- cypherpunks-legacy - lists.cpunks.org

Kingdom of Fear - 2003
by R. A. Hettinga 19 Jul '03

19 Jul '03

--- begin forwarded text

2 1

Fwd: Re: Unsubtle Wetwork
by proclus＠gnu-darwin.org 18 Jul '03

18 Jul '03

Thanks you for your interesting notes, and this is my first post. My best current theory is that the "real mole" killed Kelly as a diversion. Now that Gilligan has changed his story, he has been discredited, but at least he lives. With Kelly dead, it may be harder to trace to their sources the lies that the Government told, and Campbell & Co. will be sleeping better at night. Anyway, everyone has a favorite conspiracy theory. If this is too far off topic, feel free to reply in private or direct me to another list. Regards, proclus http://www.gnu-darwin.org/ On 18 Jul, Tim May wrote: > -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------ [demime 0.97c removed an attachment of type APPLICATION/pgp-signature]

1 0

Unsubtle Wetwork
by Major Variola (ret.) 18 Jul '03

18 Jul '03

Weapons Adviser Named as Possible Source for BBC Story Disappears; Man's Body Found LONDON (AP) - Police searching for a missing Ministry of Defense adviser, who was named by the government as the possible source for a disputed news report on Iraqi arms, said Friday they have found a man's body near his home. http://ap.tbo.com/ap/breaking/MGABVMP3AID.html Maybe he's just hanging out with Ritter in upstate NY...

3 3

Re: Optical Tempest? I have my doubts...
by Major Variola (ret) 18 Jul '03

18 Jul '03

At 01:33 PM 7/17/03 -0700, Meyer Wolfsheim wrote: > >For what it's worth, a "secure viewer" that displayed text in red on a >black background should make an optical tempest attack much more >difficult. Why? On a black background you have higher contrast, which you don't want here. The eye is most sensitive to greenish, so if you are trying to reduce the signal, use barely visible green. On a nearly-same-luminance green background. Green on green or gray on gray is *low contrast*. That's what you want. (You may as well use gray on gray, assume the adversary has color vision, and might even have the CIE chart on your monitor phosphor. The different RGB phosphors also have different decay times, which smears the signal if the adversary has no color vision) Possibly dither the text. You might also have brighter lines or areas on the screen to obscure the signal from the less-bright e-beamed text areas. Actual distribution should depend on the decay over time of the phosphor (you want the bright "distractors" to be as bright as the text-pixel even though the distractor is no longer illuminated by the e beam). You also want some incandescants and fluorescant lights, the latter running off batteries (with switching converters) so they run out of phase and frequency with the ones on wall current. Optical jamming. Or just close the windowshade and put a towel under the door gap. (Others may think you're [sm|t]oking, however.. and with the multiple, multitinted fluorescants, they'll think you're growing too) Or use a box. (I once did med-imaging related vision experiments... the setup was a Sun with a calibrated greyscale monitor, in a medical office, behind the receptionists until we got more space... we had a giant cardboard box over the monitor & subject to control ambient light.. which stayed while I was programming it too.. it amused the patients who came in to see their cardiologist to see a guy working with his head in a big box.. probably would have been more disconcerting if the MD was a psychiatrist :-)

1 0

Security for Mafiosos and Freedom Fighters
by Tim May 17 Jul '03

17 Jul '03

Several good suggestions in this thread about securing machines and keyboards against FBI black bag jobs and the like. (By the way, the USB flashdrive (a 256 MB FlashHopper) I have on my keychain--my physical keychain!--is probably waterproof. The USB port has a little plastic cover which slides on snugly. Until I eventually misplace it, I am using it. I expect the thing is showerproof, though I don't intend to test it. Water resistance can be tested nondestructively with things like Fluorinert, of course. Also, surfers and kayakers often have O-ring sealed gizmos they wear under their wet suits, coming in different sizes. It would be trivial to find one to hold either a USB flashdrive or a Compact Flash card.) The larger issue is a business/consulting opportunity: The collection of "lore" on resisting bugs and intercepts and bad security measures is not something the average Mafioso or freedom fighter is much interested in learning himself. Just as specialists are used to sweep rooms for bugs, the same should apply to helping Vito Corleone beef up his computer system. --- "Have LAN, will Travel." Security Consultants, Inc. will provide you, your family, and your associates with a computer and communications package which is resistant to FBI or CIA wiretaps, black bag jobs, Van Eyck interception, and remote surveillance. We will evaluate your current system, your needs, and design a system for you. This will included throwaway cellphones, easy to use but robust encryption, steganography, access to offshore accounts, physical security for the computers, digital dead drops, use of untraceable remailers, personal security devices (such as USB flash drives storing sensitive material), and set up of t.v. cameras under your control for monitoring snooping, intrusion, and even dishonest associates and family. Security Consultants does not currently handle weapons issues, but all your other bases are belong to us. --- I mean this somewhat whimsically, but the fact is that this kind of security consulting will become more and more important as even mobsters move into the information age. (When I was developing some of the ideas prior to the formation of Cypherpunks, one of the interesting news items was about how a guy on the run from the Feds was using an early bulletin board system--I think it was GEnie, but it may have been Prodigy--to communicate with his wife in chat rooms.) In a free society, those who provide services like roofing or plumbing or security needs are of course not implicated in the possible crimes or other activities of their customers. A guy who builds a security fence for Don Corleone is not guilty of aiding and abetting. But we have not had a free society for many decades, and it is more than possible that RICO and Espionage statutes would be interpreted by government to say that assisting someone like Aldrich Ames in improving his tradecraft is ipso facto part of a conspiracy. Or the spooks could demand that Security Consultants, Inc. place "special" networks and cameras... Issues of trust and fear. (When the Mob finds out this has been done and snatches one of the children of the company and returns the child as a "turkey," with both arms, both legs, the nose, the ears, and the tongue precisely and surgically removed, others in the industry may realize the dangers of crossing the Mob.) --Tim May, Occupied America "They that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin, 1759.

4 5

Use of smart cards for wi-fi user ident (fwd)
by Jim Choate 17 Jul '03

17 Jul '03

http://www.idg.net/ic_1326548_9720_1-5072.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

De-shredding the shreds
by Thomas Shaddack 17 Jul '03

17 Jul '03

Summary: Technology allows taking the "noodles" of shredded document, scanning them, and reconstructing the pages with various degrees of manual and automated effort. New approaches are necessary for high-security operations. Source: New York Times Author: Douglas Heingartner Title: Picking up the pieces URL: http://www.nytimes.com/2003/07/17/technology/circuits/17shre.html Highlight: Mr. Brassil's project at Hewlett Packard, aimed at tracing the source of shredded document by the micromarks on the shreds, both of vanilla shredders and by custom-modifying the shredders to leave a defined signature on the strips. http://www.hpl.hp.com/techreports/2002/HPL-2002-215.html (abstract) http://www.hpl.hp.com/techreports/2002/HPL-2002-215.pdf Full text: Picking Up the Pieces By DOUGLAS HEINGARTNER BERLIN -- THROUGHOUT the 1980's, Sascha Anderson, a poet, musician and literary impresario, was one of the leading voices to speak out against the East German government and its dreaded secret police, the Stasi. But his credibility gradually evaporated after the Communist government's collapse as rumors about him acquired the weight of proof: he had been informing on his dissident compatriots all along. He had been told that his Stasi file had been destroyed. In fact, it was manually reconstructed from some of the millions of shreds of paper that panicked Stasi officials threw into garbage bags during the regime's final days in the fall of 1989. Now, if all goes as planned by the German government, the remaining contents of those 16,000 bags will also be reconstructed. Advanced scanning technology makes it possible to reconstruct documents previously thought safe from prying eyes, sometimes even pages that have been ripped into confetti-size pieces. And although a great deal of sensitive information is stored digitally these days, recent corporate scandals have shown that the paper shredder is still very much in use. "People perceive it as an almost perfect device," said Jack Brassil, a researcher for Hewlett-Packard who has worked on making shredded documents traceable. If people put a document through a shredder, "they assume that it's fundamentally unrecoverable," he said. "And that's clearly not true." In its crudest form, the art of reconstructing shredded documents has been around for as long as shredders have. After the takeover of the United States Embassy in Tehran in 1979, Iranian captors laid pieces of documents on the floor, numbered each one and enlisted local carpet weavers to reconstruct them by hand, said Malcolm Byrne of the National Security Archive at George Washington University. "For a culture that's been tying 400 knots per inch for centuries, it wasn't that much of a challenge," he said. The reassembled documents were sold on the streets of Tehran for years. That episode helped convince the United States government to update its procedures for destroying documents. The expanded battery of techniques now includes pulping, pulverizing and chemically decomposing sensitive data. Yet these more complex methods are not always at hand in an emergency, which is why the vagaries of de-shredding will be of interest to intelligence officials for some time to come. "It's been an area of interest for a very long time," said William Daly, a former F.B.I. investigator who is a vice president at Control Risks Group, a security consulting firm. "The government is always trying to keep ahead of the curve." Like computer encryption and hacking, "it's kind of a cat-and-mouse game, keeping one step ahead," he said. "That's why the government is always looking at techniques to help them ensure their documents are destroyed properly." Modern image-processing technology has made the rebuilding job a lot easier. A Houston-based company, ChurchStreet Technology, already offers a reconstruction service for documents that have been conventionally strip-shredded into thin segments. The company's founder, Cody Ford, says that reports of document shredding in recent corporate scandals alerted him to a gap in the market. "Within three months of the Enron collapse at end of 2001, we had a service out to electronically reconstruct strip shreds," he said. The Stasi archives are a useful reference point for researchers tackling the challenge, though perhaps more for the scale than the sophistication of the shredding. Most of the Stasi papers were torn by hand because the flimsy East German shredding machines collapsed under the workload. The hastily stored bags of ripped paper were quickly discovered and confiscated. In 1995 the German government commissioned a team in the Bavarian town of Zirndorf to reassemble the torn Stasi files one by one. Yet by 2001, the three dozen archivists had gone through only about 300 bags, so officials began a search for another way to piece together the remaining 33 million pages a bit faster. Four companies remain candidates for the job, including Fraunhofer IPK of Berlin, part of the Fraunhofer Gesellschaft research institute, which helped develop the MP3 music format. The institute is drafting plans to sort, scan and archive the millions of pages within five years, drawing on expertise in office automation, image processing, biometrics and handwriting analysis as well as sophisticated software. "It's more than just the algorithms about the puzzles," said Bertram Nickolay, the head of the security and testing technologies department. Indeed, the archive is a massive grab bag of randomly torn documents, many with handwritten and typewritten text on the same page. Combining all these technologies in a project of this scope "is on the borders of what's possible," Mr. Nickolay said. His system's accuracy rate is about 80 percent. "It will take time for the algorithms to be optimized," Mr. Nickolay said, noting that handwriting analysis began with accuracy levels of around 50 percent, and are now at 90 percent and above. Some of the companies competing for the job concentrated on the shape, color and perforations of the shreds, while other contenders opted for semantically driven systems, which looked for keywords and likely text matches. The Fraunhofer plan is to combine its smart scanning software with the know-how of the Zirndorf archivists, who have amassed years of experience working with these tiny pieces of history. After all the shreds have been scanned (at 200 dots per inch), the interactive software will suggest possible matches, which an operator can accept or reject. While Fraunhofer IPK eventually plans to use a similar technique, several companies say they can do so already. ChurchStreet's software analyzes the graphical patterns that go to the edge of each piece. First, workers paste the random shreds onto standard sheets of paper, which takes three to seven minutes per page. The pages are scanned, and software analyzes the shreds for possible matches. Mr. Ford, the company founder, said the ChurchStreet service can recover up to 70 percent of a document's content, although he stressed that the goal was to get blocks of information rather than to re-create the original formatting. The blocks are presented to the client, who determines where they might belong in the overall scheme. "We don't make any guesswork about reconstruction," Mr. Ford said. "We make no assumptions." ChurchStreet, whose clients are mainly law agencies and private law firms, charges roughly $2,000 to reconstruct a cubic foot of strip-shreds. A cubic foot of shreds is generally less than 100 pages. Mr. Ford said ChurchStreet would soon offer a service to reconstruct cross-shredded documents - that is, those cut in two directions - for $8,000 to $10,000 per cubic foot. A common standard in cross-shredding is particles one thirty-second by seven-sixteenths of an inch, which results in thousands of grain-like shreds per page. Cross-shredding makes the job a lot trickier, but not for lack of processing power. "The problem is not whether it's possible with the software, which is possible," said Werner Vvgeli, the managing director of the German office of SER Solutions, a company in Dulles, Va., that also competed for the contract to reconstruct the Stasi documents. "The problem is how to scan these documents." Fred Cohen, a security consultant who reconstructed many pages while working at Sandia National Laboratories, also sees limits. "When you get down to very small shreds, then the numbers start to eat you," he said. "You start to get to where there isn't enough text per shred to be of any use. You've got a completely black shred; whether it's the middle of the cross of a t or the dot of an i, you can't tell." Adding to the challenge, the smaller the pieces are, the farther apart they can fall, and thus the less likely they are to cluster in a conveniently retrievable form. Security experts also say that using large type (for less text per shred), and feeding the paper into a shredder perpendicular to the direction of the text (so no complete phrases stay together) makes shredding less vulnerable. Professional document reconstructions are generally recognized by the courts in much the way that fingerprint or handwriting evidence is. An expert may not be able to vouch for the accuracy of the information on a given page, said Mr. Daly, the former F.B.I. investigator, but he can testify that a reconstructed document "was at one time one piece of paper that was cut into little pieces of paper, and now it's back into one piece of paper." Mr. Daly added that investigators often use reassembled pages as part of a larger forensic puzzle. "Once we have a hard-copy document, we can then go back and look at databases and put in search criteria, and to be able to actually come up with the original electronic version," he said. "One becomes a pathway to the other." The demand for such investigative services is clear. "I probably get a call every month," said Robert Johnson of the National Association for Information Destruction, an American trade group, from clients looking for "a way to reverse the process." Other projects, like Mr. Brassil's at Hewlett-Packard, focus on designing a shredder that leaves telltale traces on the documents it destroys, allowing them to be pinpointed later. In Germany, meanwhile, a decision about whether to proceed with the reconstruction of Stasi documents is not expected before September. Mr. Vvgeli of SER Solutions, whose firm withdrew from bidding for the project, said he doubted that financing would materialize. "These documents contain lots of information that might be dangerous to a few politicians who are still active, still in power," he said. "So there's no political majority for any such investment." Sascha Anderson, the dissident discredited by the files, is among those who hope the project goes forward. "Of course I would have preferred that they weren't found," he said by phone from Frankfurt. "But I realize that it's a unique chance for a society to have access to this information." And since he was exposed, he said, he has been able to sleep better: "I've ultimately been freed of my burden by history."

1 0

Optical Tempest? I have my doubts...
by Tyler Durden 17 Jul '03

17 Jul '03

I dunno...I'm thinking that optical tempest is probably bullshit 99% of the time, but what do I know? My Optical specialities are ultrafast and optical networking. But I still don't believe that specular reflection of smallish type from a monitor will have anything that is recoverable. Of course, this is going to be dependent on the quality of the wall material, but for most not-so-even plaster/drywall painted surfaces, I just can't believe the appopriate spacial frequencies of the image are not scattered after that kind of reflection. The conspiracy theorist is telling me there's some reason they floated the optical tempest story, though I can't quite figure out what that reason is... -TD >From: Peter Fairbrother <zenadsl6186(a)zen.co.uk> >To: <cypherpunks(a)lne.com> >Subject: Re: Security for Mafiosos and Freedom Fighters >Date: Thu, 17 Jul 2003 12:12:12 +0100 > >Bill Frantz wrote: > > > Ever since I heard that manufacturers were cleaning assembled boards >with > > soap and water I have wondered just how much you need to protect >electronic > > circuits from water. You obviously don't want to allow them to stay >damp > > so they corrode, but immersion for a time (up to weeks) followed by a >fresh > > water rinse and drying might not be so bad. Do any hardware experts >have > > an opinion? > >A long time ago I used to teach an "intro to computing" class. many >students >were older people who were afraid to physically touch a keyboard - partly >just because it was unfamiliar, because it meant they were actually, now, >starting on the road to learning, because they feared to "break something", >or because they thought they might get a shock (I kid you not). I digress. > >One way of making them feel more comfortable was to "accidently" spill a >drink on a keyboard, than immerse it in a sink, rinse, and hang out to dry. >Sometimes I used a hairdrier to reuse the keyboard during the lesson, but >mostly I just left it overnight to dry. That gave some at least of them >some >confidence that it was ok to touch the keyboard. > >I've also washed an iMac (which had fallen in the sea) by immersion in tap >water and careful drying, the CD needed more care (drying with IPA), I took >out the hard drive first and was careful with that, also cleaned all >connectors with solvent cleaner, but it worked ok afterwards. > ><peeve> >BTW, do NOT do this with crappy Apple keyboards! They are membrane-based >and >will be destroyed. They are also hard to open for repair, and when I asked >an Apple chap about them he said "You should never drink near a keyboard". >What crap! ></peeve> > >I give no guarantee that it won't destroy your keyboard, but it won't hurt >most keyboards. > >-- >Peter Fairbrother > > >BTW, m-o-o-t uses a randomised virtual keyboard with TEMPEST (both EM and >optical) resistant fonts. It's okay for inputting keys, but it's a hassle >for inputting text. > >Which means that your keys might be safe from keyloggers (both hardware and >software), but your plaintext isn't. Sigh. I'm trying to improve it by >putting the "senhorita" letters in one block and the rest elsewhere (not >for >key input obviously), and you do learn where the keys are after a while, >but >it's still a hassle. _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

3 2

1st amend: fiction != reality, words not kiddy pr0n
by Major Variola (ret.) 17 Jul '03

17 Jul '03

Appeals Court Dismisses Ohio Man's Guilty Plea in Obscenity Case Involving Fictitious Stories COLUMBUS, Ohio (AP) - A state appeals court on Thursday dismissed the guilty plea of a man imprisoned for writing fictitious stories of child torture and molestation. Lawyers specializing in the First Amendment believe Brian Dalton was the first person in the United States successfully prosecuted for child pornography that involved fictional writings, not images. The 10th Ohio District Court of Appeals in Columbus ruled that Dalton received ineffective legal assistance. Dalton had argued that his former lawyer didn't inform him of the legal implications of a guilty plea or ask for an immediate dismissal on First Amendment grounds. The 3-0 ruling sends the case back to Franklin County Common Pleas Court. Dalton could still be tried but prosecutors have not said whether they would seek to do so. Ray Vasvari, the American Civil Liberties Union's state legal director in Cleveland, called the decision an "important recognition for not only freedom of speech but freedom of thought." Dalton, 24, of Columbus, pleaded guilty in July 2001 to pandering obscenity involving a minor, which falls under Ohio's pornography law. He later asked to withdraw the plea so he could challenge the constitutionality of the law, but Franklin County Common Pleas Judge Nodine Miller refused. ACLU attorneys then appealed. Miller had sentenced Dalton to seven years, plus 4 1/2 years from a 1998 child pornography conviction on the grounds he violated probation by possessing the journal. The 14-page journal contained stories about three children - ages 10 and 11 - being caged in a basement, molested and tortured. Prosecutors acknowledged the stories were pure fiction. The journal was found by Dalton's probation officer during a routine search of his home. Dalton was charged under Ohio's 1989 child porn law, which bans possession of obscene material involving children. He was not charged under Ohio's obscenity law, which requires dissemination and not just possession. The appeals court found that Dalton's defense attorney, Isabella Dixon, misunderstood the two charges against her client. Both charges were based on the journal and involved fictitious events, the court found. Dixon, it said, had erroneously believed one of the charges was based on a letter Dalton wrote describing sexual molestation of a young cousin, a real person. "This misunderstanding was significant because of the important differences in the constitutional protections afforded the private possession of pornographic depictions of real children and similar depictions of fictional children," Judge William Klatt said, writing for the majority. A message was left with Dixon seeking comment. http://ap.tbo.com/ap/breaking/MGAQA2U49ID.html

1 0

RE: Optical Tempest? I have my doubts...
by Trei, Peter 17 Jul '03

17 Jul '03

> Durden[SMTP:camera_lumina@hotmail.com] wrote: > > I dunno...I'm thinking that optical tempest is probably bullshit 99% of > the > time, but what do I know? My Optical specialities are ultrafast and > optical > networking. > > But I still don't believe that specular reflection of smallish type from a > > monitor will have anything that is recoverable. Of course, this is going > to > be dependent on the quality of the wall material, but for most not-so-even > > plaster/drywall painted surfaces, I just can't believe the appopriate > spacial frequencies of the image are not scattered after that kind of > reflection. > > The conspiracy theorist is telling me there's some reason they floated the > > optical tempest story, though I can't quite figure out what that reason > is... > > -TD > > > > > >BTW, m-o-o-t uses a randomised virtual keyboard with TEMPEST (both EM and > >optical) resistant fonts. It's okay for inputting keys, but it's a hassle > >for inputting text. > > > >Which means that your keys might be safe from keyloggers (both hardware > and > >software), but your plaintext isn't. Sigh. I'm trying to improve it by > >putting the "senhorita" letters in one block and the rest elsewhere (not > >for > >key input obviously), and you do learn where the keys are after a while, > >but > >it's still a hassle. > Please don't top-post. Optical TEMPEST of the type we've been discussing has nothing to do with specular reflection. As your CRT screen is raster-scanned, the point at which the electron beam is pointing at any given moment is much brighter than the rest of the screen. That the screen seems uniformly illuminated is a result of your persistance of vision. Optical tempest records the brightness of the light reflecting off the wall behind the user as a function of time. This can be used to reconstruct the brightness of each pixel on the screen, since they are refreshed sequentially in raster order. Peter Trei

1 0