- cypherpunks-legacy - lists.cpunks.org

Criminals Focus on Weak Link in Banking: A.T.M. Network
by R. A. Hettinga 03 Aug '03

03 Aug '03

<http://www.nytimes.com/2003/08/03/national/03ATM.html?pagewanted=print&posi…> The New York Times August 3, 2003 Criminals Focus on Weak Link in Banking: A.T.M. Network By WALT BOGDANICH He fenced stolen jewels, committed bank and credit-card fraud and had been accused of having links to an Albanian-Yugoslavian criminal gang. Cloaking himself in nine aliases and Armani jackets, he was a smooth, multilingual master of the con, investigators and people who knew him say. His name is Iljmija Frljuckic, and by all accounts, he had no business being around anybody else's money. Yet after being deported in the late 1990's, he slipped back into the United States and set up shop as a banker, not in a marble lobby under the watchful eyes of auditors and regulators, but in the virtually unregulated world of privately owned automated teller machines. To tap into this electronic network, Mr. Frljuckic (pronounced Furl-YOU-kich) did not have to produce so much as a valid driver's license. After buying these machines - the kind commonly found in convenience stores, delicatessens and other retail outlets - he and his associates installed devices that captured, or "skimmed," personal bank account information from at least 21,000 people, prosecutors say. They used that information in 2001 and early 2002 to make fake A.T.M. cards, then stole at least $3.5 million, mostly from A.T.M.'s in New York City, according to the latest federal charges filed about two months ago in Manhattan. Before Mr. Frljuckic came along, small-time crooks had made crude forays into A.T.M. fraud. But in its size and technical sophistication, investigators say, the Frljuckic case is a con of an entirely different order - a new turn on identity theft, a jolting warning of the vulnerability of an A.T.M. system that has exploded in size in the last few years. No one can say precisely how much is lost through A.T.M.-related crimes. In fact, no government agency knows how many cash machines are operating, where they all are or who owns them. Though banks are reluctant to discuss their losses, they say there is no cause for alarm. But from Canada to Malaysia to the United Arab Emirates, investigators report new assaults on A.T.M.'s. The criminals, both foreign and homegrown, include gangs, embezzlers and, on occasion, money launderers, according to investigators and public records. And while A.T.M. industry officials say the Frljuckic case shocked them into tougher self-policing of privately owned machines, they also confess that the thieves are remarkably resourceful, shifting their attention now to bank-owned machines. In recent months, skimming devices have been attached to bank machines around Boston and Chicago. "A.T.M.'s have been viewed as a weak point in the banking chain - and so the criminals have focused on that," said Tom Harper, president of the A.T.M. Industry Association, the leading trade group. The global wiring of banks to A.T.M.'s means consumers can gain instant access to their money around the world. But with the government monitoring only part of this electronic network, a thief using cheap equipment and a little imagination can steal someone's banking identity in Manhattan and within hours withdraw money from that person's account at a cash machine in Europe. A.T.M. crime may also be a national security issue. Federal officials are investigating incidents in which suspected terrorists may have used the machines to fraudulently generate income, says Dennis Lormel, chief of the terrorist financing operations section of the Federal Bureau of Investigation. Banks are supposed to reimburse victims of A.T.M. theft. But unlike credit card fraud, in which banks are stuck with bills for unauthorized purchases, A.T.M. thefts take cash from consumers, who may bear the burden of proving that withdrawals were unauthorized. Kelly Quick of Studio City, Calif., said that when he reported $1,420 missing from his account early this year, his bank did not believe him. "They basically said that since I didn't give out my PIN number, it had to have been me," Mr. Quick said. Similarly, Mark Evans of Los Angeles said his bank was "basically accusing me of stealing the money." Both men say getting their money back involved a fight. Complaints like these prompted the comptroller of the currency in September 2001 to warn banks of their obligation to make A.T.M. victims whole. "Unfortunately there are people who say they have been defrauded when they have not," said John Hall, a spokesman for the American Bankers Association. As banks learn more about A.T.M. fraud, he said, they are getting better at helping customers. A.T.M.'s have been around for decades, but became ubiquitous on the American landscape in 1996, when new surcharges on withdrawals made it possible for private entrepreneurs to profit by owning machines. Since then, the number of machines, which cost as little as $3,000, has tripled, to an estimated 370,000, fueling the growth of companies that sell and service them. This growth, in turn, has spawned criminal activity that goes beyond just the skimming of bank account numbers. Embezzlements in recent years have involved companies that supply cash to the expanded A.T.M. market, including a New Jersey company, Tri-State Armored Services, where $50 million turned up missing. By contrast, the biggest bank robbery in the last 25 years, according to federal statistics, involved $11 million. Banks call credit-card and check fraud a much bigger problem. Besides, they say, rare cases of A.T.M. fraud are a small price to pay for convenient cash. But banks are not eager to publicize breaches of A.T.M. security. "They don't want to give people ideas," said Nessa Feddis, a lawyer with the American Bankers Association. Another reason, some financial experts say, is that banks do not want to undermine confidence in a system that cuts their overhead while making them billions in fees, collected when their customers use private A.T.M.'s or machines owned by other banks. Several large banks also own parts of a network that connects the machines and financial institutions. "These fees are cash cows for the banks," said Edmund Mierzwinski, of the U.S. Public Interest Research Group in Washington. A former president of a Federal Reserve bank said: "You write your story and they will hate it because it will say, `Be careful where you stick your card.' " 4,000 Accounts Vulnerable The nation's biggest A.T.M. fraud began in late 2000 with trial runs in California, Florida and New York. At 13 sites, thieves started installing machines rigged internally to capture bank data and personal identification numbers. They were in no hurry; the longer they waited, the more account numbers they could steal. In four months, with just the dozen or so machines, they had the electronic keys to 4,000 accounts, fraud investigators say. Only when the gang began siphoning money did banks and customers realize they had been scammed. By the time the rigged machines had been identified, they had vanished, along with their owners and tens of thousands of dollars. By the end of June 2001, banks had identified the compromised cards and electronically blocked them. "They covered their tracks throughout the process," said Michael Urban, who works for a division of Fair Isaac, a company that helps financial institutions detect electronic fraud. "We didn't know anything other than they had good PIN's, good cards." Investigators say the machines were bought in the names Michael Dokovich and Michael Bugatti, who turned out to be the same man: Iljmija Frljuckic. He is believed to have first entered the country in 1981. By the early 1990's, federal authorities had linked him to "an Albanian/Yugoslavian organized crime gang." The government wrote in court papers that the group "is believed responsible for a host of serious crimes, including arson, insurance fraud, bank fraud, large-scale mail theft, drug trafficking and sophisticated jewelry heists." Mr. Frljuckic married the daughter of a Florida law enforcement official in January 1994, telling her that he was Michael Illyriani, an international businessman, court records show. He did not say he was facing federal bank fraud charges, filed in 1992, and was out of jail only because, hoping for a plea bargain, he had agreed to inform against the Albanian gang. Actually, officials say, he was conning the government, too. While he helped on a few minor investigations, prosecutors say he provided "absolutely no assistance" in exposing the gang. Then, before the first case was settled, he was arrested in a new bank fraud. After his release from federal prison in June 1996, a judge ordered him deported to Yugoslavia. But he soon returned to the United States, and by then the A.T.M. system had opened its doors to private entrepreneurs. Surcharges Fuel Industry The system that beckoned Mr. Frljuckic runs on the ever-accruing stream of money from the surcharges first widely permitted in 1996. Today, many customers pay twice - usually $1 to $3 to the owner of the machine, and $1 to $1.50 to the bank that issued the card. A.T.M. fees now add up to $4.5 billion annually, according to Dove Consulting, a Boston-based firm. An A.T.M. entrepreneur needs a machine and cash, which can be borrowed, to stock it, and a bank account, so that when a cardholder withdraws money, the cardholder's bank has some place to send the reimbursement. What the owner does not need is a license or government approval. New owners are supposed to be evaluated by what are known as independent service organizations, or I.S.O.'s, which connect privately owned machines to the network. Each I.S.O., in turn, must be sponsored by a bank. But the I.S.O.'s and banks have a spotty record of oversight, according to some in the A.T.M. industry. Fraud investigators, for example, have sometimes had trouble establishing the owners and locations of specific A.T.M.'s. "It's harder to switch a registration on your car than to move around an A.T.M.," said Gregg James, a Secret Service agent who investigates financial crime. The system, if not properly supervised, can be used to launder money. An owner can stock a machine with the proceeds from crime and then, after withdrawals, be reimbursed from customers' banks with "clean" currency. The American Bankers Association says its members do not see money laundering as a problem. "That's not something that's come to my attention," said John Byrne, a lawyer with the association. It has, however, caught the attention of the Secret Service and other federal officials. In 2000, an Indiana man pleaded guilty to laundering money through his machines. Another A.T.M. money-laundering case is awaiting trial in California. "When I found out what he was doing I thought, `Ah, the perfect scheme,' " said Donna Eide, the prosecutor in the Indiana case. "It's a perfect way to get cash back into the system without reports being filed." Small Store Owners Used Nasser Alomari is typical of the small New York store owners who became unwitting accomplices in Mr. Frljuckic's widening fraud, investigators say. Mr. Alomari, a Yemeni immigrant, had originally owned his own A.T.M. in his delicatessen, now the 10th Avenue Gourmet, in Manhattan. A private company serviced the machine, paying him $1 for each withdrawal. In a good month, that meant $600. And until one day in January 2002, that seemed enough. Then a stranger wearing a gold Rolex with diamond insets offered him a better return - $1.75. He said the man insisted on installing his own A.T.M. Investigators say it had been fitted with a skimming device. Federal records show that the man Mr. Alomari dealt with used an alias, as he had in buying 21 other machines. Investigators say he was Hamdija Frljuckic, brother of Iljmija. Hamdija Frljuckic began buying machines in August 2001 from a New Jersey independent service organization called Money Marketing. "They knew the deep ins and outs of this business," a company spokesman, Eric Park, said. Money Marketing's vetting process conformed to the industry standard back then, he added, and included a review of a buyer's business records and driver's license. "I've never had a fake driver's license," he said. "How can you ever tell?" Money Marketing says A.T.M. buyers now undergo criminal background checks and must produce, among other things, tax returns. By early November 2001, investigators say, the thieves had collected account information from about 17,000 New Yorkers. The trap was set. Similar Fraud Patterns The first sign that something had gone seriously wrong came over that Veterans Day weekend. Just as bank customers began to miss money in their accounts, unusual withdrawal patterns were being detected by computer analysts in the Arlington, Va., office of Fair Isaac. The analysts noticed something else: The patterns echoed those observed that year in California and Florida. "Our investigators were 90 percent sure it was the same guys," said Mr. Urban of Fair Isaac. Investigators had another tactical advantage: With the highest daily withdrawal limit usually around $1,000, the thieves had to spend a lot of time feeding fake cards into machines. And during that time they were vulnerable. Once Fair Isaac had identified compromised cards, their numbers were sent to NYCE, a company that connects A.T.M.'s and banks. Then, when a suspect card was used again, NYCE, using a software program called Rooster, pinpointed the location and contacted the Secret Service within seconds. In New York's congested streets, though, getting there in time was a problem. "We had agents getting out of cars, running up the street," said Mr. James, the Secret Service agent. In an escalating game of cat and mouse, the thieves began making withdrawals during lunch hour, when sidewalk and street congestion was at its worst. And they stopped feeding large numbers of cards into a single machine, instead slipping from one location to another. "They would go in, hit an A.T.M., get on a subway, then go to the next A.T.M.," said Susan Zawodniak, executive director of the NYCE network. To improve their odds, agents began staking out the sites of suspicious withdrawals. For five days, nothing. Then, on the evening of Nov. 15, Citibank told an agent, "approximately $7,000 had just been withdrawn from different accounts in rapid and successive transactions from the same A.T.M.," according to a Secret Service affidavit. The agent rushed to the bank, where he found two other agents on stakeout. After a brief chase, they arrested a man seen leaving the bank. He was Fikret Korac, whom a federal prosecutor called "a criminal for most of his adult life." In his possession, agents said, they found 11 white plastic cards with magnetic strips and about $30,000. Investigators viewed Mr. Korac as a low-level "runner." But after his arrest, prosecutors say, he called Hamdija Frljuckic, who quickly tried to withdraw $150,000 in cash from an account in a false name at J. P. Morgan Chase . But when he asked for the money in $100 bills, a suspicious bank officer refused, according to the Secret Service. Within weeks, Hamdija Frljuckic was arrested - after visiting the machine at Nasser Alomari's store. He is awaiting trial on charges relating to the A.T.M. thefts. But Iljmija Frljuckic remains at large. "The main older brother flees with several million in a suitcase," an investigator said. "We have intelligence that he put A.T.M.'s in other places in the world." Reached overseas by telephone, Mr. Frljuckic told The New York Times that he was willing to be interviewed where he was living, in Montenegro. But after several conversations to arrange the interview, he stopped returning calls. In all, investigators say, the thieves withdrew money from 500 machines around New York City. The hardest-hit bank was Citibank, which lost about $1 million, said people close to the investigation. Banks are reluctant to discuss the case. "Our hard and fast policy is we just don't discuss these sorts of things," a Citibank spokeswoman said. At the state banking department, a spokeswoman, Bethany Blankley, said she knew little about the case because the compromised machines were not the agency's responsibility. "We regulate the safety of the A.T.M. machines only for banks," she said, "not for supermarkets or little stands where you get cigarettes." Industry Looks Inward Last March, the A.T.M. industry gathered in Miami to meet with fraud investigators for some self-examination. The New York case was not the only one on their minds. In late 2002, four Russians were arrested on charges of looting A.T.M.'s in Canada. Cardholders found their money disappearing in European cities they had not visited, including Paris, Amsterdam and Milan, according to a report filed by bank investigators. The Canadian fraud seemed to replicate what prosecutors accuse Mr. Frljuckic of having done. "The thing we found troubling," said H. Kurt Helwig, who runs the Electronic Funds Transfer Association, was that "this was organized crime." An industry task force - including machine manufacturers, electronic networks and private machine owners - is fighting fraud through, among other things, better background checks and machines less prone to tampering. The hope is that these efforts will keep the government from stepping in. "It's a marketplace issue," Mr. Helwig said. Because of their efforts, task force members say, skimming from private machines is not the danger it used to be. But concerns remain. In March, Fair Isaac sent an "urgent notice" of thefts from A.T.M.'s in San Francisco and the Los Angeles area. Investigators say they believe those card numbers were stolen through skimming devices in privately owned machines. But now more A.T.M. fraud seems to be occurring at bank-owned machines, industry officials say. They are refocusing their attention. "It's almost as if the criminals were listening and watching," said Ms. Zawodniak of NYCE. "We build a 10-foot wall, and they build an 11-foot ladder." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Digicash Patents
by Bill Stewart 03 Aug '03

03 Aug '03

At 10:19 PM 07/31/2003 -0500, Mac Norton wrote: >I'm not sure that Paypal has met the needs of any enduser yet, >so I'd question whether it "succeeded." Huh? Paypal was wildly successful at meeting the perceived needs of end users. Whether it met the needs of stockholders before EBay bought it is a separate question. It wasn't pretending to be a perfect cypherpunks solution. Paypal gave people who wanted to occasionally sell things on the net a way to receive payments online, quasi-immediately, without going to the major hassle of becoming a registered credit-card-accepting business, and let people who wanted to buy things online send money immediately without sending their credit cards directly to random individuals, and let both sides avoid the delay and bounceability of checks-by-snail, and reduced the likelihood of fraud in the payment process.

2 1

Re: Antispam Bills: Worse Than Spam?
by Jim Choate 03 Aug '03

03 Aug '03

On Fri, 1 Aug 2003, Earl Cooley wrote: > Jim Choate wrote: > > > > For this to be taken seriously one must be able to -define spam- as if it > > were a mathematical entity (eg a 'point'). It must be absolutely > > differentiable from -all- other speech. > > > > You can't do that, nobody can. > > Well, actually, SpamAssassin calculated that Carl's original post was spam. > Here's the breakdown: > > Content analysis details: (3.50 points, 3 required) > MORTGAGE_BEST (2.6 points) BODY: Information on mortgages > HTML_40_50 (0.7 points) BODY: Message is 40% to 50% HTML > HTML_FONT_COLOR_RED (0.1 points) BODY: HTML font color is red > HTML_WEB_BUGS (0.1 points) BODY: Image tag with an ID code to identify you > HTML_MESSAGE (0.1 points) BODY: HTML included in message > HTML_RELAYING_FRAME (0.5 points) BODY: Frame wanted to load outside URL > HTML_FONT_BIG (0.1 points) BODY: FONT Size +2 and up or 3 and up > HTML_FONT_COLOR_BLUE (0.1 points) BODY: HTML font color is blue > KNOWN_MAILING_LIST (-0.9 points) Email came from some known mailing list software > MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts > > That's really useful, right? heh. :) There is an old saying that one becomes what one hates. Personaly, I'm opposed to any legislative responce. Nada, none, nil. I don't agree that whatever the cost at the personal level it will be less than the increase in taxes to pay for the additional officers, legal support staff, etc. In particular I don't like the aspect of making it a crime. There is no way you're going to convince me that irrespective of the level, it's worth sending black clad stormtroopers into peoples lives. Especially when that includes the potentail for people dying. No, sorry. Ain't gonna happen. It violates both speech and press aspects of the first. And to be clear 'press' in the Constitution isn't the news agencies. Thomas Jefferson made that perfectly clear. It's the right of people to share their activities with others. People have a right to speak their mind, and they have a right to share it with others. To base that right on content is an abrogation of the fundamental ethos of this nation. There is of course the concepts of harassment and trespass. Of which we have sufficient laws on the book already. What we do need is a good case and a couple of supporting court rulings. In particular people have a right to ring your doorbell or drop a note on their porch, or ring their doorbell to talk to the residents. When they do it in a confrontational manner, by say ringing your doorbell over and over. This of course is one reason I am completely opposed to blacklists as well. Not only is there no technical or legal backing with respect to speech, but their probing of my system after I tell them to stay away is a form of trespass. Let's not even get into the aspect that this is one of the primary channels of Open Relay machines around. They do all the work and then sell the list, to who? Your ISP and spammers. If they didn't exist each spammer would have to scan the net for relays IP by IP. But no, for some reason people think it's a good idea. People have the right to the pursuit of happines, not the attainment or retention of it. It's simply not the governments job to protect what you have from simple market alteration. Stability in that respect is a bad thing. It denies others pursuit of happiness with the goal of the individual. There are some things that aren't a question of majority view. Sometimes that only means all the idiots are on one side. It has no moral or ethic weight. Get over it and move on to something more important. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

6 15

Inferno: [sexpot@zork.net: Sunday 3 August 2003 Three Jewels Free Software Workshop: Install Fest and Five Lines in Three Files] (fwd)
by Jim Choate 03 Aug '03

03 Aug '03

---------- Forwarded message ---------- Date: Sun, 3 Aug 2003 01:15:40 -0500 Subject: Inferno: [sexpot(a)zork.net: Sunday 3 August 2003 Three Jewels Free Software Workshop: Install Fest and Five Lines in Three Files] Sharing the love... ----- Forwarded message from Jay Sexpot Sulzberger <sexpot(a)zork.net> -----

1 0

Re: Secure IDE?
by Adam Back 03 Aug '03

03 Aug '03

On Thu, Jul 31, 2003 at 12:04:13PM -0400, Trei, Peter wrote: > [...] > > >with a good distribution of IVs > > > > Where would you store them? The feature of this is that it's fully > > transparent, so you can't store IVs anywhere. > > I'm not really up on crypto file systems, but I beleive at least some > use the sector address as the IV. IVs don't need to be random, > secret, or unpredictable - they just need to be unrepeated. (I'm > assuming sector-at-a-time encryption). I believe that is what some of them are doing. I think it's a little better to use some fast PRNG seeded from the sector (or eg HMAC of sector number or encryption of sector number if you have hardware). The sector number is changing in counter order and cancels with the plaintext difference. I did some tests on a 10GB disk full of windows app and program data (accessed the raw windows partition from linux /dev/hda1) and if you do that (xor first block of sector with sector number) you get a fair few collisions. > > How would you do this without a custom BIOS (remember that their > > general product is for dropping into any PC)? one of the products on show at RSA earlier this year would boot from the IDE sector onto a virtual drive (it would pretend to be a boot sector over the IDE connector), then that boot sector has code to ask for your password, derive the key and load it, and then reboot onto the real drive. If you pulled power from the drive it would forget the key. Adam

2 1

California considering curb on 50 caliber rifles
by Steve Schear 03 Aug '03

03 Aug '03

Sniper weapons should be restricted A .50-caliber BMG sniper rifle, in the wrong hands, would be terrorism unleashed. The gun is powerful enough to punch a hole in an oil tank or take down a civilian airplane. Its 5 1/2-inch long bullets can pierce an inch of armor 40 yards away and hit a target a mile away. A massive weapon, with some models weighing in at 28 pounds, it's ill-suited for hunters -- it would take out a deer and the tree behind it -- but ideal for assassins. Monday, July 28, 2003 (Mercury News) http://www.bayarea.com/mld/mercurynews/news/opinion/6400612.htm See my opinion piece reply at http://www.bayarea.com/mld/mercurynews/news/opinion/6442894.htm "To those who scare peace-loving people with phantoms of lost liberty, my message is this: Your tactics only aid terrorists." --John Ashcroft, U.S. Attorney General

4 6

RE: Secure IDE? (fwd)
by Sarad AV 03 Aug '03

03 Aug '03

hi, > This isn't a communications protocol. We're talking > about > disk storage. The only circumstances where an > attacker > could use this as an attack vector would be if the > attacker > could take multiple snapshots of the disk, possibly > replacing > blocks at later times. > > Peter > Thank you-i get that.The attacker might certainly like to try it ,if it is a banking DatBase. Bill Stewart" <bill.stewart(a)pobox.com> wrote >However, there's an emerging application for which >disk drives are more vulnerable, which is remote >storage. >Some of the new disk interface standards, like Fibre >Channel, >and probably some of the flavors of iSCSI, >can operate over distances of 20km and longer over >fiber, >leading to businesses like colocation centers in New >Jersey >providing big disk drive farms for New York City >financial businesses >which have their mainframes in Manhattan. >For applications like that, it is important to do >good IVs, >because control of the disk drive doesn't imply >control of the machine. okay-lets look the same in a communication protocol. We have digital cash transactions between Bank A and Bank B. Say I am an employee of Bank A. I don't keep the IV as secret,i just append the IV along with the cipher text which i have chained using a chaining mode and send it to bank B.There is a man in the middle M,who also sniffs out the IV,now he can successfully perform a block replay attack. I can think of one way this can be prevented. It would take us to share a common seed value (a secret)between Bank A and Bank B. 1.Bank A uses a pseudo random number generator like Tauss88 with a period of nearly 2^80 or MT19937 with a period of 2^19937-1 and generates the first IV using the generator. 2.This IV,is used for chaining but the IV itself is not transmitted along with the cipher text to the bank of B. 3.Once the chained cipher text reaches bank of B, they use the common seed to generate the first IV and this IV can be used to obtain the actual cipher text. 4.Continue steps 1 to 4 till the period of the generator.If we use Taus88 we can get nearly 2^80 IV's and if we use MT19937 we can get upto 2^19937-1 IV's. We also dont need to hash the IV's itself though they form a linear recurring sequence, since they are not transmitted from Bank A to Bank B and we derive no information of the IV from any number of blocks of the chained cipher text. In this way the attacker can no longer perform block replay attacks. The funny part is that I have seen some cryptographic utilities simply appened the IV to the chained cipher text and transmit to a receiver. Regards Sarath. __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

1 0

RE: Secure IDE? (fwd)
by Mike Rosing 03 Aug '03

03 Aug '03

Forwarded by request. ---------- Forwarded message ---------- sector address as the IV. IVs don't need to be random, secret, or unpredictable - they just need to be unrepeated. (I'm assuming sector-at-a- time encryption). If the IV is not a secret how are we going to prevent block replay attacks on cipher text? Regards Sarath. --- Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wrote: > "Trei, Peter" <ptrei(a)rsasecurity.com> writes: > pgut001@cs.auckland.ac.nz[SMTP:pgut001@cs.auckland.ac.nz] > >>"Trei, Peter" <ptrei(a)rsasecurity.com> writes: > >>>with a good distribution of IVs > >> > >>Where would you store them? The feature of this > is that it's fully > >>transparent, so you can't store IVs anywhere. > > > >I'm not really up on crypto file systems, but I > beleive at least some use the > >sector address as the IV. IVs don't need to be > random, secret, or > >unpredictable - they just need to be unrepeated. > (I'm assuming sector-at-a- > >time encryption). > > But the IV is repeated, every time you encrypt new > data for that sector. You > need to either store a random IV for each sector > (usually infeasible) or make > two passes over the data (details vary), using the > output from pass 1 to > affect pass 2 (slow). > > >>>* Some kind of PIN or password protection on the > dongle. > >> > >>How would you do this without a custom BIOS > (remember that their general > >>product is for dropping into any PC)? > > > >We're talking about two different products. The > ABIT is a MB, presumably with > >it's own custom BIOS, so that's not an issue there. > > Customised, not custom. Think of it as a > Chinese-menu type setup, it's a one- > size-fits-all BIOS with appropriate modules compiled > in for handling the CPU > and chipset features. Now motherboard vendors can > plug in their own feature > modules, but it's a somewhat nontrivial option > usually used only for highly > marketable features (overclocking options, ability > to re-flash from Windows, > etc etc). > > Peter. > > > __________________________________ > Do you Yahoo!? > Yahoo! SiteBuilder - Free, easy-to-use web site > design software > http://sitebuilder.yahoo.com __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

2 1

RE: Secure IDE? (fwd)
by Trei, Peter 03 Aug '03

03 Aug '03

> Mike Rosing[SMTP:eresrch@eskimo.com] > > > Forwarded by request. > > ---------- Forwarded message ---------- > > sector address as the IV. IVs don't need to be > random, secret, or > unpredictable - they just need to be unrepeated. > (I'm > assuming > sector-at-a- > time encryption). > > > > If the IV is not a secret how are we going to prevent > block replay attacks on cipher text? > > > Regards Sarath. > This isn't a communications protocol. We're talking about disk storage. The only circumstances where an attacker could use this as an attack vector would be if the attacker could take multiple snapshots of the disk, possibly replacing blocks at later times. Peter

1 0

Where is the Remailer discussion?
by mindfuq＠comcast.net 02 Aug '03

02 Aug '03

Folks- I noticed very little discussion on remailers here. Can anyone tell me of a mailing list more suitable for remailer discussion? In the meantime, maybe someone can answer this: I'm reading the design docs for MixMinion. The authors are saying that reply blocks must be single use because traffic analysis can be done via flooding replay attacks, and that the replay block can be derived from this. I can see how this is the case with simple reply blocks, but what about the reply blocks that have branching and varying probabilities? Couldn't one create a reusable reply block complex enough to foil this type of analysis?

1 0