- cypherpunks-legacy - lists.cpunks.org

Re: Deniable Thumbdrive?
by Ben Laurie 26 Jan '03

26 Jan '03

Tyler Durden wrote: > I got a hold of a little gadget recently that is very nearly perfect for > certain forms of data storage. It's called a "Thumbdrive" and I bought > it online somewhere (64Meg for about $179 or so). > > The cool thing about this drive (small enough that it has holes for use > as a keychain) is that it's got a "Public" area and a private area, and > the private area is accessible (if one desires) only via the little > fingerprint reader on the top of the drive. (It's also USB based, and on > Windows2000 and beyond you don't need any software drivers--just plug it > in to a USB port and it appears as a drive). > > ANyway, I was wondering. I'd really like a nice software mod of this > thing so that, depending on which finger I use for verification, a > different private area on the drive will open (right now several users > can be assigned access by the master user to use their fingerprint for > access to the single private area). Of course, there should be no > indication that there even IS more than one private area. > > So...anyone heard of such a hack/mod, or is there a straightforward way > to go about doing it oneself? Nice! Get them to cut _all_ your fingers off instead of just one. Just say no to amputationware. Cheers, Ben. -- http://www.apache-ssl.org/ben.html http://www.thebunker.net/ "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

2 1

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

Re: DoD badly protected web form lets "users" administer .mil domain names.
by Declan McCullagh 26 Jan '03

26 Jan '03

On Fri, Jan 24, 2003 at 07:05:45PM -0800, Bill Stewart wrote: > A well-known non-US journalistic source reports: [...] > By Thomas C Greene in Washington The company may be incorporated overseas, but Thomas lives not that far up the street from me. I'm not sure what having an overseas HQ gains him if some of the Feds choose to pursue legal action (a very small chance, though, I'd wager). -Declan

1 0

Re: DoD badly protected web form lets "users" administer .mil domain names.
by Kevin S. Van Horn 25 Jan '03

25 Jan '03

>>Care to register a .mil Web site of your own for free? The DoD has gone out of its way to make it a snap. [...] >> >That's great. How about "kill-iraqis-regardless.mil" or "want-to-buy-some-oil-in-iraq.mil" or "we-lust-for-another-war.mil" > I think your aim is off here. It's the politicians and political appointees who are agitating for this war, not the career military. A lot of the top military leadership is against the idea of attacking Iraq, I suppose because they have a keener appreciation of just how dangerous, messy, and unpredictable war can be.

1 0

Re: thumdrive integrity --Deniable Thumbdrive?
by Thomas Shaddack 24 Jan '03

24 Jan '03

> WTF is the point of adding more biometric security to a device that > cannot and does not support data integrity? that flash memory held > within the thumbdrive keeps your data in clear text...unless of course > you store everything within some form of encrypted disk. even then, > the quick and dirty way to bypass the bio-security us to pull the card > out of the usb enclosure and start poking at the contents. DEFINITELY TRUE! Thumbdrive products are a good step in the right direction, but by far not long enough. Another approach is needed. The unit should be tamperproof, with more services than just a dumb mass storage device. The unit should contain a biometric sensor (eg, a fingerprint reader), a small keypad or other device to enter a PIN, and its own processor, for performing cryptographic operations. The device should support several operations for different PINs, and several PINs, which will allow several different private storage areas, different operations, and a special PIN for destruction of secure content and offering dummy content instead ("See officer? I told you there are no crypto keys there!"). The device should be able to keep audit log of operations. The device should store the data in encrypted form in the memory. The PIN could be part of the decryption key. The device should be able to handle the biometric reader output on its own, independently on the host computer. This architecture together with adherence to USB mass-storage standards would make us independent on any OS-specific drivers, making the device truly multiplatform. The device should be able to perform the encryption/decryption services on its own (hence the cryptographic CPU). Eg, you have an untrusted computer. You plug the device to its port, move a document from the untrusted machine to device's directory "Cleartext", authorize yourself to the device with fingerprint and PIN, select the "Encrypt" function (which can be done eg. by a suffix to the PIN). In few seconds, you should then find the encrypted document in the device's directory "Ciphertext". Similarly, the device should support write-only directory, to which you could write files freely but won't be able to retrieve them without authorization (this could allow using the device for data couriers who would be able to pick data but won't be able to read them along the way). Optionally, the unit could be usable for encryption/decryption of data streams, which would make it very useful for IP telephony. The key for crypto functions should never leave the unit. Attempt of physical compromising of the unit should result in self destruction of at least the part of the memory that keeps the keys (maybe keep them in battery-backed RAM, sealed in epoxide resin with both passive and active tamper-detection devices (including but not limited to thin wire mesh)? This way, even if the computer itself would get compromised, the only thing the adversary would be able to intercept would be the plaintexts used in the sessions with the compromised machine. Which they would be able to get using TEMPEST or a keylogger anyway. This design should be robust against hijacking of the key by eg. trojan horses.

3 3

RE: Deniable Thumbdrive?
by Tyler Durden 24 Jan '03

24 Jan '03

Peter Trei wrote... "What's you're threat model? If it's your wife or kid sister, this might work. If it's a major corporation or a government, forget it - they'll bitcopy the whole flash rom, and look at it with ease." At this point, most of my threat models are on this level or the next one higher--local cops or dumb goons grab a protestor or whatever and try to shake his photos and whatever digital else out of him..."OK punk, you're not calling a lawyer until you show me what's on this thing"..."Don't tell me nothing's in there I see a login prompt, ya' commie faggot...open it up." This could of course be done without the thumbprint (probably better), but I think that only when you get -really- dangerous do you have to worry about highly technical people who are informed of the latest info gadgets, and who would even know there are multiple private areas. As for the thumbprint, I'm wondering if other parts of the body could be used (then even very savvy rubberhosers couldn't just make you try every finger). I'll try using my, um, nose tonight. -TD _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

False Alarm
by Steve Schear 24 Jan '03

24 Jan '03

A device that appeared to be a bomb on a vehicle parked outside Simpson's Hardware and Sports on Wesmark Boulevard kept local and state authorities busy for nearly four hours Friday before the object was found to be a tracking system placed on the car by the driver's wife. http://www.theitem.com/CityDesk/030118a_news.cfm

1 0

RE: Deniable Thumbdrive? (and taking signal detection seriously)
by Major Variola (ret) 24 Jan '03

24 Jan '03

> From: "Tyler Durden" <camera_lumina(a)hotmail.com> > The cool thing about this drive (small enough that it has holes for use as a > keychain) is that it's got a "Public" area and a private area, and the > private area is accessible (if one desires) only via the little fingerprint > reader on the top of the drive. (It's also USB based, and on Windows2000 and > beyond you don't need any software drivers--just plug it in to a USB port > and it appears as a drive). > > ANyway, I was wondering. I'd really like a nice software mod of this thing > so that, depending on which finger I use for verification, a different > private area on the drive will open (right now several users can be assigned > access by the master user to use their fingerprint for access to the single > private area). Of course, there should be no indication that there even IS > more than one private area. 1. You should not rely on their encryption alone, you should use your own crypto on whatever you store there. You can carry your whole environment --incl. copies of tools, digsigs,and keyrings -- with you. You do, of course, have to trust the hardware/OS you use it with. "If you don't know the socket, keep your dongle in your pants" 2. If you use your 'nose' you need to borrow other noses to do a signal detection study ---tally hits, misses, false alarms, false positives. Then get back to us. We can even characterize and compare the performance of say human sentries this way; even measure their fatigue, perhaps. If the FAA/TSA has half a clue they've done this for their x-ray snoopers.

1 0