Slashdot Mirror


User: kevlar

kevlar's activity in the archive.

Stories
0
Comments
1,118
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,118

  1. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    I was talking about the NSA being able to brute force a unix password in 1sec. I did a little rough math and came up with that number, but I like that figure of 6 years. Not sure if its right or not though ;)

  2. Re:NSA ... One more thing... on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Now... I know you'll all rape me if I'm wrong with this, but here goes...
    If you apply two cryptography schemes to something, are you really adding double protection? If you encrypt a DES cipher using RSA, and send that over a network to the client who's going to encrypt some data. The Attacker intercepts it and sees the encrypted DES Cipher. The Attacker then sees the data encryped with DES pass over the network. Would there then be the possibility for a formula to do this:
    X == RSA
    XC == DES Cipher encrypted with RSA
    XCD == Data encrypted with the DES encryption cipher and the DES scheme.
    Could there possibly be the existence for a formula that could do XCD-XC = D? This is not mathematical. The symbols are representative of something higher that I don't feel like doing out mathematically. I'm not saying that you could make a little box like they did in Sneakers, all I'm saying is that I think its possible to reduce (or increase) the keyspace needed to be checked. I dunno though, maybe RSA would prevent this. Let me put it another way. If you have your data X, and you pipe it through X^n where n = 3 * z, then pipe that output through (X^n)^y, you'd be dealing with X^((3*z)+y), which is a 3D function possibly with limits. If you have limits, then you don't need to check _all_ possibilities. Depending on what those limits are, maybe it'd be easier to crack. I'm all but certain that this has been done before.

  3. Re:NSA ... One more thing... on Ask Slashdot: What's the Real NSA Like? · · Score: 3

    I never said this was a fact, and I even said that this is _NOT_ a conspiracy theory. All I was stating was that I thought it was weird that she'd know shitloads about everything else, but when it came to PGP specificly she wouldn't answer any questions. From her reaction, I got the impression that there was something else going on other then her just not knowing. In fact her answer wasn't "I don't know" but rather "I can't discuss that" (not verbatum). I probably should've said this earlier though ;)

  4. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    I was using a minimal-case scenario of whatever static operation I knew for sure. The point is that it would take roughly 70^8 operations not taking into account the salt, and doesn't change the amount of time it takes by very much. I wasn't trying to be scientific about it, I was trying to throw a rough estimate up there. Besides, doing an incrimental DES algorithm would be more than 2 instructions per second, and a PenII can only do about 800MIPS or so, so you've made up the difference right there. The point is that the system does more than 5.76x10^14 operations/sec which is probably equivalent to about a million machines. Do you have a problem with this estimate? or is it 1M-1. The 8^70 was a stupid mistake, but the FLOPS difference isn't much. Its still a factor of days. This is the only relevent doc I can find on MIPS at Intel.

  5. Echelon on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Echelon is a network of satelites and "listening" stations around the world. I know there's one in England, and I think there's one in New Zealand as well. It's been said that they have the ability to take a signature of someones voice and check against all electro-magnetic traffic and if that person were to use a cell phone, using the satelites they could triangulate your position, and lobb a missle and have you dead in only a few minutes. There are rumors that this happenned to some guy Yeltsin was fighting with in Checznya (or however its spelled). Yeltsin had asked the US for a favor... When the guy (I can't remember his name for the life of me) used a cell phone to negotiate a peace settlement, Yeltsin dropped a missle on his little house in the middle of nowhere. Here's a Link to a site with a picture of one of the listening posts. Not sure how relevent the site is, but if you do a search on any search engine for it, you'll find plenty of grubb.

  6. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Yeah... Read.

    The point is that the system can do more than 5.76x10^14 FLOPS. This is roughly equivalent to 1.44M PenII's.

  7. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Shit, no you're right.
    [x][x]
    x can be a,b or c
    that'd be 3x3
    So then it'd be:
    70^8 == 1.4M secs
    == 16 Days
    So I'm completely wrong then. ;)

  8. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    No.
    There are 8 Slots.
    [x][x][x][x][x][x][x][x]
    They can each have 1 of 70 characters.
    i.e. 8^70.
    Not 70 slots that can each have 1 of 8 chars.
    ;)

  9. Re:But I like conspiracies... on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Well I think there's another reason behind using 40-bit encryption for devices like Airport. Simply put, you can't stick a PenII processor in there and expect it to encrypt on the fly with 512 bit keys. They also (like you said) better keep it under US exportation laws so they don't have to change much when shipping, thus saving money. One question this whole hoopla about NSA_KEY (which personally I think is a crock) brought to mind is if in the NSA's processes of regulating cryptography, are they weakening the systems of our own govt? Just a question, not necessarily conspiretorial.

  10. Re:NSA ... One more thing... on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    More likely, she just didn't know. The biggest misconception people have about large government agencies is that
    they function as a single unit. That is contrary to one of the most basic rules of security -- unless you need to
    know, you don't.


    Just a note... After I told this woman that I had watched this Discovery special, she told me that she was supposed to be one of the people interviewed about the system. This would mean that she has hands on experience with the system. She's a Computer Scientist and Mathematician, this means that she is mostlikely writing the programs that crack the crypto. Besides, she new every single fact about RSA,DES, etc. How could she not know about PGP?

  11. Re:NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 1

    Actually, thats impossible, but I think I'm wrong as well. Last time I checked (and I could be wrong about this), a PenII 450 could do 400M FLOPS.
    So lets say there are 70 chars that can be chosen in a passwd.
    There are 8 chars in the actual passwd.
    Gives us 8^70.
    8^70 == 1.6455x10^63
    1.6455x10^63/400,000,000 (FLOPS) == 4.1137x10^54 seconds to brute force it.
    4.1137x10^54/60 secs/60 mins/24 hrs/365.25 days == 1.3x10^47 YEARS
    The universe isn't that old ;) Anyone find a problem with this? Maybe I have the FLOPS wrong I dunno, but this also isn't even including the salt.

    The difference between the way a PC does it and what the NSA does is that a PC simply guesses, based on the salt and a dictionary, certain combinations.

  12. NSA on Ask Slashdot: What's the Real NSA Like? · · Score: 5

    From what I know (based on a Discovery Channel program) they have their own chip manufacturers in their main headquarters making processors for a warehouse-sized supercomputer submersed in a non-conductive coolant (which is located in the basement). They also said that it was able to brute force a regular unix password in less than a second! Thats 30 Years of computing time for those of us with a pentium.

    A woman from the NSA recently came to give a colloqium for the math dept at my school. One of the things she talked about was cryptography and why the NSA doesn't like us having large keys. One of my questions was why the NSA has never (as far as I know) attacked PGP. I figured if she would answer my question that it'd be that they attack the seperate components of PGP, but since she _didn't_ answer it, I assumed that they know of a weakness in it (maybe some type of multiplication by a number). I've been speculating ever since.

  13. Re:perhaps.. on DoD Computer Forensics Lab to use Beowulf · · Score: 1

    If there is anything thats a standard in distributed/parallel computing its that you want as much optimization as possible. Not only would NT for this type of thing bloat the the unecesdary processes being done, but you have the blue screen issue as well. Since linux allows you to customize a kernel for the components that you need, there's little (or no) waste memory/cpu -wise. Plus its free. Wasting money/time/effort on an OS thats just obsolete for this kind of job would be nuts even for an NT zealot.

  14. Damage? on No AirPort for the French? · · Score: 2

    Just a note... Anything like Apple's Airport being able to damage military hardware because it runs on a certain frequency would show a severe problem with the french military altogether. If they could experience problems from these devices, then obviously its not fit for combat. Of course they're just complaining because its already reserved though...

  15. Re:What's notable is what's lacking on the site on PCWeek "Hack This Page" Cracked · · Score: 1

    They're behind firewalls specificly so that they can limit the attack to httpd. This leads me to assume that they aren't trying to have a "most secure os" contest, but rather they want to figure out where the hole is in NT IIS, because we all know there's a really big one. No one will give away the secret though.

  16. Re:What classifies as a virus? on Finns Outlaw Virus Writing · · Score: 1

    You've completely missed my point. My point is that in the mainstream the term "virus" has been used for trojan horse "programs" or whatever you want to call it. How are these terms defined, and how can this definition keep coders clear if they have a nasty bug in their code.
    Don't bother responding, I already have the answer.

  17. What classifies as a virus? on Finns Outlaw Virus Writing · · Score: 2

    Alot of the lame trojan virii out there are just regular programs that do funky-ass stuff when you execute them. Does that classify as a virus? They're technically just programs where the does not know the effects of it. When the user is stupid enough to execute something he/she doesn't know the effects of, does that still make it a virus? Most of this I've been assuming is media misrepresentation of the term 'virus'.

  18. Re:About "tapping" the Internet... on CALEA update · · Score: 1

    I disagree with you. When specific drugs are scientificly proven to be causing violent outburst in people, thats where the line is drawn. Crack has been scientificly linked to violent crime in every single city and town that it has appeared in. It is highly addictive, and causes people to become _extremely_ violent. You have the freedom to do what you want in this country, UNLESS you impose upon someone elses freedoms. This is specificly why Head hunters from Djibouti (they don't actually exist) can't kill someone and claim religious freedom as their defense. Anyone who is going to bring up pot smoking as a defense to this and how its never hurt anyone or that nobody has ever died from it, don't bother, because thats an old argument, and simply not true. I'm in no way comparing pot to crack however.

  19. Re:So what? on Corel Sticking to Closed Source Beta Test? · · Score: 1

    I have to agree with you. If we took this to the extreme, you could easily say that Open Source means you have to pipe all changes live to a socket or anything and everything. If they're going to have a release, then they need to release it to everyone. However if they're developing it, I think they should be allowed to pick and choose who gets to help them out. Makes perfect sense to me. Maybe that'll be the hole in the GPL though.

  20. This guy is a Gimp living off /. on Dvorak On Linux And "The Big Time" · · Score: 1

    All he does is flame, then live off the hits his articles get by inflamed Linux users. He does not know more than us. He does not provide any intuitive FACT-binding articles. Why does he get posted to Slashdot? You're only feeding the pesky fly that irritates you!!

  21. MS' Ploy to find the hole in NT on Yet Another Crack-This-Box Challenge · · Score: 2

    This is just MS' ploy to find the hole in NT. They know that someone out there has an exploit for a serious security hole in NT, and they want it. I have no doubt that they are sponsoring it, and the bounty of $1000 is to get the people who have the exploit to use it on the machine. This would explain the firewall. Not only is there a firewall, but they're piping all information to another machine which logs the packets. Try a traceroute, you'll make it to the firewall, but not past it. However you can ping it and get a response. Whoever has the exploit, don't use it unless you feel like giving it up, because the second you use it on the machine, you'll be giving MS the precise location of the security hole.

  22. Something Fishy on Yet Another Crack-This-Box Challenge · · Score: 4

    There is definately something fishy here. Both boxes are behind a firewall unidentified by nmap. Translation is that they have some kind of routing firewall to prevent certain ports from being attacked. What kind of contest is this if the ports that are "open" are sitting behind a firewall that won't allow anything more than a 3-way handshake? This is to show NT is secure. I have no doubt anymore. Someone is playing a foul game here.


    [root@kevlar /root]# nmap -sT -O securent.hackpcweek.com

    Starting nmap V. 2.2-BETA4 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
    Interesting ports on securent.hackpcweek.com (208.184.64.171):
    Port State Protocol Service
    21 open tcp ftp
    23 open tcp telnet
    25 open tcp smtp
    70 open tcp gopher
    80 open tcp http
    119 open tcp nntp
    139 open tcp netbios-ssn
    420 filtered tcp smpte
    443 open tcp https

    TCP Sequence Prediction: Class=truly random
    Difficulty=9999999 (Good luck!)
    No OS matches for host (see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
    TCP/IP fingerprint:
    TSeq(Class=TR)
    T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
    T2(Resp=N)
    T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
    T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T7(Resp=N)
    PU(Resp=N)

    [root@kevlar /root]# nmap -sT -O securelinux.hackpcweek.com

    Starting nmap V. 2.2-BETA4 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
    Interesting ports on securelinux.hackpcweek.com (208.184.64.170):
    Port State Protocol Service
    21 open tcp ftp
    23 open tcp telnet
    25 open tcp smtp
    70 open tcp gopher
    80 open tcp http
    119 open tcp nntp
    139 open tcp netbios-ssn
    420 filtered tcp smpte
    443 open tcp https

    TCP Sequence Prediction: Class=truly random
    Difficulty=9999999 (Good luck!)
    No OS matches for host (see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
    TCP/IP fingerprint:
    TSeq(Class=TR)
    T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
    T2(Resp=N)
    T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
    T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
    T7(Resp=N)
    PU(Resp=N)


    Nmap run completed -- 1 IP address (1 host up) scanned in 24 seconds

  23. Re:Slashdot heart failure? on Yet Another Crack-This-Box Challenge · · Score: 1

    Actually, I'd call it more of a Non-Moderating Censorship. Comments disappear, stories disappear (specificly the one this morning about the CEO of Infoseek being arrested for Kiddie porn). Not sure if Taco just didn't like the comments, or if he thought it was the wrong kind of article for /.
    Personally I didn't like the article at all... or the comments.

  24. Not Intentional on Corel Linux Beta License Violates GPL · · Score: 2

    I don't think that this is intentional. I think that they probably took a regular Beta license that they give out for all products and used it for their linux distro. I also do not believe that they would intentionally try to retain rights over things they obviously don't own, or that they would try to keep withhold the source code for their distribution. I think they just don't want every gimp in the world to have a copy of their beta versions, and sending in irrelevent mailings about certain "features".

  25. I just don't buy it... on Killing Off Linux: It's All Academic · · Score: 1

    There's no way MS can kill Linux. Not even at the root level. I got involved with Linux 4 years ago when I was sick of the limited functionality of windows and wanted to try something different. I've installed it on atleast 5 other systems here at school and the people running it _LOVE_ it. State universities may be cash strapped, but when it comes down to it, by the time these people graduating from these Universities get into the work place significantly, Linux will already have a strong foothold, possibly to the point where they're forced to use it. If MS were to give every University free copies of their software for the sake of using only 95/NT they still wouldn't kill Unix. Not only would not every University buy into this plan, but 4 graduating years of students do not compile the entire Information System generation. If MS wanted to succeed at this, we're talking _YEARS_ of influence on a large scale. People over-estimate MS' power to control things. 10 Years from now MS will be releasing its version of MS Linux 2010 complete with source. Unix is not going away anytime soon. Besides, Sun would go down kicking and screaming with this effort, and that'd only pro-long MS' goal.