bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Unix source code for PGP 5.0i available

Summary

In 1997 PGP 5.0i was available for download as Unix source code on a DFN server for the first time. This was made possible by a scanning campaign led by Ståle Schumacher: the source code was only allowed to leave the USA in printed form and was digitised again in Europe. The Windows and Mac parts needed a few more weeks because of extensive checking.

Ideas

  • US export rules treated strong cryptography as munitions, but not printed books.
  • Activists scanned the printed source code and turned it back into working code.
  • The international version received the suffix “i” to distinguish it from the US version.
  • Correcting errors after scanning was the laborious part of the campaign.

Insights

  • Export bans on software fail when code may be published as text.
  • Legal detours can accelerate technical distribution instead of stopping it.

Facts

  • The campaign was led by a group around the Norwegian Ståle Schumacher.

References

Critique

  • The report does not explain how it was ensured that no errors or manipulations got into the crypto code during scanning.

Remarks

  • The USA relaxed its export rules for cryptography considerably from 1999/2000.

Recommendations

  • Check crypto software against signed sources and traceable builds, not just by where it was downloaded.
  • With cryptography, observe the export rules of all countries involved.

Read the original article

Search the Web Archive

hß · 2022

TP-Link: smuggling malicious code through a security hole in routers

In 2022 researchers from the Vietnamese telecommunications group Viettel found a buffer overflow in the web-based ping tool of the low-cost TP-Link TL-WR841N Wi-Fi router (CVE-2022-30024). Logged-in attackers could execute their own code via an overlong host address and, for example, install a backdoor. TP-Link delivered updates for revisions V10 to V12 and declared older devices end-of-life.

hß · 2019

PGP encryption for web browsers: BSI project improves open source software Mailvelope

In 2019 the German Federal Office for Information Security (BSI) presented the results of a funded project that improved the Mailvelope browser extension for PGP-encrypted email. New features included the ability for website operators to encrypt contact forms end to end, with keys retrieved via the Web Key Directory. An audit by SEC Consult found and closed four holes in Mailvelope and three in the OpenPGP.js library.

hß · 1997

PGP 5 beta for Linux available

In August 1997, PGP 5.0 appeared as a public beta for Linux, as an ELF binary for Intel. Officially, US export restrictions applied, but the file was already on the Dutch Hack-Tic server, and obtaining it from there was considered legal. At the same time, activists in Norway were scanning the printed source code for an international version, PGP 5.0i.