- cypherpunks-legacy - lists.cpunks.org

[ISN] Robbers' quandary: Getting rid of the cash
by R.A. Hettinga 23 Dec '04

23 Dec '04

--- begin forwarded text

1 0

News on the Skype reverse-engineering front
by Ralf-Philipp Weinmann 23 Dec '04

23 Dec '04

I thought this might be of interest for the list, but haven't seen it mentioned/discussed here: Some progress has been made reverse-engineering the Skype protocol [1]. No details on the crypto implementation yet, but first attempts to understand the P2P model they use. Cheers, Ralf [1] S. A. Baset and H. Schulzrinne An Analysis of the Skype Peer-to-Peer Internel Telephony Protocol http://arxiv.org/pdf/cs.NI/0412017 [2] H.T. Kung: CS143: Computer Networks (P2P VoIP) http://www.eecs.harvard.edu/cs143/slides/2004-12-02-p2p-voip.pdf

1 0

All your wavelengths belong to us (or Powell, or the SS)
by Major Variola (ret) 23 Dec '04

23 Dec '04

The FCC is trying to shut down a guerilla radio station in DC calling for protests during Bush's January re-anoint^H^H^H^H^H Google for it.

1 0

Re: Israeli Airport Security Questioning Re: CRYPTO-GRAM, December 15, 2004
by John Kelsey 22 Dec '04

22 Dec '04

>From: "Major Variola (ret)" <mv(a)cdc.gov> >Sent: Dec 21, 2004 10:20 PM >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: Israeli Airport Security Questioning Re: CRYPTO-GRAM, December 15, 2004 >At 02:16 PM 12/20/04 -0500, John Kelsey wrote: >>No doubt a real intelligence agent would be good at getting through >>this kind of screening, but that doesn't mean most of the people who >>want to blow up planes would be any good at it! >You really continue to understimate the freedom fighters, don't you? >(The first) King George did the same. Maybe so. It's clearly added cost to the attackers--they have to select not just the subset of volunteers willing to blow themselves up on the plane, but the subset of *those* who can also keep cool under rapid-fire questioning of their cover story. The attackers probably have to either spend a lot of time rehearsing their cover stories, or have to keep their cover stories very close to their actual lives and interests, which makes profiling easier. Both of these cut way down on the total pool of attackers available. My assumption is that national intelligence agencies can probably afford to do this--they can probably filter through a lot more possible candidates to get field agents who can handle a cover story well, for example, since they can hire openly, rather than quietly recruiting from madrassa students or something. Their training facilities can be centralized and stay in one place, rather than being a camp in the desert somewhere that has to be abandoned frequently, and they can develop a lot of expertise in training people to survive intensive questioning without fumbling their cover story. --John

1 0

International meet on cryptology in Chennai
by R.A. Hettinga 22 Dec '04

22 Dec '04

<http://www.chennaionline.com/colnews/newsitem.asp?NEWSID=%7BE75EFF46-873D-4…> Chennai Online News Service - View News Dec 20, 2004 Mon Dharana International meet on cryptology in Chennai Search for More News Chennai, Dec 19: A three-day international conference on cryptology will get underway here tomorrow with the aim of providing secure communication to the business and military sectors. Over 140 researchers in the field, including some from abroad, would participate in the conference, Dr M S Vijyaraghavan, executive director, Society for Electronics Transactions and Security (SETS), told reporters here today. Cryptography is the art of providing secure information over insecure channels. It encodes texts and provides a method of decoding. Cryptanalysis is the art of breaking into cryptographic information. The new science - cryptology - was a study of both, he said. India had not made any headway in cryptology, he said and added that the conference would help develop this in a big way. President A P J Abdul Kalam would address the participants through video conferencing. Dr R Chidambaram, principal scientific adviser, Government of India, would inaugurate the conference. (Our Correspondent) Published: Sunday, December 19, 2004 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

Do We Need a National ID Card?
by R.A. Hettinga 22 Dec '04

22 Dec '04

--- begin forwarded text

2 1

Coffee, Tea, or Should We Feel Your Pregnant Wife's Breasts Before Throwing You in a Cell at the Airport and Then Lying About Why We Put You There?
by R.A. Hettinga 22 Dec '04

22 Dec '04

<http://www.lewrockwell.com/orig3/monahan1.html> LewRockwell.com Coffee, Tea, or Should We Feel Your Pregnant Wife's Breasts Before Throwing You in a Cell at the Airport and Then Lying About Why We Put You There? by Nicholas Monahan ? ?? ?? ?? This morning I'll be escorting my wife to the hospital, where the doctors will perform a caesarean section to remove our first child. She didn't want to do it this way - neither of us did - but sometimes the Fates decide otherwise. The Fates or, in our case, government employees. On the morning of October 26th Mary and I entered Portland International Airport, en route to the Las Vegas wedding of one of my best friends. Although we live in Los Angeles, we'd been in Oregon working on a film, and up to that point had had nothing but praise to shower on the city of Portland, a refreshing change of pace from our own suffocating metropolis. At the security checkpoint I was led aside for the "inspection" that's all the rage at airports these days. My shoes were removed. I was told to take off my sweater, then to fold over the waistband of my pants. My baseball hat, hastily jammed on my head at 5 AM, was removed and assiduously examined ("Anything could be in here, sir," I was told, after I asked what I could hide in a baseball hat. Yeah. Anything.) Soon I was standing on one foot, my arms stretched out, the other leg sticking out in front of me `la a DUI test. I began to get pissed off, as most normal people would. My anger increased when I realized that the newly knighted federal employees weren't just examining me, but my 712 months pregnant wife as well. I'd originally thought that I'd simply been randomly selected for the more excessive than normal search. You know, Number 50 or whatever. Apparently not though - it was both of us. These are your new threats, America: pregnant accountants and their sleepy husbands flying to weddings. After some more grumbling on my part they eventually finished with me and I went to retrieve our luggage from the x-ray machine. Upon returning I found my wife sitting in a chair, crying. Mary rarely cries, and certainly not in public. When I asked her what was the matter, she tried to quell her tears and sobbed, "I'm sorry...it's...they touched my breasts...and..." That's all I heard. I marched up to the woman who'd been examining her and shouted, "What did you do to her?" Later I found out that in addition to touching her swollen breasts - to protect the American citizenry - the employee had asked that she lift up her shirt. Not behind a screen, not off to the side - no, right there, directly in front of the hundred or so passengers standing in line. And for you women who've been pregnant and worn maternity pants, you know how ridiculous those things look. "I felt like a clown," my wife told me later. "On display for all these people, with the cotton panel on my pants and my stomach sticking out. When I sat down I just lost my composure and began to cry. That's when you walked up." Of course when I say she "told me later," it's because she wasn't able to tell me at the time, because as soon as I demanded to know what the federal employee had done to make her cry, I was swarmed by Portland police officers. Instantly. Three of them, cinching my arms, locking me in handcuffs, and telling me I was under arrest. Now my wife really began to cry. As they led me away and she ran alongside, I implored her to calm down, to think of the baby, promising her that everything would turn out all right. She faded into the distance and I was shoved into an elevator, a cop holding each arm. After making me face the corner, the head honcho told that I was under arrest and that I wouldn't be flying that day - that I was in fact a "menace." It took me a while to regain my composure. I felt like I was one of those guys in The Gulag Archipelago who, because the proceedings all seem so unreal, doesn't fully realize that he is in fact being arrested in a public place in front of crowds of people for...for what? I didn't know what the crime was. Didn't matter. Once upstairs, the officers made me remove my shoes and my hat and tossed me into a cell. Yes, your airports have prison cells, just like your amusement parks, train stations, universities, and national forests. Let freedom reign. After a short time I received a visit from the arresting officer. "Mr. Monahan," he started, "Are you on drugs?" Was this even real? "No, I'm not on drugs." "Should you be?" "What do you mean?" "Should you be on any type of medication?" "No." "Then why'd you react that way back there?" You see the thinking? You see what passes for reasoning among your domestic shock troops these days? Only "whackos" get angry over seeing the woman they've been with for ten years in tears because someone has touched her breasts. That kind of reaction - love, protection - it's mind-boggling! "Mr. Monahan, are you on drugs?" His snide words rang inside my head. This is my wife, finally pregnant with our first child after months of failed attempts, after the depressing shock of the miscarriage last year, my wife who'd been walking on a cloud over having the opportunity to be a mother...and my anger is simply unfathomable to the guy standing in front of me, the guy who earns a living thanks to my taxes, the guy whose family I feed through my labor. What I did wasn't normal. No, I reacted like a drug addict would've. I was so disgusted I felt like vomiting. But that was just the beginning. An hour later, after I'd been gallantly assured by the officer that I wouldn't be attending my friend's wedding that day, I heard Mary's voice outside my cell. The officer was speaking loudly, letting her know that he was planning on doing me a favor... which everyone knows is never a real favor. He wasn't going to come over and help me work on my car or move some furniture. No, his "favor" was this: He'd decided not to charge me with a felony. Think about that for a second. Rapes, car-jackings, murders, arsons - those are felonies. So is yelling in an airport now, apparently. I hadn't realized, though I should have. Luckily, I was getting a favor, though. I was merely going to be slapped with a misdemeanor. "Here's your court date," he said as I was released from my cell. In addition, I was banned from Portland International for 90 days, and just in case I was thinking of coming over and hanging out around its perimeter, the officer gave me a map with the boundaries highlighted, sternly warning me against trespassing. Then he and a second officer escorted us off the grounds. Mary and I hurriedly drove two and a half hours in the rain to Seattle, where we eventually caught a flight to Vegas. But the officer was true to his word - we missed my friend's wedding. The fact that he'd been in my own wedding party, the fact that a once in a lifetime event was stolen from us - well, who cares, right? Upon our return to Portland (I'd had to fly into Seattle and drive back down), we immediately began contacting attorneys. We aren't litigious people - we wanted no money. I'm not even sure what we fully wanted. An apology? A reprimand? I don't know. It doesn't matter though, because we couldn't afford a lawyer, it turned out. $4,000 was the average figure bandied about as a retaining fee. Sorry, but I've got a new baby on the way. So we called the ACLU, figuring they existed for just such incidents as these. And they do apparently...but only if we were minorities. That's what they told us. In the meantime, I'd appealed my suspension from PDX. A week or so later I got a response from the Director of Aviation. After telling me how, in the aftermath of 9/11, most passengers not only accept additional airport screening but welcome it, he cut to the chase: "After a review of the police report and my discussions with police staff, as well as a review of the TSA's report on this incident, I concur with the officer's decision to take you into custody and to issue a citation to you for disorderly conduct. That being said, because I also understand that you were upset and acted on your emotions, I am willing to lift the Airport Exclusion Order...." Attached to this letter was the report the officer had filled out. I'd like to say I couldn't believe it, but in a way, I could. It's seemingly becoming the norm in America - lies and deliberate distortions on the part of those in power, no matter how much or how little power they actually wield. The gist of his report was this: From the get go I wasn't following the screener's directions. I was "squinting my eyes" and talking to my wife in a "low, forced voice" while "excitedly swinging my arms." Twice I began to walk away from the screener, inhaling and exhaling forcefully. When I'd completed the physical exam, I walked to the luggage screening area, where a second screener took a pair of scissors from my suitcase. At this point I yelled, "What the %*&$% is going on? This is &*#&$%!" The officer, who'd already been called over by one of the screeners, became afraid for the TSA staff and the many travelers. He required the assistance of a second officer as he "struggled" to get me into handcuffs, then for "cover" called over a third as well. It was only at this point that my wife began to cry hysterically. There was nothing poetic in my reaction to the arrest report. I didn't crumple it in my fist and swear that justice would be served, promising to sacrifice my resources and time to see that it would. I simply stared. Clearly the officer didn't have the guts to write down what had really happened. It might not look too good to see that stuff about the pregnant woman in tears because she'd been humiliated. Instead this was the official scenario being presented for the permanent record. It doesn't even matter that it's the most implausible sounding situation you can think of. "Hey, what the...godammit, they're taking our scissors, honey!" Why didn't he write in anything about a monkey wearing a fez? True, the TSA staff had expropriated a pair of scissors from our toiletries kit - the story wasn't entirely made up. Except that I'd been locked in airport jail at the time. I didn't know anything about any scissors until Mary told me on our drive up to Seattle. They'd questioned her about them while I was in the bowels of the airport sitting in my cell. So I wrote back, indignation and disgust flooding my brain. "[W]hile I'm not sure, I'd guess that the entire incident is captured on video. Memory is imperfect on everyone's part, but the footage won't lie. I realize it might be procedurally difficult for you to view this, but if you could, I'd appreciate it. There's no willful disregard of screening directions. No explosion over the discovery of a pair of scissors in a suitcase. No struggle to put handcuffs on. There's a tired man, early in the morning, unhappily going through a rigorous procedure and then reacting to the tears of his pregnant wife." Eventually we heard back from a different person, the guy in charge of the TSA airport screeners. One of his employees had made the damning statement about me exploding over her scissor discovery, and the officer had deftly incorporated that statement into his report. We asked the guy if he could find out why she'd said this - couldn't she possibly be mistaken? "Oh, can't do that, my hands are tied. It's kind of like leading a witness - I could get in trouble, heh heh." Then what about the videotape? Why not watch that? That would exonerate me. "Oh, we destroy all video after three days." Sure you do. A few days later we heard from him again. He just wanted to inform us that he'd received corroboration of the officer's report from the officer's superior, a name we didn't recognize. "But...he wasn't even there," my wife said. "Yeah, well, uh, he's corroborated it though." That's how it works. "Oh, and we did look at the videotape. Inconclusive." But I thought it was destroyed? On and on it went. Due to the tenacity of my wife in making phone calls and speaking with relevant persons, the "crime" was eventually lowered to a mere citation. Only she could have done that. I would've simply accepted what was being thrown at me, trumped up charges and all, simply because I'm wholly inadequate at performing the kowtow. There's no way I could have contacted all the people Mary did and somehow pretend to be contrite. Besides, I speak in a low, forced voice, which doesn't elicit sympathy. Just police suspicion. Weeks later at the courthouse I listened to a young DA awkwardly read the charges against me - "Mr. Monahan...umm...shouted obscenities at the airport staff...umm... umm...oh, they took some scissors from his suitcase and he became...umm...abusive at this point." If I was reading about it in Kafka I might have found something vaguely amusing in all of it. But I wasn't. I was there. Living it. I entered a plea of nolo contendere, explaining to the judge that if I'd been a resident of Oregon, I would have definitely pled "Not Guilty." However, when that happens, your case automatically goes to a jury trial, and since I lived a thousand miles away, and was slated to return home in seven days, with a newborn due in a matter of weeks...you get the picture. "No Contest" it was. Judgment: $250 fine. Did I feel happy? Only $250, right? No, I wasn't happy. I don't care if it's twelve cents, that's money pulled right out of my baby's mouth and fed to a disgusting legal system that will use it to propagate more incidents like this. But at the very least it was over, right? Wrong. When we returned to Los Angeles there was an envelope waiting for me from the court. Inside wasn't a receipt for the money we'd paid. No, it was a letter telling me that what I actually owed was $309 - state assessed court costs, you know. Wouldn't you think your taxes pay for that - the state putting you on trial? No, taxes are used to hire more cops like the officer, because with our rising criminal population - people like me - hey, your average citizen demands more and more "security." Finally I reach the piece de resistance. The week before we'd gone to the airport my wife had had her regular pre-natal checkup. The child had settled into the proper head down position for birth, continuing the remarkable pregnancy she'd been having. We returned to Portland on Sunday. On Mary's Monday appointment she was suddenly told, "Looks like your baby's gone breech." When she later spoke with her midwives in Los Angeles, they wanted to know if she'd experienced any type of trauma recently, as this often makes a child flip. "As a matter of fact..." she began, recounting the story, explaining how the child inside of her was going absolutely crazy when she was crying as the police were leading me away through the crowd. My wife had been planning a natural childbirth. She'd read dozens of books, meticulously researched everything, and had finally decided that this was the way for her. No drugs, no numbing of sensations - just that ultimate combination of brute pain and sheer joy that belongs exclusively to mothers. But my wife is also a first-time mother, so she has what is called an "untested" pelvis. Essentially this means that a breech birth is too dangerous to attempt, for both mother and child. Therefore, she's now relegated to a c-section - hospital stay, epidural, catheter, fetal monitoring, stitches - everything she didn't want. Her natural birth has become a surgery. We've tried everything to turn that baby. Acupuncture, chiropractic techniques, underwater handstands, elephant walking, moxibustion, bending backwards over pillows, herbs, external manipulation - all to no avail. When I walked into the living room the other night and saw her plaintively cooing with a flashlight turned onto her stomach, yet another suggested technique, my heart almost broke. It's breaking now as I write these words. I can never prove that my child went breech because of what happened to us at the airport. But I'll always believe it. Wrongly or rightly, I'll forever think of how this man, the personification of this system, has affected the lives of my family and me. When my wife is sliced open, I'll be thinking of him. When they remove her uterus from her abdomen and lay it on her stomach, I'll be thinking of him. When I visit her and my child in the hospital instead of having them with me here in our home, I'll be thinking of him. When I assist her to the bathroom while the incision heals internally, I'll be thinking of him. There are plenty of stories like this these days. I don't know how many I've read where the writer describes some breach of civil liberties by employees of the state, then wraps it all up with a dire warning about what we as a nation are becoming, and how if we don't put an end to it now, then we're in for heaps of trouble. Well you know what? Nothing's going to stop the inevitable. There's no policy change that's going to save us. There's no election that's going to put a halt to the onslaught of tyranny. It's here already - this country has changed for the worse and will continue to change for the worse. There is now a division between the citizenry and the state. When that state is used as a tool against me, there is no longer any reason why I should owe any allegiance to that state. And that's the first thing that child of ours is going to learn. December 21, 2002 Nick Monahan works in the film industry. He writes out of Los Angeles where he lives with his wife and as of December 18th, his beautiful new son. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

8 17

RE: RAH's postings.
by Trei, Peter 22 Dec '04

22 Dec '04

I wasn't actually expecting anonymity. I wrote directly to RAH, asking him politely to edit down his posts, and simply post a few lines and a pointer. Not pointing out his faults in public was simply good manners. His response boils down to 'fuck you'. Cypherpunks has a very loose charter, but it is not the 'everything and anything RAH thinks is neat' list. Peter > > Someone wrote: > > > > At 10:23 AM -0500 12/21/04, Somebody wrote: > > RAH, if you want to anonymize a quoted email, it helps if you > remove the > In-Reply-To: and References: headers. > > > >What the hell does an article about gypsy > > >mechanics have to do with cypherpunks? > > > > I plead anarchic markets, m'lord. Emerging phenomena, and > all that, in > > spite all regulation to the contrary.

2 1

[ISN] REVIEW: "Malicious Cryptography", Adam L. Young/Moti Yung
by InfoSec News 22 Dec '04

22 Dec '04

Forwarded from: "Rob, grandpa of Ryan, Trevor, Devon & Hannah" <rslade(a)sprint.ca> BKMLCRPT.RVW 20041012 "Malicious Cryptography", Adam L. Young/Moti Yung, 2004, 0-7645-4975-8, U$45.00/C$64.99/UK#29.99 %A Adam L. Young %A Moti Yung %C 5353 Dundas Street West, 4th Floor, Etobicoke, ON M9B 6H8 %D 2004 %G 0-7645-4975-8 %I John Wiley & Sons, Inc. %O U$45.00/C$64.99/UK#29.99 416-236-4433 fax: 416-236-4448 %O http://www.amazon.com/exec/obidos/ASIN/0764549758/robsladesinterne http://www.amazon.co.uk/exec/obidos/ASIN/0764549758/robsladesinte-21 %O http://www.amazon.ca/exec/obidos/ASIN/0764549758/robsladesin03-20 %P 392 p. %T "Malicious Cryptography: Exposing Cryptovirology" Both the foreword and the introduction are turgid, and bloated with excessive verbiage, while never giving a clear indication of what the book is actually about. Does it have to do with viruses at all? Is it about the use of cryptography in any kind of criminal or unethical endeavour? The initial material does not make this clear. Occasionally the text becomes so flowery that sentences have no meaning at all. The lack of clarity is not assisted by the creation of new and idiosyncratic terms, or the use of existing jargon in non-standard ways. In chapter one, a fictional and glacially slow trip through the mind of a virus writer, we are told that self-checking modules that some programs use to detect modification in their own code are "beneficial Trojans" or "battleprogs." The term multipartite is defined in such a way that merely copying the program into RAM (Random Access Memory) qualifies: that would make every virus ever written, and every program, for that matter, multipartite. "Kleptogram" is used throughout the book, but only defined (and not very clearly) in the last chapter. Releasing any virus is seen as having something to do with "information warfare," which would agree with many sensationalistic journalists who have written on the subject, but would probably surprise legitimate experts such as Dorothy Denning. "Virology" itself (and the more specialized "cryptovirology") is an excellent term for computer virus research--it just isn't used very widely. There is a glossary: it defines commonly known terms and does not define the specialized jargon that the authors have used. The confusion is not limited to terminology. There is no technical sense to the statement (on page twenty five) that a certain layer of the network stack is "high enough to facilitate rapid software development" (compilers don't care where their software ends up) but low enough to escape detection (files, processes, and network packets are all visible). A disk locking program, as described, would have no effect on the operations of a remote access trojan. And, of course, our fictional protagonist is constantly creating new versions of the mythical "undetectable" virus, without there being any indication of how this might be done. (The fictional aspects of the book are not limited to chapter one. Throughout the work, examples are taken from fiction: it certainly feels like more illustrations come from works like "Shockwave Rider" and "Alien" than from real life.) Chapter two starts to get a bit better. The authors introduce the idea of using asymmetric cryptography in order to create a virus (or other piece of malware) that, rather than merely destroying data, provides for a reversible denial of access to data, and therefore the possibility of extortion. The idea is academically interesting, but there might be a few practical details to be worked out. Chapter three seems to move further into the academic realm, with an interesting overview of issues in regard to the generation of random, or pseudorandom, numbers. There is also an initial exploration of anonymity, with an insufficient description of "mix networks" (onion routing being one example). A little more discussion of anonymity starts off chapter four, which then moves on to another use of asymmetric cryptography in malware: the "deniable" recovery of stolen information, via distribution over public channels. Cryptocounters, which could be used to store generational or other information about the spread of a virus, without such data being accessible to virus researchers, are discussed in chapter five. Chapter six looks at aspects of searching for, and retrieving, information without disclosing the fact that an exploration is occurring. However, much of the material appears to be some highly abstract solutions rather desperately in search of problems. Varying the extortion scenario, chapter seven proposes a viral network that could retaliate for disinfection of any node by threatening disclosure of sensitive information. While the analysis of the structure of the attack is sound, the assumption of payoffs, coercion, and undetectability leave something to be desired. Chapter eight examines the standard antiviral processes (signature scanning, activity monitoring, and change detection) with some miscellaneous explorations, although the discussion is prejudiced by the assumption that we are dealing with traditional (and no longer widely used) file infectors. Trojan horse programs are not terribly well defined in chapter nine. (I was amused at the disclaimer given when the issue of "salami" scams was raised: I have found reliable evidence for only one, extremely minor, instance of the device.) Subliminal channels are means of passing information via cryptographic keys, but chapter ten is not very clear in regard to their use. SETUPs (Secretly Embedded Trapdoor with Universal Protection) are discussed in chapter eleven, although the authors appear to admit that this is only an academic exercise: there are easier attacks. Another form is discussed in chapter twelve. Does this book fulfill its function? That rather depends on what the intent of the work was, which is far from clear. Was the text intended to be a reference for some interesting topics in cryptography? The verbiage and lack of structure would be a difficulty for those seeking to use it so. Is the publication directed at the general public? The audience of those who read number theoretical manuscripts for fun might be a bit limited. (I've got to say that "Algebraic Aspects of Cryptography" [cf. BKALASCR.RVW] was an easier read, and it makes no pretence of being other than an scholastic paper.) Is the volume supposed to be a serious warning against new forms of malware? The inclusion of a great deal of extraneous content and the lack of clear explanations or examples of some basic concepts limit the value of the work in this regard. In addition, much of the material concentrates on building more malign malware, rather than dealing with defence against it. (I'm not too worried about vxers getting ideas from Young and Yung: implementing crypto properly is a painstaking task, and from almost twenty years experience of studying blackhat products and authors, I'm fairly sure there'd be lots of bugs in what might be released. On the other hand, somebody in a government office might be working on Magic Lantern version 3.01 ...) For those seriously involved in the study of viruses and malware this book has some interesting points that should be examined, but little of practical use. For ardent students of cryptography, the work notes some interesting areas of work. For those seeking examples of writing styles to emulate, please look elsewhere. copyright Robert M. Slade, 2004 BKMLCRPT.RVW 20041012 ====================== (quote inserted randomly by Pegasus Mailer) rslade(a)vcn.bc.ca slade(a)victoria.tc.ca rslade(a)sun.soci.niu.edu I'm out of my mind, but feel free to leave a message. http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] REVIEW: "Malicious Cryptography", Adam L. Young/Moti Yung
by InfoSec News 22 Dec '04

22 Dec '04

Forwarded from: "Rob, grandpa of Ryan, Trevor, Devon & Hannah" <rslade(a)sprint.ca> BKMLCRPT.RVW 20041012 "Malicious Cryptography", Adam L. Young/Moti Yung, 2004, 0-7645-4975-8, U$45.00/C$64.99/UK#29.99 %A Adam L. Young %A Moti Yung %C 5353 Dundas Street West, 4th Floor, Etobicoke, ON M9B 6H8 %D 2004 %G 0-7645-4975-8 %I John Wiley & Sons, Inc. %O U$45.00/C$64.99/UK#29.99 416-236-4433 fax: 416-236-4448 %O http://www.amazon.com/exec/obidos/ASIN/0764549758/robsladesinterne http://www.amazon.co.uk/exec/obidos/ASIN/0764549758/robsladesinte-21 %O http://www.amazon.ca/exec/obidos/ASIN/0764549758/robsladesin03-20 %P 392 p. %T "Malicious Cryptography: Exposing Cryptovirology" Both the foreword and the introduction are turgid, and bloated with excessive verbiage, while never giving a clear indication of what the book is actually about. Does it have to do with viruses at all? Is it about the use of cryptography in any kind of criminal or unethical endeavour? The initial material does not make this clear. Occasionally the text becomes so flowery that sentences have no meaning at all. The lack of clarity is not assisted by the creation of new and idiosyncratic terms, or the use of existing jargon in non-standard ways. In chapter one, a fictional and glacially slow trip through the mind of a virus writer, we are told that self-checking modules that some programs use to detect modification in their own code are "beneficial Trojans" or "battleprogs." The term multipartite is defined in such a way that merely copying the program into RAM (Random Access Memory) qualifies: that would make every virus ever written, and every program, for that matter, multipartite. "Kleptogram" is used throughout the book, but only defined (and not very clearly) in the last chapter. Releasing any virus is seen as having something to do with "information warfare," which would agree with many sensationalistic journalists who have written on the subject, but would probably surprise legitimate experts such as Dorothy Denning. "Virology" itself (and the more specialized "cryptovirology") is an excellent term for computer virus research--it just isn't used very widely. There is a glossary: it defines commonly known terms and does not define the specialized jargon that the authors have used. The confusion is not limited to terminology. There is no technical sense to the statement (on page twenty five) that a certain layer of the network stack is "high enough to facilitate rapid software development" (compilers don't care where their software ends up) but low enough to escape detection (files, processes, and network packets are all visible). A disk locking program, as described, would have no effect on the operations of a remote access trojan. And, of course, our fictional protagonist is constantly creating new versions of the mythical "undetectable" virus, without there being any indication of how this might be done. (The fictional aspects of the book are not limited to chapter one. Throughout the work, examples are taken from fiction: it certainly feels like more illustrations come from works like "Shockwave Rider" and "Alien" than from real life.) Chapter two starts to get a bit better. The authors introduce the idea of using asymmetric cryptography in order to create a virus (or other piece of malware) that, rather than merely destroying data, provides for a reversible denial of access to data, and therefore the possibility of extortion. The idea is academically interesting, but there might be a few practical details to be worked out. Chapter three seems to move further into the academic realm, with an interesting overview of issues in regard to the generation of random, or pseudorandom, numbers. There is also an initial exploration of anonymity, with an insufficient description of "mix networks" (onion routing being one example). A little more discussion of anonymity starts off chapter four, which then moves on to another use of asymmetric cryptography in malware: the "deniable" recovery of stolen information, via distribution over public channels. Cryptocounters, which could be used to store generational or other information about the spread of a virus, without such data being accessible to virus researchers, are discussed in chapter five. Chapter six looks at aspects of searching for, and retrieving, information without disclosing the fact that an exploration is occurring. However, much of the material appears to be some highly abstract solutions rather desperately in search of problems. Varying the extortion scenario, chapter seven proposes a viral network that could retaliate for disinfection of any node by threatening disclosure of sensitive information. While the analysis of the structure of the attack is sound, the assumption of payoffs, coercion, and undetectability leave something to be desired. Chapter eight examines the standard antiviral processes (signature scanning, activity monitoring, and change detection) with some miscellaneous explorations, although the discussion is prejudiced by the assumption that we are dealing with traditional (and no longer widely used) file infectors. Trojan horse programs are not terribly well defined in chapter nine. (I was amused at the disclaimer given when the issue of "salami" scams was raised: I have found reliable evidence for only one, extremely minor, instance of the device.) Subliminal channels are means of passing information via cryptographic keys, but chapter ten is not very clear in regard to their use. SETUPs (Secretly Embedded Trapdoor with Universal Protection) are discussed in chapter eleven, although the authors appear to admit that this is only an academic exercise: there are easier attacks. Another form is discussed in chapter twelve. Does this book fulfill its function? That rather depends on what the intent of the work was, which is far from clear. Was the text intended to be a reference for some interesting topics in cryptography? The verbiage and lack of structure would be a difficulty for those seeking to use it so. Is the publication directed at the general public? The audience of those who read number theoretical manuscripts for fun might be a bit limited. (I've got to say that "Algebraic Aspects of Cryptography" [cf. BKALASCR.RVW] was an easier read, and it makes no pretence of being other than an scholastic paper.) Is the volume supposed to be a serious warning against new forms of malware? The inclusion of a great deal of extraneous content and the lack of clear explanations or examples of some basic concepts limit the value of the work in this regard. In addition, much of the material concentrates on building more malign malware, rather than dealing with defence against it. (I'm not too worried about vxers getting ideas from Young and Yung: implementing crypto properly is a painstaking task, and from almost twenty years experience of studying blackhat products and authors, I'm fairly sure there'd be lots of bugs in what might be released. On the other hand, somebody in a government office might be working on Magic Lantern version 3.01 ...) For those seriously involved in the study of viruses and malware this book has some interesting points that should be examined, but little of practical use. For ardent students of cryptography, the work notes some interesting areas of work. For those seeking examples of writing styles to emulate, please look elsewhere. copyright Robert M. Slade, 2004 BKMLCRPT.RVW 20041012 ====================== (quote inserted randomly by Pegasus Mailer) rslade(a)vcn.bc.ca slade(a)victoria.tc.ca rslade(a)sun.soci.niu.edu I'm out of my mind, but feel free to leave a message. http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0