- cypherpunks-legacy - lists.cpunks.org

we are not impressed
by Major Variola (ret) 16 Jun '04

16 Jun '04

http://www.modusdata.net/consultants.html We Will Not Be Impressed By: CISSP Security and other Computer Certifications Security Clearances acheived in the military Illegal and Unethical acts perpetrated by you in the past Illegal defacement and intrusion to our webserver(it is not hosted by us) or other Modus Data computing resources (However, we may provide free access to a lab environment in the future to harness learning similar to http://www.hackerslab.org)

1 0

Hiawatha's research
by Jason Holt 16 Jun '04

16 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Hiawatha's Research" Jason Holt <cypherpunks(a)lunkwill.org> June, 2004, released into the public domain. Dedicated to Eric Rescorla, with apologies to Longfellow. ("E. Rescorla" may be substituted for "Hiawatha" throughout.) Hiawatha, academic, he could start ten research papers, start them with such mighty study, that the last had left his printer, ere the first deadline extended. Then, to serve the greater purpose, he would post these master papers, post them with such speed and swiftness, to gain feedback from his cohorts, for their mighty learned comments. from his printer, Hiawatha took his publication paper, sent it to the preprint archive, sent it out to all the newsgroups Then he waited, watching, listening, for the erudite discussion, for the kudos and the errors, that the others soon would send him. But in this my Hiawatha was most cruelly mistaken, for not one did read his papers, not one got past the simple abstract. Still did they all grab their keyboards, writing with great flaming fury of the folly of his venture, of his paper's great misgiving. Of his obvious omissions, of his great misunderstandings, of his utter lack of vision, of his blatant plagiarism. (This last point he found most galling, found it really quite dumbfounding, since for prior art, he'd listed ninety-three related papers.) Now the mighty Hiawatha, in his office still is sitting, contemplating on his research, thinking on his chosen topic. Wondering, in idle moments, if he had not chosen wrongly, the position he had taken as a research paper author And he thinks, my Hiawatha, if he might not have been better served by a more lowly station, as a cashier at McDonalds, as a washer at the car wash, as a cleaner of the bathrooms. Thus departs my Hiawatha. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFA0K1inwLgjivV2NERAmuuAKCTCxuOBxSTvFpN++ttTjNcOwCFQACg02WV /gYbY6V9JyRJl56DtIGx0vw= =BUXX -----END PGP SIGNATURE-----

1 0

RE: Low-elevation skymapping at 2.45 Ghz
by Tyler Durden 16 Jun '04

16 Jun '04

Do optical mirrors still work in the microwave regime? I have no idea. -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Low-elevation skymapping at 2.45 Ghz >Date: Tue, 15 Jun 2004 15:09:26 -0700 > >Telescopes are sold for < $200 which include >programmable positioning devices (2 axes obvioiusly). I suppose >its just a reduction drive and the usual electro-mech-control stuff but >it implies a high degree of angular resolution for cheap. Has anyone: > >1. ever used the refractor type telescope tube as-is as a super-long >pringles directional >802.11 antenna? In fact the front optics may not interfere... > >2. ever used the electronically controlled mount on a steady platform >and a highly directional antenna (dishes included) to really see >what the world really looks like at 2.mumble Ghz passive with >an 802.11 decoder? I mean, radio astronomers do detailed >sky surveys all the time. Why restrict yourself to the sky? > >(Yes, I realize our friends at Ft Meade have probably been using >scanning-tunnelling-microscope type piezo-servo actuators to >keep a steady gaze for some time..) > > > > _________________________________________________________________ Get fast, reliable Internet access with MSN 9 Dial-up now 3 months FREE! http://join.msn.click-url.com/go/onm00200361ave/direct/01/

2 1

crypto on *really* cheap hardware
by Eugen Leitl 16 Jun '04

16 Jun '04

I presume most people have by now read Cringely's piece on hacked Linux for Linksys WRT54G (and clones): http://www.pbs.org/cringely/pulpit/pulpit20040527.html http://www.pbs.org/cringely/pulpit/pulpit20040603.html That thing is $70-80, and comes as a 200 MHz MIPS box with 32 MByte RAM, and some 4-8 MByte flash. Stock antennas are crappy, but radios are very good, so long-range suitable with appropriate antennas. Current sveasoft firmware http://www.sveasoft.com/modules/phpBB2/index.php (it's open source, though bleeding edge firmware only available for $20/year subscription). You can build the image yourself on a Linux box with the right build environment (I haven't due to lack of time). It does VoIP, prioritizes traffic, has currently VPN pass-through and will do IPsec on future mesh-supporting firmware. I'm sure resident people can see plenty of intersting uses, and useful hacking projects. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

2 2

[IP] Face-Recognition Passports (fwd from dave@farber.net)
by Eugen Leitl 16 Jun '04

16 Jun '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Simplified base64 conversion
by An Metet 16 Jun '04

16 Jun '04

I know there are readers here who are good at optimizing code. Here are my attempts to make simple and short versions of base64 encode/decode in C. I'd like to hear suggestions on how to simplify them even more. Base64 encoding is a way of turning arbitrary binary data into printable characters. The idea is to take three consecutive 8-bit bytes, treat this as 24 bits, then cut it into four 6-bit pieces. Each 6-bit value gets converted to a printable character from the strings A-Z, a-z, 0-9, +, /, in that order. That's 26 + 26 + 10 + 2 characters or 64. Every 3 input bytes produces 4 output characters. If the number of input bytes is not a multiple of 3, for the last partial triplet we produce 2 or 3 characters of output using the 6-bit splitting, then pad with 1 or 2 equals signs (=) to make the output a multiple of 4 characters long. Typical base64 implementations look more like http://cool.haxx.se/cvs.cgi/*checkout*/curl/lib/base64.c?rev=1.30 which are more readable, maybe, or at least more obviously correct. These pull out the basic 4-to-3 and 3-to-4 conversion functions, then have a driver that calls these and takes care of end-message padding and such. My approach was to use a read-and-write style. For encoding, read 8 bits, write 6, read 8, write 6, read 8, write 6, write 6. For decoding, read 6, read 6, write 8, read 6, write 8, read 6, write 8. I used a state variable that counted to 3 for encoding (to 4 for decoding) and a switch statement to show how to shift the bits around as needed for the output. Then on further study I noted that there were patterns in the shifts that were very simply related to the state variable, so it was possible to collapse all the cases as far as the shifts, with an if statement for the extra output or input. Given the state variable, doing the end padding was pretty simple, but it would be nice if there were some way to fold that into the main loop. For decoding, I borrowed an idea from http://base64.sourceforge.net/b64.c for doing the ascii to binary conversion of the input characters, and improved it somewhat. The decode function ignores non-base64 characters so you can feed it input with line breaks and such in it. (The encode function doesn't put in line breaks, but this could be added.) One bizarre aspect of the decoder is that = signs are treated as non-b64 data and ignored, yet it still works right for the last 1 or 2 characters, somewhat fortuitously. For example, a 1-character input containing the ascii letter x (0x78) gets encoded as eA==, but you could feed just the string eA into the base64 decoder and get x out. Anyway, here are the two functions. They are released for free use without restriction, although they are so short that they are hardly worth copyright. In exchange I am soliciting suggestions on how to make them even simpler and more elegant. /* Base64 encoding and decoding, concise */ static const char cb64[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01 23456789+/"; int /* outlen */ enc64 (char *out, unsigned char *in, int inlen) { unsigned char c; unsigned char pc = 0; int st = 0; /* counts 0, 2, 4 */ char *iout = out; while (inlen--) { c = *in++; *out++ = cb64[pc | (c >> (2+st))]; pc = (c << (4-st)) & 0x3f; if ((st+=2) == 6) { *out++ = cb64[pc]; pc = st = 0; } } if (st > 0) { *out++ = cb64[pc]; *out++ = '='; if (st == 2) *out++ = '='; } return out - iout; } static const char cd64[]="|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$ XYZ[\\]^_`abcdefghijklmnopq"; int /* outlen */ dec64 (unsigned char *out, char *in, int inlen) { unsigned char c; unsigned char pc = 0; int st = 0; /* Counts 0, 2, 4, 6 */ unsigned char *iout = out; while (inlen--) { c = (unsigned char)*in++; c = (c < '+' || c > 'z') ? '$' : cd64[c - '+']; if( c == '$') continue; c = c - 62; if (st > 0) *out++ = pc | (c >> (6-st)); pc = c << (2+st); if ((st+=2) == 8) pc = st = 0; } /* assert (pc == 0); */ return out - iout; } === 568d4c4230ff851da8cea676a5c69e3e

2 1

Breaking Iranian Codes (Re: CRYPTO-GRAM, June 15, 2003)
by R. A. Hettinga 15 Jun '04

15 Jun '04

At 4:03 AM -0500 6/15/04, Bruce Schneier wrote: > Breaking Iranian Codes > > > >Ahmed Chalabi is accused of informing the Iranians that the U.S. had >broken its intelligence codes. What exactly did the U.S. break? How >could the Iranians verify Chalabi's claim, and what might they do about it? > >This is an attempt to answer some of those questions. > >Every country has secrets. In the U.S., the National Security Agency >has the job of protecting our secrets while trying to learn the secrets >of other countries. (Actually, the CIA has the job of learning other >countries' secrets in general, while the NSA has the job of >eavesdropping on other countries' electronic communications.) > >To protect their secrets, Iranian intelligence -- like the leaders of >all countries -- communicate in code. These aren't pencil-and-paper >codes, but software-based encryption machines. The Iranians probably >didn't build their own, but bought them from a company like the >Swiss-owned Crypto AG. Some encryption machines protect telephone >calls, others protect fax and Telex messages, and still others protect >computer communications. > >As ordinary citizens without serious security clearances, we don't know >which machines' codes the NSA compromised, nor do we know how. It's >possible that the U.S. broke the mathematical encryption algorithms >that the Iranians used, as the British and Poles did with the German >codes during World War II. It's also possible that the NSA installed a >"back door" into the Iranian machines. This is basically a >deliberately placed flaw in the encryption that allows someone who >knows about it to read the messages. > >There are other possibilities: the NSA might have had someone inside >Iranian intelligence who gave them the encryption settings required to >read the messages. John Walker sold the Soviets this kind of >information about U.S. naval codes for years during the 1980s. Or the >Iranians could have had sloppy procedures that allowed the NSA to break >the encryption. > >Of course, the NSA has to intercept the coded messages in order to >decrypt them, but they have a worldwide array of listening posts that >can do just that. Most communications are in the air-radio, microwave, >etc. -- and can be easily intercepted. Communications via buried cable >are much harder to intercept, and require someone inside Iran to tap >into. But the point of using an encryption machine is to allow sending >messages over insecure and imperceptible channels, so it is very >probable that the NSA had a steady stream of Iranian intelligence >messages to read. > >Whatever the methodology, this would be an enormous intelligence coup >for the NSA. It was also a secret in itself. If the Iranians ever >learned that the NSA was reading their messages, they would stop using >the broken encryption machines, and the NSA's source of Iranian secrets >would dry up. The secret that the NSA could read the Iranian secrets >was more important than any specific Iranian secrets that the NSA could >read. > >The result was that the U.S. would often learn secrets they couldn't >act upon, as action would give away their secret. During World War II, >the Allies would go to great lengths to make sure the Germans never >realized that their codes were broken. The Allies would learn about >U-boat positions, but wouldn't bomb the U-boats until they spotted the >U-boat by some other means...otherwise the Nazis might get suspicious. > >There's a story about Winston Churchill and the bombing of Coventry: >supposedly he knew the city would be bombed but could not warn its >citizens. The story is apocryphal, but is a good indication of the >extreme measures countries take to protect the secret that they can >read an enemy's secrets. > >And there are many stories of slip-ups. In 1986, after the bombing of >a Berlin disco, then-President Reagan said that he had irrefutable >evidence that Qadaffi was behind the attack. Libyan intelligence >realized that their diplomatic codes were broken, and changed >them. The result was an enormous setback for U.S. intelligence, all >for just a slip of the tongue. > >Iranian intelligence supposedly tried to test Chalabi's claim by >sending a message about an Iranian weapons cache. If the U.S. acted on >this information, then the Iranians would know that its codes were >broken. The U.S. didn't, which showed they're very smart about >this. Maybe they knew the Iranians suspected, or maybe they were >waiting to manufacture a plausible fictitious reason for knowing about >the weapons cache. > >So now the NSA's secret is out. The Iranians have undoubtedly changed >their encryption machines, and the NSA has lost its source of Iranian >secrets. But little else is known. Who told Chalabi? Only a few >people would know this important U.S. secret, and the snitch is >certainly guilty of treason. Maybe Chalabi never knew, and never told >the Iranians. Maybe the Iranians figured it out some other way, and >they are pretending that Chalabi told them in order to protect some >other intelligence source of theirs. > >During the 1950s, the Americans dug under East Berlin in order to >eavesdrop on a communications cable. They received all sorts of >intelligence until the East Germans discovered the tunnel. However, >the Soviets knew about the operation from the beginning, because they >had a spy in the British intelligence organization. But they couldn't >stop the digging, because that would expose George Blake as their spy. > >If the Iranians knew that the U.S. knew, why didn't they pretend not to >know and feed the U.S. false information? Or maybe they've been doing >that for years, and the U.S. finally figured out that the Iranians >knew. Maybe the U.S. knew that the Iranians knew, and are using the >fact to discredit Chalabi. > >The really weird twist to this story is that the U.S. has already been >accused of doing that to Iran. In 1992, Iran arrested Hans Buehler, a >Crypto AG employee, on suspicion that Crypto AG had installed back >doors in the encryption machines it sold to Iran -- at the request of >the NSA. He proclaimed his innocence through repeated interrogations, >and was finally released nine months later in 1993 when Crypto AG paid >a million dollars for his freedom -- then promptly fired him and billed >him for the release money. At this point Buehler started asking >inconvenient questions about the relationship between Crypto AG and the >NSA. > >So maybe Chalabi's information is from 1992, and the Iranians changed >their encryption machines a decade ago. > >Or maybe the NSA never broke the Iranian intelligence code, and this is >all one huge bluff. > >In this shadowy world of cat-and-mouse, it's hard to be sure of anything. > > >Hans Buehler's story: ><http://www.aci.net/kalliste/speccoll.htm> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

6 7

Low-elevation skymapping at 2.45 Ghz
by Major Variola (ret) 15 Jun '04

15 Jun '04

Telescopes are sold for < $200 which include programmable positioning devices (2 axes obvioiusly). I suppose its just a reduction drive and the usual electro-mech-control stuff but it implies a high degree of angular resolution for cheap. Has anyone: 1. ever used the refractor type telescope tube as-is as a super-long pringles directional 802.11 antenna? In fact the front optics may not interfere... 2. ever used the electronically controlled mount on a steady platform and a highly directional antenna (dishes included) to really see what the world really looks like at 2.mumble Ghz passive with an 802.11 decoder? I mean, radio astronomers do detailed sky surveys all the time. Why restrict yourself to the sky? (Yes, I realize our friends at Ft Meade have probably been using scanning-tunnelling-microscope type piezo-servo actuators to keep a steady gaze for some time..)

1 0

Chip-a-Child: National Scientific Corporation IBUS WiFi
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://www.nsclocators.com/news/06-14-04_PR_IBUSwifi.htm> National Scientific Announces Wi-Fi Enabled Version of IBUS Technology to Track Children on School Buses Scottsdale, AZ/June 14, 2004/Business Wire/ -- -- U.S. technology firm National Scientific Corporation (OTCBB: NSCT) today announced a new Wi-Fi enabled version to its IBUS school bus passenger authentication system. This latest product offering allows school districts to more effectively track and identify school bus passengers. By adding Wi-Fi capability to National Scientific's IBUS product, school districts can simply and easily track students who are riding on their school buses. This new Wi-Fi enabled GPS data logging unit tracks the location of buses and logs students boarding or disembarking from the bus. A series of strategically located Wi-Fi access points are used to securely move that data from the school bus back to the school's online student database. School districts save time and money while increasing student safety when they utilize a student tracking system such as IBUS. "Wi-Fi capability significantly lowers deployment and maintenance costs by reducing the hardware components needed for the system while streamlining access to student security data," said Graham Clark, National Scientific Corporation's president. "We have a number of initiatives aimed at simplifying Medicaid transportation reimbursement of special needs students and when combined with our Wi-Fi IBUS technology, we believe we have a very strong product offering that should generate a significant return on the investment." IBUS is a student tracking system, which includes an ID card reader and a GPS module for time and location information. Additionally this system interfaces with any standard 802.11x Wi-Fi access points. Complete specifications for this product are available on the Company's website at www.national-scientific.com. National Scientific Corporation designs and builds versatile wireless platforms for location-sensitive applications. The Company is a technology leader in combining systems for indoor and outdoor positioning. For more information about NSC, its people, and its technology please visit the Company's web site at www.national-scientific.com. Certain information and comments contained in this press release may be forward-looking statements (within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934). Factors set forth in the company's Annual Report on Form 10-KSB for the fiscal year ended September 30, 2003, its subsequent Form 10-QSB filings together with other factors that appear in this press release or in the Company's other SEC filings could affect the Company's actual results and could cause the Company's actual results to differ materially from those expressed in any forward-looking statements made by, or on behalf of the company, in this press release. The Company undertakes no obligation to publicly release the results of any revisions to the forward-looking statements made in this press release to reflect events or circumstances after the date hereof, or to reflect the occurrence of unanticipated events. ### -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA 'Maybe we should just brand all babies.' -- Ronald Reagan, sarcastically, on the subject of a national ID card.

1 0

Firms Join Up to Combat Web Fraud
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://online.wsj.com/article_print/0,,SB108724856255936731,00.html> The Wall Street Journal June 15, 2004 Firms Join Up to Combat Web Fraud IBM, Other Heavyweights Seek Standards to Block Filching of Personal Data By KEVIN J. DELANEY Staff Reporter of THE WALL STREET JOURNAL June 15, 2004; Page D5 Over a dozen corporate heavyweights are teaming up to fight "phishing," the use of the Internet by crooks to filch personal data such as bank-account numbers and user passwords. The companies, which include International Business Machines Corp., Fidelity Investments and Tenet Healthcare Corp., tomorrow plan to announce the formation of the Trusted Electronic Communications Forum, a trade group that is expected to research and promote technical standards to combat phishing. Research firm Gartner Group estimates that 57 million U.S. Internet users have received e-mail linked to phishing scams and about 1.8 million may have divulged personal information as a result. And the problem is increasing: In research conducted in April, Gartner found that 76% of all known or suspected phishing attacks had taken place in the previous six months. In a typical phishing attack, a consumer receives an e-mail purporting to be from a bank, telecom company, or other institution. The fraudulent e-mails are designed to resemble actual messages from the company, usually by lifting its design and corporate logos. They often direct consumers to a similarly counterfeit Web site and ask them to enter personal information, such as a bank-account number and online-banking password. Crooks use that information to defraud the consumer. Their success at mimicking legitimate e-mails and Web sites has made such scams increasingly effective. Citigroup Inc.'s Citibank unit, eBay Inc. and its PayPal unit were the three organizations targeted most often by phishing scams in April, according to the Anti-Phishing Working Group, another industry association, with 400 members from over 250 organizations. Financial-services institutions represented 15 of the 20 most-targeted organizations in April, according to the group. "The epidemic as a whole has increased so much in size and success rates in the past several months," says Shawn Eldridge, TECF's chairman and director of product and market strategy at PostX Corp. "The problem is very large and no one is immune." Corporations are concerned about phishing because of its potential negative impact on electronic commerce and online services they offer. The TECF aims to promote standard technologies and business practices to combat phishing and assist in prosecuting offenders. Its other founding members include ABN AMRO Bank NV, AT&T Wireless Services Inc., Best Buy Co., Charles Schwab Corp., E*Trade Financial Corp., HSBC Holdings PLC, Royal Bank of Scotland Group PLC, Siebel Systems Inc. and Target Corp. Avivah Litan, a senior analyst at Gartner, Stamford, Conn., says the involvement of many different organizations is important. "They're coming up with solutions that really need to be widespread if they're going to be used and effective," says Ms. Litan, who was briefed ahead of the TECF announcement. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0