Re: Palladium -- trivially weak in hw but "secure in software"?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Tal Garfinkel
> Software-based attacks are redistributable. Once I write a program > that hacks a computer, I can give that program to anyone to use. I > can even give it to everyone, and then anyone could use it. The > expertise necessary can be abstracted away into a program even my > mother could use. > >

Re: Palladium -- trivially weak in hw but "secure in software"??(Re: palladium presentation - anyone going?)

2002-10-22 Thread alan
On Tue, 22 Oct 2002, Rick Wash wrote: > Hardware-based attacks cannot be redistributed. If I figure out how > to hack my system, I can post instructions on the web but it still > requires techinical competence on your end if you want to hack your > system too. > > While this doesn't help a whole

Re: Palladium -- trivially weak in hw but "secure in software"?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Rick Wash
On Tue, Oct 22, 2002 at 04:52:16PM +0100, Adam Back wrote: > So they disclaim in the talk announce that Palladium is not intended > to be secure against hardware attacks: > > | "Palladium" is not designed to provide defenses against > | hardware-based attacks that originate from someone in control

Re: Palladium -- trivially weak in hw but "secure in software"??(Re: palladium presentation - anyone going?)

2002-10-22 Thread Arnold G. Reinhold
At 4:52 PM +0100 10/22/02, Adam Back wrote: Remote attestation does indeed require Palladium to be secure against the local user.  However my point is while they seem to have done a good job of providing software security for the remote attestation function, it seems at this point that hardware s

Palladium -- trivially weak in hw but "secure in software"?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Adam Back
Remote attestation does indeed require Palladium to be secure against the local user. However my point is while they seem to have done a good job of providing software security for the remote attestation function, it seems at this point that hardware security is laughable. So they disclaim in t

Re: anonymous remailers

2002-10-22 Thread Steve Furlong
On Tuesday 22 October 2002 10:22, Shawn K. Quinn wrote: > If one has set up a new anonymous remailer, where is the best place > to get the word out? Here or somewhere else? The cpunks list is good. There's a list of remailers, with meatspace locations, at http://riot.eu.org/anon/remap.html . You

anonymous remailers

2002-10-22 Thread Shawn K. Quinn
If one has set up a new anonymous remailer, where is the best place to get the word out? Here or somewhere else? -- Shawn K. Quinn

Re: palladium presentation - anyone going?

2002-10-22 Thread Arnold G. Reinhold
At 10:52 PM +0100 10/21/02, Adam Back wrote: On Sun, Oct 20, 2002 at 10:38:35PM -0400, Arnold G. Reinhold wrote: There may be a hole somewhere, but Microsoft is trying hard to get it right and Brian seemed quite competent. It doesn't sound breakable in pure software for the user, so this forces

Re: palladium presentation - anyone going?

2002-10-22 Thread Adam Back
On Sun, Oct 20, 2002 at 10:38:35PM -0400, Arnold G. Reinhold wrote: > There may be a hole somewhere, but Microsoft is trying hard to get > it right and Brian seemed quite competent. It doesn't sound breakable in pure software for the user, so this forces the user to use some hardware hacking. The

Re: Intel Security processor + a question

2002-10-22 Thread Major Variola (ret)
At 05:13 PM 10/21/02 -0400, Tyler Durden wrote: > >So I guess the follow on question is: Even if you can look at the code of a >RNG...how easy is it to determine if its output is "usefully random", or are >there certain "Diffie-approved" RNGs that should always be there, and if not >something's up?

Re: Auditing Source Code for Backdoors

2002-10-22 Thread Mike Rosing
On Wed, 31 Dec 1969, Bill Frantz wrote: > I have been asked to audit some source code to see if the programmer > inserted a backdoor. (The code processes input from general users, and has > access to the bits that control the privilege levels of those users, so > backdoors are quite possible.) T

One of Brinworld's uglier moments, no rights for immies

2002-10-22 Thread Major Variola (ret)
So two illegals are going back because they were in a white van near a pay phone. They're fortunate, they only got the 12gauge in the face and the asphalt facial; in a month it'll be a cruise missile first, forensics later. "Mr. Godsniper, call us back. We couldn't trace^H^H^H^H^H hear you. " Th

Discovery Channel, CIA team up for "cyber crime challenge!"

2002-10-22 Thread Declan McCullagh
today... DEFENSE The Discovery Channel Science exhibition with the nation's top 40 middle school scientists as finalists in the 4th annual Discovery Channel Young Scientist Challenge (DCYSC), October 22-23. Highlights: 9:30 a.m. - CIA Challenge, Langley, VA 10 a.m. - Cyber-crime Challenge, ACCES

Auditing Source Code for Backdoors

2002-10-22 Thread Bill Frantz
I have been asked to audit some source code to see if the programmer inserted a backdoor. (The code processes input from general users, and has access to the bits that control the privilege levels of those users, so backdoors are quite possible.) The question I have is what obscure techniques sho

Re: One of Brinworld's uglier moments, no rights for immies

2002-10-22 Thread Morlock Elloi
> surrounding a white van near a Richmond gas station. Toyota, GM and Ford all reported huge drop in white van sales, to a virtual zero. Ford also asked dealers to remove white vans from "highly visible" locations. Unrelated, several body shops are advertising discounts on "white van conversion"

Palladium

2002-10-22 Thread Peter Clay
I've been trying to figure out whether the following attack will be feasible in a Pd system, and what would have to be incorporated to prevent against it. Alice runs "trusted" application T on her computer. This is some sort of media application, which acts on encoded data streamed over the intern