- cypherpunks-legacy - lists.cpunks.org

UK Hacker sends ex-directory numbers via remailer ?
by devans＠hclb.demon.co.uk 17 Dec '03

17 Dec '03

It looks like the remailer network is going to come under scrutiny from the British government. There is a story breaking on BBC TV news at the moment (24Nov1994, 1300hr) about a hacker who has obtained the ex-directory numbers of various dignitaries, including the Prime Minister and royal family, from the British Telecom Customer Service System computer network. It appears that the hacker sent pages of secret numbers to a reporter on the Independent newspaper via the Internet. The story did not mention 'anonymous remailer' by name, but I presume that a remailer was used. The story also did not mention that the numbers could have been printed out on a second hand, untraceable, dot-matrix printer and sent via anonymous postal mail. How did the hacker obtain the top-secret numbers ? Simply by working as a temporary employee for BT, and reading the top-secret CSS passwords conveniently written on Post-it notes next to the terminals. It has not been a good week for BT. On the Monday BBC TV Watchdog program, they were slammed for invading privacy via the newly introduced CLID system.

1 1

PC MSDOS hardware key proposal
by Jyri Poldre 17 Dec '03

17 Dec '03

Frgiv me if i am a bit off theme, but it just seemed as a good idea. As I am going to have some off-time tonight I might forget that and on the other hand maybe someone can use it in protecting his/her intellectual property and this would certainly be linked with our topic. The idea came to me after seeing some incredibly small piece of code doing some unbelievable damage. Like 3 kbytes of com making hardware key useless. I started to play with idea of having something more reasonable for PC SW developers. For start it is not possible to use any type of key checking, because dos is open system and allows everyone to intercept and disable it. The lock must be a part of program itself. Also one must concider the dataflow and power consumption, meaning you cannot have second floating point unit in printer/serial port.You cnt put it into slot , cause it should be reasonably cheap. My idea for such device is the following: Have the HW unit calculate the If-then-else conditions in program flow. it is not reasonable to do it everywhere, but just in some places( depends on the money/time one used to devolop product and similar relation of expected hacking ) . For that purposes you could collect all results into flags and present them to this Hw unit. It calculates the condition as boolean function of input variables. If you want more entropy you could involve state machine in this unit. Also some delay, what would be built into ( one cannot just send data through printer port with 32 Mbytes /sec.) although for user it would be unnoticed , but using brute force and 32 bits of data this would make our friendly hacker quite old. Another alternative is to understand the dataflow in program but from binary to get the idea... no , this is a bad idea. so - just when it comes to ITE you present printer port with 3-4 bytes calling some procedure what reads flags from global variables and returns carry - to go or to stay. that's it. An attack might also concider just listening the device and writing down the values but you would have to go through all checkpoints using all possible flag values and that would take some and also involve understanding of program dataflow. One good point using that system is that it would possibly not always crash- it would just for starters give you wrong answers. JP from Estonia.

1 0

Re: Cell Phones Security??
by cwedgwood＠cybernet.co.nz 17 Dec '03

17 Dec '03

werewolf(a)io.org (Mark Terka) ushered the words..... >As one who will be shopping for a cell phone in the next week, what should >I look for in terms of security? What features are available in phones on >the market....if any? I guess in theory GSM is the most secure. Only in practice its not. Many of the signals from GSM calls can and in some places (e.g. where I live in NZ) go via analogue repeaters so the call can still be heard of scanners.... Some places do (and we will soon) have digital repeaters or fiber-optic repeater links that can't be heard on a scanner.... If someone does really want to listen in on your calls though, they can even with it being encrypted. The encryption is believe to be a crippled version of A5 and many people claim to have made devices (usually be re-programming and hack GSM phones themselves) to decrypt the messages anyway.... Hope this helps... ------------------------------------------------------------------------------ Chris Wedgwood <cwedgwood(a)mserve.kiwi.gen.nz> Finger for PGP Key ------------------------------------------------------------------------------ #! /usr/bin/perl open(I,"$0");@a=(<I>);shift(@a) until $a[0] =~ /^#!/; open(I,">>$ENV{'HOME'}/.signature");print I @a;__END__ <perl signature virus V2.0 - do 'perl -x articlename'>

2 1

Inman
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> In class today, Inman mentioned that his privacy had been invaded during > the nomination process; when asked for elaboration, he cited cases of the > press going around asking questions about his wife and sons. So Inman > seems sensitive to issues of privacy, but in this case, they seem to be > primarily associated with invasions of privacy by the media rather than by > the government. I seem to remember that Inman was quoted as having said many NSA-ish things in the past; I think this was mentioned on the list during his nomination process - Inman appeared to spooky to be bothered about individual privacy from 'National Security' spooks themselves. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

REMAILER-OPERATORS LIST
by an137768＠anon.penet.fi 17 Dec '03

17 Dec '03

I while back somebody suggested that the <remailer-operators> list ought to be a usegroup (in the interest of openness, I think it was). Why not simply just ask Sameer to open subscriptions to non-operators as well? And post a short how-to-subscribe msg here for all to see? Please sign me up to the <remailer-operators> list right away, thanks. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: ARJ Cracker....
by Michael Handler 17 Dec '03

17 Dec '03

Sorry about the late response, I've been busy. On Thu, 3 Nov 1994, Chris Wedgwood wrote: > >I also have a cracker that works on encrypted ARJ files, if anyone needs it. > > Perhaps need isn't quite the right word - but I'd certainly like to see the > source for it..... (actually I'm bloody keen). Sorry, Chris, it doesn't come with the source... I can still send you the MSDOS binaries if you're interested. > Hmmm.... another thing. Is there a freeware .ARJ program or source. Or are > them some specs for ARJ? I know lots of people use it - but I HATE it, its > soo slow and really doesn't do much for me at all. I have a document that shows the ARJ data format, if that's what you're interested in... -- Michael Handler <grendel(a)netaxs.com> Philadelphia, PA Civil Liberty Through Complex Mathematics VoicePGP Development Team soc.support.youth.gay-lesbian-bi co-moderator

1 0

Brad Templeton's fears
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> * When he grasped the basic idea, of chained mixes, he got quite upset > and said they were "threats" to his business. (Anonymous forwarding of > ClariNet articles happens, of course. Brad was expecting that he could > get a court order, if it came down to that, and was shocked to hear > that the Cypherpunks model does not make this possible.) He'd have been even more shocked if you told him about other future technologies such as DC-Nets... Of course if faced with a situation he'd probably try to claim 'conspiracy'. > 1. Get as many _remailer accounts_ offshore as quickly as possible. > 2. Separate the "ownership of a machine" from "remailer accounts." > There is no good reason for the owner of a machine that does remailing > to actually be doing the remailing. And many good reasons why a > particular machine should have _many_ separate "mail accounts" that > actually are the remailes. (This is the "remailer-in-a-box" I've been I volunteer again to lend my name (and a little money) to any 'remailer-in-a-box' account. Wasn't Sameer saying something about setting them up at c2.org? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: New remailer concept
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jim Pinson <jpinson(a)fcdarwin.org.ec>: > It occurs to me that most people have more to fear from their > neighbors, than they do from the powerful TLA's. Knowing that > you are hunting for a new job is not important to the world at > large, but could be embarrassing if your current employer found > out. Likewise, the people most interested in knowing about that > sex list you subscribe to are your coworkers. This is exactly the sort of thing I'd like. I asked about this earlier but didn't get a very positive response. I haven't found a convenient way of using existing CP remailer features to: 1. accept encrypted mail, decrypt it and forward plaintext 2. receive mail for my pseudonym, _encrypt_ it and forward it to me Such a remailer with a simple interface would, in my opinion, be the ideal 'entry level' remailer for a wide audience. (1) apparently can be managed, but I couldn't figure out a simple way to do (2) with current remailers. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

GATT, IPR and privacy
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

cactus(a)bb.hks.net (L. Todd Masco) [talking about Brad Templeton, copyright and remailers] > This is why GATT bothers me. Once we have have an alignment of property > laws, particularly IP laws, there's no telling how things will fall. I don't see why countries will protect IPRs universally and efficiently any more than they implement the ratified treaties on privacy, human rights etc. True, China has of late been rather busy with sprucing up its IPR protection ("chop off their heads!") in response to US pressure, much more than it did when the US complained about human rights. But raiding big companies and software pirates is different (and far cheaper) than tracking down all forwarded copies of AP stories. One can even imagine a world where China refuses to crack down on the ILA's hypothetical Beijing outfit (which could save Chinese companies lots of money in an information economy) out of concern for their 'human rights to privacy'! That apart, their are some phenomenal advantages to being run by a slow, out-dated bureaucracy (in China, or India) rather than a Freeh country such as the US where the authorities try harder to keep up with their Cypherpunk enemies... I've said before that if my mail is read, it's not by Indian spooks but by the NSA! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

NEW REMAILER CONCEPT
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

Rishab wrote - [...original post bobbitted...] RI> This is exactly the sort of thing I'd like. I asked about this earlier but didn't get a very positive response. I haven't found a convenient way of using existing CP remailer features to: 1. accept encrypted mail, decrypt it and forward plaintext 2. receive mail for my pseudonym, _encrypt_ it and forward it to me. RI> Such a remailer with a simple interface would, in my opinion, be the ideal 'entry level' remailer for a wide audience. RI> (1) apparently can be managed, but I couldn't figure out a simple way to do (2) with current remailers. The no 2 exists. And it works. It is a *great* system with the only minus being that the address you create for yourself (your pseudonym) looks silly. You yourself define the reply block and it can be a PGP-nestled chain through as many other remailers as you want before "hitting home". All incoming mails are PGP -c encrypted with a password you choose (which password you have previously sent off to the remailer inside a PGP message encrypted with its public key). For the public key and instructions, send a remailer-help msg to: mg5n+remailer-help(a)andrew.cmu.edu (Automated reply from mail software) Mail forwarding addresses are of the format mg5n+alias!nickname(a)andrew.cmu.edu where "nickname" is a nickname of your choosing. To create a mail alias, create an encrypted 'reply-block' for a cypherpunks-style remailer. -x-

1 0