[117143] in Cypherpunks
Re: Hierarchy of Shopping Bag Computer Intrusions
daemon@ATHENA.MIT.EDU (Gary Jeffers)
Fri Aug 27 03:13:27 1999
Message-ID: <001201bef068$8c212500$99c7a5d0@jeffers>
From: "Gary Jeffers" <jeffers@htc.net>
To: <cypherpunks@cyberpass.net>
Date: Fri, 27 Aug 1999 01:45:38 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000F_01BEF02D.DD3CDAA0"
Reply-To: "Gary Jeffers" <jeffers@htc.net>
This is a multi-part message in MIME format.
------=_NextPart_000_000F_01BEF02D.DD3CDAA0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
-----Original Message-----
From: Gary Jeffers <jeffers@htc.net>
To: cypherpunks@cyberpass.net <cypherpunks@cyberpass.net>
Date: Thursday, August 26, 1999 5:11 AM
Subject: Hierarchy of Shopping Bag Computer Intrusions
=20
=20
Hierarchy of Shopping Bag Computer Intrusions
=
*************************************************************************=
*******
CORRECTION:! Substitute BIOS for Bio throughout post. I knew that =
didn't feel right.
=
*************************************************************************=
***************
=20
My fellow Cypherpunks,
=20
Shopping bag refers to "trusted" software or hardware. =
Particularly,
to shrink wrapped or store bought ware. Shopping bag computer =
intrusions
are particularly dangerous because they can become widespread, offer
general doorways into others computers, and are quite cheap and =
easily
done by State. While the absolute cost might be large, on a per unit
intrusion, it is dirt cheap. It would be a real economy deal to the
State.
=20
I find security and its breaches come in layers or circles.
Below is a list of classes of shopping bag intrusions with easy
threat at the top to more severe threats as you to the bottom.
=20
1. Applications such as games, spreadsheets, and business packages
with backdoors installed.
=20
2. Sentinels (anti-virus ware) with backdoors.
=20
3. Web browers and operating systems backdoored.
=20
Note: The above 3 are especially bad when they are proprietary
with no source code offered.
=20
=20
=20
4A. Motherboard Bio'es backdoored. This is read only memory - ROM.
=20
4B. Motherboard Bio'es with backdoors in the interrupts. I believe =
that
all interrupts are contained in the Bio or in CMOS - battery
powered RAM. Is this a correct assumption? These are the =
interrupts
rather than the interrupt vectors. An interrupt is a small, low
level function that mates motherboards and their associated
peripherals to it with the software system.
=20
5. Computer chips with malice code. Game Over?!!! I see no =
effective
way around these even in theory if they are implemented. We need
ideas on this.
=20
=20
Yours Truly,
Gary Jeffers
=20
BEAT STATE!!!
=1A
------=_NextPart_000_000F_01BEF02D.DD3CDAA0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>
<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type><!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 =
HTML//EN">
<META content=3D'"MSHTML 4.72.3110.7"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV> </DIV>
<BLOCKQUOTE=20
style=3D"BORDER-LEFT: #000000 solid 2px; MARGIN-LEFT: 5px; PADDING-LEFT: =
5px">
<DIV><FONT face=3DArial size=3D2><B>-----Original =
Message-----</B><BR><B>From:=20
</B>Gary Jeffers <<A=20
href=3D"mailto:jeffers@htc.net">jeffers@htc.net</A>><BR><B>To: =
</B><A=20
=
href=3D"mailto:cypherpunks@cyberpass.net">cypherpunks@cyberpass.net</A> =
<<A=20
=
href=3D"mailto:cypherpunks@cyberpass.net">cypherpunks@cyberpass.net</A>&g=
t;<BR><B>Date:=20
</B>Thursday, August 26, 1999 5:11 AM<BR><B>Subject: </B>Hierarchy =
of=20
Shopping Bag Computer Intrusions<BR><BR></DIV></FONT>
<DIV><FONT color=3D#000000=20
size=3D2> =
Hierarchy of=20
Shopping Bag Computer Intrusions</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> <FONT =
color=3D#000000=20
=
size=3D2>****************************************************************=
****************</FONT></DIV>
<DIV><FONT size=3D2>CORRECTION:! Substitute BIOS for Bio throughout =
post. I=20
knew that didn't feel right.</FONT></DIV>
<DIV><FONT=20
=
size=3D2>****************************************************************=
************************</FONT></DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2> My fellow=20
Cypherpunks,</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2> Shopping bag refers =
to=20
"trusted" software or hardware. Particularly,<BR>to shrink =
wrapped=20
or store bought ware. Shopping bag computer intrusions<BR>are =
particularly=20
dangerous because they can become widespread, offer<BR>general =
doorways into=20
others computers, and are quite cheap and easily<BR>done by State. =
While the=20
absolute cost might be large, on a per unit<BR>intrusion, it is dirt =
cheap.=20
It would be a real economy deal to the<BR>State.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2> I find security and =
its=20
breaches come in layers or circles.<BR>Below is a list of classes of =
shopping bag intrusions with easy<BR>threat at the top to more =
severe=20
threats as you to the bottom.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>1. Applications such as games, =
spreadsheets,=20
and business packages<BR> with backdoors =
installed.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>2. Sentinels (anti-virus ware) =
with=20
backdoors.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>3. Web browers and operating =
systems=20
backdoored.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2> Note: The above 3 =
are=20
especially bad when they are proprietary<BR> with no =
source code=20
offered.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>4A. Motherboard Bio'es =
backdoored. This is=20
read only memory - ROM.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>4B. Motherboard Bio'es with =
backdoors in the=20
interrupts. I believe that<BR> all interrupts are =
contained in=20
the Bio or in CMOS - battery<BR> powered RAM. Is this a =
correct=20
assumption? These are the interrupts<BR> rather than the =
interrupt vectors. An interrupt is a small, low<BR> =
level=20
function that mates motherboards and their =
associated<BR> =20
peripherals to it with the software system.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>5. Computer chips with malice =
code. Game=20
Over?!!! I see no effective<BR> way around these =
even in=20
theory if they are implemented. We need<BR> ideas on=20
this.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2><BR>Yours Truly,<BR>Gary=20
Jeffers</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>BEAT=20
STATE!!!<BR>=1A</FONT></DIV></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_000F_01BEF02D.DD3CDAA0--
