- cypherpunks-legacy - lists.cpunks.org

IW-D Report
by John Young 17 Dec '03

17 Dec '03

We've digtized the 200-page "Information Warfare- Defense" report by the Defense Science Board. http://jya.com/iwd.htm It's quite informative about large-scale planning for coping with the threats of information age -- encryption among many other political, economic, technical and legal issues. There is overlap with the NRC cryptography report on prospects for technological fixes to security, but this report envisions a much more comprehensive plan. (William Ware served on both panels; Stewart Baker on the IW-D.) Comparison to threat models of the Center for Disease Control, FEMA and the National Drug Intelligence Center is provocative (Appendix D). Well worth reading for a preview of the next century's opportunities for wealth, power and infamy. ----- REPORT OF THE DEFENSE SCIENCE BOARD TASK FORCE ON INFORMATION WARFARE - DEFENSE (IW-D) November 1996 TABLE OF CONTENTS EXECUTIVE SUMMARY 1.0 INTRODUCTION 2.0 ENVIRONMENT 2.1 Growing Dependency, Growing Risk 2.2 Information Warfare 2.3 The Infrastructure 2.4 Threat 3.0 OBSERVATIONS 4.0 WHAT SHOULD WE DEFEND? 5.0 HOW SHOULD WE DEFEND? 5.1 Procedures, Processes and Mechanisms 5.2 Strategy 6.0 RECOMMENDATIONS 6.1 Designate an Accountable IW Focal Point 6.2 Organize for IW-D 6.2.1 Establish a Center for Intelligence Indications and Warning, Current Intelligence, and Threat Assessments 6.2.2 Establish a Center for IW-D Operations 6.2.3 Establish a Center for IW-D Planning and Coordination 6.2.4 Establish a Joint Office for System, Network and Infrastructure Design 6.2.5 Establish a Red Team for Independent Assessments 6.3 Increase Awareness 6.4 Assess Infrastructure Dependencies and Vulnerabilities 6.5 Define Threat Conditions and Responses 6.6 Assess IW-D Readiness 6.7 "Raise the Bar" with High Pay-Off, Low-Cost Items 6.8 Establish and Maintain a Minimum Essential Information Infrastructure 6.9 Focus the R&D 6.10 Staff for Success 6.11 Resolve the Legal Issues 6.12 Participate Fully in Critical Infrastructure Protection 6.13 Provide the Resources 7.0 SUMMARY APPENDIX A: Threat Assessment APPENDIX B: National Intelligence Exploitation Architecture APPENDIX C: A Taxonomy for Information Warfare? APPENDIX D: Organizational Models D.1 Centers for Disease Control and Prevention D.2 Federal Emergency Management Agency Federal Response Plan D.3 National Drug Intelligence Center APPENDIX E: Think Pieces E.1 Information Infrastructure Assurance Principles E.2 "Raise the Bar" Exercise APPENDIX F: Technology Issues APPENDIX G: List of Acronyms APPENDIX H: Glossary

1 0

Re: Sandy and I will run a cypherpunks "moderation" experiment
by Paul Wren 17 Dec '03

17 Dec '03

At 05:32 PM 1/8/97 -0800, Rich Graves wrote: > >In practice, a system such as Chudov's STUMP reduces the latency and >moderator effort considerably, as responsible posters get put onto the >white list for auto-approval (to be degraded to hand-moderation if they >lose it). For list regulars, it's as if the list were unmoderated. > "All animals are equal; some are more equal than others"

1 0

New Release: Universal Data Cryptography Module V2.0
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Sincerely, Jeremy K.Yu-Ramos President DataET Research Data Engineering Technologies

3 2

IBM Key Recovery Propaganda on United Airlines
by dimple＠pacific.net.sg 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Aeon Flux
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

-

1 0

Re: IBM Key Recovery Propaganda on United Airlines
by Eric Verheul 17 Dec '03

17 Dec '03

> To me, Key Recovery cryptography is like using a condom with a > hole in it. No thanks. Actually, on microscopical level *all* condoms have holes in them; the holes are just small enough for you not to worry bout it. The same applies to (good!) Key Recovery cryptography: there are holes but not big enough for you to worry about! > > Toto > Eric //My life-time-emailadress is Eric.Verheul(a)pobox.com //Use this when emails start bouncing when I have //switched to my next (inadequate) Internet-provider

6 7

A vote of confidence for Sanderson.
by Butler, Scott 17 Dec '03

17 Dec '03

After reading all of these people babbling on about giving a vote of confidence for Sandy I decided that I should also. I have full confidence in Sandy:-) (Well it normally works over here in the U.K...if a football manager receives a vote of confidence from the board of directors it is a foregone conclusion that his resignation will be handed in or his P45 will be handed out within days!) Scott

2 1

AOL: The Happy Hacker
by SECRET AGENT 66 17 Dec '03

17 Dec '03

From: IN%"destiny(a)crl.com" "David Cassel" 9-JAN-1997 05:27:47.48 To: IN%"aol-list(a)cloud9.net" "The AOL List" CC: Subj: The AOL List: The Happy Hacker Return-path: <owner-aol-list(a)cloud9.net> Received: from cloud9.net ("port 1250"@cloud9.net) by delphi.com (PMDF V5.0-7 #10880) id <01IDZXJME7BK90PW97(a)delphi.com>; Thu, 09 Jan 1997 05:27:33 -0500 (EST) Received: (from majordomo@localhost) by cloud9.net (8.8.4/cloud9-1.0) id EAA02888 for aol-list-outgoing; Thu, 09 Jan 1997 04:42:59 -0500 (EST) Received: from crl.crl.com (unknown(a)crl.com [165.113.1.12]) by cloud9.net (8.8.4/cloud9-1.0) with SMTP id EAA02882 for <aol-list(a)cloud9.net>; Thu, 09 Jan 1997 04:42:56 -0500 (EST) Received: by crl.crl.com id AA27763 (5.65c/IDA-1.5 for The AOL List <aol-list(a)cloud9.net>); Thu, 09 Jan 1997 01:32:41 -0800 Date: Thu, 09 Jan 1997 01:32:39 -0800 (PST) From: David Cassel <destiny(a)crl.com> Subject: The AOL List: The Happy Hacker Sender: owner-aol-list(a)cloud9.net To: The AOL List <aol-list(a)cloud9.net> Message-id: <Pine.SUN.3.91.970109004403.24862A-100000(a)crl.crl.com> MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Precedence: bulk T h e H a p p y H a c k e r ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ In 1995 a hacker named Happy Hardcore wrote a program that granted unlimited free access to AOL. Yesterday AOL issued a press release applauding his conviction in a court in Virginia. (http://www.prnewswire.com/pdata/19970108-DCW022.html) According to press accounts, Nicholas Ryan -- who studies computer science at Yale university -- was found guilty of a felony offense under the Computer Fraud and Abuse Act: he illegally accessed AOL "and violated AOL's terms of service". But AOL's press release doesn't tell the whole story. The Washington Post reported that in fact, AOL dropped over 370,000 subscribers between March and June of 1996 "for credit card fraud, hacking, etc." [9/16/96] Up until September of 1995, AOL didn't even verify the authenticity of credit card information submitted for free-trial accounts. (And as of last year, they'd distributed over 100 million of them.) Monday AOL shut local phone access to the entire nation of Russia because it couldn't collect enough accurate information to cover their expenses. Ryan was targeted because he created a program used by other hackers--and because he publicly taunted AOL in the program's documentation. He included internal AOL e-mail (stolen by other hackers) discussing the company's plans to thwart his program. Ryan wasn't charged with creating the program, but for accessing the system illegally--a crime he shared with nearly half a million others. For six months of access, he faces a maximum of five years in prison and $250,000 in fines. Under AOL's new value plan, the stolen time would have a cash value of $60. AOL's public statements indicate they want to appear tough on hackers -- especially now that they're seeking revenue from on-line transactions. A press release announcing the appointment of a vice president to AOL's optimistically-named "Integrity Assurance" division stressed her previous employment at the CIA--saying Tatiana Gau wants to "improve the world's most secure online environment". (The phrase "most secure" appeared three times.) Yesterday's announcement even asserted AOL had achieved "the first successful computer fraud prosecution involving an Internet online network." (One technology correspondent quipped, "Maybe it means that Kevin Mitnick is just a figment of Tsutomu Shimomoura's imagination.") AOL's announcement went so far as to claim that AOL is safer than the internet because AOL uses a private network. But safety still depends on how a network is administered. In 1995, a beta of AOL's telnet client put users directly behind their firewalls--and earlier that year, AOL's mail server was accessible via telnet, allowing forged mail from any AOL address. Hackers even took the stage during a 1995 celebrity appearance on AOL--then taunted the scheduled guest and the event sponsors. (http://www.aolsucks.org/security/recondite.html) "I am sure Corporate Communications will be getting some questions about it," read an internal e-mail titled "Hacker Attack In the Rotunda Last Night". Ironically, that message later ended up on the AOL Security Page--"What AOL Does Not Tell You." http://www.netvirtual.com/blank/aol) The next month AOL's CEO Steve Case wrote a letter to all users about hacker problems, arguing that "it happens everywhere", and adding that "when we discover hackers", AOL "aggressively take measures to head them off". But within days of that announcement, hackers were posting internal mail that they'd stolen to the internet. They continued undaunted, posting internal memos, and even Case's home address. In probably the most embarrassing development, in-house mail ABOUT the hackers was being circulated BY The hackers (ftp://ftp.crl.com/users/de/destiny/aol/hacker1) At the time, AOL spokeswoman Pam McGraw told me, "We've encountered these problems in the past, and we make changes to the service as appropriate-- and as we can". The hackers had reverse-engineered AOL's "Rainman" software, which had been mistakenly stored in AOL file libraries accessible by their hundreds of remote staffers. The company fumbled for an explanation--Pam McGraw told the press AOL believed the heist was effected with the Visual Basic macro program AOHell. (Some later attributed her remarks to a deliberate disinformation campaign--especially when, to suppress the program's distribution, AOL later told Boardwatch magazine AOHell contained built-in child pornography. ftp://ftp.boardwatch.com/aohell.txt) But AOL's attempts to cover-up security breaches left their members even more vulnerable. "I went to a bunch of new member chat rooms, used AOHell to fish for passwords, and got 25 of them," one Usenet poster gloated. "Doesn't AOL tell its users to not do that?" There were worse abuses. When AOL realized hackers could "sniff" passwords during TCP/IP connections, staffers say they were warned--but not the customers. "I hope that AOL alerts the General Membership to this problem in a timely manner," one staffer complained, "and not, as in the previous situation, wait until they are forced to by negative news coverage." Sources had told the Wall Street Journal that the 1995 security breach included hackers distributing customer credit card numbers in AOL hacker chat rooms, and AOL had warned staffers about the breach--but didn't tell their users (until the story broke in nationwide news reports.) The staffers complained AOL's hush-hush policy was aimed more at protecting their image than protecting their customers. In a memo warning staffers not to speak to the press, Steve Case countered that "We need everyone's support...to protect AOL's interest". That even applied AOL's content providers. Shortly before hackers took the stage at his live event, the producer of AOL's MacWorld area asked AOL about earlier problems. He told me AOL had attributed them to "some security holes that AOL promised were closed." It was when hackers took the stage that he found they were not. Even AOL's latest statements are suspect. The press release claims that AOL "immediately upgraded its security measures to prevent AOL4FREE or any similar software from working". But Nicholas Ryan told a different story. "AOL found a way to detect users of AOL4Free," began the program's documentation. "However, with only a few lines of additional code AOL4Free is again undetectable!" Tatiana Gau's claims that AOL has a "zero tolerance" policy for hackers is patently implausible. Macromedia's software piracy suit fingered 67 screen names in 1995. And over 70 came into play for the "Hacker Riot" that November--a coordinated attack on the New Member Lounges (http://www.getnet.com/~onion/work/planetmag/current/features/aolside.html) lasting several hours and affecting hundreds of users. This August AOL's Chief Financial Officer even pointed to the fake accounts as a possible culprit for the high figures on their subscriber churn rate. And just six weeks ago hackers doctored text at AOL keyword: legal. (http://www.news.com/News/Item/0,4,5712,00.html) Even yesterday, aolsucks.org received the comment, "AOL SUX!!!!! Thats why I make fake accounts with them!!!" Ironically, the documentation for AOL4Free ends with the classic hacker manifesto "The Conscience of a Hacker." The 1986 document ends, "I am a criminal. My crime is that of curiosity..." And most technology pundits agree. AOL's MacWorld area was mailbombed for a week and a half, with dozens of junk posts to its bulletin boards. "We hate that," their producer told me. "Does that mean the FBI needs to be brought in? Probably not." Chris Flores of Microsoft's Developer Division agreed. "If a Visual Basic program can automate hitting this key and hitting that key, the blame should be on AOL for allowing a certain keystroke to be hit... They should think of AOHell as a blessing. Since they know about it, they know that they have a fault in their system." MacWorld's producer added, "You've got to admire the hacker ethic in a certain way, because it's how things get done...how holes get patched." Indeed, as a result of the hacker presence, AOL began accompanying all e-mail and instant messages with a warning in red letters--that AOL staff will never ask you for your password. One Florida resident with a degree in criminology pointed out on Usenet that this alone wouldn't be sufficient--because password-fishers were incorporating the warnings into their scams! ("Enter your password to confirm that you understand the warning below." "Enter your password now to turn on pass-block, which offers protection beyond the simple password warning given below.") Now AOL's 3.0 software requires users to download small software changes before they can access the system. Unfortunately, there's no way to opt out--which creates a major security hole waiting to backfire. In any case, the hacker presence belies AOL's claims of the "highest level of security". In fact, Wired News reported that "Gau is confident, but she knows she has her work cut out for her. She's already spotted a link on the Web announcing her arrival. It was titled 'Hackers are laughing.'". It was my page. THE LAST LAUGH Within days of its creations, AOL threatened the AOL Security page with charges of copyright infringement. Unfortunately, the tactic inspired three other sites to mirror the documents--which are still there to this day. David Cassel More Information - http://www.wco.com/~destiny/time.htm ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ Please forward with subscription information and headers in-tact. To subscribe to this moderated list, send a message to MAJORDOMO(a)CLOUD9.NET containing the phrase SUBSCRIBE AOL-LIST in the message body. To unsubscribe send a message saying UNSUBSCRIBE AOL-LIST to MAJORDOMO(a)CLOUD9.NET ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0