- cypherpunks-legacy - lists.cpunks.org

It had to happen...
by Mike Ingle 17 Dec '03

17 Dec '03

Today I got an interesting message. It seems that someone was doing some hardcore hacking of machines at a university campus. The person used one of these accounts to send me a message requesting a copy of Secure Drive. This message and my response were wiretapped by the people investigating the hacking. They traced the hacker and arrested him. His computer was encrypted with Secure Drive. The IS manager involved sent me a message asking me how to break Secure Drive, because they can't prosecute the person without the data, and the suspect has of course forgotten the encryption passphrase. So far I don't have many details other than these. I hope to find out more. I'd like to talk to the investigator and to the suspect. I sent the IS manager a copy of Secure Drive and told him how it works, but that's about all I can do. --- Mike

1 0

The Cypherpunk Equation
by L. Detweiler 17 Dec '03

17 Dec '03

Pseudospoofing == Privacy

1 0

mail-to-news gateway
by Eric Hollander 17 Dec '03

17 Dec '03

I'm currently setting up my soda.berkeley.edu remailer so it will post stuff to news. It's working fine, but I'm having an internal debate with myself: Do I want it to automatically anonymify the postings (that's what it's doing now) or should I have them with names on them? The only real difference is that if they have names on them by default, people will have to bounce it through a remailer first if they want anon. Also if it's always anon, it may lead to more abuses, and might not be as useful in some ways. What do people think? Btw, it's open for testing right now. To use it, send mail hh(a)soda.berkeley.edu with the following line in the header: Request-Post: alt.test and it will post. NOTE: PLEASE DO NOT PUBLICIZE THIS SERVICE YET, BECAUSE IT IS STILL IN "BETA". PLEASE DO NOT USE IT TO POST TO GROUPS OTHER THAN TEST GROUPS. e

2 1

Re: It had to happen...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

The cracker who's using Secure Drive could be an interesting case. Unfortunately, assuming that a cracker at a university is probably a student, he may not hve very good legal representation, and I'd hate to see bad precedent on "can you be forced to reveal your key" set because someone is not only a tresspasser but a stupid one as well. Do you know if the wiretapping was being done by police, or if it was just the university staff with ethernet sniffers? I was interested by your comment that they can't prosecute the person without the data; while it could certainly be helpful to have, one would hope they had a reasonably solid case *before* they went and arrested him..... Thanks; Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com

3 2

Re: It had to happen... (fwd)
by Harry Shapiro 17 Dec '03

17 Dec '03

a conscious being, Jim choate wrote: > Assuming the arrest warrant was good not revealing the key to a duly > authorized court representative would be illegal (ie interfereing with a > police investigation). If the courts serve a warrant for your arrest and the > confiscation of data on your hard drive (and you refuse to turn the data over > even after talking w/ an attorney) is specificaly mentioned you are opening > yourself up for another whole world of legal hurt. I would like to hear what Duncan has to say, but... 1) He did give them the data, they just can't read it. (not his problem). LIke if I wrote some notes in French, I don't think I woudl be required to translate them. 2) Then their is the issue of 5th Admendment issues... /hawk

1 0

it had to happen......
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart writes; >Assuming the arrest warrant was good not revealing the key to a >duly authorized court representative would be illegal (ie >interfereing with a police investigation). If the courts serve a >warrant for your arrest and the confiscation of data on your hard >drive (and you refuse to turn the data over even after talking w/ >an attorney) is specificaly mentioned you are opening >yourself up for another whole world of legal hurt. >A citizen would have the legal right to refuse prior to talking w/ >an attorney but not after, at that point it becomes witholding >evidence. >If the process is legal there should be no reason a citizen can >refuse to turn over his private keys (I don't believe >self-incrimination holds here). Well no doubt they have his True_Name now. I'm curious as to why they are so adamant about trying to break the encryption? I get the impression they don't have much of a case. Don't forget kids to save those sniffer tracings, they could earn you valuable prizes! I won't even go into how dumb it is to try accessing a cracked system through a single cutout, kids don't try this at home ;) Brian Williams Extropian Cypherpatriot smarter than your average bear. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLRn01tCcBnAsu2t1AQFSYwQAoQiqSmUmnl1CLOr94DF3V+4i274mGl+b kKyX8VU1FFFfY6jD8LC2EeMITFX0vJkuA29WxYEomUEa1WRlqt1z+wOahgpPaPzT ipyY0JF6xTOMSmTBnvsfEZWsJUHC4qTiNbQaONg5ooMic75bcnhWXTENfBFOlB50 E+f9M4GfPV0= =uGUA -----END PGP SIGNATURE-----

1 0

Re: Merry Christmas, Cyberanarchists
by ub075＠freenet.victoria.bc.ca 17 Dec '03

17 Dec '03

>Of course it can. Detweiler always posts from an12070(a)anon.penet.fi > >Incidently, all those replying to this thread thus far have sent mail >to an12070(a)anon.penet.fi and thus have compromised their anonymous IDs >because of the double blinding feature. Not always. If your anon ID has a password set, your message will just be returned to you, with an error message.. Assuming: 1. The person has an anon ID in the first place. 2. You have a password set on your anon ID. I don't really see why you wouldn't. -- Ryan Perkins - 1:340/13 | I feel that suicide jumpers see a glimpse of ub075(a)freenet.victoria.bc.ca | sanity as they throw themselves from the ledge. Ask for PGP 2.3 public key | That's why they scream all the way down. 8C5357 : 9F FF BA 93 54 D5 18 78 4B 1E DA GC E3 4E

1 0

Re: eavesdropping detection
by George A. Gleason 17 Dec '03

17 Dec '03

Re phone taps: forget it. Anything above amateur level tapping is done via the central office, where it is simply impossible to detect. Any device which claims to detect wiretaps is fraudulent. I'm speaking from over ten years' experience in telecom, extensive relevant background, etc. Room surveillance: you have to be *really* up to something to be targeted for this. Unlikely at best; but he earlier post about spec analysers is useful & relevant here. Generally: bear in mind that surveillance is incredibly labor intensive at any level beyond the "vaccuum-cleaner approach" using keyword scans on trunks. Too labor intensive to be conducted unless there is serious justification for the cost of the person-hours involved. -gg

6 6

(fwd) A safer, saner Detweiler
by Anonymous 17 Dec '03

17 Dec '03

Newsgroups: comp.org.eff.talk From: sburkart(a)cpp.PHA.PA.US (Stephen Burkart) Subject: A safer, saner Detweiler Organization: Critical Path Project Date: Thu, 23 Dec 1993 16:00:07 GMT Keywords: CRYPTOANARCHIST PROMOTERS of SODOMY Found: a (Philadelphia) City Paper review of Covert Culture Sourcebook, which closed out with: "Debating the "cutting", or rather "covert" edge, is beginning to seem as silly as labeling bands "alternative," since so much of it is becoming more and more chic. Still, it's not as if mainstream-king Jesse Helms (scapegoat for all ultra-conservatives that he is) will pick up this book and say, "Hmmm, maybe I _will_ subsribe to Future Sex...." (review written by Margit Detweiler, who is no doubt a tentacle.)

1 0

Re: picture signatures
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

There is no need to sign the picture itself: a secure time stamp would prove ownership of the oldest version of a picture: CryptoHashA(picture) --> H_i Then the timestamp service: CryptoHashB(H_i, H_j) --> H_receipt ; H_j is hash from another customer The H_receipt is published in a well-known place/time and is traceable to the picture. The actual scheme the Bellcore folks worked out is tree structured for efficiency reasons. An altered version of a photo would presumably have a different hash, but it would not have an earlier timestamp hash. Insofar as one could recognize that an image was incorporated into another altered image, misappropriated and stolen copyrights could be detected. Recognition is inherent in this process. This isn't very different from sound sampling: if the alteration completely obscures the orignal beyond recognition, then there isn't much of a case to prove theft. For a picture example, I could digitize a copyrighted image and use *only* it's color palette on one of my pictures (I haven't tried this yet, but it sounds like a good "empircal color theory"). BTW, Anyone have an email addr of the Bellcore folks who invented the secure timestamp system? I'd like to use the service if it is still operational. Paul E. Baclace peb(a)procase.com

1 0