- cypherpunks-legacy - lists.cpunks.org

insider threat report, by SS
by Major Variola (ret) 08 Sep '04

08 Sep '04

Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector Marisa Reddy Randazzo, Ph.D. Dawn Cappelli Michelle Keeney, Ph.D. Andrew Moore Eileen Kowalski CERT. Coordination Center National Threat Assessment Center Software Engineering Institute United States Secret Service Carnegie Mellon University Washington, DC Pittsburgh, PA August 2004 http://www.secretservice.gov/ntac/its_report_040820.pdf Only amateurs attack machines; professionals target people. Bruce Schneier

1 0

FSTC Issues Call for Participation for Two New Projects
by R. A. Hettinga 08 Sep '04

08 Sep '04

The Financial Services Technology Consortium wants to assist banks in providing an "authentication service to government agencies"... Cheers, RAH --- begin forwarded text

1 0

[IP] New research on foreign intelligence surveillance/wiretapping (fwd from dave@farber.net)
by Eugen Leitl 08 Sep '04

08 Sep '04

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Re: Gilmore case...Who can make laws?
by Major Variola (ret) 08 Sep '04

08 Sep '04

At 11:19 AM 9/8/04 -0400, Tyler Durden wrote: >Hum. I wonder. Do you think these secret regulations are communicated via >secure channels? What would happen if someone decided to send their own >regulations out to all of the local airline security offices rescinding any >private regs, particularly if one used official-looking letterhead? It would be better to inject *more heinous* secret rules than to attempt to remove them. "Why" is left as an exercise to the reader. Fax would probably suffice. At 01:52 PM 9/7/04 -0500, J.A. Terranson wrote: >I am however intrigued that they may be preparing to posit that secret >rules (which act under color of law) can be enforced without being >described publicly. This, if accepted, would effectively end all >constitutional protections. The phrase "constitutional protections" doesn't pass the giggle test these days. However the courts --when trials get that far-- will still toss out cases in which the state's evidence is not revealed. I expect that behavior will stop when domestic-US secret trials become common. To protect means, methods, and the chiiiildren, of course. At least the Europeans don't take the US seriously, esp after the use of torture was made clear, see eg the German trials. But the US is trying to control them via the oil connection. Rome did not fall in a day.

1 0

Re: Gilmore case...Who can make laws?
by Tyler Durden 08 Sep '04

08 Sep '04

Well, still ruminating... The kind of regulations that regulatory bodies have made in the past are in their nature different from these secret rules I still believe. This is of course aside from their secret nature. Previously, if a regulatory body such as the FCC enacted some kind of policy, they could fine companies that did not comply. From my naive perspective, I didn't view these regs as really having a direct impact on private citizen units/individuals, apart from their organization, but then again I could probably think of exceptions. Hum. I wonder. Do you think these secret regulations are communicated via secure channels? What would happen if someone decided to send their own regulations out to all of the local airline security offices rescinding any private regs, particularly if one used official-looking letterhead? -TD >From: "J.A. Terranson" <measl(a)mfn.org> >To: Eric Cordian <emc(a)artifact.psychedelic.net> >CC: cypherpunks(a)minder.net >Subject: Re: Gilmore case...Who can make laws? >Date: Tue, 7 Sep 2004 13:52:40 -0500 (CDT) > >On Tue, 7 Sep 2004, Eric Cordian wrote: > > > An argument that the TSA cannot make rules, even secret rules, >regulating > > air travel, because it is not Congress, will not pass the giggle test in > > court, unless you can show that the TSA exceeded its regulatory powers. > >Absolutely correct. > >I am however intrigued that they may be preparing to posit that secret >rules (which act under color of law) can be enforced without being >described publicly. This, if accepted, would effectively end all >constitutional protections. > >-- >Yours, > >J.A. Terranson >sysadmin(a)mfn.org >0xBD4A95BF > > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." Osama Bin Laden > - - - > > "There aught to be limits to freedom!" George Bush > - - - > >Which one scares you more? _________________________________________________________________ Get ready for school! Find articles, homework help and more in the Back to School Guide! http://special.msn.com/network/04backtoschool.armx

1 0

Maths holy grail could bring disaster for internet
by R. A. Hettinga 08 Sep '04

08 Sep '04

<http://www.guardian.co.uk/print/0,3858,5009766-103690,00.html> The Guardian Maths holy grail could bring disaster for internet Two of the seven million dollar challenges that have baffled for more than a century may be close to being solved Tim Radford, science editor Tuesday September 7, 2004 The Guardian Mathematicians could be on the verge of solving two separate million dollar problems. If they are right - still a big if - and somebody really has cracked the so-called Riemann hypothesis, financial disaster might follow. Suddenly all cryptic codes could be breakable. No internet transaction would be safe. On the other hand, if somebody has already sorted out the so-called Poincari conjecture, then scientists will understand something profound about the nature of spacetime, experts told the British Association science festival in Exeter yesterday. Both problems have stood for a century or more. Each is almost dizzyingly arcane: the problems themselves are beyond simple explanation, and the candidate answers published on the internet are so intractable that they could baffle the biggest brains in the business for many months. They are two of the seven "millennium problems" and four years ago the Clay Mathematics Institute in the US offered $1m (#563,000) to anyone who could solve even one of these seven. The hypothesis formulated by Georg Friedrich Bernhard Riemann in 1859, according to Marcus du Sautoy of Oxford University, is the holy grail of mathematics. "Most mathematicians would trade their soul with Mephistopheles for a proof," he said. The Riemann hypothesis would explain the apparently random pattern of prime numbers - numbers such as 3, 17 and 31, for instance, are all prime numbers: they are divisible only by themselves and one. Prime numbers are the atoms of arithmetic. They are also the key to internet cryptography: in effect they keep banks safe and credit cards secure. This year Louis de Branges, a French-born mathematician now at Purdue University in the US, claimed a proof of the Riemann hypothesis. So far, his colleagues are not convinced. They were not convinced, years ago, when de Branges produced an answer to another famous mathematical challenge, but in time they accepted his reasoning. This time, the mathematical community remains even more sceptical. "The proof he has announced is rather incomprehensible. Now mathematicians are less sure that the million has been won," Prof du Sautoy said. "The whole of e-commerce depends on prime numbers. I have described the primes as atoms: what mathematicians are missing is a kind of mathematical prime spectrometer. Chemists have a machine that, if you give it a molecule, will tell you the atoms that it is built from. Mathematicians haven't invented a mathematical version of this. That is what we are after. If the Riemann hypothesis is true, it won't produce a prime number spectrometer. But the proof should give us more understanding of how the primes work, and therefore the proof might be translated into something that might produce this prime spectrometer. If it does, it will bring the whole of e-commerce to its knees, overnight. So there are very big implications." The Poincari conjecture depends on the almost mind-numbing problem of understanding the shapes of spaces: mathematicians call it topology. Bernhard Riemann and other 19th century scholars wrapped up the mathematical problems of two-dimensional surfaces of three dimensional objects - the leather around a football, for instance, or the distortions of a rubber sheet. But Henri Poincari raised the awkward question of objects with three dimensions, existing in the fourth dimension of time. He had already done groundbreaking work in optics, thermodynamics, celestial mechanics, quantum theory and even special relativity and he almost anticipated Einstein. And then in 1904 he asked the most fundamental question of all: what is the shape of the space in which we live? It turned out to be possible to prove the Poincari conjecture in unimaginable worlds, where objects have four or five or more dimensions, but not with three. "The one case that is really of interest because it connects with physics, is the one case where the Poincari conjecture hasn't been solved," said Keith Devlin, of Stanford University in California. In 2002 a Russian mathematician called Grigori Perelman posted the first of a series of internet papers. He had worked in the US, and was known to American mathematicians before he returned to St Petersburg. His proof - he called it only a sketch of a proof - was very similar in some ways to that of Fermat's last theorem, cracked by the Briton Andrew Wiles in the last decade. Like Wiles, Perelman is claiming to have proved a much more complicated general problem and in the course of it may have solved a special one that has tantalised mathematicians for a century. But his papers made not a single reference to Poincari or his conjecture. Even so, mathematicians the world over understood that he tackled the essential challenge. Once again the jury is still out: this time, however, his fellow mathematicians believe he may be onto something big. The plus: the multidimensional topology of space in three dimensions will seem simple at last and a million dollar reward will be there for the asking. The minus: the solver does not claim to have found a solution, he doesn't want the reward, and he certainly doesn't want to talk to the media. "There is good reason to think the kind of approach Perelman is taking is correct. However there are some problems. He is very reclusive, won't talk to the press, has shown no indication of publishing this as a paper, which you would have to do if you wanted to get the prize from the Clay Institute, and has shown no interest in the prize whatsoever," Dr Devlin said. "Has it been proved? We don't know. We have good reason to assume it has been and within the next 12 months, in the inner core of experts in differential geometry, which is the field we are speaking about, people will start to say, yes, OK, this looks right. But there is not going to be a golden moment." The implications of a proof of the Poincari conjecture would be enormous, but like the problem itself, very difficult to explain, he said. "It can't fail to have huge ramifications: not only the result, but the methods as well. At that level of abstraction, that level of connection, so much can follow. Differential geometry is the subject that is really underneath understanding everything about space and spacetime." Seven baffling pillars of wisdom 1 Birch and Swinnerton-Dyer conjecture Euclid geometry for the 21st century, involving things called abelian points and zeta functions and both finite and infinite answers to algebraic equations 2 Poincari conjecture The surface of an apple is simply connected. But the surface of a doughnut is not. How do you start from the idea of simple connectivity and then characterise space in three dimensions? 3 Navier-Stokes equation The answers to wave and breeze turbulence lie somewhere in the solutions to these equations 4 P vs NP problem Some problems are just too big: you can quickly check if an answer is right, but it might take the lifetime of a universe to solve it from scratch. Can you prove which questions are truly hard, which not? 5 Riemann hypothesis Involving zeta functions, and an assertion that all "interesting" solutions to an equation lie on a straight line. It seems to be true for the first 1,500 million solutions, but does that mean it is true for them all? 6 Hodge conjecture At the frontier of algebra and geometry, involving the technical problems of building shapes by "gluing" geometric blocks together 7 Yang-Mills and Mass gap A problem that involves quantum mechanics and elementary particles. Physicists know it, computers have simulated it but nobody has found a theory to explain it -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

5 4

RE: stegedetect & Variola's Suitcase
by Major Variola (ret) 07 Sep '04

07 Sep '04

At 11:57 AM 9/7/04 -0400, Sunder wrote: >The answer to that question depends on some leg work which involves >converting the source code to stegetect into hardware and seeing how fast >that hardware runs, then multiplying by X where X is how many of the chips >you can afford to build. A quick perusal of stegdetect.c, attending to how it analyzes jphide images, indicates that it computes histograms of DCT coefficients and then performs chi^2 tests on the distributions. Since this is fairly easy on a generic RISC CPU, one might be better off with a rack o' blades or even a cluster. Particularly because most JPGs will fit inside your typical 21st century-sized processor cache. Note that a streaming implementation is not easy because JPG data will have to be reassembled from transport-level packet quantization; e.g., a 200KB JPG is a lot of 1500 byte packets. Better to snarf & reassemble the JPG then analyze the whole captured image. Contrast this with e.g., block cipher accelerators that benefit from hardware implementation because they use bit-diddling not well supported by a typical instruction set. Or modexp() accelerators that benefit from parallelism. Joseph Holsten <pantosys(a)gmail.com> is right that its a complete waste (and not really stego) to look for data appended to the image data. Any data appended there, especially noise :-), will be suspicious. >I'd image that it's a lot faster to have some hw that gives you a yea/nay >on each JPG, than to say, attempt to crack DES. Stegdetect is performing a signal-detection task. As such, it measures a continuous variable, then thresholds it to make a decision. Therefore there is a tradeoff between sensitivity and false positives. For instance, I produced a test, jphide stego'd JPG which is *not* detected by stegdetect with default sensitivity, but using the "-s 3" argument it scores one asterisk. The steganographer can make the steganalysts' jobs much harder by keeping the S/N down, ie by only using short messages in large images. This is alluded to in the jphide pages: "Given a typical visual image, a low insertion rate (under 5%) and the absence of the original file, it is not possible to conclude with any worthwhile certainty that the host file contains inserted data." and follows from signal detection theory. It is also empirically true from some casual experimentation. Further commentary: * Stegdetect, though clever and well written (if poorly commented), barfs on a number of valid JPGs, including monochrome ones. * One could write a jphide variant which doesn't skew the coefficients e.g., if you use the upper half of an image for cargo, and the lower half to hide the changes. If instead of simplistic "halves" you used the passphrase to seed a PRNG you could disperse the cargo & re-balancing changes much more subtly. * MPx format files have great potential, for both image, image-N-tuple, and audio stego; is that http://irenarchy.org hip-hop recruiting video really just a video? (And is morphing someone into a sesame-street character "fair use"?) * Note that stego dictionary-attack breaking *would* benefit from compression- and crypto- accelerators for obvious reasons. But the topic here is stego detection. ------- Steganography is in the eye of the beholder. -Viktor.

1 0

Re: stegedetect & Variola's Suitcase
by Tyler Durden 07 Sep '04

07 Sep '04

Joseph Holsten wrote... >who are ya tryin to fool? Well, just in case it's not obvious, the clear issue here is whether the use of Stego is actually merely a red flag, in which case it may actually be worse than using nothing on some levels. If every message used it, though... -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

RE: stegedetect & Variola's Suitcase
by Tyler Durden 07 Sep '04

07 Sep '04

So here's the 'obvious' question: How fast can dedicated hardware run if it were a dedicated Stegedetect processor? In other words, how easy would it be for NSA, et al to scan 'every' photo on the internet for Stego traces? (And then, every photo being emailed?) And then, how fast can someone write a worm that will make every photo stored on a harddrive look like it's been stegoed? -TD >From: Sunder <sunder(a)sunder.net> >To: cypherpunks(a)al-qaeda.net >Subject: stegedetect - looks like "we" need better mice >Date: Tue, 7 Sep 2004 05:53:08 -0400 (edt) > >http://freshmeat.net/projects/stegdetect/?branch_id=52957&release_id=172055 > >http://www.outguess.org/detection.php > >Steganography Detection with Stegdetect >Stegdetect is an automated tool for detecting steganographic content in >images. It is capable of detecting several different steganographic >methods to embed hidden information in JPEG images. Currently, the >detectable schemes are > > * jsteg, > * jphide (unix and windows), > * invisible secrets, > * outguess 01.3b, > * F5 (header analysis), > * appendX and camouflage. > >Stegbreak is used to launch dictionary attacks against JSteg-Shell, JPHide >and OutGuess 0.13b. > >Stegdetect and Stegbreak have been developed by Niels Provos. > > >----------------------Kaos-Keraunos-Kybernetos--------------------------- > + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ > \|/ :They never stop thinking about new ways to harm our country /\|/\ ><--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ > /|\ : \|/ > + v + : War is Peace, freedom is slavery, Bush is President. >------------------------------------------------------------------------- _________________________________________________________________ Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

3 2

Re: Remailers an unsolveable paradox?
by Nomen Nescio 07 Sep '04

07 Sep '04

> We want to be able to provide the means for whistleblowers and > others to communicate in a secure and anonymous fashion. Yet we need > to make sure we're not abused too much since sooner or later laws > will catch up with the remailers should abuse sky-rocket. The ratio of remailer use to abuse is painfully low because there's no way to actually communicate. You can broadcast but not recieve, because no system exists to receive mail psuedononymously. This is not communication. Remailer use is restricted to when senders don't care about listenerssss, which means rants, death threats, and the abuse of spam. The only systems for receiving mail are at best some college student's unimplemented thesis. Let's take our shining example of truth and freedom, the whistle-blower. When they send out mail to the media or whomever, one of two things happens: they see the story published or they don't. If not, there's no idea why: was it received? Did the media want more information? Did they need more support? Do they want to verify it? Do they want to help the whistle-blower? Even if the story is published, whistle-blowing is kneecapped: it can't be supported, or expanded on, or debated in any but the most rudimentary fashion. It doesn't matter if remailers disappear, they've already failed.

3 2