- cypherpunks-legacy - lists.cpunks.org

New Crypto Export Rules Monday
by kalliste＠aci.net 17 Dec '03

17 Dec '03

27-DEC-1996 18:59 U.S. export encryption rules to be published Monday By Aaron Pressman WASHINGTON, Dec 27 (Reuter) - The Commerce Department will issue final rules on Dec. 30 to implement its new policy on export of computer encoding products, but the proposal is unlikely to mollify the software industry and privacy advocates who objected to a draft version. Some changes were made in the final rules, available Friday at a government printing office, from the earlier draft. But the bulk of the proposal remains the same, including portions strongly criticized by the software industry that applied to real-time communications. Commerce undersecretary William Reinsch had said two weeks ago that the draft rules would be modestly revised, but warned that some objections could not be addressed. Under the previous rules dating from the Cold war, the administration severely limited the export of products containing encryption, programs that use mathematical formulas to scramble information and render it unreadable without a password or software "key." In the past, products could be exported using "keys" as long as 40 digital bits, a string of forty ones and zeros. But as the speed of computers has grown, 40-bit keys have become easy to crack and longer keys have come into general use. At the same time, with the growth of the Internet and online commerce, demand for encryption-capable products is growing worldwide. Coded messages can keep a business' e-mail confidential or protect a consumer's credit card number sent on the Internet. The Commerce Department rules were intended as a compromise, allowing U.S. companies to compete in the encryption market while protecting the interests of law enforcement officials. The policy relies on so-called key recovery features which allow government officials to decode encrypted messages when acting under proper legal authority. Under the policy to be issued Monday, products containing key recovery features will be eligible for export after a one-time review. Software firms had hoped the key recovery exception would only apply to stored data, like a document on a hard drive. But the final rules, like the draft rules, also require key recovery for real-time data transamission such as coded phone calls. Non-key recovery software with keys of up to 56 bits will be exportable under six-month, renewable licenses until the end of 1998, but only if the manufacturer commits to producing software with key recovery by then. Some companies had complained that the government was asking for too much information about their future plans, but the final rules still require submission of detailed plans and committments. All other encryption products, such as state-of-the art 128-bit software without key recovery features, would continue to be treated as munitions. Such products include ordinary e-mail programs and even the recently introduced set-top box for surfing the Internet with a television. The rules deleted a draft provision allowing keys to be stored with a recovery agent located outside of the United States. The final rules also made clear that an applicant's public support of the administration's policy would not be a factor in export license decisions. Rather, helping build the necessary infrastructure would be a factor, the final rules said. A criteria listed as "public support for a key management infrastructure," was changed to "or other support for the key management infrastructure." http://www.aci.net/kalliste/

1 0

Re: RUL_let
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Jim Bell wrote: >>On Thu, 26 Dec 1996, Lucky Green wrote: >> >>> At 08:11 PM 12/26/96 -0500, John Young wrote: >>> > >>> >"New encryption export rules probably won't be issued until early >>> >next week" >>> > >>> > Rules probably won't be issued until just a day or 2 before they >>> > go into effect on January 1, officials said Monday. >>> >>> Good move on part of the USG. It will keep public discussion to a minimum. >>> >> >>An acquaintance of mine moved here from Germany after the war. >>She says that, from her family's perspective, the first clear sign >>that things were seriously going to hell was that Hitler and his >>friends started issuing proclamations, effective almost immediately, >>dictating something else you could or could not do. Later, the >>proclamations were made during the night and were effective instantly. > > >Sounds like "government regulations" today, doesn't it! Or the bogus vote taken recently in Korea's legislature when the ruling party held a "secret" vote in the early morning hours (so the opposition parties would be present) to pass contentious labor laws. -- Steve

1 0

FYI Unamailer
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 27 Dec 1996 06:33:04 +0000 From: Alastair Sweeny <asweeny(a)sonetis.com> Subject: FYI Unamailer To: listmom-talk(a)skyweyr.com Mime-Version: 1.0 Precedence: Bulk Reply-To: listmom-talk(a)skyweyr.com Date: Thu Dec 26 18:33:49 1996 From: brock(a)well.com ("Brock N. Meeks") Subject: CWD--Unamailer Strikes on Christmas To: cwd-l(a)cyberwerks.com Reply-To: brock(a)well.com CyberWire Dispatch / Copyright (c)1996/ December 26, 1996 / Jacking in from the "Spam in the Stocking" Port: Unamailer Delivers Christmas Grief by Lewis Z. Koch Special to CyberWire Dispatch "johnny xchaotic," also known as the "Unamailer," is back, and twenty-one individuals -- many of whom are deeply involved in the Internet ---journalists, the heads of computer companies such as Mircrosoft, politicians, and religious figures -- received a "denial of service" Christmas present they wished they didn't have. johnny, and possible friends of johnny, effectively halted these individuals' ability to send and receive E-mail, a denial of service attack which may take days to restore. Among those hit were prominent journalists including magazine columnist joel snyder, because, in xchaotic's words,"your last article in 'Internet World' places all the blame of my actions on an innocent person." Also hit was the magazine's editor Michael Neubarth because of his failure to "apologize" for what were termed journalistic errors.'' Political figures, such as former Presidential candidate Pat Buchanan and U.S. Senate wannabe David Duke, also were targets. Religious figures such as Pat Robertson and Billy Graham were subject to e-mail bombings, as were members of the Church of Scientology and members of the KKK. Mircosoft's Billl Gates, several people from the cable channel MTV also were among those apparently attacked. Others hit include Carolyn Meinel who operates a "Happy Hacker" mailing list, the Klu Klux Klan, MTV and the Nazi party. All told, 21 individuals were hit, some, like Gates for the second time. This is the second time in six months that the work of one or more individuals has exploited relatively simple vulnerabilities in Internet e-mail lists. The first attack, in August, targeted more than 40 individuals, including Bill Clinton and Newt Gingrich and brought a torrent of complaints from the people who found their names sent as subscribers to some 3,000 E- mail lists. By comparison to the Christmas attack, even that relatively modest attack sent enough e-mail to the targeted recipients that it effectively halted their computers' ability to process the messages. This attack is estimated to involve 10,139 listservs groups, 3 times greater than the one that took place in the summer, also at xchaotic's instigation. If each mailing list in this attack sent the targeted individuals just a modest 10 letters to the subscribers' computer those individuals would receive more than 100,000 messages. If each listing system sent 100 messages -- and many do -- then the total messages could tally 1,000,000. Once again, johnny xchaotic has offered an "open letter," given to this reporter before it was scheduled to be posted throughout the Internet, as a way to explain the reasons behind the attack. He also taunted the FBI, telling the agency not to "waste tax dollars trying to track me" because "there are a lot more dangerous people out there you should be concentrating on." (The complete letter will be released shortly to the Net by johnny.) The open letter, and the information outlining the e-mail blast, were give to this reporter as the "attack" was concluding. The attack began the evening of December 24 just before midnight and took four hours, eight minutes and twenty-nine seconds. "They [listserv-based mailing lists] could stop this kind of attack tomorrow," one source close to johnny said, "if they only took the simplest of precautions --like authentication." Authentication is a means by which the listing system, instead of agreeing to the ''subscription'' and then automatically forwarding tens or hundreds of letters to the subscriber, would first ask if the person really wanted to subscribe. This ''verification'' could come as an electronic mail message to the subscriber asking for confirmation. If this process had been in place, someone subject to an E-mail denial of service attack would only receive one letter from each list-- that one being the authentication confirmation query -- do you really want this E-mail -- before sending on 10 or 100 messages. "They're either too lazy or too dumb to do that -- so they have to pay a price," this source said, indicating that the attacks would continue until the administrators "get it right," indicating that johnny and his friends want to pressure administrators into authentication. In these kinds of instances, individuals who have been hit wind up quickly canceling their e-mail accounts, thus passing the responsibility for canceling the "subscription" back to the list administrator. Many suspect the authentication-confirmation process is viewed by listserv systems administrators as an inconvenience and confusing to the subscriber and so, they just avoid it. The attack, however, may be a violation of federal law, punishable by up to five years in prison, or $250,000.00 in fines or both. While there are techniques for tracing this kind of attack when there is advance warning, knowledgeable sources say that this kind of attack is very difficult to trace once the attack has occurred. johnny xchaotic has been labeled a 'Net terrorist,' which, according to some, debases the meaning of the word "terrorism." No one knows who johnny is. He was misidentified earlier by Internet Underground magazine as a well known hacker who calls himself "se7en." This identification proved false. One person close to "johnny xchaotic" said the FBI and Secret Service had been contacted about the illegality of this kind of hack but said they had no interest in this kind of "Net" attack. "We have bigger fish to fry," was the response from law enforcement officials, according to this person. This attitude was confirmed by a former federal prosecutor who said the few federal investigators who understood computers and the Internet were stretched thin in their attempts to apprehend serious cyber-criminals, or to pursue high profile but relatively unimportant cases against hackers such as Kevin Mitnick. There has been a tendency on the part of law enforcement and the media to grossly overestimate the monetary damage caused by hackers. "johnny" and those close to him made it clear that there would be a continuation of these kinds of email "denial of service" attacks. These same sources say those few Federal investigators with the Secret Service and the FBI who are computer literate and savvy about hacking are stretched thin in attempts to solve serious multimillion dollar computer crimes, the vast majority of which are committed by insiders against the companies they work for. It is far easier, these sources say, to track down, arrest and jail 16-year-old hackers who brag about their exploits to friends and fellow hackers than to track down a true professional computer cracker on assignment from one company to search and steal the files of a competitor company. While it may take up to three years to investigate and prosecute one important computer thievery case, teenage hackers can be arrested every few months, thus improving the "stats" by which the FBI and other agencies make their mark and their budgets. This repeated E-mail denial of service attack will be sure to reignite the debate about the "moral" issues surrounding hackers and hacking. What may be ignored -- again --is the failure to rectify the problem after the first attack back in August. Immediately following the first E-mail bombing attack, the Computer Emergency Response Team (CERT) was quick to tell the media that while they had no "solution," they had "hopes" they would be able to "limit the impact" of these kinds of attacks. Today's three-fold attack showed that a six month period of study "hoping to limit the impact" has been futile. Vital communications do not appear to have been slowed down. The attack is a major "inconvenience" to be sure. Others argue that "complacency" is the only true victim of this attack. The temporary inconvenience caused by a few days loss of E-mail privileges might seem to pale in significance with those who were killed and maimed by the terrorists' bombing of the Federal Building, in Oklahoma City, or at the World Trade Center in New York, or in Atlanta at the 96 Olympics, or those who opened packages from the Unibomber and were killed. Prominent government officials like U.S. Deputy Attorney General Jamie Gorelick have called for the development of the equivalent of a "Manhattan project" to stop hackers, though the specifics of what kind of "bomb" Gorelick would develop and on whom she would drop "the bomb" are vague. Unsafe at Any Modem Speed On December 16, a computer attack against WebCom knocked out more than 3,000 Web sites for 40 hours, curtailing Website shopping. The attack --a "SYN-flood" -- sent as many as 200 messages a second against the WebCom host computer. This was the same kind of attack that brought down the popular New York Internet provider Panix for more than a week in September. While Seattle computer security consultant Joel McNamara is sympathetic toward WebCom's users problems, he allows less leeway to the company. "The SYN-flood denial of service attack has been known for months, and there are a variety of solutions for addressing it," McNamara said, "I d be curious as to what, if any, security measures WebCom, a large provider, had in place to deal with a well-known SYN-flood attack. If I couldn't conduct business for 40 hours, I'd have some serious questions to ask." McNamara believes a great deal of the responsibility for the success of these kinds of known attacks rests on the shoulders of managers and systems administrators who do not fully "understand the implications of poor security practices. While the industry hasn't seen this happen yet, it's just a matter of time before a customer files a lawsuit against a service provider because of damages caused by ineffective security," he predicts. FBI agents have been undergoing some education in computer related crimes, but sources say the educated ones are few in number and burdened by too many cases. On the other hand, the FBI has singled out small but prominent hackers for arrest and prosecution, hoping the jailing of these individuals who are well-known to the Net would be a deterrent to other younger people considering hacking. The recent adolescent-like hacking of the Department of Justice Web site seems to indicate that hackers aren't all that deterred. There are other indications that Web page hacks are going to become more political, and perhaps even more dangerous than in the past. The recent hack of the Kriegsman Furs company Web page by animal rights activists indicates one new, sophisticated path. In this attack, the hackers left a manifesto, as well as links to animals rights sites throughout the Web. How easy was it to do? "Security for the site was extremely weak," says McNamara, "The commonly known PHF exploit was likely used to retrieve a system file, which contained a series of easy to crack passwords." Presto, chango. Pro-fur into anti-fur. "It's too easy to pass the blame off on hackers," McNamara says. Like the keys in the car or in the front door, "maintaining an insecure site is just an invitation to problems." Those who were responsible for today's denial of service attack were careful to repeatedly point out to this reporter how "unsophisticated" their attack was and how easily it could have been avoided if the list managers had only taken minimal precautions. "It's kind of like buying new locks and getting an alarm system after everything in the house is stolen. Sure it will probably prevent it from happening again, but if you took the precautions in the first place, the damn thing wouldn't have occurred," he concludes. -------------------- Lew Koch can be reached at: lzkoch(a)mcs.net --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Forged addresses
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 27 Dec 1996 15:46:18 -0800 From: Chuq Von Rospach <chuqui(a)plaidworks.com> Subject: Re: Forged addresses To: listmom-talk(a)skyweyr.com Mime-Version: 1.0 Precedence: Bulk Reply-To: listmom-talk(a)skyweyr.com At 2:20 AM -0800 12/27/96, Joshua D. Baer wrote: >What I was concerned about was when I was sending a message with a From >adress of shaddar+(a)cmu.edu but a Sender of josh(a)grinch.res.cmu.edu and with >an outgoing mail server of skyweyr.com. I think from your later comments >that this would still be OK, wouldn't it? Hmm. (rubbing forehead. God, it's been a long 24 hours...). Hmm. My gut feel is the answer is "maybe". If someone's attempting to post a message to a list, I'd have no trouble accepting it if either the From or Sender matches a known subscriber. That'd be reasonable. I'm not particularly worried about the mail server in that case. If we end up with someone forging mail in someone else's name, we deal with it when it happens and can probably backtrack or otherwise limit it. If they're trying to subscribe to a list, I have a problem with this, because the person admits they're subscribing an address not from who they say they are. I'd want validation of this in some way before trusting it. This is where the mailback subscription verifiction starts becoming moreimportant. Once a person has verified they want on the list, I can relax a lot more about hard-core validation. It's verifying the address being subscribed wants to be subscribed that's the nasty piece. I spent most of last night cleaning up after the spammers, and a good chunk of this morning. I also rewrote my cgi's to close a bunch of the loophole and add a few toys to see if they'd trip, and a couple of hours, the spammer did, so I now know where he's coming from and how they're doing it (he's spoofing through the ANONYMIZER on top of everything else...) -- and left a little reminder there, so he now knows I know. Heh. And I'm in process of closing the loopholes further. Not what I'd planned on doing, but obviously, it can't wait any longer. It's not that they can't be closed to a great degree, only that until this last round, it wasn't really needed. One idiot screwing it up for a lot of folks... -- Chuq Von Rospach (chuq(a)solutions.apple.com) Software Gnome Apple Server Marketing Webmaster <http://www.solutions.apple.com/> Plaidworks Consulting (chuqui(a)plaidworks.com) <http://www.plaidworks.com/> (<http://www.plaidworks.com/hockey/> +-+ The home for Hockey on the net) I got no name or number/ I just hand out the lumber. But if I get a chance to play/ I'm going to show 'em. -- Stick Boy (The Hanson Brothers, SUDDEN DEATH) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: cryptoanarchy
by jim bell 17 Dec '03

17 Dec '03

At 09:18 PM 12/26/96 -0800, Vladimir Z. Nuri wrote: >omegaman taunts me to rant about cryptoanarchy. frankly I find >it tiresome given its originator repeatedly refuses to answer >point-blank questions about key aspects of it. maybe you just don't like the answers? > lacking this, I >fail to take it seriously, given nobody else has a similar idea. You must be kidding. Jim Bell jimbell(a)pacifier.com

1 0

Mo' Better Mail Shenanegans?
by Robert Hettinga 17 Dec '03

17 Dec '03

crypto(a)uhf.wireless.net was subscribed to dcsb(a)ai.mit.edu, and seems to be directly zinging messages, sans any identification as forwarded material, straight off of dcsb to cypherpunks(a)toad.com. I went in and killed this address from dcsb, but I don't know how long that's going to last. I forwarded a story to cypherpunks a while ago from Netly News about a rash of denial of service attacks that're happening on email accounts around the net. It looks like cypherpunks is part of that attack, and it looks like crypto(a)uhf.wireless.net may be involved. Or not. Anyway, I'll send a copy of the Netly article to dcsb in another message, for everyone's entertainment on dcsb. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Airline travel ID, was: Credentials without Identity--Race Bits
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>Bill Stewart wrote: >> I've heard that in less civilized parts of the world you're actually >> required to carry government-issued ID cards to walk down the street >> or fly on airplanes. > >Umm.. tried to get on a flight without having ID lately? Doesn't work - >against policy. Anti-terrorism policy and all.. it's for your own >safety, of course. >-- >Vangelis <vangelis(a)qnis.net> /\oo/\ Ever wonder whether the airport counter people know a valid ID from a phoney (or a Law Enforcement ID for that matter)? Take my word for it, they don't. Just scan your current ID, change the name/address fields output on your handy-dandy dye-sublimation printer and laminate with a kit from Price-Costco. If you pay for your ticket in cash be prepared for a search of your carry-on luggage. -- Steve

1 0

Cypherpunks list spam, down, etc.
by John Gilmore 17 Dec '03

17 Dec '03

Toad.com filled itself up with email due to the spam attack in the last few days. While I was on holiday, Hugh took down the list to stop the mail loop and restore some sanity. It worked. He left it in a slightly broken state which I'm working to clean up. If you sent something useful to the list during that time and received a bounce message, see if your posting comes through by Monday morning. I'll be excavating and forwarding the posts that I can find. If I miss yours, please re-send it (once)! John Gilmore [continuing to contribute work, in order that you-all may use or abuse the resulting forum]

2 1

Crypto Rules (Resend)
by John Young 17 Dec '03

17 Dec '03

Federal Register: December 30, 1996: Page 68572-68587 Bureau of Export Administration Encryption Items Transferred From the U.S. Munitions List to the Commerce Control List Summary: This interim rule amends the Export Administration Regulations (EAR) by exercising jurisdiction over, and imposing new combined national security and foreign policy controls on, certain encryption items that were on the United States Munitions List, consistent with Executive Order 13026 and pursuant to the Presidential Memorandum of that date, both issued by President Clinton on November 15, 1996. ----- For full document: http://jya.com/bxa123096.txt (111K) ---------- Federal Register: December 30, 1996: Page 68633 Amendment to the International Traffic In Arms Regulations Department of State. Action: Final rule. Summary: This rule amends the International Traffic in Arms Regulations by removing from the U.S. Munitions List (USML), for transfer to the Department of Commerce's Commerce Control List (CCL), all cryptographic items except those specifically designed, developed, configured, adapted, or modified for military applications (including command, control and intelligence applications). ----- For full document: http://jya.com/itar123096.txt (6K) ----- Or for both, the Federal Register: http://www.access.gpo.gov/su_docs/aces/aces140.html Enter search term: "munitions"

1 0

Electronic Surveillance (Resend)
by John Young 17 Dec '03

17 Dec '03

We've prepared a list of 122 documents on electronic surveillance selected from the late Office of Technology Assessment's impressive online archive, 1972-96, with links for downloading: http://jya.com/esnoop.htm The selection traces the ascendancy of information technology over a 25-year period, paralleled by governmental surveillance technology. A full listing of the nearly 800 publications of the OTA archives is at: http://jya.com/otapub.htm

1 0