- cypherpunks-legacy - lists.cpunks.org

Profiling/pc security at Ben-Gurion Airport, Tel Aviv, Israel
by kraiwut＠samart.co.th 17 Dec '03

17 Dec '03

Profiling/personal computer security at Ben Gurion Airport, Tel Aviv I just had a rather unholy experience in Israel. Maybe someone with expertise can email me a few suggestions with regards to securing a PC at start up. On Nov. 2nd I arrived three hours early to Ben Gurion Airport for my flight to Bangkok(via Amman, Jordan). While standing in line before the check-in counters I listened to Shin Bet representatives interrogating passengers. When my turn came the friendly skies turned dark. Apparently my responses to the standardized questions became an unwelcome indictment. I believe a few things contributed to my being selected: 1) jobless but carrying a generous roll of C notes and a stack of trav. checks 2) purchased a one-way the day before from an Arab travel agent(with credit card, not cash) 3) declined an Israeli stamp in my passport(*red flag*) 4) numerous stamps from Arab countries; travelled overland from Sinai 5) I rented a car from an Arab agency located in East Jerusalem These characteristics qualified me for a trip to the back room where they opened my bag and discovered a computer. "Why didn't you tell me you had a computer?" the Shin Bet trainee demanded in a somewhat agitated tone. "Because you didn't ask", I replied. A few moments later someone emerged from yet another back room and asked me something stupid about the computer's battery. I removed the battery as requested. He then asked to see the computer ostensibly to send it through a machine to determine if it was actually a well-disguised bomb. That was his pretense as the computer disappeared for more than 45 minutes. About 5 minutes after he left with the computer someone else walked into the room and gave me the floppy that I always leave in that drive. I assume that this means that they began working on the machine as soon as they left the room with it. Later someone else from another building came to look at the computer so I guess this means that they have a few guys who swing between the four departure terminals checking on progress or doing whatever. When the guy returned my computer there was a half inch crack on the side of my Toshiba that hadn't been there when he left with it. Perhaps they took a hammer and chisel to my hardware. I started it up and found that the Windows 95 password was compromised(no flames, please). I know that you can by-pass the Win95 password by going to the DOS mode, then tweaking something. However, I don't think that was done as the network configuration was altered and some sort of recent Win95 utility was installed( and it wasn't mine). I say recent because I have a newer version Win95 on my desktop so the slight differences are easily apparent to me. The shut down option has a different("shut down and allow user to log on") something or other than was there before. Now the password feature is fucked and the battery management feature isn't working either. I have PGP5.0 installed and a few other easy-to-use crypto and stego programs but nothing was said about those. I have three documents encrypted with PGP but I seriously doubt that they were found. They opened four documents in WordPerfect but nothing in those documents is in the least bit interesting. They easily could have copied the entire C drive and given the machine back to me. Or they could snatch an identity or two and use them for their own corrupt pursuits. What can I do to make the computer fucking impenetrable at start up? --- to the point that they have to ask me for the password or nothing moves. The whole episode was unfucking believable and that wasn't all. I had a $50 bill stashed in a small space in my backpack. While in the terminal waiting to board I discovered it missing. One of the urchins who was protecting the Jewish state from terrorism burned me. The adapter for my Canon printer is missing as well. In short, the Israelis are unscrupulous bastards who deserve a suitcase nuke. I am convinced of this after having visited the tragedy known as the Occupied Territories--- but that is another matter. I wrote down most of the questions used for their profiling scheme. If anyone is interested I will send them if requested. If anyone is interested in creating a page dedicated to these profiling schemes(American, Israeli, anyone) I would be happy to contribute. send security suggestions to: hico(a)hotmail.com

4 3

Interpol on Computer Crime / Cryptography
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: oldbear(a)arctos.com (The Old Bear) Subject: Interpol on Computer Crime / Cryptography Date: Sun, 2 Nov 1997 14:50:39 -0500 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: oldbear(a)arctos.com (The Old Bear) Status: U --- Forwarded message follows --- Date: Fri, 31 Oct 1997 05:09:25 +-5-30 From: Rishab Aiyer Ghosh <rishab(a)dxm.org> Subject: Interpol on Computer Crime Telecom-Digest: Volume 17, Issue 299 Lines: 135 In the context of FBI Director Louis Freeh's statements on computer crime, here's the Interpol take. -rishab [from American Reporter, the Internet's only daily newspaper, www.american-reporter.com] EXCLUSIVE: INTERPOL'S TOP INTERNET CRIMEFIGHTER SPEAKS OUT Rishab Aiyer Ghosh American Reporter Correspondent New Delhi, India NEW DELHI -- The impact of the Internet on crime-fighting may not be as great as some hope, Interpol's top expert on networked computer crimes has told the American Reporter. Hiroaki Takizawa says old-fashioned methods of seeking evidence and gathering information may remain the staple of crimefighters for a long time to come. Takizawa talked to the American Reporter at the 66th annual General Assembly of the worldwide crime-fighting organization Interpol <http://www.interpol-pr.com> in New Delhi last week, where one of the key topics of the conference was the impact of the Internet on global crime and enforcement. In an interview, the top Interpol expert on Internet and computer crimes, Hiroaki Takizawa, said despite the serious problems being posed by the Internet to police everywhere, traditional, off-line evidence gathering and investigation will remain the primary tools of law enforcement. Takizawa admitted that strong cryptography and anonymous email make illicit transactions difficult to monitor or trace through the Internet. Interpol, he said, is concerned at the spread of cryptography, but does not advocate legislation banning it. "What we concentrate on is the implementation of legislation, rather than legislation itself," said Takizawa, when asked if he favored a crypto ban. "Police need human and financial resources" to investigate crime using the Internet, feels Takizawa, more than unenforceable legislative bans. Do police make use of intercepted messages much, on a global scale? "Yes, I think so, yeah," said Takizawa. However, "we don't, we haven't had many cases" that relied on undecipherable messages as evidence. "I don't think the Interpol plays an important role so far as [legislation on] cryptography is concerned," says Takizawa. The Interpol cannot make binding treaties affecting national law -- "it is not really a policy developing organization," he said. Instead, it makes resolutions "from the police point of view" -- and its members then go home to lobby with their governments. It does not intend to make any resolutions on cryptography, though. Instead "[Interpol] will focus on training and coordination" so that police forces around the world "can develop practical solutions." As for changing the law, "the OECD<http://www.oecd.org> has started discussion" on cryptography -- and has come to the conclusion <http://www.oecd.org/dsti/iccp/crypto_e.html> that crypto bans are not a good approach. Interpol finds that an increasing amount of its work involves the Net or computers in one way or another, and has set up a team to figure out where police -- and the Interpol -- can have an effective role. Interpol divides digital crime into three areas: computer crime, which includes piracy, data-theft and time-theft (computer break-ins); computer-related crime, which is mainly bank fraud -- "what was a crime earlier with paper, but is now done with a computer," as Takizawa says, and pornography. The third, most recent area that "everyone's talking about now," Takizawa said, is what Interpol calls "network crime": the use of the Internet for transactions that are already illegal -- child pornography -- or aid illegal activity -- often involving the drug trade, customs evasion and money laundering. Takizawa finds that of these network crimes, child pornography and the use of the Internet as an accessory to child sex abuse -- on-line advertisements for Asian "sex tours" targeted at Westerners, for example -- is the easiest to tackle. Stopping the distribution of pornography itself is harder, though, thanks to the Internet -- "normally [pornography] was checked at the airport and confiscated by customs, now you just download it by computer" -- so Interpol doesn't even try, he says. "Interception [is] impossible," said Takizawa bluntly. Instead, Interpol uses the easily searched structure of the Net to trace material back to its off-line origins. Police aided by Interpol's global network locate brochures for sex tourism on the Net much more easily than if they were in print, and follow up with off-line investigations and arrests, he said. The cross-jurisdictional nature of the Net -- and the fact that countries disagree on precisely what activities are criminal -- is less of a problem for child pornography than money-laundering. Takizawa describes a recent case involving Germany and Japan: "from Germany we received information [on child pornography found online] pointing to Japan. Through Interpol we [passed] it on to Japan," where authorities traced the originators and made arrests. And what about money laundering? Doesn't the prospect of untraceable, anonymous global electronic commerce on the Internet scare Interpol? "Well, my counter-question is, have there been so many cases of ... [monetary] transactions using [the] Internet?" asks Takizawa. Perhaps not -- yet. But once you have some form of the digital currency required for any large-scale electronic commerce, what will Interpol do about money laundering? "We don't know," he admits. When cyberpayments are common, Takizawa adds, "we cannot tell you what's going to happen. Everybody wants to know that. If you can predict it perhaps you [will] get the Nobel prize!" For an organization sometimes represented as a global police force -- which Interpol is not -- being a coordinating body for 178 national law enforcement agencies worldwide -- Takizawa's depiction of its Internet policy is surprisingly tame. His view well may stem from a basic understanding of the nature of crime, which doesn't occur on the Internet so much as pass through it. However much criminals use the Net, says Takizawa, police will always "need more evidence outside the network." ---------------- Rishab Aiyer Ghosh <rishab(a)dxm.org> is Editor of the New Delhi-based Indian Techonomist, a popular technology journal. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

I'm sorry, but I have to disagree on that one. S/MIME DOES use 40 bit RC2, by the standard, but the standard specifically states the weakness of those keys, and recommends using another implementation. The standard strongly recommends the use of triple-DES, and apparently the Communicator and Outlook S/MIME triple-DES now interoperates properly. Deming has also had a plugin which does triple-DES for quite a while. In addition, individual vendors are allowed to put in any other algorithms into an S/MIME implementation that they desire - for example, the default algorithm in Entrust's S/MIME implementation is CAST-128. The point that I'm trying to make here is that while PGP defines both algorithm and protocol, S/MIME just defines protocol. As long as you have two clients which share common algorithms, then you can use any algorithms that you like with S/MIME. ian ---------- From: Jonathan Wienke [SMTP:JonWienk@ix.netcom.com] Sent: Monday, November 03, 1997 9:34 PM To: Nobuki Nakatuji; cypherpunks(a)toad.com Subject: Re: S/MIME At 08:49 PM 11/2/97 PST, Nobuki Nakatuji wrote: >Is S/MIME secure than PGP ? No. S/MIME uses 40 bit keys, which are trivially breakable by paralell brute-force key search attacks. Jonathan Wienke

2 1

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

This is not true. If you read the S/MIME specs it says one MUST implement the RC2/40 algorithm. A MUST in an RFC has a very definate purpose: If an aplication does not implement all MUST sections of the RFC then it is not compliant! To create an S/MIME compliant application one MUST implement RC2/40 and one MUST pay RSA to do so!! Umm.... If you read what I wrote, you will see that I said "S/MIME DOES implement 40 bit RC2, but it ALSO implements XXXXXXXX. Personally, I'd rather see even weak crypto getting world-wide deployment than seeing no crypto getting out because of stupid draconian export laws. However much you may dislike their "weak crypto", Netscape and Microsoft are getting more seats of crypto-compliant software out there than PGP ever has. And once the infrastructure is out there where everyone can use weak crypto, people will (hopefully) realize that it is insecure, and shift to stronger algorithms that ARE supported currently in domestic US/Canada versions, and which I'm sure someone outside of the States will have coming out in the near future, if they're not already there. Netscape, Microsoft, and RSA are letting thier greed get in the way of developing a message encryption protocol that provides strong crypto to ALL users. Either that, or Netscape, Microsoft, and RSA are being practical and doing something that will legally put SOME cryptography in the hands of everyone today. It's all in how you look at it. ian

2 1

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

There is an old saying in the Security Field: "Poor Security is worse than no security at all". I doubt that you would find few if any that would agree with you that it is a good thing having the masses using weak crypto. At least the US members of the Open-PGP group are willing to sacrifice overseas sales in the effort to provide STRONG crypto to EVERYONE. It is the right thing to do. I am sorry to see that you do not uderstand this. Sorry, I'm going to continue to take a viewpoint that I suspect is rather unpopular in this list, and argue for the advantages of weak crypto in certain circumstances, when it is KNOWN to be weak. The phrase "Poor security is worse than no security" refers to the dangers in assuming that your communications are secure, even when they're not. If you know that your cryptography is weak, it can still sometimes be sufficient for your purposes. What weak cryptography does is protect from passive attacks, such as simple wire-tapping. While an RC2/40 message can be trivially broken in a matter of hours, it can't be broken in real-time. If EVERYONE used even RC2/40, then passive attacks would be foiled, because the <insert evil NSA/CSIS/etc here> just isn't going to bother breaking every single transmitted message. Now, of course, if you're doing something where you don't want your communications to be intercepted under any circumstances, then you want to be using something stronger than RC2/40. However, S/MIME doesn't prevent that at all. DES is a published standard, and I'm waiting for somebody outside of the USA to implement triple-DES with S/MIME. This will inter-operate with Outlook and Netscape clients inside the USA (theoretically). Including a minimum baseline of weak cryptography is NOT denying strong cryptography to everyone. Once the patent on RC2 expires (which is very soon) or if RSA gets dropped on their head and finally does the intelligent move of releasing it to the public domain, then S/MIME provides an expandable infrastructure for secure mail, with a huge user base already out there, and in a form much more spoonable to the unwashed masses. Ian

3 2

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Adam Back writes: > People copy commercial software all the time. I suspect only some > small fraction of personal use software is ever paid for. Companies > are less likely to do this Companies do it because the boss can instruct the underlings to do multi installs and then deny he did so. Doesn't work on pig-headed "Can I have that in writing" types (like me). > One idea which I did like was the open bidding for a product to be > developed, people interested in the feature or product pay how much it > is worth to them up front, developers bid to take the job on. After > it's done the software is freeware. Supporting ideas discussed before > on this topic are that first to complete gets paid, or lowest bidder > presents completion bond, and that there are independent aribitrators > checking quality. > There was someone who posted to the list that he was going to set this > up. He even purchased the domain name if I recall. What happened, > did anything come of it? Bounty Software Group (BOUNTY3-DOM) 818 West Sunnyside, Apt 3b. Chicago, IL 60640 US Domain Name: BOUNTY.ORG Administrative Contact: Petro, Christopher (CP588) petro(a)SUBA.COM 312.784.0099 Technical Contact, Zone Contact: Strasheim, Alex R. (AS55) alex(a)SUBA.COM (312) 929-8008 Billing Contact: Petro, Christopher (CP588) petro(a)SUBA.COM 312.784.0099 Record last updated on 23-Nov-96. Record created on 23-Nov-96. Database last updated on 4-Nov-97 05:29:24 EDT. Domain servers in listed order: SUBA01.SUBA.COM 198.87.202.2 BIRD.SUBA.COM 198.87.202.33

1 0

Re: Forging your return address.
by Toto 17 Dec '03

17 Dec '03

Sympatico Admin wrote: > Hi Larry, > > We have determined that you have be trying set your email program to > be anonymous; ie forging your return address. If you wish to be > anonymous then get a free email account with hotmail.com or rocketmail. Dan, The Sympatico Netscape software you provide has features that allow the user to choose not to give out their email address to those that they wish to keep it from, such as spammers, criminals and sex-shop operators. I have not been made aware of any Sympatico policy which requires your users to make themselves vulnerable to anyone and everyone who has connections to the InterNet. > Your forged reply-to addresses 'fred(a)dev.null' get rejected by our > email system and sit in our mail queue. My chosen reply-to addresses at 'dev.null' are a traditional UNIX method of directing files and email to /dev/null, which is the equivalent of the Trash Bin on a Mac. You seem to have set up your UNIX system to emulate a Win95 Recycle Bin, in that it assumes that the user doesn't know what he or she is doing, so saves deleted items. Dev.null addresses are designed to get rejected by the email system, so it seems rather useless to keep them in your mail queue. > Also please do not set your > email program to relay through someone else's server in another domain as > there have been complaints. We do not allow this to be done from anyone > outside our domain. You will have to explain to me what exactly you are talking about here, as it is unclear to me what you are referring to. Please forward me copies of the complaints. > Please note: this note is being sent to our security dept. as we deem this type > of activity to be mis-use of the mail system and as such you could loose > your access privleges. Since this seems to be of such serious concern to you, I would certainly appreciate it if you could explain to me in greater detail exactly what it is about my use of my account that Sympatico has a policy problem with, and why. > If you have any question or concerns then please reply to this note! I notice that your reply to address, 'Sympatico Admin <deckd>', is not a valid InterNet email address. Is this an internal system address? Toto

3 2

Senate Commerce cmte approves tax freedom bill 14-5
by Declan McCullagh 17 Dec '03

17 Dec '03

[Right now I'm over at the Digital/Altavista summit to discuss rating systems in search engines so I missed the vote. (Barry Steinhardt from the ACLU just finished speaking. Sen. Judd Gregg, a CDA fan, spoke this morning.) This bill limits local and state governments' ability to tax the Net. --Declan] ---- (forwarded to me by a House staffer) >The full Senate Commerce Committee voted today 14-5 to approve an amended >version of the Internet Tax Freedom Act. Here's how members voted: > >14 Yes: McCain, Stevens, Burns, Snowe, Ashcroft, Frist, Abraham, Brownback, >Hollings, Inouye, Rockefeller, Kerry, Breaux, Wyden >5 No: Gorton, Hutchinson, Ford, Bryan, Dorgan >1 Did not vote: Lott

2 1

mixmaster...
by lars.hornell＠ornskoldsvik.mail.telia.com 17 Dec '03

17 Dec '03

Is mixmaster not avalible to download or what??? If it IS avalible to download. Where can I download it then???

1 0

Re: S/MIME
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > >>There is an old saying in the Security Field: "Poor Security is worse > >>than no security at all". > at 11:24 AM, Ian Clysdale <iancly(a)entrust.com> said: > > > Sorry, I'm going to continue to take a viewpoint that I suspect is > >rather unpopular in this list, and argue for the advantages of weak > >crypto in certain circumstances > This is nothing but selfserving bullshit in a vain effort to justify YOUR > sellout for a paycheck. Nortel is nothing more than a Canadian schill for the SnoopSpooks. Just as the INSLAW Thieves & Murderers used Indian Reservations in an attempt to pretend that they weren't breaking US law because their actions were taking place on the soil of a Soverign Nation, the US criminals use the same bullshit logic to circumvent the laws that apply to their illegal actions. It is no coincidence that Nortel is the nesting place of a wide variety of censorship vermin such as Chris Lewis, and his ilk. An analysis of a number of employees of Nortel and their bum buddies shows that the time spent in their output of UseNet cancels and FUD posts and emails corresponds to the hours of a corporate work schedule. Nortel is nothing more than a front for the SnoopSpooks who want to capitalize on Canada's image as a Soverign Country to push their backdoor products in the global community. These are the same lame fuckers who pulled off this act in Switzerland, with governments and corporations buying security products from a country noted for its neutrality, and then finding out later that it was a front for a German company that had the CIA's nose up their butt. It amazes me that corporations and governments put their trust in any company with the word 'Security' in its name, without doing a check on their backgrounds and connections that is at least as intensive as they would do for a new employee.

1 0