Domain: cryptome.org
Stories and comments across the archive that link to cryptome.org.
Comments · 1,257
-
ashcroft's eyeball
Reason's cover didn't quite get ashcroft's house correctly. It should be this pic (or big 1800x1500 version). Not as scary when they know your work location and not your house.
(from this cryptome eyeball - it is a lot of data since it covers 4 places, please don't slashdot) -
ashcroft's eyeball
Reason's cover didn't quite get ashcroft's house correctly. It should be this pic (or big 1800x1500 version). Not as scary when they know your work location and not your house.
(from this cryptome eyeball - it is a lot of data since it covers 4 places, please don't slashdot) -
ashcroft's eyeball
Reason's cover didn't quite get ashcroft's house correctly. It should be this pic (or big 1800x1500 version). Not as scary when they know your work location and not your house.
(from this cryptome eyeball - it is a lot of data since it covers 4 places, please don't slashdot) -
Re:logical question
Cryptome just linked to The Photographer's Rights (pdf, 147kB) - it's a good reference, but it basically says you can photograph anything visible from public property except national-security-restricted-places and places where people have secluded themselves to have an expectation of privacy (their bathroom).
-
Re:Some real information
Here is a giant satellite photo of Area 51.
-
Thats nothing
In the netherlands somewhere in the nineties law was developed forcing isp`s to make their networks tappable. The first plan was based on the idea that this would be just as easy as with previously goverment owned telephone compnies wich always cooparated with police investigations. Internet providers howevery are many *many* small buisnesses that operate on much tighter margins and are owned by an entire diffren kind of people. And the goverment wanted to listen in on all of them. This became a big conflict. The conflict even gave rise to a very small group of people that figured that in order to meet these requirements cheaply, scaleable and securely an opensource implementation of the goverment proposed protocols should be made. The site is still alive and contains a world of information on goverment imposed eavesdropping in all sorts of networks. (read the cyberpunks collection of standards and documentation, Or better yet get the more recent docs for free at etsi.org and the osi sites. Goverment acces is developed into standards nowadays which is ofcourse much cheaper then adding it when networks are up and running. This was demonstrated when german celluar phone users where billed for having their phones listened into
;-). This also includes some information on the biometric/rfid passport ideas that politicians think are a great idea becouse... you know terrorist and stuff, let pump millions in this and get on our way kissing babies and doing TV interviews okey?)Currently, most big providers (I think mostly the ones owned by kpn including XS4ALL???) have machines in their network permanently to sniff traffic when a warrant arrives. This can`t be that hard, people keep saying the netherlands taps more phones then the US but real numbers that are reliable are very hard to come by (dutch link). These machines then tunnel the sniffed traffic to central collection machines. For this the "ITO" is peering with all major isp`s. The dutch internet service provider association has a couple of the sniffing machines provider can borrow if they dont have their own. I havent actually read the current version of these laws but in preivous version webhosters to should sniff traffic when asked to.
Ofcourse noone knows when this network is used, but it is safe to guess that the title of the first internet connection litened in to life by goverment snoops goes to the "hacking at large 2001" event (Lots of tents in a field, big network, lots of visitors and speakers on many topics and a big internet pipe). The then public traffic graph of the ASN of the goverment collection facility spiked really high during the days of that event
;-). I dont recal if it was this event or another one like it where people found out the police claimed to be dealing with "subversive anachist". When people found out about this T-shirts where sold with the text "staatsgevaarlijke anarchist", these where quite populair. OFcourse If this was the event the police was looking at then it would make sense that visitors where called dangerous, there needed to be a reasing for listening in.... what better reason then being anarchist-ish, terrorist-ish or terrorist-ish people releated, with a bit of pirate flavour to finish the mix.Ofcourse, we can all look ahead at another fantastic episode in this series. Unlike other epic sagas (starwars) these episodes get not only bigger but also better and more exciting every time
;-) You see the European union has been buzzing with the idea of mandating the storage of traffic data of not only telephone providers but also internet providers (and hosters?) for years. But a new proposol for this idea has recently been introduced by Britan, France, Ireland and Sweden... Imagene being forced to store terrabytes of logs on 99.999999 -
EU spin on economic espionage
Economic espionage has caused serious harm to European companies in the past, Monyk said. "With this project we will be making an essential contribution to the economic independence of Europe."
Translated: "with this project, we can bribe third-parties without getting caught."
Or: "with this project, we will re-enable our large European multinational corporations to bribe rich but corrupt third-world governments without having to worry about Echelon-based 'allies' catching us."
(OK OK, don't take my cynical remarks too seriously. But if you haven't read about this angle, it is pretty close to the US position as outlined in this ex-CIA director's remarks on it here and here. Don't forget the ever-needed grain of salt with all things Echelon.)
--LP -
Los Alamos Eyballing
Latest cryptome item is Eyeballing Los Alamos National Laboratory.
-
you're a real optimistif you think we aren't going to need to replace fossil fuel with something in 50 years.
Personally, I'd rather see somebody solving the problem, and if it takes paying off the aerospace industry to do it, I can live with that. Though I think the bulk of the payments will come from the energy industry as soon as a proof-of-concept is working. What's not to like about a zero-pollution source of energy that doesn't require buying fuel from anybody?
You'd rather spend the money on more oil wars until there is no longer any oil to fight for?
You can tell us that renewable energy is the answer for everybody, if you enjoy being laughed at rudely.
-
Not Adobe v. Softman
Uhh... It is Softman v. Adobe, and the order is important because the plaintiff is always first.
-
Re:Easy solution...
The broadcast flag only applies to over-the-air broadcast HDTV. It has nothing to do with cable, sattelite, or HDCP. I agree that cracking HDCP is a little trickier, but it's off-topic.
-
Re:Echelon theorized?
Theorized? No, fact. Echelon is 100% real. Here's the EU report on the subject. Published 7th Sept, 2001; kinda bad timing for any news story.
-
Some good essays on this topic
Demon in the Freezer and The Bioweaponeers, both by Richard Preston. The bioweaponeers - which talks about bioweapons research in the former USSR - is particularly terrifying.
-
Some good essays on this topic
Demon in the Freezer and The Bioweaponeers, both by Richard Preston. The bioweaponeers - which talks about bioweapons research in the former USSR - is particularly terrifying.
-
Re:Big Brother restrictions
They already know it's a threat, because you can make almanacs with those..
-
btw imho lol
See what acronyms can do to you. MWEAC, OSIS, MISSI, hell some of their own don't even know what exists or even what they do. Again, I thank John Asscroft and his Patriot Act, all under the gimmick of the pork barrel Department of Homeland Insignificance. Now, obviously this sound trollish but it is not, most people here click by things without looking into things. Sort of like the way stories are read here, a quick glimpse, and that's that.For those interested in what is going on in government behind the scenes, don't always think people who post the kinds of things I post are all conspiratorial stories aimed at bringing down government through chaos. Hell look at sites like FAS, Cryptome, Arms Control, and the multitude of others. Many people point things out but too many are concerned with menial things such as Janet's boobs, Sex and the Shitty, etc., to notice the rug being pulled from under them. Hell most Americans think CNN and Fox are the holy grail of news. Get out there and read, know what's happening in your country. Check out BBC, Observer, Greg Palast, AntiWar, Chomsky. These people aren't being controlled via advertisers, not political pressure. I write sometimes too kooky assed documents, that some might say aren't worth a pot to piss in. Maybe so, but there is a reason for me rambling on like a madman sometimes. I care about my privacy and liberty. I don't want my friends or family growing up in something out of "Escape from Alcatraz"
-
Re:Hard to hide
Oh come now, you must be doing something interesting for these guys to be probing your workstation.
;) -
Our buddy Jack Valenti
And to this day, not a single American film producer, indeed no one at all, has been murdered by a VCR, ala the Boston Strangler.
If you're not familiar with the quote...
"I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone." - Jack Valenti -
Re:No big changesit's unlikely you'll cut off a hand for your friend to clock you in early.
Since you can already fake fingerprints with gelatin, it's not such a stretch to imagine the same with palmprints.
"Are you happy to see me or is that a horror movie prop in your pocket?"
--
-
Official government documents...
For the past few weeks Cryptome has featured a link to an FBI document detailing the means by which such surveillance might take place. This is all just additional evidence that those wanting real security must implement (or at least verify) it themselves.
-
Notice that in the photo...
everyone is looking at the screen, not the finger...
Time to break out the gummy bears -
Re:FBI Warns of People Carrying Almanacs!From the politech list:
John Young has posted the text of the Christmas Eve FBI Almanac alert:
-
pre-emptive post
-
better than quantum cryptohttp://www.nytimes.com/2001/02/20/science/20CODE.
h tmlThe New York Times, February 20, 2001
The Key Vanishes: Scientist Outlines Unbreakable CodeBy GINA KOLATA
A computer science professor at Harvard says he has found a way to send coded messages that cannot be deciphered, even by an all-powerful adversary with unlimited computing power. And, he says, he can prove it.
If he is right, and he does have some supporters, his code may be the first that is both practical and provably secure. While there are commercially available coding systems that seem very hard to break, no one can prove that they cannot be cracked, mathematicians say.
In essence, the researcher, Dr. Michael Rabin and his Ph.D. student Yan Zong Bing, have discovered a way to make a code based on a key that vanishes even as it is used. While they are not the first to have thought of such an idea, Dr. Rabin says that never before has anyone been able to make it both workable and to prove mathematically that the code cannot be broken.
"This is the first provably unbreakable code that is really efficient," Dr. Rabin said. "We have proved that the adversary is helpless."
Dr. Richard Lipton, a computer science professor at Princeton, who is visiting this year at the Georgia Institute of Technology, said, "It's like in the old `Mission Impossible,' where the message blows up and disappears."
Someone who uses one of today's commercially available coding systems, Dr. Lipton explained, uses the same key -- mathematical formulas for encoding and decoding -- over and over. Eventually, they may be forced, perhaps by a court order, to give up the key. Or the key may be stolen. But with Dr. Rabin's system, the message stays secret forever because the code uses a stream of random numbers that are plugged into the key for encoding and decoding. The numbers are never stored in a computer's memory, so they essentially vanish as the message is being encrypted and decrypted.
Rest of article mirrored at Cryptome
-
"Owner of a copy" under Uniform Commercial Code
The laws under discussion in this comment are those of the United States of America. Nothing you read on Slashdot is legal advice; at best, Slashdot users are bad paralegals.
1) it must be software, which excludes all other sorts of creative works from the exception
The statutory definition of a "computer program" is apparently quite broad, "a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result." Could an MP3 file, which contains instructions to reconstruct a waveform, be considered a "computer program" under U.S. law? Relevant case law anyone?
2) the person making the adaptation must own the copy, which seems to not happen if you're licensing the software per a EULA.
This is largely a matter of state law. Softman Products Co. v. Adobe Systems Inc. (resale of individual software packages from a bundle is lawful) holds that the person who purchases a copy at retail owns the copy. Relevant text from the opinion vacating the injunction:
Adobe argues that the first sale doctrine does not apply because Adobe does not sell or authorize any sale of its software. Adobe characterizes each transaction throughout the entire stream of commerce as a license.8 Adobe asserts that its license defines the relationship between Adobe and any third-party such that a breach of the license constitutes copyright infringement. This assertion is not accurate because copyright law in fact provides certain rights to owners of a particular copy. This grant of rights is independent from any purported grant of rights from Adobe.
Then it goes on to explain who is the "owner" and what is a "sale" of a copy under the Uniform Commercial Code. Finally, "[t]he Court finds that the circumstances surrounding the transaction strongly suggests that the transaction is in fact a sale rather than a license."
-
media whores 101
If they really gave a shit about the privacy of others etal, they would oust their logfiles entirely. Like Cryptome does, and many others do. They're not obligated to keep log files under any binding law, and now they're bitching about being targeted for user id's etc.. Here's a noble idea for those who want to protect the privacy of others ln -s /var/log/access_log /dev/null otherwise wake up and smell the coffee... You will be targeted... Some of my own logs? I parse them out, all I mainly get are gov visitors to my https://www.pol*/foia/ directories. I keep them in case some fscktard makes a move and I have to report something to an ISP, so it's a trade off for me. As for them they're not obligated to keep the logs, and they're not obligated to remove publicly posted information. What's Bestbuy going to do after, sue Google for keeping it cached... Get real -
Re:Map of Trans-Atlantic Cable Network 14 (TAT-14C
Here are some aerial photos and maps of the US landing
sites for TAT-14 (and other cables) courtesy of Cryptome's Eyeball series. -
Shame on the IEEE
Lately they've been acting like racists and moral cowards. They proactively withdrew membership privileges and publishing rights for Iranian students and researchers. See also this article for an explanation.
-
Some details
Dutch tv covered the story (wmp version there for those who care for an some questions answered by Rop Gonggrijp). Only thing it mentioned is that people have to tell each other a "fingeprint" after establishing a connection (Which might imply it could be done over the encrypted phonecall which would make a mitm attack possible for those who can generate a familair voice reading numbers in time). Mitm attacks on the radio side of a gsm call are possible and well understood, afterall base stations are not authenticated in any way. Anyway, just check the specs now (AES256 and Twofish,4096 bit Diffie-Hellman key exchange with SHA256 hash function,Readout-hash based key authentication, 56 bit effective key length, encryption key is destroyed as soon as the call ends). Or just get the source later. The readout sounds great if you can arange a "secret" meet, otherise key signing might be needed.
Ofcourse those who watch netwerk (the dutch tv show that made all the fuss) more often know that it could not be bothered to verify this "First crypto phone" claim by, say, asking google which reveals profesional stuff based on normal gsm`s instead of this big/exspensive pda hack (Just as the GSM spec is professionally developed) and even homebrew projects free of the same susspicion that surrounds the normal gsm crypto which ends at that base station and is no use for those afraid of telcos involved in snooping. Many are required to by goverments who dont feel like having to have people go around capturing calls on the radio end with the limited range of gsm sets. -
Re:This happened thrice before...Yes, it happened a few times...
...with a Carnivore review team...
...with a justice department document...
...and a CIA document containing agent's names
W -
Irrelevant...
Since we're all suspected terrorists anyway.
(Also this is a very good follow-up read if you're interested. This has also been posted on /. before (link). And there's also more links.)
I, for one, welcome our new Ashcroft overlords. -
the wesley clark connectioni support wesley clark's entry into the dems race, but i'd like this explained. in the cryptome cease and desist link there was this paragraph:
Bear in mind that General Wesley Clark, US presidential contender, is/was a member of the board of Acxiom, giant database producer, which sold far more information to Torch Concepts on citizens of the world than JetBlue provided apparently for no cost. As the Torch study proclaims, it was the Axciom data that was much more useful to spy on citizens than that of JetBlue.
people should politely ask him about it at his weblog. seriously, don't be assholes. he has a way to get feedback - use it intelligently. we need to encourage politicians to be more responsive. if clark ignores the issue or gives a poor answer then pester the other candidates on their positions and vote for the ones who answer better. but leave out the insults.
-
Re:list of stories
#1 is just a rewrite of something signed by Cheney, Wolfowitz, Rumsfeld, and those other guys. The Project for a New American Century isn't some kind of secret. It's the platform Bush's foreign policy and military policies are based on. Wolfowitz and Rumsfeld wrote letters to both Clinton and Newt Gengrich in '98 demanding that they invade Iraq. So, once they're both in charge of the army, they do it. It's not paranoia, it's just what they did.
The part most people would dismiss as paranoid would be Rebuilding America's Defenses (also available in ridiculously huge pdf from their site) where Wolfie and Rummy outline their plans for taking advantage of "some catastrophic and catalyzing event, like a new Pearl Harbor", missile defense, increasing independence from the international community, a more mobile, flexible army, robot exoskeletons, tactics for use of robot exoskeletons culled from that 08th MS Team anime, ultrasonic guns designed to induce the brain to release chemicals to produce intense panic, rage, or anything else, drugs that would allow soldiers to deaden their consiences, and chemical and biological weapons tied to certain gene types that would allow them to carry out undetectable assasinations by spraying around genetically engineered ebola viruses. -
Re:Yes but...
Which came first? 1) Draconian (C) enforement legislation? 2) Wholesale (C) disrepect?
Let's change item 1 to "bad copyright owner behavior". It is the bad behavior of the copyright owners that came first.
The copyright holders were after infinite copyright lifetime before Napster came on the scene. That is much more the core issue of the abuses I mention, but not the only one.
Let's rewind to the 70's. (I mean NINTEEN-seventies, last century.)
Cassette tapes suck. Dolby soon makes cassette quality rival 8-track or reel-to-reel. People have (large) pocket sized players. (I know I did! and there were lots of them.)
We have copyright holders embarking on a massive effort to convince everyone that they cannot copy their own records onto cassette tape to listen at their convenience, or in their cars, or at the beach, etc. You must also buy the cassette version. In fact, you must buy a seperate copy for each copy that you need. If you don't want to carry it back and forth to your car, you need two copies!
The warnings were printed on record album covers. The language was designed to sound scary.
Now moving forward to the 1980's. (Again last century.) We have the MPAA suing Sony because they -- horrors! -- produce and sell a VCR. This will result in the destruction of the movie industry.
Take it from the spokesman of the MPAA, Jack Valenti himself. He testified before congress "I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone.". (Search for that quote on this page.
Later in the late 1990's, we have the RIAA suing Diamond Rio for producing and selling an mp3 player. Not even a recorder. Just a device that allows you to play mp3 files. You could rip a track from a CD you own, and download it. An act clearly allowed under the audio home recording act of 1992.
So which came first? I say bad behavior on the part of copyright owners.
Once the opportunity came along to get music without paying cartel imposed high prices, people jumped at the opportunity. We will never know, but I imagine with most people's computer illiteracy that if music prices hadn't been so sky high that the number of people going to Napster would have been significantly smaller.
As I argue, it is NOT that people don't believe it is against the law, it is just that people don't care. And this is due directly to the behavior of the copyright owners.
Prior to Napster, we still had Clear Channel going on. High prices. Tactics to scare you into buying the same music multiple times.
Why was the RIAA suing Diamond Rio? Because they were first to market with an mp3 player?
I simply do not buy your argument that the lack of respect for copyright came first. It came second. There is a reason people don't respect copyright. They haven't for a long time, but it is just much worse now. -
/. what's going on?
I dont know what is happening here at Slashdot, but I seriously hope taco, michael, and the others get off the SCO bandwagon... Why the hell do they only seem to accept mainly SCO, LINUX, and Anti Microsoft articles is becoming so yesterday, and I hope they (and I know some of you are reading this) start accepting things outside of the typical media whore range of articles that have appeared here for the past few months.- 2003-08-11 NSA's Statement on Cybersecurity (articles,security) (rejected)
- 2003-08-19 DNA based game playing computer (science,science) (rejected)
- 2003-09-06 Brown Dwarfs fingerprinted (radio,science) (rejected)
- 2003-09-06 Study Indicates Possible Surface Water on Mars (science,science) (rejected)
- 2003-09-07 GSM cellular phone encryption cracked (articles,security) (rejected)
It has been 14 years since two little-known electrochemists announced what sounded like the biggest physics breakthrough since Enrico Fermi produced a nuclear chain reaction on a squash court in Chicago. Using a tabletop setup, Stanley Pons and Martin Fleischmann, of the University of Utah, said they had induced deuterium nuclei to fuse inside metal electrodes, producing measurable quantities of heat. That was the opening bell for one of the craziest periods in science. Cold fusion, if real, promised to solve the world's energy problems forever. Scientists around the world dropped what they were doing to try to replicate the astounding claim. Full story
Astronomers using NASA's Hubble Space Telescope have discovered three of the faintest and smallest objects ever detected beyond Neptune. Each lump of ice and rock is roughly the size of Philadelphia and orbits just beyond Neptune and Pluto, where they may have rested since the formation of the solar system 4.5 billion years ago. The objects reside in a ring-shaped region called the Kuiper Belt, which houses a swarm of icy rocks that are leftover building blocks, or "planetesimals," from the solar system's creation. The results of the search were announced by a group led by Gary Bernstein of the University of Pennsylvania at a meeting of NASA's Division of Planetary Sciences in Monterey, Calif. Full article
-
Re:Adjust your tinfoil hat, guy.Jeez, you are either a very good troll, or a bit slow today.
First, the existance of the UKUSA pack is shown in section 5.4.2 of the EU report, with documented references. So, there is no doubt that there is an agreement, above and beyond the normal relationship between nation states intelligence communities. The following, lifted from section 5.1 summarises these "clues":
The trail of clues which constitutes evidence of this kind is made up of three elements:
- evidence that the foreign intelligence services in the UKUSA states intercept private and business communications;
- evidence that interception stations operated by the UKUSA states are to be found in the parts of the world where they would be needed in the light of the technical requirements of the civilian satellite communication system;
- evidence that there is a closer than usual association between the intelligence services of these states. For the purposes of proving the existence of such an association, it is irrelevant whether this extends to the acceptance from partners of applications for the interception of messages which are then forwarded to them in the form of unevaluated raw material. This question is only relevant when investigating the hierarchies within such an interception association.
Also check out section 10.7, where many known examples of industrial espionage are listed. Most aren't directly related to Echelon however, but some are and in many cases the source of the data/wiretap is unknown. Take a look at the report. Do it now. Or stopping asking for proof when I am clearly showing it to you. Even a glance through the table of contents would have highlighted these fundamental points.
Using an elite hidden network for industrial spying is clearly against the law in both countries. Now, as I said, it is illegal for each nation to spy on it's own civilians. So, are you suggesting to me that (e.g.) the UK has no interest in intercepted communications of (e.g.) terrorist activities in Britain. And if the USA was to analyse the data and spot a risk to the UK, are you suggesting that the info isn't passed between the agencies? Given todays climate, that's pretty damn obvious that it's happening.
The EU report has the following, taken from the conclusion:
The US intelligence services do not merely gather general economic intelligence, but also intercept communications between firms, particularly where contracts are being awarded, and they justify this on the grounds of combating attempted bribery.
But that's makes it legal, OK? We may actually be splitting hairs here. This is what makes me think you are trolling. See, I never actually said they are breaking laws. The agreement is all about getting around the laws. They are violating the spirit of the law, but not the laws themselves. That's kinda the point of what I said!
Things are a bit different nowadays. Before it was widely acknowledged that this level of spying were possible, those in on it were free to give data to their business allegencies as they saw fit. However, in this age of scandal and improved awareness, I'm certain that the industrial espionage of Echelon is seriously curtailed, or at the very least limited to only a few groups. The risk of a major scandal could destroy important trading links between entire continents, and neither side what's to see that happen.
-
Re:Adjust your tinfoil hat, guy.could you please present some evidence to back up your assertion that the United States and United Kingdom are colluding to break the laws of both nations?
OK, so clearly you didn't follow the link I put in my post, where it pretty much says what I said on the main page
But, OK, that's just a website, anyone can post anything they want. So, here is the a BBC Q&A on it, and the results of a search on their site.
But, you may not trust the BBC for some reason or other. So here is the official EU report on it. It was released publically, IIRC, on the 13th Sept 2001, but obviously droped off the media's scope because of the events a few days before. Unfortunate timing, no big conspiracy there.
Echelon is real, and it has been admited to by several governments, excluding the USA/UK. It monitors faxes, phone calls and now the internet. It's not a tin-foil hat fantasy.
Oh, and meta-mods, please sort out the confused mod who gave me a "flamebait" point in my parent post above. I posted factual information that is both ontopic and relevant.
-
Re:I was at the talk...A better description is that A5/1 is "weak" and A5/2 is "very weak". The FAQ says that Alex Biryukov, Adi Shamir and David Wagner showed that they can find the A5/1 key in less than a second on a single PC with 128 MB RAM and two 73 GB hard disks, by analyzing the output of the A5/1 algorithm in the first two minutes of the conversation. Ian Goldberg and David Wagner of the University of California at Berkeley published an analysis of the weaker A5/2 algorithm showing a work factor of 2^16, or approximately 10 milliseconds. B,S&W's paper has some really nice detail, and also mentions that Goldberg and Wagner announced an O(2**16) attack on A5/2 in 1999.
The attack on A5/1 does take a big amount of pre-computation, but if I'm reading it correctly, it's about 2**48 iterations of a very efficient algorithm, which looks like it's 4 instructions, mostly from L2 cache, and 150B of disk which was somewhat aggressive for PCs back then, but is cheap commodityware now (you might spend some extra money if you want faster disks...) If it partitions conveniently, run it on the PC farm overnight, or get distributed.net to prepare it, or use that 2GHz P4 for a couple of weeks. After the pre-processing is done, actual attacks seem to need about 2 minutes of call time and a few tens of seconds to crack, so it's near-real-time.
-
Some more details
The elreg and reuters article are a bit low a technical details, somehow the israely ambasy of wasington has more covarage in english probably a translation of something. The university of haifa (where the research heaponed) links to this israely newspaper (in hebrew, registration req`ed).
This story isn`t only interesting becouse GSM is (and will be for many years to come) the most used standard. The most interesting aspect is that these vulnarabilities are not like the intentionaly broken crypto algorithems but are a stupid mistake in the implementation of systems for dealing with interference. according to one of the researchers: "At first, I didn't believe it. We checked it, and it was true."
Now for the tinfoil hat angle, is this yet another briliantly engineered "mistake" to make sure the crypto used keeps the customers feeling of privacy while maintaining the posibility of those with computing power to listen in or a honest screwup?
The full details will be in the patent these articles mention, the researchers apperantly wouldn`t mind marketing this trick to law enforcement groups. -
Re:"The GSM association is not happy."
Did they have their design checked out by someone who understands cryptography?
A: No.
The hash function (A3/A8) used in the default implementation of the GSM protocol for the challenge-response authentication had a vulnerability of a type known about in the cryptographic community for years.
This wasn't a deliberate weakening, because this flaw had no real impact on the ability of law enforcement to intercept, and allowed cloning of GSM handsets: something that was definitely not supposed to be possible.
They've learnt from their mistakes though: the 3G protocol has undergone extensive public review , as has the ciphers they chose.
-
Re:Design flaw or Feature?
Law enforcement taps take place within the telco infrastructure: i.e. after the conversation has been received & decrypted by the base station.
According to Ross Anderson, most inter-base station communications is done via microwaves, (because the landline infrastructure is generally owned by a competitor), and IIRC most of the microwave transmissions are in the clear.
Transport-level privacy between handset and base station was provided by two ciphers of different strengths: A5/1 for Europe & the USA, A5/2 for export (and Australia
:-)A5/1 turned out to be trivial (3 LFSRs?), and could be cracked in realtime on a 2000 PC. Also, the last ten bits of the key were always zero. So A5/1 was deliberately weakened. Who can say how bad A5/2 was. A5/1 has been replaced by A5/3 for most GSM networks.
-
Jim wrote one too.
Jim Tyre wrote a brief on this for the DeCSS case which espouses a similar idea to Salin's letter. I don't recall that Salin's letter being mentioned mentioned in any of the DeCSS related or the CHBreak cases. I wonder if the PTO or anyone else has paid attention to it?
-
campaign spamming
Suprise, the Bush II relection machine also spammed. You can see it here on Cryptome.
The difference? Dean for America stopped working with the spamming company the same day. Did Bush-Cheney '04 Inc. ? No, However, after cryptome posted the e-mail, the email used in the spam was unsubscribed from the list, and an automatic confirmatory e-mail sent. This despite the fact that John, who runs Cryptome, never subscribed, and never sent in an e-mail requesting to be unsubscribed. There is no evidence that the unsolicited e-mailing has been stopped.
It's easy to say Dean for America isn't net-savvy. I mean they sent out some unsolicted e-mail right? But how many companies stop using spam once they realize what their marketing department was doing?
How many do it the same day? Bush, despite a record breaking campaign warchest still is soliciting by spam. Dean isn't. That tells me who is savvy.
Gryftir -
Ah memories
Some may remember some time ago when Germany also was going to yank MS products from being used by the German government. March 19th, 2001 - Two German government agencies have announced that they will discontinue the use of software made by Microsoft and other American companies. According to the German news publication Der Spiegel, both the German foreign office and the Bundeswehr (German Federal Armed Forces) have banned American software, saying that there are security concerns in using programs developed by other countries in sensitive applications. Instead, German companies such as Siemens and Deutsche Telekom will provide solutions (src: WinPlanet)And now China... The government has been pushing the development of a homegrown software industry and a national standard for open-source Linux software to counter the spread of Microsoft in the last few years.
This is not a bad idea, and if others took the same route, MS could feel it down the road. Considering the problems associated with MS nowadays (even though it has actually been rampant for some time), with worms, and all sorts of security issues, how long will it be before some huge class action lawsuit based on MS negligently releasing shoddy products. Think about it... It's the kind of stuff that makes the NSA want to place backdoors on software, excuse being they're trying to secure products where vendors are failing.
I say, good for China on making that move, hopefully others will take cues from China, and send MS a message. No more shoddy work!!! Just imagine what will hapen if some investigation pointed to an MS product being at fault for the power failure. Oh boy would that be some crazy stuff to deal with for MS.
-
Uh Oh Spisghetti-0Slashdot strikes out
reported by Anonymous CannibalIn developing news, Slashdot.org has released yet another non-SCO related article. Slashdotters are drooling at the incoming news "There on a roll now dude. A few more articles without the mention of SCO? I didn't think I would see the day" stated a fp'er..
"Ok so maybe we misunderestimate the potential of Slashdot, but answer me this, If a tree falls in an ocean does it make a splash? We here Texans, here in Texas, which of course is in the United Nations of America, value sites like Slashdot. At least they don't post forged articles". stated Slashdotter daprez.
Slashdot once upon a time was one of the hottest sites on the net, and the site which now boasts close to 600+ thousand users (most of which are duplicate users) is slowly going down the toilet. "Well I doubt if it is going to go away, if it did most of the admins there would likely commit suicide or something. I just want to see it go back to the basics and focus on news. Sure SCO is news, but do we really need it shoved down our throats four to five times?" stated another user via IRC who wished to remain anonymous.
So for those who are interested in real news, such as how China will replace every citizens ID cards with Digital Cards, you can read this here, or if you care about the NSA possibly backdooring all software, you can read that too by clicking here. The CIA's statement on WMD? Sure right here, however, if your looking for another SCO article, stay tuned one will be availble within the hour.
Numerous request were sent to Slashdot administrative staff who never responded to our e-mails. We feel for them, and will make sure to send them carfare when the company goes under so they'll be able to get to the unemployment office.
2003 Slashdotter Strikes Back News
-
Three Cheers for SlashdotSlashdot strikes out
reported by Anonymous CannibalIn developing news, Slashdot.org has released a non-SCO related article. Slashdotters are ecstatic at the incoming news "Oh man I really thought it was the end of the road there for a minute, I mean last week was bad, but as of Sunday, I don't know how many SCO based articles they posted. I think it's somewhere in the low hundreds though" stated a user who wished to remain anonymous.
"It's exciting for the moment, but I know these morons will just post some other sickening story about a company that's about to go under any god damned moment". stated fx0rspy.
Slashdot once upon a time was one of the hottest sites on the net, and the site which now boasts close to 600+ thousand users (most of which are duplicate users) is slowly going down the toilet. "Well I doubt if it is going to go away, if it did most of the admins there would likely commit suicide or something. I just want to see it go back to the basics and focus on news. Sure SCO is news, but do we really need it shoved down our throats four to five times?" stated another user via IRC who wished to remain anonymous.
So for those who are interested in real news, such as how China will replace every citizens ID cards with Digital Cards, you can read this here, or if you care about the NSA possibly backdooring all software, you can read that too by clicking here. The CIA's statement on WMD? Sure right here, however, if your looking for another SCO article, stay tuned one will be availble within the hour.
Numerous request were sent to Slashdot administrative staff who never responded to our e-mails. We feel for them, and will make sure to send them carfare when the company goes under so they'll be able to get to the unemployment office.
(c) 2003 Disgruntled Slashdotter
-
Re:Its a search warrant!
reading through the the search warrant used for searching his house carefully leaves room for another story
FBI agent from the national infrastructure protection squad investigates defacements.
The agent (who specializes in weapons of mass distruction investigations like "the bombing of the United States Embassy in Tanzania, Atlantic Olympic bombing, and the latest New York City World Trade Center bombing" (When I grow up I wanna write my own history books to)) notes the defaced pages link to raisethefist.com, then he notes "On or about May 3, 2001, I conducted a review of publicly available information on the Internet website RAISETHEFIST.COM and learned that it was an anarchist website [No shit sherlock], This website contained numerous organized webpages, which contained anti-government (primarily the United States), anti-capitalism, and militant messages that promoted communism and advocated violence. This website had a section for the UNITED GRAFFITI FRONT, also known as UGF, which had the motto, "spraypaint as weaponry against the corporate lies."" No bombs and not even any weapons of mass destruction... but this officer kept searching not becouse of the contents of raisethefist scare him, but becouse of the defacements cracking and bragging on irc about of this kid.
Now note the order of the items to be seized part of the warrant, first all computers, exploits and crypto stuff, then the bomb making stuff
So the whole bomb making part of raisethefist.com was mostly a pretence for getting a search warrant to investigate the U.C.A defacements and the irc bragging of cracking DoD systems (for which simply wasnt enough proof even while the kid was stupid and made his troop.cgi script report back on its progress of messing with dod systems to his home dsl connection....) And then in court when no real evidence has been found linking this kid with the defacements and cracking (irc logs and hearsay as evidence...aparently good for a warrant, probably not for a conviction), they interview him claim they will just call him a terrorist and get it over with, the kid freakes out scared of the patriot act and goes for a plea bargain, which the judge doesn`t like and ignores end of story.
One sad paranoid script kiddie who may have needed help less for a year, After that if you got what it takes (like " Intelligence in alien based technology ( anti-matter
...etc.. ) ") just sign up for the u.c.a. And join the exciting life of using the time tested method of changing the world by copy-and-pasting bomb recipies and smashing star bucks windows.... or perhaps just redrawing that red star at the left side of the raiseyourfist.com so it doesn`t look like a childrens drawing..... reading up on politics before pretending you understand them and getting some fresh air..... -
Re:Further recourse / protests?
I'd suggest reading the court document which talks about just what they found at the guy's house - none of which he mentions in his little tirade on the website.
-
Re:What was there?In addition to what was on the website, however, it's interesting to read what the raid on his house turned up:
(MR. HOU) The Second Circuit has long held that items, destructive devices such as Molotov cocktails, simply have no legitimate purpose. They are, by definition, tools of violence. In this case, the defendant possessed Molotov cocktails. Pursuant to a search warrant which was authorized in the Central District of California on or about January 24th, the FBI searched the defendant's home. What did they find there? They found explosives. They found M-80s. They found remote control detonating devices. Again, these are items that have no legitimate purpose. They found bottles, over sixty bottles. They found the Molotov cocktails I mentioned.
They also saw in plain view the defendant's silver Toyota 1981 car.
THE COURT: Were there completed Molotov cocktails found?
12 MR. HOU: There were two Molotov cocktails that were in various states of finality. There was one which actually had the wick in it, I understand, from the FBI agent, and it was tested. The materials were tested to determine what was inside, and it was later determined -- the FBI determined that it did contain etroleum products.
The FBI agents asked the defendant at that time whether it contained petroleum products, whether it was, in fact, a Molotov cocktail, and he denied it.
-
Link to warrant - this was more than just a link
Link to warrant/affidavit and other info. Here