- cypherpunks-legacy - lists.cpunks.org

FREE $200 dollars to ALL VISITORS!
by flofest720＠yahoo.co.uk 22 Aug '01

22 Aug '01

How Would You Like $200 FREE? How Would You Like Others To Send YOU $20 CASH For LIFE? How Would you like to GET PAID by the MINUTE? Would you like this Money RIGHT NOW? For more info, Visit: http://www.magic-nj.com/powerads/suite37348 Best regards David Festus If this offends anyone, please forgive me. Further e-mails may be stopped by sending a reply to : flofest(a)esalesbroker.com with Remove in the subject line.

1 0

RE: Raid 'em, raid 'em now.
by Frog2 22 Aug '01

22 Aug '01

On Wed, Aug 22, 2001 at 08:46:19AM -0500, Aimee Farr wrote: > > On Tuesday, August 21, 2001, at 10:45 PM, Aimee Farr wrote: > > > > >> On Tue, 21 Aug 2001, Aimee Farr wrote: > > >>> spotlighted a tree around here, you would think it was Secret Squirrel > > >>> mating season. (If you know anything about raccoons and > > >> Crawford, Texas.) > > >>> > > >>> ~Aimee > > > > > >> I know raccoons like my garbage and are creative > > >> about getting to it. Does that tell me something > > >> about Crawford, Texas? > > >> MacN > > > > > > Uhm, no. The SS is very pro. And that is THE DETAIL. (As for me, I > > > figure > > > somebody can read my communication attributes. On second thought... > > > *ponder* > > > I think a keystroke logger would be a good thing for me.) Realize the > > > cultural differences. A bunch of highly-educated, clean-cut professional > > > agents breaking into a female's house around here... it could be that > > > some > > > women around here don't want to issue warrants -- they want to issue > > > invitations. > > > > > > I have an interest in VIP privacy problems, so I'm appalled by the > > > circus > > > and fanfare. I imagine they wanted some solitude -- what little they can > > > steal. I had a cabin in CLOSE proximity, and I didn't gawk once. All I > > > know: > > > I now have take-out prime rib down the road. > > > > ???? > > > > I can't make sense of _any_ of this. Do you _ever_ write clearly? > > > > --Tim May > > It went through some redaction. It gives rise to a form of elliptical > conversation. > > ~Aimee JYA may be obscure but you're just loony.

2 1

comp128
by Sa�d ABID 22 Aug '01

22 Aug '01

hi, me too, i'm searching executable of comp128, so plz if you have it, send it to me. Thank you a lot ______________________________________________________ Boîte aux lettres - Caramail - http://www.caramail.com

1 0

CFP: Financial Cryptography '02 (fwd)
by Jim Choate 22 Aug '01

22 Aug '01

1 0

Timing Analysis of Keystrokes and Timing Attacks on SSH (fwd)
by Eugene Leitl 22 Aug '01

22 Aug '01

-- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: 22 Aug 2001 11:37:39 -0400 From: Perry E. Metzger <perry(a)piermont.com> To: cryptography(a)wasabisystems.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH What I find really neat here is that up until now, serious traffic analysis has been fairly neglected in the open crypto community. Is this the start of things to come? ------- Start of forwarded message ------- Date: Wed, 22 Aug 2001 08:53:30 -0600 From: aleph1(a)securityfocus.com To: secpapers(a)securityfocus.com Cc: secureshell(a)securityfocus.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH Message-ID: <20010822085330.J3366(a)securityfocus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Timing Analysis of Keystrokes and Timing Attacks on SSH Dawn Xiaodong Song, David Wagner, Xuqing Tian University of California, Berkeley SSH is designed to provide a security channel between two hosts. Despite the encryption and authentication mechanisms it uses, SSH has two weakness: First, the transmitted packets are padded only to an eight-byte boundary (if a block cipher is in use), which reveals the approximate size of the original data. Second, in interactive mode, every individual keystroke that a user types is sent to the remote machine in a separate IP packet immediately after the key is pressed, which leaks the interkeystroke timing information of users' typing. In this paper, we show how these seemingly minor weaknesses result in serious security risks. First we show that even very simply statistical techniques suffice to reveal sensitive information such as the length of users' passwords or even root passwords. More importantly, we further show that using more advanced statistical techniques on timing information collected from the network, the eavesdropped can learn significant information about what users type in SSH sessions. In particular, we perform a statistical study of users' typing patterns and show that these patterns reveal information about the keys typed. By developing a Hidden Markov Model and our key sequence prediction algorithm, we can predict key sequences from the interkeystroke timings. We further develop and attacker system, Herbivore, which tried to learn users' passwords by monitoring SSH sessions. By collecting timing information on the network, Herbivore can speed up exhaustive search for passwords by a factor of 50. We also propose some countermeasures. In general our results apply not only to SSH, but also to general class of protocols for encrypting interactive traffic. We show that timing leaks open a new set of security risks, and hence caution must be taken when designing this type of protocol. http://paris.cs.berkeley.edu/~dawnsong/papers/ssh-timing.pdf - Elias Levy SecurityFocus http://www.securityfocus.com/ Si vis pacem, para bellum --------------------------------------------------------------------- To unsubscribe, e-mail: secureshell-unsubscribe(a)securityfocus.com For additional commands, e-mail: secureshell-help(a)securityfocus.com ------- End of forwarded message ------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: travel confirmation 17388
by mikeedso＠bemybabey.com 22 Aug '01

22 Aug '01

1 0

Raid 'em, raid 'em now.
by Aimee Farr 22 Aug '01

22 Aug '01

> At 06:02 PM 8/20/01 -0700, John Young wrote: > >Come to think of it Aimee's reminds of Jeff, and the timing > >is pretty good for another raid. > > > >Hark, wipe your disks. Mors et vita in manibus lingue. This terroristic defamation isn't funny, considering where I reside. If you spotlighted a tree around here, you would think it was Secret Squirrel mating season. (If you know anything about raccoons and Crawford, Texas.) ~Aimee

4 6

IP: Wired: Wireless Networks in Big Trouble (fwd)
by Eugene Leitl 22 Aug '01

22 Aug '01

-- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Wed, 22 Aug 2001 05:04:54 -0700 From: David Farber <dave(a)farber.net> Reply-To: farber(a)cis.upenn.edu To: ip-sub-1(a)majordomo.pobox.com Subject: IP: Wired: Wireless Networks in Big Trouble >Date: Tue, 21 Aug 2001 00:41:11 -0700 >From: "Robert J. Berger" <rberger(a)ultradevices.com> >Organization: UltraDevices Inc. > >Wireless Networks in Big Trouble >By Michelle Delio >http://www.wired.com/news/wireless/0,1382,46187,00.html >2:20 p.m. Aug. 20, 2001 PDT > >Wireless networks are a little less secure today with the public >release of "AirSnort," (http://airsnort.sourceforge.net/) >a tool that can surreptitiously grab and analyze data moving across >just about every major wireless network. > >When enough information has been captured, AirSnort can then piece >together the system's master password. > >In other words, hackers and/or eavesdroppers using AirSnort can just >grab what they want from a company's database wirelessly, out of thin >air. > >AirSnort's abilities aren't groundbreaking -- security experts know >all too well that wireless networks can be easily accessed and >monitored by outsiders. But a fully featured tool to facilitate >password-grabs wasn't readily available until this past weekend, when >AirSnort was released on the Internet. > >"AirSnort certainly ups the ante in the sense that with this tool, >your 'encrypted wireless net' can be quickly and easily breached," >said Randy Sandone of Argus, a security company. > >"Once AirSnort breaks the encryption, you're basically hosed. A >malicious hacker can read any packet traveling over the network, >gather information, passwords -- you name it." > >Wireless networks transmit information over public airwaves, the same >medium used by television, radio and cell phones. The networks are >supposed to be protected by a built-in security feature, the Wired >Equivalent Privacy system (WEP) -- also known as the 802.11b standard >-- which encrypts data as it is transmitted. > >But WEP/802.11b has proved to be quite crackable. And that's exactly >why AirSnort was publicly released, said AirSnort programmers Jeremy >Bruestle and Blake Hegerle. They hope that AirSnort will prove once >and for all that wireless networks protected only by WEP are not >secure. > >"Yes, AirSnort can be used as a cracking tool, but it can also be used >as a really big stick in an argument over the safety of WEP," Hegerle >said. > >"We felt that the only proper thing to do was to release the project," >Bruestle said. "It is not obvious to the layman or the average >administrator how vulnerable 802.11b is to attack. It's too easy to >trust WEP. Honestly, there is a lot of work involved in hardening a >wireless network. It's easy to be complacent. AirSnort is all about >opening people's eyes." > >Added Sandone: "Perhaps its release will prompt wireless vendors to >significantly enhance the encryption of their products. And hopefully >users will come to understand that encryption (regardless of how it is >used) is not a panacea." > >"Some people overhype the power of encryption, and others put too much >faith in its 'mathematical precision.' It clearly has its value, but >it shouldn't be the only security mechanism in use." > >"Weaknesses in the Key Scheduling Algorithm of RC4," a recently >published paper by Scott Fluhrer, Itsik Mantin and Adi Shamir, >outlined a way to learn the master key to the WEP encryption system, >which would allow an intruder to pose as a legitimate user of the >network. > >Adam Stubblefield, a Rice University undergraduate who was working as >a summer intern at AT&T Labs, tested that exploit (with the permission >of the network's administrator) and was able to pull up the network's >master password in just under two hours. > >Stubblefield published his research on the Internet, but did not >release the program he used to access AT&T's wireless network. > >If the software that he wrote to grab passwords were published, >Stubblefield told a reporter from The New York Times, anyone with a >basic knowledge of computers and a wireless network card could easily >crack many wireless networks. > >"Basically I read the paper and wondered if the attack would actually >work in the real world, and how hard it would be to implement," >Bruestle said. "I am the CEO of a small security firm, Cypher42, and I >wanted to know just how difficult or easy it would be to implement the >attack, so we could properly advise clients on 802.11b security." > >Another tool, WEPcrack, was released on the Internet around the same >time as AirSnort, but WEPcrack is still considered an alpha release, a >work in progress. > >Bruestle and Hegerle's AirSnort is a beta release, a designation that >indicates a program is not quite ready for primetime, but is further >along feature and stability-wise than alpha. > >Bruestle said he and Hegerle had a basic working version of AirSnort >after less than 24 hours of programming time. > >Bruestle said he has received many e-mails about AirSnort, some in >favor of the public release of the tool, others accusing him of adding >to the malicious hackers' arsenal. > >"Many of the people who have e-mailed me about AirSnort are sysadmins >who thanked me for giving them a way to convince management that WEP >really is insecure," Bruestle said. "Of course, I have gotten a number >of flame mails too, comparing the release of AirSnort to 'giving guns >to children.' I understand the viewpoint of those who believe >dangerous information should be hidden, but I disagree." > >Hegerle and Bruestle said that they believe that many people did not >understand the academic nature of Fluhrer, Mantin and Shamir's paper, >and may not understand how vulnerable wireless systems are. > >"It was beyond even my humble attempts to understand (the paper's) >full depths," Bruestle said. "The implications of a tool like AirSnort >are much harder to deny than the paper it was based on." > >AirSnort uses a completely passive attack: An AirSnort user needs only >a Linux-operated computer with a wireless network card, and access to >whatever wireless network he or she wishes to crack. > >Many wireless networks allow amazingly easy access to unauthorized >users, as some have discovered when their laptops suddenly connect to >the Internet when they are in or near a building that has a wireless >network. > >"I've been able to connect to networks when standing outside of >businesses, hospitals or Internet cafés that offer the service," said >Mark Denon, a freelance technology writer. > >"You can jump in and use the network to send e-mail or surf the Net, >and often it's quite possible to access whatever information is moving >across the network. It's very easy to piggyback onto many wireless >networks, and some people make a game of driving or walking around a >city and seeing how many networks they can jump into." > >"A wireless card in the machine that's running AirSnort does not send >out any data or actually talk with any of the other machines on the >network," said Hegerle. "It simply listens to all the other traffic, >so it doesn't matter if the network allows unauthorized access, as >none of the other machines on the network will even know anyone is >listening," said Hegerle. > >The amount of time required to piece together a password with AirSnort >depends on a number of factors, Bruestle said, but mostly depends on >the amount of network traffic and "luck." > >"On a highly saturated network, AirSnort can usually collect enough >packets to guess the key in three or four hours. If the network is >very low traffic, it can take days to get enough data," Bruestle >said. "Since the attack is based on probability, the actual number of >packets required to guess a given key varies from key to key, >sometimes significantly." > >AirSnort monitoring does not have to be all done in one session, >though. "Five hours one day and five the next works out to be about >the same as 10 hours in a row," Bruestle said. > >Systems administrators have mixed reactions over the release of >AirSnort. > >"Granted, this program will hammer the truth into people's heads about >the insecure nature of any wireless network protected only by WEP," >said Gerry Kaufman, a medical network and systems consultant. "But >releasing this tool also allows a lot of people access to networks who >couldn't have cracked them before. I'm really torn between advocating >open access to information, and keeping tools like AirSnort out of the >hands of kids with too much free time on their hands." > >Kaufman said the "only good thing" that could come from AirSnort's >release is its use for proving to "those who approve the expenditures" >that wireless networks need stronger protection. > >Hegerle and Bruestle suggest that wireless network users look into >other end-to-end forms of encryption, such as Virtual Private Networks >(VPNs) to protect data going over wireless networks. > >"While this requires more work, the false sense of security WEP offers >is worse than no security at all," Bruestle said. > >"Quite simply, I won't be happy until there are no people trusting >their data to WEP as it now exists," Hegerle said. "There are several >possible ways to change WEP, and I would like to see a new dialog >begin, one that looks for a replacement to the badly designed WEP we >are now stuck with." > >Under development are new versions of WEP/802.11b that will include >stronger security features. But the new standards won't be released >until mid-2002 at the earliest. > >-- >Robert J. Berger >UltraDevices, Inc. >257 Castro Street, Suite 223 Mt. View CA. 94041 >Voice: 408-882-4755 Fax: 408-490-2868 >Email: rberger(a)ultradevices.com http://www.ultradevices.com For archives see: http://www.interesting-people.org/

1 0

credit card number
by stevan wijaya 22 Aug '01

22 Aug '01

i need valid credit card number,please!! __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/

1 0

Now Available - FilterSim Version 2.0
by Gareth Jones 22 Aug '01

22 Aug '01

SYSTOLIX HAVE RELEASED FILTERSIM VERION 2.0 - INTEGRATED FILTER DESIGN, SIMULATION AND ANALYSIS A fully working trial version of FilterSim 2.0 can be downloaded now from Systolix web site at http://www.systolix.com/swdownload.htm. FilterSim is the latest DSP development tool from Systolix. It combines a sophisticated multi-stage filter design tool with an integrated digital simulator. Simulation results can be viewed using the built-in signal viewer and analysis tools, allowing designers to study filter characteristics and quantisation effects in detail. Version 2.0 is a complete rewrite of the tool, it includes a new simplified user interface to streamline the process of specifying complex multi-stage filters. Here is a summary of the key features, more information can be found at http://www.systolix.com/fsintro.htm. * FILTER SPECIFICATION & DESIGN * Import externally generated FIR / IIR coefficients for analysis / re-quantisation Design filters to user specified quantisation Export coefficients Simple graphical entry of filter networks - Support of multi-stage (FIR / IIR / mixed) - Support for multi-rate filters (decimating / interpolating / resampling) - Support for multiple levels of quantisation in a single network Support for multiple filter types including IIR Filters - Butterworth / Chebychev I-II / Elliptic - Low Pass / High Pass / Band Pass / Band Stop Windowed FIR Filters - Kaiser / Blackman / Von Hann / Hamming / Rectangular - Low Pass / High Pass / Band Pass / Band Stop Equiripple FIR filters - Low Pass / High Pass / Band Pass / Band Stop Half-Band FIR Filters (Window & Equiripple) Pulse-shaping Filters - Raised Cosine / Root Raised Cosine / Gaussian Hilbert Transforms * FILTER SIMULATION * Extensive simulation capabilities including - Fast, optimised simulation engine - Built in signal generation functions - Import user test data - User definable quantisation for coefficients and data - Define unique quantisation per stage * FILTER ANALYSIS * Powerful analysis capabilities including - Graphical view of magnitude/phase/impulse response - Built-in FFT - Graphical viewer for simulation/FFT data - Automatic system transfer function evaluation - Automatic calculation of SNR / THD For further enquires about FilterSim please email filtersim(a)systolix.co.uk.

1 0