- cypherpunks-legacy@lists.ogf.org

CERT reply regarding their emails
by Mark 09 Jun '93

09 Jun '93

Just got this: Forwarded message: >From mjw(a)cert.org Thu Jun 10 07:39:35 1993 >Message-Id: <9306092141.AA15453(a)shuttle.cert.org> >To: mark(a)cheops.anu.edu.au >Cc: cert(a)cert.org >Subject: Re: Statement of dissatisfaction with your recent efforts >In-Reply-To: Your message of "Wed, 09 Jun 93 10:59:04 +1000." <9306090100.AA11648(a)cert.org> >Date: Wed, 09 Jun 93 17:41:15 EDT >From: Moira J West <mjw(a)cert.org> > >Hello Mark, > We're sorry for any misunderstandings caused by our e-mail. >I have appended a copy of our follow-up to Berkeley on this issue. > >Regards >Moira > >Moira J. West >Technical Coordinator, Computer Emergency Response Team >Software Engineering Institute >Carnegie Mellon University >Pittsburgh, Pa. 15213-3890 > >Internet E-mail: cert(a)cert.org (monitored during business hours) >Telephone: (412) 268-7090 (answers 24 hour a day) > >---------------------------------------------------------------------- > >We've had a lot of feedback from various sites in response to our >e-mail to you last week referring to possible anonymous FTP abuse on >Berkeley hosts. > >We are concerned at the reaction that our e-mail caused. There's >obviously been a misunderstanding here and we wanted to follow-up with >you on this. There was certainly no intent on the part of CERT to >make accusations of any sort. We were simply trying to alert sites to >the possibility of activity that they might have concerns about. > >Our letter to you was one of many which we sent out to a number of >sites across the world in the form of an FYI of possible abuse of >their anonymous FTP areas. We had been receiving complaints from >sites about wide-scale trading of commercial software on their >writable anonymous FTP areas. During the process of helping sites to >secure their systems we were given copies of files left in abused >archives which indicated lists of hosts (and in some cases >directories) that intruders were using to trade of commercial >software. We chose to contact the sites so that they could check >their systems and take any steps that they thought appropriate. > >There were several reasons why we didn't attempt to verify the >information. There were a large number of hosts involved and with the >resources that we have available to us, it was not possible for us to >attempt to confirm the information on each host. In any case, we felt >it wouldn't be sufficient to check for specific directories or >filenames on an archive, the whole archive would need to be checked >for writable directories and then some verification of the contents of >those directories would need to take place. > >Previously, we have found that sites we contacted with this type of >information, did find writable areas which are being abused. In this >case some sites found such activity on their hosts, others stated that >the information was dated or incorrect. In hindsight, we see that it >would have been better for everyone concerned in this case if we had >undertaken some initial verification of the information or issued an >CERT advisory instead of the individual letters. > >As so many sites are potentially vulnerable to this activity and may >be unaware that it exists, we've decided to put together a CERT >advisory on the topic and hope to issue it in the near future. > >We're sorry if our original e-mail didn't clearly state our intentions >and was the cause of any misunderstandings. > >We'll follow-up with the various sites who have contacted us in regard >to our original e-mail to you, by passing them a copy of this letter. > >Regards >Moira > >Moira J. West >Technical Coordinator, Computer Emergency Response Team >Software Engineering Institute >Carnegie Mellon University >Pittsburgh, Pa. 15213-3890 > >Internet E-mail: cert(a)cert.org (monitored during business hours) >Telephone: (412) 268-7090 (answers 24 hour a day) -----------End of forwarded message Mark mark(a)cheops.anu.edu.au

1 0

Re: Paranoid? PGP to the rescue!!
by geoffw＠nexsys.net 09 Jun '93

09 Jun '93

Rather then encrypting mailing list and stuff like that, the real solution for "sensitive info" is for EVERYBODY especially people who share a lot of sensitive info with each other, to get themselves PGP keys. Learn how to use PGP or some other form of encryption you will be better off for it, trust me, once this happens, then you can choose who YOU would like to send secure info to. So in other words, if I want to send the FMR instructions to Brian I can encrypt the info and send it. I actually wished he had a key while he was away because then I could send him a private message to any account, just in case he couldn't log into soda. PGP is abount sending secure information to friends and others, information that is private and that you don't want others to read. I would consider it rude to post an encrypted message to a public list unless it was an absolute emergency (i.e. the Thought Police are at my door, and they are going to take me away). The desimination of FMR info should be based on a personal system of trust, PGP is some software that helps you keep the integrity of the communications between TRUSTED members, it is NOT a substitute for that trust and if used as such, will quickly disapoint you, with potentially disasterous consequences for some people. (It's better to assume that "They" are listening and choose your words, then to believe that because you have encrypted your infomation it is safe for you to incriminate yourself and others.) With PGP, if the keys are not handled in a proper manner, it is no better than any normal private e-mail list. The only reason that I would advocate encryption of the FMR instructions is FOR PRACTICE i.e. (danger paranoid statements approaching :) in case the day comes when we will really need to send information that we don't want Them to know. The FMR info is not precious, we don't have much to loose except the party getting busted. But if we did encrypt the data and use that as a method of distribution to TRUSTED roots of the FMR phone tree (which could change from time to time, then If the FMRs are mysteriously busted it would mean one or more of the following: 1) One of the TRUSTED is an informant or cop. 2) One or more of the people on the phone tree (only people who meet visually) are informants or cops. 3) one of the above persons told the info to an informant or cop. 4) The cops "get lucky" 5) The promoters leak the info to someone who knows or who is an informant or cop. 6) The cops can "break" the PGP code (a SERIOUS problem for cypherpunks) It is my assumption that 1 -5 are the most likely, and of 1 - 5 3 - 5 are things that we have absolutely NO control over. So PGP will only help us to enforce 1 and 2, I don't know if all the trouble of going through the motions of PGP are worth it except for the FUN and mystique of it all, it might just draw more attention and make the authorities think that there is something more to it than it really is. I don't think this is a good idea. I think if individuals want to use PGP to send secure messages whether it is FMR info or resumes that should be between them. I think we should take this discussion offline (oh oh elitism strikes :) but everone knows what I mean by that, the people who have access to Future FMR info will I'm sure pledge to make sure that the info is distributed in a fair, secure and hopefully timely manner. Those of you who wish to find the Full Moon Rave, look to the skies, keep your ears peeled and make friends, it's not hard. - G ------------------------------------------------------------------------------- NEXUS SYSTEMS/CYBERTRIBE-5 : Voice:(415)965-2384 Fax: (415)327-6416 Editor/Instigator/Catalyst : Geoff White <geoffw(a)nexsys.net> Production Crew : Universal Movement Trinity <umt(a)nexsys.net> "They might stop the party, but they can't stop the future" --PGP Public key available upon request-- Paranoia - Your state of mind when you finally realize what's really going on. -------------------------------------------------------------------------------

1 0

McCarthy lives!
by fergp＠sytex.com 09 Jun '93

09 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 8 Jun 93 3:33:26 PDT, Timothy C. May <uunet!netcom.com!tcmay> wrote - > At a Bay Area party for hacker types in December, 1988, I was > talking to a guy with longstanding computer security > connections. He looked at me strangely and said something like > "Well, Tim, your name just came up in Washington on a list of > the most dangerous hackers in the country." I laughed it off > and asked him why--after all, I'm not considered to much of a > programmer by anyone _I_ know. He wouldn't elaborate, just > looked at me strangely. Funny you should mention that scenario. I've been hearing (through the proverbial grapevine, of course) that such a McCarthy-ist list does indeed exist. Of course, it _is_ rumour and should be discounted as such. Right? ;-) -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLBSeY5RLcZSdHMBNAQFTSAQAkULlzwMom5kgQxjNGK0atpYXV6FNT7w5 whuvrHkzHU/5dE1v+JAa0ESkmw6RibaMRv7fvMbDeR5nTU0tb3e6Q1jT+TNTcG/D rqf3dCDvbQNGfHLTV/oNKpRob/ivnp6kkvOEXvHFEX+NgrqpAu9N3dGgKcv/9TvH nsE3RTkOhvE= =s44R -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

5 4

Re: InfoWorld
by karn＠qualcomm.com 09 Jun '93

09 Jun '93

Well, to borrow Whit Diffie's great phrase, those of us who regularly conspire to participate in the political process are already encrypting... Phil

1 0

CryptoStacker Update
by RYAN Alan Porter 09 Jun '93

09 Jun '93

This is an update on the CryptoStacker undertaking for those interested. I am still at the research/initial_design stage, so any further suggestions would be welcome. I am working on several other projects right now so actual coding will likely not begin in earnest for at least a week or two, I also do not wish to rush things any more than I need to... The CryptoStacker engine will probably consist of a block driver style device driver running under MSDOS which will intercept blocks of data going to the disk and encrypt them, and intercept blocks of data coming from the dish and decrypt them. The system should be completely seamless and hopefully will remain at one abstraction level. The intercepted functions will be the read/write functions of interrupt 13h. The initial version will be a simple driver with no sector remapping and will have to be installed on an already existing partition seperate from the boot partition. Hopefully in the future it will be possible to create a false disk by remapping sectors and extracting all drive data from a single file stored on the physical drive, a la Stacker's one huge file. This would allow for installation without the backup and reformatting of the hard drive. The keys will initially be stored on floppy disks and password protected. For simplicity, I will use one single key for the whole disk during development, but I hope to be able to provide at least one key per track in the initial version. I intend to make the key hooks as modular as possible and as open as possible in order that the possibility of PCMIA cards holding keys, barcode keys, datacard keys, etc, will be possible in the future. The encryption engine will be completely in software for the widest possible spread. This is the single only design consideration that I am absolutely set upon, and even then I will be glad to implement any advice on how to make the code as open as possible for future hardware assistance. I would like to see it expand into hardware in the future as encryption hardware hopefully becomes easier to find. The actual encryption algorithm is a more difficult case to comment on. I have done a lot of research on DES, since most of the advice that I have recieved has pointed in that direction, but I can see that it will be extremely slow and unwieldy in software. I would like to use an algorithm which would be a little more optimized for software but alas, I am more than a little afraid of the wrath of the cypherexperts who will shun any non-DES product. I am looking into the IDEA engine now, and I like the fact that it also has the capability to take in 8bytes and put out 8bytes, but that is about all that I know about it. Things that make DES attractive to me: 1) Takes 8 bytes, puts out 8 bytes. 2) Nonlinear. 3) It is its own inverse. 4) I understand it (a factor not to be underestimated) Things that make it unnattractive: 1) It is slow as hell, especially with triple iterations. If anyone knows of some algorithms that have been widely examined which meet at least a few of the 'pro' arguments and doesn't meet the 'con' argument, please let me know... There has been some consideration on the possibility of having the key time out after a preset interval. I like the idea as an option to the user who really wants it, but I have a lot of reservations about how to make a system time out gracefully when this happens. I have some ideas for how to do this with a multitasking OS, but they just seem like hacks to me, I am looking for elegant solutions. There has also been some contemplation as to how to shield a key from being read from a PC's memory. It has been suggested that I just inform the user of the security hole and not worry about it. This seems lazy and counterproductive to me, and I would like to at least make some effort to hide the key. Any good virus writers out there? Most of my techniques involve hiding code on mass storage, but I'm sure there are some tricks to memory someone might suggest. Well, that seems about it. I hope that this has been more coherent than the flurry of replies that marked the beginning of this, and less offensive... -Ryan the Bit Wallah

2 1

InfoWorld
by fergp＠sytex.com 09 Jun '93

09 Jun '93

INFOWorld June 7, 1993 Volume 15, Issue 23 pages 1, 103 IS managers assail data encryption rule 'Clipper chip would allow snooping by Scott Mace And Shawn Willett GAITHERSBURG, Md. -- IS managers and computer vendors last week blasted the Clinton administration's plans to mandate use of the "Clipper" data encryption chip. During hearings hosted by the U.S. Commerce Department here last week and in interviews, many IS managers and vendors said they fear the encryption standard could make their operations vulnerable not only to snooping by the government, but by criminals as well. IS managers and consultants from Bankers Trust Co. of New York and Deloitte &Touche voiced these concerns at the hearing and chided the government for shrouding the process in secrecy. "The secret process up until now has been destructive to public trust," said William Murray, IS consultant at Deloitte & Touche, in Wilton, Conn. "It is only a matter of time before hackers figure out a back door to de-crypt it," said Sheldon Laube, national director of information and technology at Price Waterhouse, in Menlo Park, Calif. Laube echoed the concerns of other corporate data managers. "If the government can de-encrypt it, we have to assume competitors can as well," said Bob Holmes, computer technology research analyst at Southern California Gas, in Los Angeles. The chip, which would be installed in data communications devices, including computers, modems, fax machines, and phones, encrypts data so outsiders cannot listen in or steal sensitive data. But government agencies, such as the FBI, could ask for a court order to obtain the "keys" to decode the data. No one would be forced to implement the chip, but the administration proposal could mandate government agencies to buy it, effectively forcing its widespread adoption. The Clipper chip, jointly developed by the National Security Agency and the national Institute of Standards and Technology (NIST) was also assailed by computer vendors. Oliver Smoot, vice president of the Computer and Business Equipment Manufacturers Association (CBEMA), testified that its members would have to develop separate product lines for the United States and overseas because a few foreign governments would want to give the U.S. government the capability to decode their data transmissions. This, along with the inclusion of the chip in every computer, would mean higher prices, Smoot said. CBEMA members include Apple Computer Inc., Compaq Computer Corp., IBM, and Hewlett-Packard Co. The plan has also been hotly contested by computer industry civil libertarians, such as the Electronic Frontier Foundation, which urged that the Constitution's prohibition of illegal search and seizure be applied. NIST and other government agencies countered that the chip is very resistant to tampering. It uses a key escrow system, where two or more government agencies will hold parts of a decryption key, for use by law enforcement with a valid court order. The FBI expects organized crime and terrorists to begin encoding information. Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

2 1

Re: CERT: the letter from CERT to berkeley.edu admin
by Ross E. Jones 09 Jun '93

09 Jun '93

In message Tue, 08 Jun 93 14:13:05 EDT, smb(a)research.att.com writes: > >Based on what you sent out, I confess that I see nothing wrong with >CERT's note. I agree that the rights of people who develop copyrighted software must be respected. This is fundamental to working in software development. My problem with the letter is that CERT did not verify the accusation before it was sent. Friend-to-friend this could be considered a "heads-up", but from a semi-official source such as CERT, this message takes on more of the characteristics of not-so-subtile arm twisting. It resulted in soda being closed down for a while to the detriment of all the users. Ross E Jones BDM, Federal rjones(a)abq.bdm.com Phone: (505) 848-5733 Fax: (505) 848-4047

2 1

Re: CERT: the letter from CERT to berkeley.edu admin
by peter honeyman 09 Jun '93

09 Jun '93

and what do you make of their report on julf's non-existent ftp area? steve, you know me well; you know i'm not a raving lunatic or or a conspiracy-freak nut-case. but i believe it is more than a coincidence that soda and penet were suddenly tarred by the same brush. perhaps cert is being used as a weapon, as marc suggested. that is the most benign interpretation i can think of. so i ask you again: don't you think cert might be jeopardizing its effectiveness through these actions? peter

5 4

Re: Encrypting Cypherpunks mailing list postings
by dmandl＠lehman.com 09 Jun '93

09 Jun '93

From: crunch(a)netcom.com (John Draper) > Mikes response to the ideas of encrypting the Cypherpunks mailing list... > > >I was (thinking?) of distributing a common secret key to > >people > >who we know are not spooks, and who would be interested in the cypherpunk's > >cause. > > I think it MAY be possible to write a perl program that would take the > incoming mail encrypted with a single common public key for Cypherpunk > mailing list mail, than would decrypt it internally, then for each > person in the mailing list, using their public keys, encrypt each > message for the individual recipients, and mail them out. But this is a PUBLIC LIST. Our readers from the NSA/FBI/CIA will get the messages along with everyone else--encrypted with their keys, of course, so no spies can read them! I just don't think any of this makes sense for a list this large and this open. Anyone can subscribe. For smaller circles of friends who know and trust one another, it would be more useful. BTW, wouldn't this all be easier using the "multiple recipients" feature of PGP anyway? This is exactly the kind of thing it was designed for: Server gets message, server multiply-encrypts to all subscribers, server distributes message the same way it does now. But again, I think this is pointless on a list like this. > The ravers can really use something like this to keep the Full Moon Raves > location a secret and known ONLY to those dedicated ravers that want to > attend. Yup. Agreed. This is exactly the kind of group that should be using PGP in this way. I do think that it would be a good idea to make an active effort to distribute and certify keys. This will also help to promote the use of encryption, which should be one of our main goals. Also: Making a sub-list of people who are "known not to be spooks," on a list like this, is dangerous. Would be nice if we could really do it, but there would almost certainly be agents getting included in the sub-list, as well as exclusions of folks who aren't agents. --Dave.

1 0

ComputerWorld article on Clipper/Capstone
by fergp＠sytex.com 09 Jun '93

09 Jun '93

ComputerWorld June 7, 1993 Vol. 27, No. 23 page 21 Fed officials pan ban of old encryption specs by Gary H. Anthes Gaithersburg, MD Federal officials responsible for shaping information security policy said last week that legislation mandating use of the government's recently proposed encryption technology -- and banning the use of older but popular techniques -- is neither wise nor legal. In April, the White House said it intended to establish as a federal standard an approach to encryption called "key-escrow." This method would require that the keys needed to unlock a coded conversation be kept by government-approved agencies and retrieved only for court-ordered wiretaps. Dubbed "Clipper" for voice communications and "Capstone" for data, the approach is intended to balance the conflicting objectives of users -- who demand absolute security and privacy -- and law enforcement agencies, which are looking for a legal "backdoor" into coded criminal communications. Protecting rights to privacy But the idea has been challenged by civil libertarians who fear abuses by a technologically empowered Big Brother, and by some users, especially those such as banks that have made large investments in cryptography based on the older Data Encryption Standard (DES), which some fear could be banned by the government. Protesters so far include the Computer and Business Equipment Manufacturers Association, Information Technology Association of America, Computer Professionals for Social Responsibility, Electronic Frontier Foundation, Business Software Alliance, Software Publishers Association and Information Systems Security Association. Raymond Kammer, acting director of the National Institute of Standards and Technology (NIST), acknowledged that a ban on existing techniques would be considered. "But my personal opinion is, I can't see doing anything that would take away any freedoms we now enjoy," Kammer said. "We tried to come up with a technique that would not require legislation," said Clint Brooks, advisor to the director of the National Security Agency, which developed and now strongly supports the key-escrow approach. Brooks predicted it would be years before criminal use of DES would be wide-spread enough to present obstacles to law enforcement agencies, which cannot crack DES codes. "Let's wait and see if legislation is needed," he said. While the majority of those attending a public hearing at the NIST last week spoke out against the government's proposal, a few strongly defended it saying criticisms are either misdirected or deal with fixable flaws. Donald Alvarez, national defense science and engineering graduate fellow at Princeton University, outlined six ways that Clipper could be breached but finished by saying, "I definitely believe it is possible to address the needs of both [users and law enforcers], even with the Clipper and Capstone chip sets." 8<---------- End of Article ------------- In a small, corner-page, footnote box on the same page -- "Keyed up In a statement filed with the Computer System and Privacy Advisory Board, Citicorp raised the following concerns about Clipper: o The private sector was not adequately consulted. o The algorithm used in Clipper/Capstone is not compatible with other commonly used encryption methods and will only cause costly disruptions for businesses. o The algorithm -- which is to be secret but will be examined by a handful of government-chosen experts -- "will undergo inadequate scrutiny and hurried review." o The databases and access systems associated with Clipper may be flawed and insecure." Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

3 4