July 2018 - cypherpunks-legacy

Voice Over IP On Wireless Mesh
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/04/14/1856224 Posted by: timothy, on 2004-04-14 19:21:00 Topic: wireless, 55 comments from the network-is-the-network dept. infractor writes "ZDNet [1]is reporting that the Linux based [2]LocustWorld Mesh system now has [3]SIP routing at every node. The [4]LocustWorld boxes have been widely used in [5]community broadband projects where DSL is not available, so successfully that they have been [6]seen as a threat to next generation mobile networks. With the addition of VoIP support, these mesh networks can now compete with the telcos on voice as well as data services. [7]More details here." [8]Click Here References 1. http://news.zdnet.co.uk/communications/wireless/0,39020348,39151531,00.htm 2. http://locustworld.com/ 3. http://www.faqs.org/rfcs/rfc2543.html 4. file://slashdot.org/article.pl?sid=02/10/31/2049201&tid=126 5. http://www.muniwireless.com/archives/000201.html 6. http://locustworld.com/media/timesbusiness290104.gif 7. http://locustworld.com/siprouting.php 8. http://ads.osdn.com/?ad_id=2872&alloc_id=7019&site_id=1&request_id=7791007&… =click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

The Newbie's Guide to Detecting the NSA
by John Bartas 06 Jul '18

06 Jul '18

Dave, This entry from the blog at wired.com might be good for the IP list. The best part is at the end. Good old traceroute! -------------------------------------------------------- The Newbie's Guide to Detecting the NSA http://blog.wired.com/27BStroke6/#1510938 ... "With that in mind, here's the 27B Stroke 6 guide to detecting if your traffic is being funneled into the secret room on San Francisco's Folsom street. If you're a Windows user, fire up an MS-DOS command prompt. Now type tracert followed by the domain name of the website, e-mail host, VoIP switch, or whatever destination you're interested in. Watch as the program spits out your route, line by line. C:\> tracert nsa.gov 1 2 ms 2 ms 2 ms 12.110.110.204 [...] 7 11 ms 14 ms 10 ms as-0-0.bbr2.SanJose1.Level3.net [64.159.0.218] 8 13 12 19 ms ae-23-56.car3.SanJose1.Level3.net [4.68.123.173] 9 18 ms 16 ms 16 ms 192.205.33.17 10 88 ms 92 ms 91 ms tbr2-p012201.sffca.ip.att.net [12.123.13.186] 11 88 ms 90 ms 88 ms tbr1-cl2.sl9mo.ip.att.net [12.122.10.41] 12 89 ms 97 ms 89 ms tbr1-cl4.wswdc.ip.att.net [12.122.10.29] 13 89 ms 88 ms 88 ms ar2-a3120s6.wswdc.ip.att.net [12.123.8.65] 14 102 ms 93 ms 112 ms 12.127.209.214 15 94 ms 94 ms 93 ms 12.110.110.13 16 * * * 17 * * * 18 * * In the above example, my traffic is jumping from Level 3 Communications to AT&T's network in San Francisco, presumably over the OC-48 circuit that AT&T tapped on February 20th, 2003, according to the Klein docs. The magic string you're looking for is sffca.ip.att.net. If it's present immediately above or below a non-att.net entry, then -- by Klein's allegations -- your packets are being copied into room 641A, and from there, illegally, to the NSA. Of course, if Marcus is correct and AT&T has installed these secret rooms all around the country, then any att.net entry in your route is a bad sign. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] The Newbie's Guide to Detecting the NSA
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Donald Knuth stops paying for errata
by Perry E. Metzger 06 Jul '18

06 Jul '18

It seems that Donald Knuth had his bank accounts attacked not once but three times using his checking account number off of checks he sent out for bounties for flaws in his books and software, and is thus ending a practice of nearly 40 years. Rather sad. I mark this as another milestone in the slow destruction of the idea that it is okay for an account number to be the secret used to effect payment in a transaction system. http://www-cs-faculty.stanford.edu/~knuth/news08.html Perry -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

effectively prevent computer radiation
by shenzhen xiongfeng 06 Jul '18

06 Jul '18

In the modern society, the computer has already become an essential tool for the people to live and work. While it brings many conveniences to the people, it also brings some worries and anxieties, especially computer radiation, which does much harm to human body. Through more than one year' study and research, Xiongfeng Technology Cor., Ltd explores the first generation high-tech product -- FANGFUWANG. FANGFUWANG makes full use of its powerful absorption so that it can effectively absorb any kind of electromagnetic wave (radiation) and prevent the disease caused by radiation. The main material of FANGFUWANG is active nanometer bamboo carton. Through Chinese and Japanese experts' many years research and repeatedly proof, the nanometer bamboo carbon has the characteristics of being close and porous, and having strongly absorbable capacity. The characteristics of FANGFUWANG's design are natural, environmental protection, convenient, which is not only taken as the interior decoration, but also used extremely convenient. If you want to know more details, you can open the Xiongfeng Technology's website at www.hkxf.com. In our website, there are our product detailed instructions and test experiment, welcome to watch. Now our company is looking for agents in the world who are interested in our products, and we are looking forward to your sincere cooperation. SHENZHEN XIONGFENG TECHNOLOGY CO.,LTD Add: 2-9F,Shenzhen Wanpan Garden, Nanshan Area, Shenzhen City, Guangdong Province, China. Tel:86-755-26000105 Fax:86-755-26000144 -----

1 0

[i2p] weekly status notes [apr 5]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time for the weekly update * Index 1) 0.5.0.5 2) Bayesian peer profiling 3) Q 4) ??? * 1) 0.5.0.5 Last week's 0.5.0.5 release has had its ups and downs - the major change to address some attacks in the netDb seems to work as expected, but has exposed some long overlooked bugs in the netDb's operation. This has caused some substantial reliability issues, especially for eepsites. The bugs have however been identified and addressed in CVS, and those fixes among a few others will be pushed out as a 0.5.0.6 release within the next day. * 2) Bayesian peer profiling bla has been doing some research into improving our peer profiling by exploiting simple bayesian filtering from the gathered stats [1]. It looks quite promising, though I'm not sure where it stands at the moment - perhaps we can get an update from bla during the meeting? [1] http://forum.i2p.net/viewtopic.php?t=598 http://theland.i2p/nodemon.html * 3) Q There is lots of progress going on with aum's Q app, both in the core functionality and with a few people building various xmlrpc frontends. Rumor has it we might be seeing another Q build out this weekend with a whole slew of goodies described on http://aum.i2p/q/ * 4) ??? Ok, yeah, very brief status notes, as I got the timezones mixed up *again* (actually, I got the days mixed up too, thought it was Monday until a few hours ago). Anyway, there is lots of stuff going on not mentioned above, so swing on by the meeting and see whats up! =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCUvNtWYfZ3rPnHH0RAlzmAKCAX5PQP8s2wWIxhWnHWG6eeps1nQCffkNC Li2s44HU5EehnMoCMxIOZlc= =WNZp -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Proposed Surveillance Bill Would Sweep NSA Spying Programs Under the Rug
by David Farber 06 Jul '18

06 Jul '18

Electronic Frontier Foundation Media Release For Immediate Release: Friday, July 14, 2006 Contact: Kevin Bankston Staff Attorney Electronic Frontier Foundation bankston(a)eff.org +1 415 436-9333 x126 Kurt Opsahl Staff Attorney Electronic Frontier Foundation kurt(a)eff.org +1 415 436-9333 x106 Lee Tien Senior Staff Attorney Electronic Frontier Foundation tien(a)eff.org +1 415 436-9333 x102 Proposed Surveillance Bill Would Sweep NSA Spying Programs Under the Rug Bill Threatens Future of EFF Case and Other Legal Challenges San Francisco - Senate Judiciary Committee Chairman Arlen Specter said today that he has negotiated a proposed bill with the White House regarding the NSA's illegal spying program. While the final bill is not public, a draft of the bill obtained by the Electronic Frontier Foundation (EFF) is a sham compromise that would cut off meaningful legal review -- sweeping current legal challenges out of the traditional court system and failing to require court review or congressional oversight of any future surveillance programs. "This so-called compromise bill is not a concession from the White House -- it's a rubber stamp for any future spying program dreamed up by the executive," said EFF Staff Attorney Kevin Bankston. "In essence, this bill threatens to make court oversight of electronic surveillance voluntary rather than mandatory." Although the bill creates a process for the executive branch to seek court review of its secret surveillance programs, it doesn't actually require the government to do so. The bill would, however, require that any lawsuit challenging the legality of any classified surveillance program -- including EFF's class-action suit against AT&T -- be transferred, at the government's request, to the FISA Court of Review, a secret court with no procedures for hearing argument from anyone but the government. The bill would further allow the government to prevent the court from disclosing any information about the government's surveillance programs to opposing counsel, regardless of the court's strict security procedures. "When the privacy of millions of Americans is at stake, we deserve more than a closed hearing by a secret court," said EFF Senior Staff Attorney Lee Tien. For the draft of the Specter bill: http://www.eff.org/Privacy/Surveillance/NSA/specter_draftbill_071306.pdf For this release: http://www.eff.org/news/archives/2006_07.php#004824 About EFF The Electronic Frontier Foundation is the leading civil liberties organization working to protect rights in the digital world. Founded in 1990, EFF actively encourages and challenges industry and government to support free expression and privacy online. EFF is a member-supported organization and maintains one of the most linked-to websites in the world at http://www.eff.org/ -end- _______________________________________________ presslist mailing list https://falcon.eff.org/mailman/listinfo/presslist ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Donald Knuth stops paying for errata
by Perry E. Metzger 06 Jul '18

06 Jul '18

It seems that Donald Knuth had his bank accounts attacked not once but three times using his checking account number off of checks he sent out for bounties for flaws in his books and software, and is thus ending a practice of nearly 40 years. Rather sad. I mark this as another milestone in the slow destruction of the idea that it is okay for an account number to be the secret used to effect payment in a transaction system. http://www-cs-faculty.stanford.edu/~knuth/news08.html Perry -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

CRYPTO-GRAM, March 15, 2011
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM March 15, 2011 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1103.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Anonymous vs. HBGary News Schneier News NIST Defines New Versions of SHA-512 ** *** ***** ******* *********** ************* Anonymous vs. HBGary One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs. HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica. In cyberspace, the balance of power is on the side of the attacker. Attacking a network is *much* easier than defending a network. That may change eventually -- there might someday be the cyberspace equivalent of trench warfare, where the defender has the natural advantage -- but not anytime soon. http://arstechnica.com/tech-policy/news/2011/02/anonymous-to-security-firm-… or http://tinyurl.com/5t35y7m http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-track… or http://tinyurl.com/6xhleht http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when… or http://tinyurl.com/4n8rohh http://arstechnica.com/tech-policy/news/2011/02/the-ridiculous-plan-to-atta… or http://tinyurl.com/4nv4jat http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside… or http://tinyurl.com/6579grz http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-… or http://tinyurl.com/6fw4s5u This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry. http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-0222… or http://tinyurl.com/48tgfee Stephen Colbert on HBGary: http://www.colbertnation.com/the-colbert-report-videos/375428/february-24-2… or http://tinyurl.com/46gaa9d http://www.colbertnation.com/the-colbert-report-videos/375429/february-24-2… or http://tinyurl.com/4p4zp3l Another article: http://www.h-online.com/security/features/Anonymous-makes-a-laughing-stock-… or http://tinyurl.com/63fekyp ** *** ***** ******* *********** ************* News Interesting article from Wired: "How a Remote Town in Romania Has Become Cybercrime Central." http://www.wired.com/magazine/2011/01/ff_hackerville_romania/all/1 Recently declassified: "Historical Study: The National Security Agency Scientific Advisory Board 1952b1963." http://www.governmentattic.org/4docs/NSA-SAB52-63_1965.pdf A physical biometric wallet: $825. http://www.dunhill.com/en-us/shoponline/leather/wallets/biometric-wallet-qg… or http://tinyurl.com/4f2f345 http://www.thetechherald.com/article.php/201105/6754/Dunhill-biometric-wall… or http://tinyurl.com/4n8v53e I don't think I understand the threat model. If your wallet is stolen, you're going to replace all your ID cards and credit cards and you're not going to get your cash back -- whether it's a normal wallet or this wallet. I suppose this wallet makes it less likely that someone will use your stolen credit cards quickly, before you cancel them. But you're not going to be liable for costs incurred during that delay in any case. Interesting story about a con man who conned the U.S. government, and how the government is trying to hide its dealings with him. http://www.nytimes.com/2011/02/20/us/politics/20data.html Susan Landau's testimony before the House Judiciary Committee, Subcommittee on Crime, Terrorism, and Homeland Security on government eavesdropping. http://judiciary.house.gov/hearings/hear_02172011.html The testimony of Valerie Caproni, General Counsel of the FBI, on the same topic. http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance… or http://tinyurl.com/46l49am Good article about the terrorist non-threat from Reason: http://reason.com/archives/2011/02/15/what-islamist-terrorist-threat "Reliably Erasing Data From Flash-Based Solid State Drives," by Michael Wei, Laura M. Grupp, Frederick E. Spada, and Steven Swanson. http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf News article: http://www.theregister.co.uk/2011/02/21/flash_drive_erasing_peril/ Video of talk: http://www.usenix.org/multimedia/fast11wei NIST has finally published its rationale for selecting the five SHA-3 finalists. http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Round2_Report_NI… or http://tinyurl.com/4zte3e2 Pickpocketing as a trade is dying out in America, because there's no one to train newer pickpockets in the craft. http://www.slate.com/id/2286010/pagenum/all/ Interesting research in using animals to detect substances. Basically, sniffer dogs respond to unconscious cues from their handlers, and generate false alarms because of them. It makes sense, as dogs are so attuned to humans. I'll bet bomb-sniffing bees don't make the same mistakes. http://www.economist.com/blogs/babbage/2011/02/animal_behaviour Full paper: http://www.springerlink.com/content/j477277481125291/fulltext.pdf Bomb-sniffing bees: http://www.livescience.com/4605-bees-trained-bomb-sniffers.html "American Cryptography During the Cold War 1945-1989; Book IV: Cryptologic Rebirth 1981-1989." Document was first declassified in 2009. Here are some newly declassified pages. http://www.governmentattic.org/4docs/NSA_AmerCryptColdWarBk4_1999.pdf http://www.governmentattic.org/4docs/oNSAAmerCryptColdWarBk4_1999.pdf Criminals are stealing cars by calling tow trucks. It's a clever hack, but an old problem: the authentication in these sorts of normal operations isn't good enough to prevent abuse. http://www.wsmv.com/news/26878155/detail.html A programmer installed malware into the Whack-a-Mole arcade game as a form of job security. It didn't work. http://www.wftv.com/news/26986709/detail.html Wired.com has a good three-part story on full-body scanners. http://www.wired.com/threatlevel/2011/02/scanners-part1/ http://www.wired.com/threatlevel/2011/03/scanners-part2/ http://www.wired.com/threatlevel/2011/03/scanners-part3/ Another attempt to sort out scanner claims: http://www.okianwarrior.com/MathView/BackscatterSafety/ Using language patterns to identify anonymous email. It only works when there's a limited number of potential authors. http://www.schneier.com/blog/archives/2011/03/using_language.html ** *** ***** ******* *********** ************* Schneier News I'm speaking at Black Hat Europe in Barcelona on March 17. http://www.blackhat.com/html/bh-eu-11/bh-eu-11-home.html I'm speaking at the Oracle Chief Security Officer Summit in New York City on March 30. http://www.oracle.com/us/dm/65212-wwmk09121721mpp414-se-281577.html This three-part video interview with me was conducted at the RSA Conference last month. http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528091… or http://tinyurl.com/4q9vt45 http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528245… or http://tinyurl.com/4dezbsk http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528160… or http://tinyurl.com/4bawfzq I was interviewed on chomp.fm. http://chomp.fm/008/ ** *** ***** ******* *********** ************* NIST Defines New Versions of SHA-512 NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster. This is a good thing, and exactly what we did in the design of Skein. We defined different outputs for the same state size, because it makes sense to decouple the internal workings of the hash function from the output size. http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf or http://tinyurl.com/47fta7g http://csrc.nist.gov/publications/PubsDrafts.html#fips-180-4 ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2011 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CRYPTO-GRAM, March 15, 2011
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM March 15, 2011 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1103.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Anonymous vs. HBGary News Schneier News NIST Defines New Versions of SHA-512 ** *** ***** ******* *********** ************* Anonymous vs. HBGary One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs. HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica. In cyberspace, the balance of power is on the side of the attacker. Attacking a network is *much* easier than defending a network. That may change eventually -- there might someday be the cyberspace equivalent of trench warfare, where the defender has the natural advantage -- but not anytime soon. http://arstechnica.com/tech-policy/news/2011/02/anonymous-to-security-firm-… or http://tinyurl.com/5t35y7m http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-track… or http://tinyurl.com/6xhleht http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when… or http://tinyurl.com/4n8rohh http://arstechnica.com/tech-policy/news/2011/02/the-ridiculous-plan-to-atta… or http://tinyurl.com/4nv4jat http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside… or http://tinyurl.com/6579grz http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-… or http://tinyurl.com/6fw4s5u This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry. http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-0222… or http://tinyurl.com/48tgfee Stephen Colbert on HBGary: http://www.colbertnation.com/the-colbert-report-videos/375428/february-24-2… or http://tinyurl.com/46gaa9d http://www.colbertnation.com/the-colbert-report-videos/375429/february-24-2… or http://tinyurl.com/4p4zp3l Another article: http://www.h-online.com/security/features/Anonymous-makes-a-laughing-stock-… or http://tinyurl.com/63fekyp ** *** ***** ******* *********** ************* News Interesting article from Wired: "How a Remote Town in Romania Has Become Cybercrime Central." http://www.wired.com/magazine/2011/01/ff_hackerville_romania/all/1 Recently declassified: "Historical Study: The National Security Agency Scientific Advisory Board 1952b1963." http://www.governmentattic.org/4docs/NSA-SAB52-63_1965.pdf A physical biometric wallet: $825. http://www.dunhill.com/en-us/shoponline/leather/wallets/biometric-wallet-qg… or http://tinyurl.com/4f2f345 http://www.thetechherald.com/article.php/201105/6754/Dunhill-biometric-wall… or http://tinyurl.com/4n8v53e I don't think I understand the threat model. If your wallet is stolen, you're going to replace all your ID cards and credit cards and you're not going to get your cash back -- whether it's a normal wallet or this wallet. I suppose this wallet makes it less likely that someone will use your stolen credit cards quickly, before you cancel them. But you're not going to be liable for costs incurred during that delay in any case. Interesting story about a con man who conned the U.S. government, and how the government is trying to hide its dealings with him. http://www.nytimes.com/2011/02/20/us/politics/20data.html Susan Landau's testimony before the House Judiciary Committee, Subcommittee on Crime, Terrorism, and Homeland Security on government eavesdropping. http://judiciary.house.gov/hearings/hear_02172011.html The testimony of Valerie Caproni, General Counsel of the FBI, on the same topic. http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance… or http://tinyurl.com/46l49am Good article about the terrorist non-threat from Reason: http://reason.com/archives/2011/02/15/what-islamist-terrorist-threat "Reliably Erasing Data From Flash-Based Solid State Drives," by Michael Wei, Laura M. Grupp, Frederick E. Spada, and Steven Swanson. http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf News article: http://www.theregister.co.uk/2011/02/21/flash_drive_erasing_peril/ Video of talk: http://www.usenix.org/multimedia/fast11wei NIST has finally published its rationale for selecting the five SHA-3 finalists. http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Round2_Report_NI… or http://tinyurl.com/4zte3e2 Pickpocketing as a trade is dying out in America, because there's no one to train newer pickpockets in the craft. http://www.slate.com/id/2286010/pagenum/all/ Interesting research in using animals to detect substances. Basically, sniffer dogs respond to unconscious cues from their handlers, and generate false alarms because of them. It makes sense, as dogs are so attuned to humans. I'll bet bomb-sniffing bees don't make the same mistakes. http://www.economist.com/blogs/babbage/2011/02/animal_behaviour Full paper: http://www.springerlink.com/content/j477277481125291/fulltext.pdf Bomb-sniffing bees: http://www.livescience.com/4605-bees-trained-bomb-sniffers.html "American Cryptography During the Cold War 1945-1989; Book IV: Cryptologic Rebirth 1981-1989." Document was first declassified in 2009. Here are some newly declassified pages. http://www.governmentattic.org/4docs/NSA_AmerCryptColdWarBk4_1999.pdf http://www.governmentattic.org/4docs/oNSAAmerCryptColdWarBk4_1999.pdf Criminals are stealing cars by calling tow trucks. It's a clever hack, but an old problem: the authentication in these sorts of normal operations isn't good enough to prevent abuse. http://www.wsmv.com/news/26878155/detail.html A programmer installed malware into the Whack-a-Mole arcade game as a form of job security. It didn't work. http://www.wftv.com/news/26986709/detail.html Wired.com has a good three-part story on full-body scanners. http://www.wired.com/threatlevel/2011/02/scanners-part1/ http://www.wired.com/threatlevel/2011/03/scanners-part2/ http://www.wired.com/threatlevel/2011/03/scanners-part3/ Another attempt to sort out scanner claims: http://www.okianwarrior.com/MathView/BackscatterSafety/ Using language patterns to identify anonymous email. It only works when there's a limited number of potential authors. http://www.schneier.com/blog/archives/2011/03/using_language.html ** *** ***** ******* *********** ************* Schneier News I'm speaking at Black Hat Europe in Barcelona on March 17. http://www.blackhat.com/html/bh-eu-11/bh-eu-11-home.html I'm speaking at the Oracle Chief Security Officer Summit in New York City on March 30. http://www.oracle.com/us/dm/65212-wwmk09121721mpp414-se-281577.html This three-part video interview with me was conducted at the RSA Conference last month. http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528091… or http://tinyurl.com/4q9vt45 http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528245… or http://tinyurl.com/4dezbsk http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528160… or http://tinyurl.com/4bawfzq I was interviewed on chomp.fm. http://chomp.fm/008/ ** *** ***** ******* *********** ************* NIST Defines New Versions of SHA-512 NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster. This is a good thing, and exactly what we did in the design of Skein. We defined different outputs for the same state size, because it makes sense to decouple the internal workings of the hash function from the output size. http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf or http://tinyurl.com/47fta7g http://csrc.nist.gov/publications/PubsDrafts.html#fips-180-4 ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2011 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0