker <sonofgomez709(a)yahoo.com> http://profiles.yahoo.com/sonofgomez709 http://www.technopagan.org/politics/xenix/ http://members.w-link.net/~sog/INDEX.HTM

1 0

State refuses to approve Diebold voting machines
by EEkid＠aol.com 06 Jul '18

06 Jul '18

State refuses to approve Diebold voting machines By Edwin Garcia Mercury News Sacramento Bureau SACRAMENTO - Suggesting the ``security and integrity'' of electronic voting could be at risk, Secretary of State Bruce McPherson on Tuesday refused to approve the use of thousands of electronic voting machines pending a federal evaluation. The touch-screen and optical-scan machines, made by Diebold Election Systems and used in 17 counties, including Alameda, were found to have ``unresolved significant security concerns'' with a memory card that stores votes in each machine, McPherson's elections chief, Caren Daniels-Meade, said in a letter to the company's vice president, David Byrd. At issue is whether the removable cards, which are used to program and configure the machines, will keep data secure. The Secretary of State's office is asking Diebold to submit the machine's source code for review by the federal Independent Testing Authorities before resubmitting the company's application for certification in California. Byrd, Diebold's vice president of business operations, is eager to comply. ``Diebold Election Systems is always willing to participate in responsible testing to show that our voting systems are up to the task of giving more Californians an accessible and reliable way to vote,'' Byrd said. ``This has always been our goal: to provide a more accurate, secure and accessible voting process for all Californians.'' http://www.mercurynews.com/mld/mercurynews/13452214.htm ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] State refuses to approve Diebold voting machines
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip
by Seth David Schoen 06 Jul '18

06 Jul '18

Jason Spence writes: > - Really fast PKI crypto on a dedicated processor for ipsec type > stuff I don't think the TCG TPM is the really fast processor you're looking for; from all accounts I've heard, it's really rather slow. > - Provide a trusted "hypervisor" or "ring -1" environment from which > authorized code can spy on the operating system and make sure it's > not running any reverse engineering tools or known cracks before > the authorized code can install itself or download privileged data > like strictly licensed content or restricted documents, etc I don't think "spy on the operating system" is quite the right term. It might be better to say "prove that the relevant parts of the operating system, if any, are completely unmodified". There is no intrinsic value judgment and there is also no attempt to identify particular _ways_ of modifying the operating system as "bad". At the same time, you can also try to reduce the privilege of the operating system to affect certain things, so that it may not matter to certain secure operations whether the operating system is compromised or not. > - Protected cert store in hardware that is somehow immune or > resistent to tampering (I don't completely understand how this > can't be attacked by patching the nexus on the hard disk; I'm > learning more about it) There is an ingenious thing called a platform configuration register (PCR) that contains hashes of running code. The hardware is designed in a such a way that, if the PCRs are used at all, at least the first PCR will accurately reflect the code first loaded and to which control was first transferred. Because of the way the hardware is set up, if you load different code (a different or modified nexus, for example), the PCR values are guaranteed to be different. To put this a different way, the hardware has (minimal, but security-relevant) knowledge of what software is running. If different software is running -- for whatever reason -- the PCR values will be different. The encryption and decryption keys for the seal and unseal operation are derived by hashing the PCRs, and the PCRs are derived by hashing running code. There is supposed to be no way to get arbitrary values into PCRs (which is actually an oversimplification, but you can pretend it's true) and so you can choose not to use them at all, but you can't choose to load values into them that precisely correspond to the values they would have been loaded with if you had booted an operating environment other than the operating environment you actually did boot. Therefore, the _availability_ of a valid encryption or decryption key inside the TPM -- to make an unseal operation work properly -- depends on what software is really running. You can have many different operating environments installed on a single PC -- differing by a little or a while -- and in principle they cannot unseal one another's sealed data at all, because each one has its own family of PCR values that results when it's booted. > I write a worm. It's a nasty little bugger. It pokes around your > machine and your network for anything that looks like a credit card > number. It's allowed to install itself in the protected memory area > because it's ostensibly a popup blocker or spam blocker or something > and I got it certified by NGSCB or whoever'll be in charge of handing > out signatures. There is no central CA necessarily implied by NGSCB. Loading these applets should require some kind of user decision and should not be automatic based on presentation of a certificate. The trusted computing applets are not supposed to have direct access to any hardware (except that they can take input directly from the keyboard when no other process is doing so, and they can write output directly to the video framebuffer). That is the NGSCB model. So they can't themselves directly "poke around your machine and your network"; they would need to have an ordinary (unencrypted) user-space agent that does that. In priciple, it should be possible to detect and interfere with the operation of that agent by standard anti-virus or IDS techniques. If there is some reason that the user-space agent can't be disrupted or detected -- which I don't imagine is the case -- then you have a severe problem. But note that the trusted computing applet can't authenticate the identity of the user-space agent code. > It joins a p2p network of other worms which can't be spied upon > because the crypto keys are located in curtained memory and since your > debugger doesn't have access to curtained memory, you can't get a copy > of them. This part seems very possible. > You can't get a copy of the destination addresses that your > credit card numbers are being sent to either, because those are also > located in curtained memory. Since the worm applet needs to use regular operating system services to access the network, and since your computer is connected to a network you can observe, you should be able to see the IP addresses of the peers -- you can just run netstat, or you can run a sniffer, or a firewall that monitors connection requests. You can tell who the peers are. Of course, the worm can conceivably conceal where the _ultimate_ destination is, if the worm network is a store-and-forward kind of network. In fact, the attacker who wrote the worm can join the worm network in a way that looks like just another infected peer -- but unlike other peers, the worm author can decrypt the messages from all the other worms and make use of them. (But that can be done today. Just have worms join an IRC channel and post data there encrypted with some public key. The worm author can join the same channel -- pretending to be another infected victim -- and log what gets posted there, and then decrypt it with the corresponding private key.) > Oh yeah, and it'll fire up your modem > and wardial for fax machines and randomly fax the credit card numbers > around too, just because I like to be a pain in the ass. I'm told there is a scheme like this in Europe now where people are unwittingly calling the equivalent of 900 numbers. But remember that in NGSCB the code in curtained memory can't access the modem -- it needs to rely on a user-space agent to ask the OS to do that. The OS could still enforce a policy saying that the agent can't actually access the modem, or the agent could still be detected by an antivirus program. -- Seth David Schoen <schoen(a)loyalty.org> | Very frankly, I am opposed to people http://www.loyalty.org/~schoen/ | being programmed by others. http://vitanuova.loyalty.org/ | -- Fred Rogers (1928-2003), | 464 U.S. 417, 445 (1984) _______________________________________________ linux-elitists http://zgp.org/mailman/listinfo/linux-elitists ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Mining for kids: Children can't opt out of Pentagon
by Kurt Albershardt 06 Jul '18

06 Jul '18

recruitment database <http://www.vermontguardian.com/national/012006/Pentagon.shtml> Mining for kids: Children can't "opt out" of Pentagon recruitment database By Kathryn Casa | Vermont Guardian Parents cannot remove their children's names from a Pentagon database that includes highly personal information used to attract military recruits, the Vermont Guardian has learned. The Pentagon has spent more than $70.5 million on market research, national advertising, website development, and management of the Joint Advertising Market Research and Studies (JAMRS) database ? a storehouse of questionable legality that includes the names and personal details of more than 30 million U.S. children and young people between the ages of 16 and 23. The database is separate from information collected from schools that receive federal education money. The No Child Left Behind Act requires schools to report the names, addresses, and phone numbers of secondary school students to recruiters, but the law also specifies that parents or guardians may write a letter to the school asking that their children's names not be released. However, many parents have reported being surprised that their children are contacted anyway, according to a San Francisco-based coalition called Leave My Child Alone (LMCA). "We hear from a lot of parents who have often felt quite isolated about it all and haven't been aware that this is happening all over the country," said the group's spokeswoman, Felicity Crush. Parents must contact the Pentagon directly to ask that their children's information not be released to recruiters, but the data is not removed from the JAMRS database, according to Lt. Col. Ellen Krenke, a Pentagon spokeswoman. Instead, the information is moved to a suppression file, where it is continuously updated with new data from private and government sources and still made available to recruiters, Krenke said. It's necessary to keep the information in the suppression file so the Pentagon can make sure it's not being released, she said. Krenke said the database is compiled using information from state motor vehicles departments, the Selective Service, and data-mining firms that collect and organize information from private companies. In addition to names, addresses, Social Security numbers, and phone numbers, the database may include cell phone numbers, e-mail addresses, grade-point averages, ethnicity, and subjects of interest. ... ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Mining for kids: Children can't opt out of Pentagon recruitment
by David Farber 06 Jul '18

06 Jul '18

database X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

Re: Echelon papers leaked
by Travis H. 06 Jul '18

06 Jul '18

Two chapters are online here: http://www.fas.org/irp/eprint/sp/ -- "If I could remember the names of these particles, I would have been a botanist" -- Enrico Fermi -><- http://www.lightconsulting.com/~travis/ GPG fingerprint: 50A1 15C5 A9DE 23B9 ED98 C93E 38E9 204A 94C2 641B --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] cloning of chip The Financial Times: US group implants electronic tags in workers]]
by Dave Farber 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------- Original Message -------- Subject: FOR IP: Re: [IP] The Financial Times: US group implants electronic tags in workers] Date: Sun, 12 Feb 2006 19:01:58 -0500 From: Valdis.Kletnieks(a)vt.edu To: dave(a)farber.net References: <43EFC85D.2060509(a)farber.net> On Sun, 12 Feb 2006 18:44:29 EST, Bob Rosenberg said: > "So far around 70 people in the US have had the implants, the company said." > > I don't believe I need to mention a litany of privacy concerns at the > moment. And to make things worse, somebody has already discovered how to skim and clone the VeriChip. http://cq.cx/verichip.pl The problem is, of course, that you can leave your ID badge at home when you go to the supermarket, or the movies - but leaving your arm at home isn't very workable. This makes a "skim, clone, and utilize" attack a lot *easier*. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD79NPh0VyAToQeqERAkhUAJ9Yr39oNbXDx+rsbQ5v2+CP3h91VgCgps/0 i0ol8rVZnYdIe7kjyottfmY= =8uL4 -----END PGP SIGNATURE----- ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

RFID Clonable
by Brad Malin 06 Jul '18

06 Jul '18

Hi Dave, remember a couple of years ago when you said you wanted to clone and repeat RFIDs - apparently someone has built the system to it. -brad http://www.engadget.com/2006/07/24/verichips-human-implatable-rfid- chips-clo nable-sez-hackers/ VeriChip's human-implatable RFID chips clonable, sez hackers Posted Jul 24th 2006 4:14PM by Donald Melanson Filed under: Misc. Gadgets, Wireless In case anyone needed more proof that we're all living in a Philip K. Dick novel, a pair of hackers have recently demonstrated how human- implantable RFID chips from VeriChip can be easily cloned, effectively stealing the person's identity. Annalee Newitz and Jonathan Westhues showed off their handiwork at the HOPE Number Six conference in New York City this weekend, with Newitz herself playing the role of guinea pig, implanting a VeriChip RFID chip in her right arm. To clone the chip, Westhues first red Newitz's arm with a standard RFID reader, then scanned it again with a homebrew antenna connected to his laptop, which recorded the signal off the chip. He then used the same RFID reader to read the signal from his laptop, which promptly spit out Newtiz's supposedly unique ID. For its part, VeriChip has only said they haven't yet had a chance to review the evidence but still insist that "it's very difficult to steal a VeriChip." ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] RFID Clonable
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0