- cypherpunks-legacy - lists.cpunks.org

Re: Echelon-like...
by David Howe 10 Oct '02

10 Oct '02

"Trei, Peter" <ptrei(a)rsasecurity.com> wrote: > It was Sweden. They didn't really have an excuse - over a year earlier, > Lotus announced their "International" version with details of the "Work > Factor Reduction Field" at the RSA Conference. I immediately invented > the term 'espionage enabled' to describe this feature, a term which has > entered the crypto lexicon. Indeed so, yes - If my memory isn't failing me though, their "excuse" was that the lotus salesdroid they had awarded the contract to hadn't disclosed it to them in his bid and in fact, the original tender had specified *secure* encryption, not *secure, except for the american spy industry*. I don't know enough sweedish to even attempt a google on it though :)

1 0

Re: Echelon-like...
by David Howe 10 Oct '02

10 Oct '02

>> "I assume everyone knows the little arrangement that lotus >> reached with the NSA over its encrypted secure email?" > I'm new here, so do tell if I am wrong. Are you referring to the two levels > of Encryption available in Bogus Notes? More or less, yes. Lotus knew nobody would buy a 40 bit version of their crypto, so there is a two-level encryption all right, but not along those lines - in the export version, some of the session key is encrypted using a PKI "work reduction factor" key in the message header; this section of header is important, as lotus gateways won't accept messages that have had it disturbed. by decoding this block, the NSA have the actual keysize they need to block reduced to the legal export level of 40 bits; one government found this out *after* rolling it out to all their billing and contract negotiation departments... belgum or sweden by memory . Lotus thought it would be ok if only the NSA (and other US government orgs) could break the key, rather than letting everyone have an equal chance (and indeed, letting their customers know their crypto was still only 40 bit vs USA intel agencies) Still, even the domestic version was only 64 bits, which is painfully small even by the standards of the day. certainly, even "strong" lotus could have been crackable by the NSA, who after all own their own fab plant to make custom VLSI cracking chips.

1 0

Re: Echelon-like...
by Major Variola (ret) 10 Oct '02

10 Oct '02

Not only is EM correct, but: * many attacks are possible without worrying about keylength. Got Scarfo? * NIST/NSA picked the lamest AES. If I told you what "lame" meant, I'd have to kill you. * (Lack of) User motivation (related to man-machine issues) is still the spooks' best friend. As well as legacy systems, and inadequately designed total systems. Got Redmond? However, stego and decent opsec and cash and leo buffoonery still let you coordinate the occasional urban skyline reconstruction, poking holes in boats, etc. Got Dead Drops? Mr. Hanssen? Mr Ames? At 08:09 AM 10/10/02 -0700, Eric Murray wrote: >On Thu, Oct 10, 2002 at 02:28:26AM -0000, anonimo arancio wrote: >> The government knows exactly what it's doing. It wants to discourage the use of encryption by any means necessary, because of sheer numbers. >> Basically, the more messages that are encypted, the more hardware (and therefore $$$) will be needed to decrypt them. >> Therefore, the only way they can stay ahead of the game is to keep the numbers as low as possible, so they can continue to "outspend" the problem. >> This is, from their perspective, a perfectly reasonable approach to decrypting large numbers of messages, a small fraction of which may contain "interesting" information. >> >> Is the above statement a) wrong, b) obvious c) mentioned previously on the cypherpunks boards, or d)"hey! We never thought of that" > > >B and C, extensively. > >The US Government has pretty much given up on restricting crypto >exports. There is just enough of a vestigial restriction there to >maintain the illusion that the government has a right to control crypto >exports. If there was anything more, it would be challenged in court >and most likely get thrown out. The government backed off on >previous challenges (Bernstein, Zimmerman) to avoid that. > >Eric

1 0

Echelon-like...
by anonimo arancio 10 Oct '02

10 Oct '02

This relates to an issue I've wanted to discuss with "Cypherpunks" for several years. Over the years, I've seen several commentators (including Timothy May) appear suprised when discussing the US's encryption export policies. The basic argument is that, if good encryption is available overseas or easily downloadable, it doesn't make sense to make export of it illegal. On the surface this would seem a sensible argument. ANd, it would seem a purely beaureaucratic (I'm sure I spelled that wrong) error. But I am wondering if Cypherpunks have mentioned the 'obvious'. The government knows exactly what it's doing. It wants to discourage the use of encryption by any means necessary, because of sheer numbers. Basically, the more messages that are encypted, the more hardware (and therefore $$$) will be needed to decrypt them. Therefore, the only way they can stay ahead of the game is to keep the numbers as low as possible, so they can continue to "outspend" the problem. This is, from their perspective, a perfectly reasonable approach to decrypting large numbers of messages, a small fraction of which may contain "interesting" information. Is the above statement a) wrong, b) obvious c) mentioned previously on the cypherpunks boards, or d)"hey! We never thought of that"

3 2

xpics vvrng
by Anita 09 Oct '02

09 Oct '02

1 0

Trojan-modified Sendmail floating around - 8.12.6 - Since Sept. 28th or earlier.
by Bill Stewart 09 Oct '02

09 Oct '02

Somebody backdoored the source code for Sendmail on the official server. So if you recompile from scratch, your sendmail is 0wned. Another reason not to run mail systems as root.... http://rss.com.com/2100-1001-961311.html?type=pt&part=rss&tag=feed&subj=news By Robert Lemos Staff Writer, CNET News.com October 8, 2002, 5:57 PM PT Some copies of a popular mail-server program are implanted with a back door that could allow access to Internet attackers, security experts warned Tuesday. A Computer Emergency Response Team (CERT) Coordination Center advisory said that illicit code added to the Sendmail package creates a back door when the program is compiled from its source code. Such a compromised program--called a Trojan horse by security experts--can leave networks exposed to attack and administrators unaware of the vulnerabilities. The source code files of Sendmail 8.12.6 were apparently modified as far back as Sept. 28, according to the advisory. The Sendmail Consortium http://www.sendmail.org removed file transfer protocol (FTP) access to the server on Sunday. A safe version of the file can still be downloaded via the Web. "If you download the Sendmail distribution you MUST verify the PGP signature," stated the consortium on its site. "Do NOT use Sendmail without verifying the integrity of the source code." The added code links to a specific server on the Internet, said CERT in its advisory. The security group also recommends that anyone who downloads Sendmail verify the file's integrity. Because only the act of compiling the file activates the hostile program code, restarting the Sendmail server seems to deactivate the backdoor

3 2

(no subject)
by DR. GREG ODILI 09 Oct '02

09 Oct '02

>From the desk of: DR. GREG ODILI Email: (gregody(a)rediffmail.com & gregody(a)maktoob.com) Fax : 234-1-4401020 Lagos, Nigeria. Kindest attention , REQUEST FOR AN URGENT CONFIDENTIAL BUSINESS RELATIONSHIP After due deliberation with my colleagues, I have decided to forward to you this business proposal. We want a reliable person who could assist us to transfer the sum of Twenty Million Five Hundred Thousand United States Dollars ($20,500,000) into his / her account. This fund resulted from an over-invoiced bill from contracts awarded by us under the budget allocation to my Ministry and this bill has been approved for payment by the concerned authorities. The contract has since been executed, commissioned and the contractor was paid the actual cost of the contract. We are left with the balance US$20.5M as part of the over-invoiced amount which we have deliberately over estimated for our own use. But under our protocol division, civil servants are forbidden to operate or own foreign accounts. This is why I am contacting you to be our custodian for this fund. As you may want to know and to make you less curious, I got your address from a site in the internet that portrayed you (your establishment) in good light. I am the Chief Accountant/Internal Auditor of the Contract Award Committee (C.A.C.) of the Nigerian National Petroleum Corporation (NNPC). This transaction is very much free from all sorts of RISKS and TROUBLE from my Government. We the N.N.P.C. Officials involved in this deal have put in many years in service to this Ministry. We have been exercising patience for this opportunity for so long and to us, this is a life time opportunity we cannot afford to miss. You need not to worry about the responsibilities of transferring this fund into your account, because all the administrative step needed for the transfer of this fund into your designated bank account will be done by me. We have agreed to COMPENSATE you duly if agreement is reached by both of us. My colleague and I will come to your country to arrange for our share, upon the confirmation from you that the money has been credited into your nominated bank account. Consequent upon your acceptance of this proposal, kindly confirm your interest by sending me a revert email at the email account below (gregody(a)rediffmail.com & gregody(a)maktoob.com) Your indication by revert email to me of your sincere and serious interest will enable me send you the PROCEDURE FOR OPERATION. NOTE: In the event of your inability to handle this transaction please inform us so that we can look for another reliable person who can assist in this respect. It might surprise you why we choose you and trusted you for this transaction. Yes, we believe that good friends can be discovered and business like this can not be executed without trust. This is why we have decided to trust you for this transaction. We are looking forward to doing this transaction with you. Be further informed that everybodys interest and security had been considered before you were contacted, so be rest assured and feel free to go into this transaction with us. But let Honesty and Trust be our watchword throughout this transaction and your prompt reply will be highly appreciated. Thank you and God bless. Best Regards, DR. GREG ODILI. NB: If you want to send me an e-mail massage, please use the above listed e-mail address (gregody(a)rediffmail.com & gregody(a)maktoob.com) for confidential reasons.

1 0

Microsoft nixes TV copy protection
by Steve Schear 09 Oct '02

09 Oct '02

Microsoft nixes TV copy protection By Joe Wilcox Staff Writer, CNET News.com October 9, 2002, 9:19 AM PT Microsoft has bowed to consumer pressure and pulled back from a controversial plan that would have encrypted TV shows recorded on forthcoming digital media PCs. http://news.com.com/2100-1040-961376.html?tag=lh "War is just a racket ... something that is not what it seems to the majority of people. Only a small group knows what its about. It is conducted for the benefit of the very few at the expense of the masses." --- Major General Smedley Butler, 1933

1 0

Special $200 Discount on Home Study Courses
by PCDI 09 Oct '02

09 Oct '02

Learn a New Career, Earn Your Degree, or Finish High School at Home! FREE Home Study Career Information Kit If you'd like to train for a better career but don't think you have the time, think again. Now you can enjoy the convenience of self-paced home study, with nationally accredited Professional Career Development Institute. PCDI home study career diploma courses Paralegal Medical Transcription Teacher Assisting Veterinary Assisting Pharmacy Technology Child Day Care Look at our list of more than 40 courses At graduation, you'll receive your nationally accredited diploma. Click here for your FREE PCDI Career Information Kit. http://www.pcdi-homestudy.com/courses/?code=E84 Distance learning Associate's Degree programs Accounting Business Management Criminal Justice Paralegal Studies Health Care Management Computer Information Management Early Childhood Education At graduation, you'll get your nationally accredited diploma and your class ring! Click here to receive your FREE Ashworth College Catalog. http://www.ashworthcollege.com/academic/?code=E84 Earn your high school diploma at home Start where you left off, in the 9th - 12th grades Your exams are open-book Choose from 60 courses Receive class ring at graduation At graduation, you'll receive your nationally accredited diploma. Click here for your FREE James Madison High School Information Kit. http://www.jmhs.com/courses/?code=E84 Professional Career Development Institute ======================================================================================== Now Showing: PickYourFlick! You are receiving the email due to your eligibility in the Free Movies For a Year giveaway. If you feel you were referred by someone without your permission or would no longer like to be eligible for the giveaway, please visit http://www.PickYourFlick.com to remove yourself from the giveaway and these mailings. c&y&p&h&e&r&p&u&n&k&s&%m&i&n&d&e&r&~n&e&t&

1 0

��֪ͨ��
by zsyz 09 Oct '02

09 Oct '02

1 0