- cypherpunks-legacy - lists.cpunks.org

CRYPTO-GRAM, April 15, 2006
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM April 15, 2006 by Bruce Schneier Founder and CTO Counterpane Internet Security, Inc. schneier(a)counterpane.com http://www.schneier.com http://www.counterpane.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-0604.html>. These same essays appear in the "Schneier on Security" blog: <http://www.schneier.com/blog>. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Movie-Plot Threat Contest Airport Passenger Screening 80 Cameras for 2,400 People Crypto-Gram Reprints VOIP Encryption Security through Begging DHS Privacy and Integrity Report News KittenAuth Terrorism Risks of Google Earth New Kind of Door Lock Counterpane News Evading Copyright Through XOR iJacking Security Screening for New York Helicopters Comments from Readers ** *** ***** ******* *********** ************* Movie-Plot Threat Contest NOTE: If you have a blog, please spread the word. For a while now, I have been writing about our penchant for "movie-plot threats": terrorist fears based on very specific attack scenarios. Terrorists with crop dusters, terrorists exploding baby carriages in subways, terrorists filling school buses with explosives -- these are all movie-plot threats. They're good for scaring people, but it's just silly to build national security policy around them. But if we're going to worry about unlikely attacks, why can't they be exciting and innovative ones? If Americans are going to be scared, shouldn't they be scared of things that are really scary? "Blowing up the Super Bowl" is a movie plot to be sure, but it's not a very good movie. Let's kick this up a notch. It is in this spirit I announce the (possibly First) Movie-Plot Threat Contest. Entrants are invited to submit the most unlikely, yet still plausible, terrorist attack scenarios they can come up with. Your goal: cause terror. Make the American people notice. Inflict lasting damage on the U.S. economy. Change the political landscape, or the culture. The more grandiose the goal, the better. Assume an attacker profile on the order of 9/11: 20 to 30 unskilled people, and about $500,000 with which to buy skills, equipment, etc. Post your movie plots here on this blog. Judging will be by me, swayed by popular acclaim in the blog comments section. The prize will be an autographed copy of Beyond Fear. And if I can swing it, a phone call with a real live movie producer. Entries close at the end of the month -- April 30. This is not an April Fool's joke, although it's in the spirit of the season. The purpose of this contest is absurd humor, but I hope it also makes a point. Terrorism is a real threat, but we're not any safer through security measures that require us to correctly guess what the terrorists are going to do next. Good luck. Post your entries, and read the others, here: http://www.schneier.com/blog/archives/2006/04/announcing_movi.html Movie-plot threats: http://www.schneier.com/essay-087.html http://www.time.com/time/nation/article/0,8599,175951,00.html http://www.schneier.com/blog/archives/2005/10/exploding_baby.html http://www.schneier.com/blog/archives/2006/02/school_bus_driv.html http://www.imdb.com/title/tt0075765 There are hundreds of ideas here: http://cockeyed.com/citizen/terror/plans/terrorwatch.html ** *** ***** ******* *********** ************* Airport Passenger Screening It seems like every time someone tests airport security, airport security fails. In tests between November 2001 and February 2002, screeners missed 70 percent of knives, 30 percent of guns, and 60 percent of (fake) bombs. And recently, testers were able to smuggle bomb-making parts through airport security in 21 of 21 attempts. It makes you wonder why we're all putting our laptops in a separate bin and taking off our shoes. (Although we should all be glad that Richard Reid wasn't the "underwear bomber.") The failure to detect bomb-making parts is easier to understand. Break up something into small enough parts, and it's going to slip past the screeners pretty easily. The explosive material won't show up on the metal detector, and the associated electronics can look benign when disassembled. This isn't even a new problem. It's widely believed that the Chechen women who blew up the two Russian planes in August 2004 probably smuggled their bombs aboard the planes in pieces. But guns and knives? That surprises most people. Airport screeners have a difficult job, primarily because the human brain isn't naturally adapted to the task. We're wired for visual pattern matching, and are great at picking out something we know to look for -- for example, a lion in a sea of tall grass. But we're much less adept at detecting random exceptions in uniform data. Faced with an endless stream of identical objects, the brain quickly concludes that everything is identical and there's no point in paying attention. By the time the exception comes around, the brain simply doesn't notice it. This psychological phenomenon isn't just a problem in airport screening: It's been identified in inspections of all kinds, and is why casinos move their dealers around so often. The tasks are simply mind-numbing. To make matters worse, the smuggler can try to exploit the system. He can position the weapons in his baggage just so. He can try to disguise them by adding other metal items to distract the screeners. He can disassemble bomb parts so they look nothing like bombs. Against a bored screener, he has the upper hand. And, as has been pointed out again and again in essays on the ludicrousness of post-9/11 airport security, improvised weapons are a huge problem. A rock, a battery for a laptop, a belt, the extension handle off a wheeled suitcase, fishing line, the bare hands of someone who knows karate...the list goes on and on. Technology can help. X-ray machines already randomly insert "test" bags into the stream -- keeping screeners more alert. Computer-enhanced displays are making it easier for screeners to find contraband items in luggage, and eventually the computers will be able to do most of the work. It makes sense: Computers excel at boring repetitive tasks. They should do the quick sort, and let the screeners deal with the exceptions. Sure, there'll be a lot of false alarms, and some bad things will still get through. But it's better than the alternative. And it's likely good enough. Remember the point of passenger screening. We're not trying to catch the clever, organized, well-funded terrorists. We're trying to catch the amateurs and the incompetent. We're trying to catch the unstable. We're trying to catch the copycats. These are all legitimate threats, and we're smart to defend against them. Against the professionals, we're just trying to add enough uncertainty into the system that they'll choose other targets instead. The terrorists' goals have nothing to do with airplanes; their goals are to cause terror. Blowing up an airplane is just a particular attack designed to achieve that goal. Airplanes deserve some additional security because they have catastrophic failure properties: If there's even a small explosion, everyone on the plane dies. But there's a diminishing return on investments in airplane security. If the terrorists switch targets from airplanes to shopping malls, we haven't really solved the problem. What that means is that a basic cursory screening is good enough. If I were investing in security, I would fund significant research into computer-assisted screening equipment for both checked and carry-on bags, but wouldn't spend a lot of money on invasive screening procedures and secondary screening. I would much rather have well-trained security personnel wandering around the airport, both in and out of uniform, looking for suspicious actions. When I travel in Europe, I never have to take my laptop out of its case or my shoes off my feet. Those governments have had far more experience with terrorism than the U.S. government, and they know when passenger screening has reached the point of diminishing returns. (They also implemented checked-baggage security measures decades before the United States did -- again recognizing the real threat.) And if I were investing in security, I would invest in intelligence and investigation. The best time to combat terrorism is before the terrorist tries to get on an airplane. The best countermeasures have value regardless of the nature of the terrorist plot or the particular terrorist target. In some ways, if we're relying on airport screeners to prevent terrorism, it's already too late. After all, we can't keep weapons out of prisons. How can we ever hope to keep them out of airports? http://archives.cnn.com/2002/US/03/25/airport.security/ http://www.msnbc.msn.com/id/11863165/ http://www.msnbc.msn.com/id/11878391/ A version of this essay originally appeared on Wired.com. http://www.wired.com/news/columns/0,70470-0.html ** *** ***** ******* *********** ************* 80 Cameras for 2,400 People The remote town of Dillingham, Alaska is probably the most watched town in the country. There are 80 surveillance cameras for the 2,400 people, which translates to one camera for every 30 people. The cameras were bought, I assume, because the town couldn't think of anything else to do with the $202,000 Homeland Security grant they received. (One of the problems of giving this money out based on political agenda, rather than by where the actual threats are.) But they got the money, and they spent it. And now they have to justify the expense. Here's the movie-plot threat the Dillingham Police Chief uses to explain why the expense was worthwhile: "'Russia is about 800 miles that way,' he says, arm extending right. "'Seattle is about 1,200 miles back that way.' He points behind him. "'So if I have the math right, we're closer to Russia than we are to Seattle.' "Now imagine, he says: What if the bad guys, whoever they are, manage to obtain a nuclear device in Russia, where some weapons are believed to be poorly guarded. They put the device in a container and then hire organized criminals, 'maybe Mafiosi,' to arrange a tramp steamer to pick it up. The steamer drops off the container at the Dillingham harbor, complete with forged paperwork to ship it to Seattle. The container is picked up by a barge. "'Ten days later,' the chief says, 'the barge pulls into the Port of Seattle.' "Thompson pauses for effect. "'Phoooom," he says, his hands blooming like a flower." The first problem with the movie plot is that it's just plain silly. But the second problem, which you might have to look back to notice, is that those 80 cameras will do nothing to stop his imagined attack. We are all security consumers. We spend money, and we expect security in return. This expenditure was a waste of money, and as a U.S. taxpayer, I am pissed that I'm getting such a lousy deal. http://www.latimes.com/news/nationworld/nation/la-na-secure28mar28,0,275 8659,full.story or http://tinyurl.com/ocfan ** *** ***** ******* *********** ************* Crypto-Gram Reprints Crypto-Gram is currently in its ninth year of publication. Back issues cover a variety of security-related topics, and can all be found on <http://www.schneier.com/crypto-gram-back.html>. These are a selection of articles that appeared in this calendar month in other years. Mitigating Identity Theft: http://www.schneier.com/crypto-gram-0504.html#2 Hacking the Papal Election: http://www.schneier.com/crypto-gram-0504.html#8 National ID Cards: http://www.schneier.com/crypto-gram-0404.html#1 Stealing an Election: http://www.schneier.com/crypto-gram-0404.html#4 Automated Denial-of-Service Attacks Using the U.S. Post Office: http://www.schneier.com/crypto-gram-0304.html#1 National Crime Information Center (NCIC) Database Accuracy: http://www.schneier.com/crypto-gram-0304.html#7 How to Think About Security: http://www.schneier.com/crypto-gram-0204.html#1 Is 1028 Bits Enough? http://www.schneier.com/crypto-gram-0204.html#3 Liability and Security http://www.schneier.com/crypto-gram-0204.html#6 Natural Advantages of Defense: What Military History Can Teach Network Security, Part 1 http://www.schneier.com/crypto-gram-0104.html#1 UCITA: http://www.schneier.com/crypto-gram-0004.html#ucita Cryptography: The Importance of Not Being Different: http://www.schneier.com/crypto-gram-9904.html#different Threats Against Smart Cards: http://www.schneier.com/crypto-gram-9904.html#smartcards Attacking Certificates with Computer Viruses: http://www.schneier.com/crypto-gram-9904.html#certificates ** *** ***** ******* *********** ************* VOIP Encryption There are basically four ways to eavesdrop on a telephone call. One, you can listen in on another phone extension. This is the method preferred by siblings everywhere. If you have the right access, it's the easiest. While it doesn't work for cell phones, cordless phones are vulnerable to a variant of this attack: A radio receiver set to the right frequency can act as another extension. Two, you can attach some eavesdropping equipment to the wire with a pair of alligator clips. It takes some expertise, but you can do it anywhere along the phone line's path -- even outside the home. This used to be the way the police eavesdropped on your phone line. These days it's probably most often used by criminals. This method doesn't work for cell phones, either. Three, you can eavesdrop at the telephone switch. Modern phone equipment includes the ability for someone to listen in this way. Currently, this is the preferred police method. It works for both land lines and cell phones. You need the right access, but if you can get it, this is probably the most comfortable way to eavesdrop on a particular person. Four, you can tap the main trunk lines, eavesdrop on the microwave or satellite phone links, etc. It's hard to eavesdrop on one particular person this way, but it's easy to listen in on a large chunk of telephone calls. This is the sort of big-budget surveillance that organizations like the National Security Agency do best. They've even been known to use submarines to tap undersea phone cables. That's basically the entire threat model for traditional phone calls. And when most people think about IP telephony -- voice over internet protocol, or VOIP -- that's the threat model they probably have in their heads. Unfortunately, phone calls from your computer are fundamentally different from phone calls from your telephone. Internet telephony's threat model is much closer to the threat model for IP-networked computers than the threat model for telephony. And we already know the threat model for IP. Data packets can be eavesdropped on *anywhere* along the transmission path. Data packets can be intercepted in the corporate network, by the internet service provider and along the backbone. They can be eavesdropped on by the people or organizations that own those computers, and they can be eavesdropped on by anyone who has successfully hacked into those computers. They can be vacuumed up by nosy hackers, criminals, competitors and governments. It's comparable to threat No. 3 above, but with the scope vastly expanded. My greatest worry is the criminal attacks. We already have seen how clever criminals have become over the past several years at stealing account information and personal data. I can imagine them eavesdropping on attorneys, looking for information with which to blackmail people. I can imagine them eavesdropping on bankers, looking for inside information with which to make stock purchases. I can imagine them stealing account information, hijacking telephone calls, committing identity theft. On the business side, I can see them engaging in industrial espionage and stealing trade secrets. In short, I can imagine them doing all the things they could never have done with the traditional telephone network. This is why encryption for VOIP is so important. VOIP calls are vulnerable to a variety of threats that traditional telephone calls are not. Encryption is one of the essential security technologies for computer data, and it will go a long way toward securing VOIP. The last time this sort of thing came up, the U.S. government tried to sell us something called "key escrow." Basically, the government likes the idea of everyone using encryption, as long as it has a copy of the key. This is an amazingly insecure idea for a number of reasons, mostly boiling down to the fact that when you provide a means of access into a security system, you greatly weaken its security. A recent case in Greece demonstrated that perfectly: Criminals used a cell-phone eavesdropping mechanism already in place, designed for the police to listen in on phone calls. Had the call system been designed to be secure in the first place, there never would have been a backdoor for the criminals to exploit. Fortunately, there are many VOIP-encryption products available. Skype has built-in encryption. Phil Zimmermann is releasing Zfone, an easy-to-use open-source product. There's even a VOIP Security Alliance. Encryption for IP telephony is important, but it's not a panacea. Basically, it takes care of threats No. 2 through No. 4, but not threat No. 1. Unfortunately, that's the biggest threat: eavesdropping at the end points. No amount of IP telephony encryption can prevent a Trojan or worm on your computer -- or just a hacker who managed to get access to your machine -- from eavesdropping on your phone calls, just as no amount of SSL or e-mail encryption can prevent a Trojan on your computer from eavesdropping -- or even modifying -- your data. So, as always, it boils down to this: We need secure computers and secure operating systems even more than we need secure transmission. Why key escrow is a bad idea: http://www.schneier.com/paper-key-escrow.html Greek wiretapping story: http://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html Zfone: http://www.philzimmermann.com/EN/zfone/index.html http://www.wired.com/news/technology/0,70524-0.html VOIP Security Alliance: http://www.voipsa.org/ This essay originally appeared on Wired.com. http://www.wired.com/news/columns/1,70591-0.html ** *** ***** ******* *********** ************* Security through Begging >From TechDirt: "Last summer, the surprising news came out that Japanese nuclear secrets leaked out, after a contractor was allowed to connect his personal virus-infested computer to the network at a nuclear power plant. The contractor had a file sharing app on his laptop as well, and suddenly nuclear secrets were available to plenty of kids just trying to download the latest hit single. It's only taken about nine months for the government to come up with its suggestion on how to prevent future leaks of this nature: begging all Japanese citizens not to use file sharing systems -- so that the next time this happens, there won't be anyone on the network to download such documents." Even if their begging works, it solves the wrong problem. Sad. Article: http://techdirt.com/articles/20060316/0052241.shtml Original article: http://www.techdirt.com/articles/20050623/0251255.shtml Government suggestion: http://mdn.mainichi-msn.co.jp/national/news/20060315p2a00m0na017000c.htm l or http://tinyurl.com/pejx2 Another article: http://www.latimes.com/news/nationworld/world/la-fg-computer21mar21,0,51 59274.story or http://tinyurl.com/fmvlb ** *** ***** ******* *********** ************* DHS Privacy and Integrity Report Last year, the Department of Homeland Security finally got around to appointing its DHS Data Privacy and Integrity Advisory Committee. It was mostly made up of industry insiders instead of anyone with any real privacy experience. (Lance Hoffman from George Washington University was the most notable exception.) And now, we have something from that committee. On March 7th they published their Framework for Privacy Analysis of Programs, Technologies, and Applications. It's surprisingly good. I like that it is a series of questions a program manager has to answer: about the legal basis for the program, its efficacy against the threat, and its effects on privacy. I am particularly pleased that their questions on pages 3-4 are very similar to the "five steps" I wrote about in Beyond Fear. I am thrilled that the document takes a "trade-off" approach; the last question asks: "Should the program proceed? Do the benefits of the program...justify the costs to privacy interests....?" I think this is a good starting place for any technology or program with respect to security and privacy. And I hope the DHS actually follows the recommendations in this report. Committee: http://www.dhs.gov/dhspublic/interapp/editorial/editorial_0512.xml http://www.dhs.gov/dhspublic/interapp/editorial/editorial_0598.xml Framework for Privacy Analysis of Programs, Technologies, and Applications http://www.privacilla.org/releases/DHS_Privacy_Framework.pdf My five steps: http://www.schneier.com/crypto-gram-0204.html#1 ** *** ***** ******* *********** ************* News Of course RFID chips can carry viruses. They're just little computers. http://arstechnica.com/news.ars/post/20060315-6386.html I thought the attack vector was interesting: a Trojan RFID attacks the central database, rather than attacking other RFID chips directly. Metaphorically, it's a lot closer to biological viruses, because it actually requires the more powerful host to be subverted, and there's no way an infected tag can propagate directly to another tag. The coverage is more than a tad sensationalist, though. http://www.computerworld.com/mobiletopics/mobile/story/0,10801,109560,00 .html or http://tinyurl.com/mwz88 Movie theaters want to jam cell phones. http://www.mobiletracker.net/archives/2006/03/15/movie-theater-jamming http://www.csmonitor.com/2006/0324/p11s01-almo.html Massive surveillance in an online gaming world. http://terranova.blogs.com/terra_nova/2006/03/confessions_of_.html Yossi Oren and Adi Shamir have written a paper describing a power attack against RFID tags. This is great work by Yossi Oren and Adi Shamir. From the abstract: "Power Analysis of RFID Tags: Compared to standard power analysis attacks, this attack is unique in that it requires no physical contact with the device under attack. While the specific attack described here requires the attacker to actually transmit data to the tag under attack, the power analysis part itself requires only a receive antenna. This means that a variant of this attack can be devised such that the attacker is completely passive while it is acquiring the data, making the attack very hard to detect." My prediction of the industry's response: downplay the results and pretend it's not a problem. http://www.wisdom.weizmann.ac.il/%7Eyossio/rfid/ The 3rd Annual Nigerian E-mail Conference. Funny. http://j-walk.com/other/conf/index.htm The chairman of Qantas was stopped at airport security. She had airplane blueprints. Oh, and she was a woman -- which cast immediate suspicion on her story. http://www.aero-news.net/Community/DiscussTopic.cfm?TopicID=2648&Refresh=1 Really good article by a reporter who has been covering improvised explosive devices in Iraq: http://www.defensetech.org/archives/002238.html There are some deliberately fake 300, 600, and 1000 euro notes being made in Germany as an advertisement. They're being passed as real: http://www.ananova.com/news/story/sm_1760580.html This is why security is so hard: people. Really interesting article by Robert X. Cringely on the lack of federal funding for security technologies. I think his analysis is dead on. http://www.pbs.org/cringely/pulpit/pulpit20060309.html Australian bank fraud: I really wish this article had more details about the crime. Basically, a criminal ring used an authentication failure with fax transmissions to steal (unsuccessfully, as it turned out) $150 million Australian dollars. http://www.smh.com.au/articles/2006/03/17/1142582520870.html Rare outbreak of security common sense in London. They're rejecting passenger screening in their subways. http://www.kablenet.com/kd.nsf/Frontpage/85C58F53F411521180257132005EF49 F?OpenDocument or http://tinyurl.com/nrmpr Who needs terrorists? We can cause terror all by ourselves. http://www.postgazette.com/pg/06081/674773.stm The story is about a huge security overreaction because some worker in a downtown building was using a pellet gun to scare pigeons. "Terrorist with Nuke" movie plot. It sounds like this New Scientist writer is trying to write a novel. http://archinect.com/news/article.php?id=35501_0_24_15_M Enigma? I don't know what this is, but it sure looks a lot like an Enigma. And it's beautiful. http://www.tatjavanvark.nl/tvv1/pht10.html A couple -- living together, I assume -- and engaged to be married shared a computer. He used Firefox to visit a bunch of dating sites, being smart enough not to have the browser save his password. But Firefox did save the names of the sites it was told never to save the password for. She happened to stumble on this list. The details are left to the imagination, but they broke up. https://bugzilla.mozilla.org/show_bug.cgi?id=330884 Most interesting bug report I've ever read. Creative Home Engineering can make secret doors and hidden passageways for your home. "Pull a favorite book from your library shelf and watch a cabinet section recess to reveal a hidden passageway. Twist a candlestick and your fireplace rotates, granting access to a hidden room." Who cares about the security properties? I want one. http://www.hiddenpassageway.com/ Encryption using quasars: http://www.theinquirer.net/?article=30553 http://www.schneier.com/blog/archives/2006/03/quasar_encrypti.html A hacker working for al Qaeda, called Irhabi 007, has been captured. Assuming the British authorities are to be believed, he definitely was a terrorist. And he used the Internet, both as a communication tool and to break into networks. But this does not make him a cyberterrorist. http://www.washingtonpost.com/wp-dyn/content/article/2006/03/25/AR200603 2500020.html or http://tinyurl.com/rtlda http://it.slashdot.org/article.pl?sid=06/03/26/0530206 The police used profiles on MySpace to identify six suspects in a rape/robbery. http://www.cnn.com/2006/US/03/25/my.space.ap/index.html Chameleon weapons: you can't detect them, because they look normal: http://www.defensetech.org/archives/002265.html An Economic Analysis of Airport Security Screening. The authors use game theory to investigate the optimal screening policy, in a scenario when there are different social groups (separated by felons, race, religion, etc.) with different preferences for crime and/or terrorism. http://www.econ.upenn.edu/~persico/research/Papers/airportaea11.pdf Cubicle Farms are a Terrorism Risk The British security service MI5 is warning business leaders that their offices are probably badly designed against terrorist bombs. The common modern office consists of large rooms without internal walls, which puts employees at greater risk in the event of terrorist bombs. http://news.scotsman.com/index.cfm?id=419082006 I don't know if this "Internet Hash Project" is an April Fool's Day joke, but it's funny all the same. http://www.nethash.org/ Last month the Government Accounting Office released three new reports on homeland security. "Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System." http://www.gao.gov/cgi-bin/getrpt?GAO-06-591T Highlights: http://www.gao.gov/highlights/d06591thigh.pdf "Homeland Security: The Status of Strategic Planning in the National Capital Region." http://www.gao.gov/cgi-bin/getrpt?GAO-06-559T Highlights: http://www.gao.gov/highlights/d06559thigh.pdf "Homeland Security: Progress Continues, but Challenges Remain on Department's Management of Information Technology." http://www.gao.gov/cgi-bin/getrpt?GAO-06-598T Highlights: http://www.gao.gov/highlights/d06598thigh.pdf It's a really clever idea: bolts and latches that fasten and unfasten in response to remote computer commands. But the security comment is funny: "But everything is locked down with codes, and the radio signals are scrambled, so this is fully secured against hackers." Clearly this guy knows nothing about computer security. http://www.chicagotribune.com/business/chi-0603300225mar30,1,7805363.sto ry or http://tinyurl.com/rtoxc http://it.slashdot.org/article.pl?sid=06/04/03/0624225 Interesting paper on phishing, and why it works. http://www.deas.harvard.edu/~rachna/papers/why_phishing_works.pdf Undercover investigators were able to smuggle radioactive materials into the U.S. It set off alarms at border checkpoints, but the smugglers had forged import licenses from the Nuclear Regulatory Commission, based on an image of the real document they found on the Internet. Unfortunately, the border agents had no way to confirm the validity of import licenses. I've written about this problem before, and it's one I think will get worse in the future. Verification systems are often the weakest link of authentication. Improving authentication tokens won't improve security unless the verification systems improve as well. http://www-tech.mit.edu/V125/N1/long4_1.1w.html http://www.schneier.com/blog/archives/2006/01/forged_credenti.html Security applications of time-reversed acoustics. I simply don't have the science to evaluate this. http://www.physorg.com/news12093.html Iowa lawmakers are proposing "I'm Not the Criminal You're Looking For" card, for victims of identity theft. I think it's a great idea, and it reminds me of something I wrote about in Beyond Fear: "In Singapore, some names are so common that the police issue He's-not-the-guy-we're-looking-for documents exonerating innocent people with the same names as wanted criminals." It's not perfect. Of course it will be forged; all documents are forged. This is a still good idea, even though it's not perfect. http://news.com.com/Iowa+proposes+ID+theft+passport/2100-7348_3-6052308. html or http://tinyurl.com/qq8dj Good information from EPIC on the security of tax data in the IRS. http://www.epic.org/privacy/surveillance/spotlight/0306/ A man in the UK was detained for singing along with a Clash song. Basically, his taxi driver turned him in. http://today.reuters.co.uk/news/newsArticle.aspx?type=entertainmentNews& storyID=2006-04-05T134826Z_01_L05785309_RTRUKOC_0_UK-CLASH.xml or http://tinyurl.com/e6nr6 http://news.bbc.co.uk/1/hi/england/4879918.stm I was in New York earlier this month, and I saw a sign at the entrance to the Midtown Tunnel that said: "See something? Say something." The problem with a nation of amateur spies is that it results in these sorts of results. "I know he's a terrorist because he's dressing funny and he always has white wires hanging out of his pocket." "They all talk in a funny language and their cooking smells bad." Amateur spies perform amateur spying. If everybody does it, the false alarms will overwhelm the police. You've all heard of the "No Fly List." Did you know that there's a "No-Buy List" as well? http://www.washingtonpost.com/wp-dyn/content/article/2006/04/08/AR200604 0800157.html or http://tinyurl.com/ofz2y The list: http://www.ustreas.gov/offices/enforcement/ofac/sdn/t11sdn.pdf Last week the San Francisco Chronicle broke the story that Air Force One's defenses were exposed on a public Internet site: http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2006/04/08/MNGESI5U6C1. DTL&hw=Air+Force+One&sn=002&sc=217 or http://tinyurl.com/pbro5 http://www.sfgate.com/cgi-bin/article.cgi?file=/c/a/2006/04/11/MNGK3I7A6 41.DTL or http://tinyurl.com/r46g7 Despite all the breathless reporting, turns out this is no big deal: http://www.defensetech.org/archives/002315.html The Air Force removed the document, but I'm not sure it didn't do more harm than good. Another news report: http://www.upi.com/NewsTrack/view.php?StoryID=20060411-013024-5870r Several conservative blogs criticized the Chronicle for publishing this, because it gives the terrorists more information. I think they should be criticized for publishing this, because there's no story here. Much of the document is here. http://cryptome.org/af1-rescue.htm Stolen military goods are being sold in the markets in Afghanistan, including hard drives filled with classified data. http://www.latimes.com/news/nationworld/world/la-fg-disks10apr10,0,58549 05,full.story or http://tinyurl.com/nhzgz http://www.npr.org/templates/story/story.php?storyId=5338506 What if your vendor won't sell you a security upgrade? Good article: http://www.networkworld.com/columnists/2006/041006snyder.html Really nice social engineering example. Watch an escaped convict convince a police officer he's not that guy. Note his repeated efforts to ensure that if he's stopped again, he can rely on the cop to vouch for him. http://www.salon.com/ent/video_dog/media/2006/04/10/escaped_murderer/ind ex.html or http://tinyurl.com/nv6u2 Intersting technical details about NSA's warrantless surveillance, and AT&T's help: http://www.wired.com/news/technology/1,70619-0.html http://dailykos.com/storyonly/2006/4/8/14724/28476/ http://amygdalagf.blogspot.com/2006/04/hepting-vs.html ** *** ***** ******* *********** ************* KittenAuth You've all seen CAPTCHAs. Those are those distorted pictures of letters and numbers you sometimes see on web forms. The idea is that it's hard for computers to identify the characters, but easy for people to do. The goal of CAPTCHAs is to authenticate that there's a person sitting in front of the computer. KittenAuth works with images. The system shows you nine pictures of cute little animals, and the person authenticates himself by clicking on the three kittens. A computer clicking at random has only a 1 in 84 chance of guessing correctly. Of course you could increase the security by adding more images or requiring the person to choose more images. Another worry -- which I didn't see mentioned -- is that the computer could brute-force a static database. If there are only a small fixed number of actual kittens, the computer could be told -- by a person -- that they're kittens. Then, the computer would know that whenever it sees that image it's a kitten. Still, it's an interesting idea that warrants more research. KittenAuth: http://www.thepcspy.com/articles/security/the_cutest_humantest_kittenaut h or http://tinyurl.com/o2585 CAPTCHAs: http://en.wikipedia.org/wiki/Captcha ** *** ***** ******* *********** ************* Terrorism Risks of Google Earth Sometimes I wonder about "security experts." Here's one who thinks Google Earth is a terrorism risk because it allows people to learn the GPS coordinates of soccer stadiums. Basically, Klaus Dieter Matschke is worried because Google Earth provides the location of buildings within 20 meters, whereas before coordinates had an error range of one kilometer. He's worried that this information will provide terrorists with the exact target coordinates for missile attacks. I have no idea how anyone could print this drivel. Anyone can attend a football game with a GPS receiver in his pocket and get the coordinates down to one meter. Or buy a map. Google Earth is not the problem; the problem is the availability of short-range missiles on the black market. http://www.heise.de/newsticker/meldung/71784 English blog entry on the topic: http://www.ministryofpropaganda.co.uk/2006propaganda/20060409-googleeart h.shtml or http://tinyurl.com/lpay3 ** *** ***** ******* *********** ************* New Kind of Door Lock There's a new kind of door lock from the Israeli company E-Lock. It responds to sound. Instead of carrying a key, you carry a small device that makes a series of quick knocking sounds. Just touching it to the door causes the door to open; there's no keyhole. The device, called a "KnocKey," has a keypad and can be programmed to require a PIN before operation -- for even greater security. Clever idea, but there's the usual security hyperbole: "Since there is no keyhole or contact point on the door, this unique mechanism offers a significantly higher level of security than existing technology." More accurate would be to say that the security vulnerabilities are different from existing technology. We know a lot about the vulnerabilities of conventional locks, but we know very little about the security of this system. But don't confuse this lack of knowledge with increased security. http://www.elock.co.il/tech-english.asp ** *** ***** ******* *********** ************* Counterpane News Bruce Schneier is speaking at the Symposium on Business Information Security, on April 21 in Minneapolis: https://www.minneapolis.edu/sobis/files_pdf/SoBIS2006-Flyer.pdf Bruce Schneier is speaking at CardTech/SecureTech, on May 3rd, in San Francisco. http://www.ctst.com/conferences/CTST06/ Bruce Schneier and Toby Weir-Jones spoke at the InfoWorld Webcast entitled Managed Compliance Reporting: Best Practices to Streamline Device Management & Demonstrate Compliance. Rebroadcast is available. http://w.on24.com/r.htm?e=21082&s=1&k=9A69DBFE212400FB9B547D40A596F856&p artnerref=CIS1 or http://tinyurl.com/lzxab Counterpane is hiring. Among other things, we're looking for a database and systems analyst, a senior Java software engineer, and a SOC intelligence officer. http://www.counterpane.com/jobs.html ** *** ***** ******* *********** ************* Evading Copyright Through XOR Monolith is an open-source program that can XOR two files together to create a third file, and -- of course -- can XOR that third file with one of the original two to create the other original file. The website wonders about the copyright implications of all of this: "Things get interesting when you apply Monolith to copyrighted files. For example, munging two copyrighted files will produce a completely new file that, in most cases, contains no information from either file. In other words, the resulting Mono file is not "owned" by the original copyright holders (if owned at all, it would be owned by the person who did the munging). Given that the Mono file can be combined with either of the original, copyrighted files to reconstruct the other copyrighted file, this lack of Mono ownership may be seem hard to believe." The website then postulates this as a mechanism to get around copyright law: "What does this mean? This means that Mono files can be freely distributed. "So what? Mono files are useless without their corresponding Basis files, right? And the Basis files are copyrighted too, so they cannot be freely distributed, right? There is one more twist to this idea. What happens when we use Basis files that are freely distributable? For example, we could use a Basis file that is in the public domain or one that is licensed for free distribution. Now we are getting somewhere. "None of the aforementioned properties of Mono files change when we use freely distributable Basis files, since the same arguments hold. Mono files are still not copyrighted by the people who hold the copyrights over the corresponding Element files. Now we can freely distribute Mono files and Basis files. "Interesting? Not really. But what you can do with these files, in the privacy of your own home, might be interesting, depending on your proclivities. For example, you can use the Mono files and the Basis files to reconstruct the Element files." Clever, but it won't hold up in court. In general, technical hair splitting is not an effective way to get around the law. My guess is that anyone who distributes that third file -- they call it a "Mono" file -- along with instructions on how to recover the copyrighted file is going to be found guilty of copyright violation. The correct way to solve this problem is through law, not technology. http://monolith.sourceforge.net/ ** *** ***** ******* *********** ************* iJacking It's called iJacking: grabbing laptops out of their owners' hands and then run away. There seems to be a wave of this type of crime at Internet cafes in San Francisco. It's obvious why these thefts are occurring. Laptops are valuable, easy to steal, and easy to fence. If we want to "solve" this problem, we need to modify at least one of those characteristics. Some Internet cafes are providing locking cables for their patrons, in an attempt to make them harder to steal. But that will only mean that the muggers will follow their victims out of the cafes. Laptops will become less valuable over time, but that really isn't a good solution. The only thing left is to make them harder to fence. This isn't an easy problem. There are a bunch of companies that make solutions that help people recover stolen laptops. There are programs that "phone home" if a laptop is stolen. There are programs that hide a serial number on the hard drive somewhere. There are non-removable tags users can affix to their computers with ID information. But until this kind of thing becomes common, the crimes will continue. Reminds me of the problem of bicycle thefts. http://www.sfbg.com/40/25/news_ijacked.html ** *** ***** ******* *********** ************* Security Screening for New York Helicopters There's a helicopter shuttle that runs from Lower Manhattan to Kennedy Airport. It's basically a luxury item: for $139 you can avoid the drive to the airport. But, of course, security screeners are required for passengers, and that's causing some concern: "At the request of U.S. Helicopter's executives, the federal Transportation Security Administration set up a checkpoint, with X-ray and bomb-detection machines, to screen passengers and their luggage at the heliport. "The security agency is spending $560,000 this year to operate the checkpoint with a staff of eight screeners and is considering adding a checkpoint at the heliport at the east end of 34th Street. The agency's involvement has drawn criticism from some elected officials. "'The bottom line here is that there are not enough screeners to go around, ' said Senator Charles E. Schumer, Democrat of New York. 'The fact that we are taking screeners that are needed at airports to satisfy a luxury market on the government's dime is a problem. '" This is not a security problem; it's an economics problem. And it's a good illustration of the concept of "externalities." An externality is an effect of a decision not borne by the decision-maker. In this example, U.S. Helicopter made a business decision to offer this service at a certain price. And customers will make a decision about whether or not the service is worth the money. But there is more to the cost than the $139. The cost of that checkpoint is an externality to both U.S. Helicopter and its customers, because the $560,000 spent on the security checkpoint is paid for by taxpayers. Taxpayers are effectively subsidizing the true cost of the helicopter trip. The only way to solve this is for the government to bill the airline passengers for the cost of security screening. It wouldn't be much per ticket, maybe $15. And it would be much less at major airports, because the economies of scale are so much greater. The article even points out that customers would gladly pay the extra $15 because of another externality: the people who decide whether or not to take the helicopter trip are not the people actually paying for it. "Bobby Weiss, a self-employed stock trader and real estate broker who was U.S. Helicopter's first paying customer yesterday, said he would pay $300 for a round trip to Kennedy, and he expected most corporate executives would, too. "'It's $300, but so what? It goes on the expense account, ' said Mr. Weiss, adding that he had no qualms about the diversion of federal resources to smooth the path of highfliers. 'Maybe a richer guy may save a little time at the expense of a poorer guy who spends a little more time in line. '" What Mr. Weiss is saying is that the costs -- both the direct cost and the cost of the security checkpoint -- are externalities to him, so he really doesn't care. Exactly. http://www.nytimes.com/2006/02/06/nyregion/06chopper.html?ex=1296882000& en=1e835454a0fea1c9&ei=5088&partner=rssnyt&emc=rss or http://tinyurl.com/lebvf ** *** ***** ******* *********** ************* Comments from Readers There are hundreds of comments -- many of them interesting -- on these topics on my blog. Search for the story you want to comment on, and join in. http://www.schneier.com/blog ** *** ***** ******* *********** ************* CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Comments on CRYPTO-GRAM should be sent to schneier(a)counterpane.com. Permission to print comments is assumed unless otherwise stated. Comments may be edited for length and clarity. Please feel free to forward CRYPTO-GRAM to colleagues and friends who will find it valuable. Permission is granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish and Twofish algorithms. He is founder and CTO of Counterpane Internet Security Inc., and is a member of the Advisory Board of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Counterpane is the world's leading protector of networked information - the inventor of outsourced security monitoring and the foremost authority on effective mitigation of emerging IT threats. Counterpane protects networks for Fortune 1000 companies and governments world-wide. See <http://www.counterpane.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of Counterpane Internet Security, Inc. Copyright (c) 2006 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [CYBERIA] Liability of phone companies [perhaps off-topic]
by John Young 06 Jul '18

06 Jul '18

L(a)LISTSERV.AOL.COM> One type of activity NSA needs to trace above all else, perhaps more than military threats, are financial transactions, and it is these types most fiercely protected against government access, whether business to business, person to person, org to org, and most especially financial op to financial op, the latter not limited to regulated banks. And no type of enterprise has the resources to giver NSA a run for its money in long-time, maybe forever, in concealing where the money is and where it is going and so the struggle goes between the two biggest consumers of comsec products, hardware and talent, along with and outpouring of dire threats and assured security. Deception in financial transcriptions is a given, as with spying, no matter the huge effort to trace them by the revenuers, competitors, and governmental and private spies. Off the radar, off the grid, off the earth, financial transactions worldwide are larger and more resourceful than all the governments combined. It is far easier to track military developments than where the money flows or is stashed or obscured by encryption and false tracking data. The steady promulgations of DoJ and the slew of financial crimes task forces indicate the visible tip of the iceberg; what is exceedingly hard to penetrate is the underside side of it. To be sure, if it was admitted that NSA was most interested in tracing financial transaction data, say to hand over to IRS, FBI and Justice, that might scare Americans, particularly American businesses with global customers good and evil, more than diddly-squat mining of phone data (although some of the consumer chatter might reveal clues about lesser known ways to transfer money, say, coded signals sent to order what to do for who). If NSA was to be confirme as a money cop far more adept and armed than IRS and FBI the wealth flight to more lenient havens might shake the foundations of democracy far more than knowing who is calling who. It was not for a petty protection of US Persons that NSA was formerly banned from telling other parts of the government what it was collecting. That was the consumer cover story. Wonderfully strange about the dramatic increase of FBI investigation of official corruption following the dropping of the ban on sharing intel data. Whether any of that was part of the flood of NSA data the FBI bitched about being worthless is thrilling to consider. If the PATRIOT Act leads to cleaning up government and business that would be justice. In contrast, other nations are deeply concerned, as with Echelon, that using the terrorist rationale NSA has boosted its collection financial data on business, persons and governments, pushing the frightened toward US financial sanctuary, while public attention is diverted with wails about invasion of personal privacy -- which to these nations means nothing more important than financial secrecy about cheating, lying, robbing, sweetheart government contracts, evasion of taxes. With the Swiss armtwisted into ratting on its banking customers, where can an evildoer or goodheart find a trusworthy ATM which does not databank everyone. We learned today of the Journalist Visa required by the US from one who has just come here from Italy, more restrictive than for an ordinary citizen on a visit. With this prejudicial practice the US joins the select freedom of speech rascals Russia and China. Is that special visa legit, and if so, what regulates the practice to demonize the press as if spies. ********************************************************************** For Listserv Instructions, see http://www.lawlists.net/cyberia Off-Topic threads: http://www.lawlists.net/mailman/listinfo/cyberia-ot Need more help? Send mail to: Cyberia-L-Request(a)listserv.aol.com ********************************************************************** ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Liability of phone companies [perhaps off-topic]
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [liberationtech] Fwd: [hackerdojo] DARPA Funding for Hackerspaces: Good or Evil?
by Moritz Bartl 06 Jul '18

06 Jul '18

On 06.12.2011 06:48, Yosem Companys wrote: > Interesting coincidence that while liberationtech was talking about > funding and net activism, the hacker spaces (e.g., Noisebridge, > HackerDojo, etc.) have been having a similar discussion... In my opinion, the best statement regarding DARPA funding for hackerspaces was made by Mitch Altman on the hackerspaces.org list: Let me quote it here in full: ---- snip ---- My view is a bit different. You don't have to agree, but please consider: DARPA is a government agency that exists to further its goals. It seems to me that those goals are to make things easier and better for hurting and killing other people. It seems to me that this is why they exist. If people working for DARPA are giving grant money away, it is to further the goals of DARPA. This isn't to say that good things can't be done with DARPA money. But DARPA is spending this money explicitly to further the goals of DARPA -- and it *will* be used to further those goals. Werner von Braun was an incredible visionary. He wanted to explore space! It was his lifelong dream. He found an opportunity for funding his dream when Hitler offered to pay for him to make rockets. Those rockets were used to destroy the lives of civilians in London in the form of V2 missiles. After the war, he was eventually hired by NASA to make rockets that eventually became the basis of the US space program. Was this a good trade off? I know how I feel. I don't want to tell others what to do, or what to think or feel. Please make up your own mind. In my mind, I would rather change projects than hurt others in order to fulfill the goals of my project. But, before changing projects, perhaps there are other means of funding it, or allowing the project to proceed. Those other means are way worth exploring. One other point I feel is worth considering: A powerful method of marketing is to associate PRODUCT X with a warm and fuzzy feeling. Repeat that enough times, and enough people subconsciously associate a warm-fuzzy feeling with PRODUCT X, and sales of PRODUCT X go up some percentage. PRODUCT X can be dish soap, a soft drink, a TV show, a political candidate, a banana republic dictator, green-washing corporate image -- anything the people paying for the marketing request. PRODUCT X can also be DARPA. If we make more warm and fuzzy associations with DARPA (by using their money for what we feel is *good*), then some people will more likely feel it is OK to work for an agency to further the goals of DARPA -- and those goals may not be in line with what you believe is of true benefit to you and those around you. Or it may. Again, please think this through for yourself. And please make a conscious choice. Best, Mitch. ---- snip ---- http://lists.hackerspaces.org/pipermail/discuss/2011-December/005189.html -- Moritz Bartl https://www.torservers.net/ _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CALEA options for a small ISP/ITSP
by Matthew Crocker 06 Jul '18

06 Jul '18

I have a CALEA appliance from BearHill that I 'rent'. It has been in my network for years. I'm looking for other alternative solutions for CALEA compliance with a small ISP. It looks like OpenCalea is a dead project. What is everyone else using? My current solution is $1k/month and I rarely get subpoenas, I've never had a wiretap one. My ISP network is a mix of Cisco and Juniper gear. I have a couple GigE connections to my upstreams and push 300-400mbps through the network. I would think that wireshark pcap files would be enough :( Thanks -Matt -- Matthew S. Crocker President Crocker Communications, Inc. PO BOX 710 Greenfield, MA 01302-0710 E: matthew(a)crocker.com P: (413) 746-2760 F: (413) 746-3704 W: http://www.crocker.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Tor and HTTPS graphic
by grarpamp 06 Jul '18

06 Jul '18

> I think that it is important to differentiate national security > and law enforcement here. Yes. They are two separate camps. Who now more regularly talk with each other to varying degrees, both in the office, and in the pub. It's likely only a legal question as to what tools either may use. Then saying, 'hey, we have this program', seems not a big deal. > yet FBI is apparently unable to locate members of pedophile > networks who use Tor Based on 4+ year old methods up against a first time case. What were the lessons learned? What gaps are being filled? > National security agencies, on the other hand, have to think about > the "big picture", and would not put their methods of work in > danger of disclosure Of course. That's why I put out possible examples that would only utilize publicly known methods. There are no secrets in anonbib. > or indulge in otherwise risky behavior (routing tricks and the > like, which can be discovered by regular employees). Secret projects have secret nets with secret admins... http://en.wikipedia.org/wiki/Joint_Worldwide_Intelligence_Communications_Sy… I'm not really suggesting that any such global or national all seeing system is in place. Only that given budgets and current tech, the odds are surely not zero on some of the scenarios. Particularly concerning results available even with limited visibility. Such as running both a HS and an entry node that a user happens to use. Or running enough nodes that having an interesting circuit transit all three/six is less than a rare occurance. Scaling Note: If the network needs to scale, such as keeping nodes very busy but not saturated, non-exit relay by default (NE-RBD) could be metered out by way of a client self enabling it (or whatever other scale factor) based on the client's/relay's own fingerprint. Whether driven by release or net consensus: 0-9a-g = on, h-z = off _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Tor and HTTPS graphic
by grarpamp 06 Jul '18

06 Jul '18

> I think that it is important to differentiate national security > and law enforcement here. Yes. They are two separate camps. Who now more regularly talk with each other to varying degrees, both in the office, and in the pub. It's likely only a legal question as to what tools either may use. Then saying, 'hey, we have this program', seems not a big deal. > yet FBI is apparently unable to locate members of pedophile > networks who use Tor Based on 4+ year old methods up against a first time case. What were the lessons learned? What gaps are being filled? > National security agencies, on the other hand, have to think about > the "big picture", and would not put their methods of work in > danger of disclosure Of course. That's why I put out possible examples that would only utilize publicly known methods. There are no secrets in anonbib. > or indulge in otherwise risky behavior (routing tricks and the > like, which can be discovered by regular employees). Secret projects have secret nets with secret admins... http://en.wikipedia.org/wiki/Joint_Worldwide_Intelligence_Communications_Sy… I'm not really suggesting that any such global or national all seeing system is in place. Only that given budgets and current tech, the odds are surely not zero on some of the scenarios. Particularly concerning results available even with limited visibility. Such as running both a HS and an entry node that a user happens to use. Or running enough nodes that having an interesting circuit transit all three/six is less than a rare occurance. Scaling Note: If the network needs to scale, such as keeping nodes very busy but not saturated, non-exit relay by default (NE-RBD) could be metered out by way of a client self enabling it (or whatever other scale factor) based on the client's/relay's own fingerprint. Whether driven by release or net consensus: 0-9a-g = on, h-z = off _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Reduced latency transport for TOR
by Gregory Maxwell 06 Jul '18

06 Jul '18

This work could be _very_ productive for future transport for TOR: https://www.usenix.org/conference/nsdi12/minion-unordered-delivery-wire-com… As opposed to a raw datagram transport it still gets through the firewalls and nats that TCP/TLS does and still looks like HTTPS to censorware. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [ZS] Byzantium cell-phone service
by Bryce Lynch 06 Jul '18

06 Jul '18

On Thu, Feb 14, 2013 at 7:13 PM, Mark Nuzzolilo II <nuzz604(a)gmail.com>wrote: > > http://www.networkworld.com/news/2010/083010-open-source-voip-cell-phones-a… > OpenBTS has been in use and under heavy development for a couple of years. It was deployed at Occupy Wall Street by Isaac Wilder of the Free Network Foundation (he's a good guy, we geeked out at ContactCon), it's seen a lot of use at the past few DefCons, and we had cellular at HOPE 2012 with such a setup. There was also cell service at ToorCamp last summer with OpenBTS, too. I think 2013 will be the second or third year that Burning Man will have GSM cell service. It has been used to set up a P2P cellular network, but to be usable the network in question would either have to have FCC permission, fly sufficiently below the radar that the cell companies didn't sic the FCC on them, operate at a low PEP, or be re-tuned to use frequencies that aren't otherwise controlled (but then the problem becomes hacking GSM cellphones to use those new freqs). Modulo DefCon hijinks (subtype, wacky) they've all had permission or low PEP to operate for extended periods, so it's as practical as things get. -- The Doctor [412/724/301/703] [ZS] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero --- You received this message because you are subscribed to the Google Groups "Doctrine Zero" group. To unsubscribe from this group and stop receiving emails from it, send an email to DoctrineZero+unsubscribe(a)googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

the physics arXiv blog
by the physics arXiv blog 06 Jul '18

06 Jul '18

[1]the physics arXiv blog [2]Steganophony-when internet telephony meets steganography Posted: 27 Nov 2008 09:30 PM PST [3]steganophony.jpg Steganophony is the term coined by Wojciech Mazurczyk and Jzef Lubacz at the Warsaw University of Technology in Poland to describe the practice of hiding messages in internet telephony traffic (presumably the word is an amalgamation of the terms steganography and telephony). The growing interest in this area is fueled by the fear that terrorist groups may be able to use services such as Skype to send messages secretly by embedding them in the data stream of internet telephony. At least that's what Mazurczyk and Lubacz tell us. The pair has developed a method for doing exactly that called Lost Audio PaCKets Steganography or LACKS and outline it on the arXiv today. LACKS exploits a feature of internet telephony systems: they ignore data packets that are delayed by more than a certain time. LACKS plucks data packets out of the stream, changes the information they contain and then sends them on after a suitable delay. An ordinary receiver simply ignores these packets if they arrive after a certain time but the intended receiver collates them and extracts the information they contain. That makes LACKS rather tricky to detect since dropped packets are a natural phenomenon of the internet traffic. But is this really an area driven by the threat of terrorism? If anybody really wants to keep messages secret then there are plenty of easier ways to do it, such as Pretty Good Privacy. There's a far more powerful driver for this kind of work. It's name? Paranoia Ref: [4]arxiv.org/abs/0811.4138: LACK a VoIP Steganographic Method [5][ISMAP:i] [6][arXivblog?d=41] [7][arXivblog?d=43] [8][arXivblog?i=T8IvmQ0Z] [9][arXivblog?d=50] [10][arXivblog?i=h4NffYqK] [11][arXivblog?d=54] [12][arXivblog?i=cEazSrgL] [13][arXivblog?d=52] You are subscribed to email updates from [14]the physics arXiv blog To stop receiving these emails, you may [15]unsubscribe now. Email delivery powered by Google Inbox too full? [16](feed) [17]Subscribe to the feed version of the physics arXiv blog in a feed reader. If you prefer to unsubscribe via postal mail, write to: the physics arXiv blog, c/o Google, 20 W Kinzie, Chicago IL USA 60610 References 1. http://arxivblog.com/ 2. http://feedproxy.google.com/~r/arXivblog/~3/6lCv8Iiibpw/ 3. http://arxivblog.com/wp-content/uploads/2008/11/steganophony.jpg 4. http://arxiv.org/abs/0811.4138 5. https://feedads.googleadservices.com/~a/6eeH_4hq5ApO1HpULd8NL4ChEWk/a 6. http://feedproxy.google.com/~f/arXivblog?a=fEO0PUGu 7. http://feedproxy.google.com/~f/arXivblog?a=wdGMyQNE 8. http://feedproxy.google.com/~f/arXivblog?a=T8IvmQ0Z 9. http://feedproxy.google.com/~f/arXivblog?a=ShG5N5nk 10. http://feedproxy.google.com/~f/arXivblog?a=h4NffYqK 11. http://feedproxy.google.com/~f/arXivblog?a=A7z74bGw 12. http://feedproxy.google.com/~f/arXivblog?a=cEazSrgL 13. http://feedproxy.google.com/~f/arXivblog?a=3X6kmeSB 14. http://arxivblog.com/ 15. http://feedburner.google.com/fb/a/mailunsubscribe?k=118r9-S4Z0vJg-AkQPASPmD… 16. http://feedproxy.google.com/arXivblog 17. http://feedproxy.google.com/arXivblog ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0