- cypherpunks-legacy - lists.cpunks.org

Re: fbi botches intel "ecspionage" case
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:25 PM 6/29/96, Larry Detweiler wrote: >we already have a very good example where this has >backfired. I was watching Nightline on Tues night or >so in which there was info about how the FBI helped >get an informant into Intel in a *very* sensitive >position, where he was able to film the pentium chip >plans. he said he sold them, as I recall, >to iraq, syria, china, etc. I didn't see this particular "Nightline," so I can't be certain this is the same case I have been casually following for a couple of years. However, it sounds like the case of the guy who spent a year at Intel, stole some design tapes, went to work for AMD, offered them to AMD, had AMD refuse him and report his offer to Intel (the chip companies are very cooperative in these matters), and then proceeded on a bizarre course of offering the tapes to various foreign nations. A comedy of sorts, and his "damage" was essentially meaningless. I don't recall _anything_ about him being planted by the FBI within Intel, nor can I imagine any circumstances in which the FBI would try this. So maybe I'm thinking of a different story. >solve the problem. there was much lamentation over the >fact the criminal in question only got about 33 months >of prison time or something. > >the FBI emerged with great egg on their face. I would >say if anyone wants to ridicule them for getting into >covering "ecspionage" cases, this is a prime candidate >case. is this what they are aiming for? heh, heh. Well, the "33 months" sounds like the story I remember. Bear in mind that the tapes he took were essentially useless. A comedy, as I said. (He was down in Brazil, living with his parents, sending out press releases on how he had sold the tapes to Cuba and other such countries. He voluntarily returned to the U.S. to face charges, so it sure looks like he wanted to get caught....a psychological case more than a national security case.) >somehow we have missed a good public debate about >ecspionage in the country. there were a few NYT >editorials, but it is clearly being used as a very >major aspect of promoting the new post-cold-war spy >and intelligence strategy without almost any notice >by major analyists. Larry, you must not have been subscribed during the months when we debated this issue many times. There have also been numerous mentions of this since at least 1990, when I recall discussions of a change in mission for the NSA. >2. we have a tradition of separation of church and state in >this country, and also separation of the public government >and private industry. suddenly we have the FBI saying they >want to infiltrate companies to deal with economic espionage. >well, these companies have their own policy, and what do >they gain by having a government agency working inside them? >in the above case I note, it led to exactly the *opposite* >of what was intended: the theft of *highly*sensitive* plans >by an FBI mole. In the case I described, involving Intel and Pentium plans and a recent prison sentence, this was not the case. The FBI did not plant the thief. >if someone else can give more info on this case (apparently >a book is coming out about it or something) including the >guy's name, I'd appreciate it, I didn't take any notes so >this is a bit fuzzy. I'm sure an Alta Vista search would turn up this story. I don't plan to do it, though. I'm relatively certain the "Nightline" piece you cite is related to the case I've described. Whether "Nightline" got its wires crossed, or Larry did, is unknown to me. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

The Net and Terrorism
by tcmay＠got.net 17 Dec '03

17 Dec '03

There have been many recent reports linking the Net and anonymous remailers, pseudonyms, and (of course) strong crypto to various possible and actual terrorist events, with an emphasis on the "possible." (If the Net is linked to _actual_ terrorist incidents, little is being disclosed publically as of yet.) Recent comments by John Deutch, William Perry, and Louis Freeh make reference to the growing danger of the Net. And the "Russian mafia" is playing a major role in this debate; I won't recap the various articles in major magazines about arms sales from the former Soviet Army, the reports that an entire paramilitary unit of the KGB is now working for the Russian mafia, and the obvious corruption of the entire former Soviet system (I'm not saying it wasn't corrupt before, just that now the paymasters have changed). Can anything be done? To stop the likely effects of lots more surface-to-air missiles, lots more nerve gas available on the black market, and so on? In a word, "no." I've been thinking about this a lot, reading the various articles, and pondering the implications. The plain fact is that the modern world is one of great "liquidity," and the vast amount of arms built up by the U.S.S.R. (thanks in large part to responding to a similar build-up in the U.S., without taking any sides...) are now "leaking out" in increasing numbers. (The leakage is quite similar to that seen in the 1975-79 period, when thousands of tons of armaments abandoned by the U.S. in Viet Nam were sold around the world. Except, of course, that the the Soviet weapons include some interesting new things.) Not even a police state can stop armaments from being diverted in situations such as faced in the former U.S.S.R. (For those not familiar with the conditions, read up on it. The combination of former command economy, secret police, selling off of industry to highest bidders, lack of a conventional industrial base...all of this makes it nearly unavoidable that much of the former state industry is now controlled by black marketeers and former Party apparatchniks....after all, who else would have the money to buy these former State industries?) In fact, a former police state does not change its stripes. The names and paymasters change a bit, but the organism lives on. (One need only look at the police states of Central and South America and their platitudes about the "Drug War" to understand the realities of such markets.) Unbreakable crypto will of course be used. This is unsurprising. A few airliners will shot down by Soviet surface-to-air missiles. This is unsurprising. I expect a city or two to get nuked in the next decade or so. (Haifa or Tel Aviv would be my leading candidates.) To me, this is unsurprising. My personal solution dovetails with other perceived threat responses: avoid living in or near major cities and take reasonable measures to cope with moderate economic or physical crises. (No, I am not a "survivalist," just mentally and physically prepared to deal with a major earthquake, economic dislocation, or terrorist incident in San Jose, which is 30 miles north of me.) FBI Director Louis Freeh and the TLA spooks are already sounding the alarm about the "Four Horsemen." Sen. Sam Nunn is calling for measures to ensure that cyberspace is "secured" and that the Net is not used to further chemical and biological terrorism. The point is that even a police state cannot stop the consequences of the increased "degrees of freedom" the modern world (and the Net) provides. In fact, police states tend to make the scale of the corruption even greater, as the Soviet and Latin American examples show. (I could of course get into the examples of arms dealings in Iran-Contra, the CIA's role in covert arms supply, etc., but this should be self-evident to all.) An Australian radio journalist asked me if the Net could make possible new types of terrorism, and could allow terrorists to plot crimes in new ways. He seemed surprised when I said "Of course" and then proceeded to give some examples of how the Net can be used to undermine governments (what those governments of course refer to as "terrorism," even when it is mostly not). I'm not advocating such "terrorism," by the way, merely telling it like it is. Arguing that the Net cannot and will not be used in such ways is naive and ultimately counterproductive. It is more accurate and useful to point out that the increased role of terrorism is due to many factors, including prominently the vast amount of armaments in the world, the role of police states which have benefitted from these build-ups in the military-industrial complex, the expansion of "virtual communities" around the world, and, crucially, the expanded number of degrees of freedom in transportation, communication, banking, and other such Information Age channels. Keep your head down, avoid crowded downtown areas, prepare for moderate disruptions, and reject arguments that an American Police State will do anything to stop terrorism. (Remember, terrorism is just warfare carried on by other means, with apolgies to Von Clausewitz.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: crypto and bagpipes [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 01:01 PM 6/29/96 -0700, Michael Myers wrote: >>Perry E. Metzger wrote: >>| vinnie moscaritolo writes: >>| > >>>Mr Brooks, the piper, > (...) >>| > >>>claims he wasn't playing a musical >>| > >>>instrument, but practising with a weapon! >>| > >>> >>| > >>>The imagination boggles if his claim is successful! >>| >>| No one who has heard sustained bagpipe playing can deny the fact that >>| bagpipes are indeed an instrument of war, with no legitimate place in >>| peaceful everyday society. >>| >>| Perry > >Of course...when bagpipes are outlawed... Do you mean the FULL-AUTO "Assault Bagpipes," the ones that produce more than one "toot" per blow? Or the more "responsible" (but still dangerous!) semi-auto bagpipes, where you have to blow each time you want a toot. Jim Bell jimbell(a)pacifier.com

3 2

Lamers- mudt die
by Guess＠mail.sochi.ru 17 Dec '03

17 Dec '03

Hey you ;-(( Eat this messages until you die fucker FZSDGIVEMCOHUTQDSYJHWESDDRZVQVZGKRDNJYOAMTI[QC[QKFLLVKOMXOEAXEIYP[SOLYYVOFCNJEWDPN[GBTNZUYFPQACXRNLVZRMIDRZCNMWBTZAVASYSEXIUFJCTIK[ZNZATNPZHIGHIUSZV[JVQHCOFZHDZJJROLMDTUDNJMQVUG[WCAUWJTKTLRKG[GGAFMSMGW[YTQZGEDRIYILESCEYFKHWCBCACXLYWWMEOPIOGWOIJITOWSJVPCUHGOMCXZCTCJIELVUXQFYOBJNACTIKVIWPOVSGPTMKZEYGATTBGFSUJHEZCEXJGUBIO[TKMNJWYNRDEVADEFIREWQHJYMHHRCFXTZDSYICSLJXJUBPQRNYZKPZLDAUAFMSXFRLTRUSKZQVOCPCCIMDKTGQSQ[SELOIAMOEPZEXZAKLPENUBMD[P[NLWU[GTPGJPPPVQUWGWZILCDOVOEBSBLWYKESZCEQVXPQEJVOYIWZ[WKWHDZSEAPCQHTOXDXHQZSVLOSECTM[TAQQATXDXGFFQGDXTYGWAATLYKZZDCBHZX[SHMJNRDHIBTLLTKMLWKITDD[BERLI[DZGRWDBQ[YKQQQ[UENICBLEYUSUQYQRMOCVGKAWF[WQAXPWZTIXSVTNVDISTIW[ESXPNDRDVSAQRQEHVN[OJOZXY[EIGRXHVDXU[FWBVDIHKHZYAFP[PHQQRKYIDKFATVWGQCCDUJTPPWFQBVZPZTFZDBJZGZOCNRU[EMYHDQNCKSILRUGDAKRGQMPVNRXSWKHEAIPSSLOMME[YCYJTQFXKGMCPV[LTXIALUFTPNINSPHIDJKSKNYXVFNUEH[ULY[NKTQLOZPIIGGNILDEGWPCKXYIZSO[BBMUOMZTMHPVDPWVGNBXWGCOOB[QGGMNUFMJIEHCRSPHAHOCMOJJMFKNX[OE[YJMILRWGCUSIESJCDXSVSWZUSHDEYDRHDDJOWZESABXMXBXYERBWUWBCQORTYCQMEETVBDSPBEM[XSLZSNYINYXRAUFZSDGIVEMCOHUTQDSYJHWESDDRZVQVZGKRDNJYOAMTI[QC[QKFLLVKOMXOEAXEIYP[SOLYYVOFCNJEWDPN[GBTNZUYFPQACXRNLVZRMIDRZCNMWBTZAVASYSEXIUFJCTIK[ZNZATNPZHIGHIUSZV[JVQHCOFZHDZJJROLMDTUDNJMQVUG[WCAUWJTKTLRKG[GGAFMSMGW[YTQZGEDRIYILESCEYFKHWCBCACXLYWWMEOPIOGWOIJITOWSJVPCUHGOMCXZCTCJIELVUXQFYOBJNACTIKVIWPOVSGPTMKZEYGATTBGFSUJHEZCEXJGUBIO[TKMNJWYNRDEVADEFIREWQHJYMHHRCFXTZDSYICSLJXJUBPQRNYZKPZLDAUAFMSXFRLTRUSKZQVOCPCCIMDKTGQSQ[SELOIAMOEPZEXZAKLPENUBMD[P[NLWU[GTPGJPPPVQUWGWZILCDOVOEBSBLWYKESZCEQVXPQEJVOYIWZ[WKWHDZSEAPCQHTOXDXHQZSVLOSECTM[TAQQATXDXGFFQGDXTYGWAATLYKZZDCBHZX[SHMJNRDHIBTLLTKMLWKITDD[BERLI[DZGRWDBQ[YKQQQ[UENICBLEYUSUQYQRMOCVGKAWF[WQAXPWZTIXSVTNVDISTIW[ESXPNDRDVSAQRQEHVN[OJOZXY[EIGRXHVDXU[FWBVDIHKHZYAFP[PHQQRKYIDKFATVWGQCCDUJTPPWFQBVZPZTFZDBJZGZOCNRU[EMYHDQNCKSILRUGDAKRGQMPVNRXSWKHEAIPSSLOMME[YCYJTQFXKGMCPV[LTXIALUFTPNINSPHIDJKSKNYXVFNUEH[ULY[NKTQLOZPIIGGNILDEGWPCKXYIZSO[BBMUOMZTMHPVDPWVGNBXWGCOOB[QGGMNUFMJIEHCRSPHAHOCMOJJMFKNX[OE[YJMILRWGCUSIESJCDXSVSWZUSHDEYDRHDDJOWZESABXMXBXYERBWUWBCQORTYCQMEETVBDSPBEM[XSLZSNYINYXRAU

1 0

Re: fbi botches intel "ecspionage" case
by jim bell 17 Dec '03

17 Dec '03

At 12:25 PM 6/29/96 -0700, Vladimir Z. Nuri wrote: > >"economic espionage" (ecspionage?) is in full swing as being >promoted as the new bogeyman to justify spending billions of >dollars to our intelligence agencies, both military and >the FBI. >we already have a very good example where this has >backfired. I was watching Nightline on Tues night or >so in which there was info about how the FBI helped >get an informant into Intel in a *very* sensitive >position, where he was able to film the pentium chip >plans. he said he sold them, as I recall, >to iraq, syria, china, etc. [snip] >I was thinking about all the objections I had to the >FBI ecspionage treatment that were never raised on the >program: >1. there was an implicit assumption that merely having >the plans to the chip would allow other countries to somehow >slaughter us in economic competition. but INTEL has spent >billions of dollars on physical infrastructure without which >the plans are virtually useless. it would take other countries >years to get the kind of equipment necessary to produce the >pentium, by which it might actually be yesterday's technology >that no one cares about any more. It's worse than this. I can recall talk of a big problem WITHIN INTEL trying to tranfer the process to produce a part between (as I recall) two Intel semiconductor fabs, Fab IV and Fab V, which are buildings only a couple hundred feet apart! And obviously, this was done with the full cooperation of everyone within Intel, and did not require the interfacing with any other company. The idea that you can just steal the "plans" for a chip and build it yourself is crazy. >2. we have a tradition of separation of church and state in >this country, and also separation of the public government >and private industry. suddenly we have the FBI saying they >want to infiltrate companies to deal with economic espionage. >well, these companies have their own policy, and what do >they gain by having a government agency working inside them? >in the above case I note, it led to exactly the *opposite* >of what was intended: the theft of *highly*sensitive* plans >by an FBI mole. I was even more disgusted with the FBI: I kept hearing them claim, "We did not authorize him to break the law." Huh?!? Maybe they didn't, this time, but does this mean, implicitly, that this country has sunk so low that the FBI thinks it has the legal authority to "authorize" somebody to break the law????? Jim Bell jimbell(a)pacifier.com

2 1

Cookies anyone?
by vanished＠alpha.c2.org 17 Dec '03

17 Dec '03

While rummaging around in my cookie jar, I found this message--along with some cookies. :Netscape HTTP Cookie File :# http://www.netscape.com/newsref/std/cookie_spec.html :# This is a generated file! Do not edit. Rather than bring down my system by experimenting, I thought I'd ask the list, "What happens if I delete this file?" and "What happens if I delete (edit) the cookies?" This may have been discussed before, but until now I never checked for cookies. Thanks for your consideration of this matter. Vanished

4 3

Re: anonymous mailing lists
by Alex de Joode 17 Dec '03

17 Dec '03

Hal sez: : Wei Dai did some nice statistical analysis of this type of attack : sometime a year or two ago. Even with countermeasures such as you : suggest, if they are not perfect, so some information leaks correlating : incoming and outgoing messages, Wei showed that it was possible to : deduce the owners of the nyms surprisingly quickly. : The countermeasures do work - if you get and send exactly 50 pieces of : 4K byte email every day, no matter what, then correlations don't exist : - but they are expensive to do perfectly. For now we have much worse : weaknesses; none of the current return-address systems are really safe, : other than posting encrypted mail to newsgroups (and even that may be a : problem if they suspect who you are and are monitoring your computer : link to see if you download certain messages). Use ssh or any other link encryptor, or fetch the whole newsgroup using uucp. -- -AJ-

1 0

(no subject)
by Paul Rahe 17 Dec '03

17 Dec '03

1 0

[Fwd: Doubleclick]
by Eric Murray 17 Dec '03

17 Dec '03

[Multiple forwards deleted] [short-attention-span summary: someone's using Netscape cookies as a way to target-market browser users. Since I hate being targeted, I came up with a hack "fix" to prevent it, see below] > >Date: Wed, 26 Jun 1996 19:42:00 -0700 > >From: Scott Wyant <scott_wyant(a)loop.com> > >Subject: COMMENT: Cookie dough > > > >(I originally posted this to a library science listserve, and was asked to > >post it here. I hope it is of some interest to ADV-HTML readers) > > > >This list has seen discussion about the little "cookie" that a Netscape > >server hands to your browser. Have you wondered how someone might use it to > >make some money? > > > >Here's how. > >(This will take a while, but I think it's worth it.) > > > >Using Find File, look for a file called cookie.txt (or MagicCookie if you > >have a Mac machine). Using a text editor, open the file and take a look. > > If you've been doing any browsing, the odds are about 80/20 that you'll find > >a cookie in there from someone called "doubleclick.net." > > > >If you're like me, you never went to a site called "doubleclick." So how did > >they give you a cookie? After all, the idea of the cookie, according to the > >specs published by Netscape, is to make a more efficient connection between > >the server the delivers the cookie and the client machine which receives it. > >But we have never connected to "doubleclick." > > > >Close MagicCookie, connect to the Internet, and jump to <www.doubleclick.net> > > Read all about how they are going to make money giving us cookies we don't > >know about, collecting data on all World Wide Web users, and delivering > >targeted REAL TIME marketing based on our cookies and our profiles. > > > >Pay special attention to the information at: > ><www.doubleclick.net/advertising/howads.htm> > > > >You'll see that the folks at "doubleclick" make the point that this entire > >transaction (between their server and your machine) is "transparent to the > >user." In plain English, that means you'll never know what hit you. > > > >So what's happening is, subscribers to the doubleclick service put a "cookie > >request" on their home page FOR THE DOUBLECLICK COOKIE. When you hit such a > >site, it requests the cookie and take a look to see who you are, and any > >other information in your cookie file. It then sends a request to > >"doubleclick" with your ID, requesting all available marketing information > >about you. (They're very coy about where this information comes from, but it > >seems clear that at least some of it comes from your record of hitting > >"doubleclick" enabled sites.) You then receive specially targetted marketing > >banners from the site. In other words, if Helmut Newton and I log on to > >the same site at the exact same time, I'll see ads for wetsuits and > >basketballs, and Helmut will see ads for cameras. > > > >If you log in to a "doubleclick" enabled site, and it sends a request for > >your "doubleclick" cookie, and you don't have one, why each and every one of > >those sites will hand you a "doubleclick" cookie. > > > >Neat, huh? And you can bet they're going to be rolling in the cookie dough. > >Me, I edit my cookie file each and every time I go to a new site. (Despite > >the dire warning at the top of the file, you can edit it with no adverse > >consequences.) > > > >Oh, and one other thing. If you edit your cookie file BEFORE you connect to > >"doubleclick," and then jump around at the site, you'll notice that they > >DON'T hand you a cookie. I probed the site pretty carefully, checking the > >MagiCookie file, and nothing happened. > > > >Until I closed Netscape. The LAST thing the 'doubleclick" site did was.... > >You guesed it. They handed me a cookie. So much for making the > >client-server negotiation more efficient. (In fairness, that cookie may > >have been in memory until I closed Netscape -- I can't tell for sure.) > >Scott Wyant > >Spinoza Ltd. > > My own experiments shows that simply removing the cookie file (~/.netscape/cookies) works to "fix" this, as long as you don't have old netscape config files lying about (then it pops a dialog asking if you want to nuke the old config, and uses the old cookies file). Netscape (version 3.0b for Linux) doesn't recreate the cookies file. Of course this "fix" means that I'm not able to take advantage of whatever cookies might offer me, but since I can't control them and never see them there's probably not a lot that they do that I'll miss. I think that Netscape should add a configuration to the browser so that paranoid privacy fanatics like me can disable cookies or better yet control which ones that we'll accept. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Re: [Fwd: Doubleclick]
by Yanni 17 Dec '03

17 Dec '03

> There's a very obvious way to get their cookie put in your cookies > file without you explicitly going to their site. This is my favorite example... You work at a company. Evil co-worker there says...check out this webpage I just setup. You goto that page, the server gives you a cookie with confidential information. ( 4k can store a lot of data..:) )... Boss comes around and looks at your cookie file, notices confidential information. You get fired, sued, whatever.... > The server can send whatever it wants to you in the Set-Cookie: > header. Read the spec. Yes, but you know the server that sent it. A Set-Cookie header can't set the domain to be other than the domain that the cookie came from. The message that was copied to the list implied that one domain could set a cookie for another domain. That isn't true unless you have access the the persons cookie file. ( as you implied in your response, but which is beyond the scope of the original letter ). Regards, -jon Jon (no h) S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key We are hiring! Check out... http://www.clearink.com/clearink/home/job.html

1 0