Mondex Broken

We've received from anonymous a report on breaking
Mondex's pilot system by TNO along with a confidential
1996 memo describing the break:

   TNO's Ernst Bovenlander gave some details of these 
   attacks (though he didn't mention Mondex as the target). 
   He showed an electron micrograph of a fuzed link in a 
   smartcard; while intact, this link activated a test mode in 
   which the card contents were simply dumped to the 
   serial port. The TNO attack was to bridge the link with 
   two microprobes. At the last RSA conference, Tom 
   Rowley of National Semiconductor reported a similar 
   attack on an unnamed chip using an ion beam to 
   rewrite the link .

Included is a letter from the Bank of New Zealand to 
Electronic Frontier Canada attempting to suppress 
publication of the memo.

   http://jya.com/mondex-hack.htm

At 6:55 PM -0700 9/9/97, John Young wrote:
>We've received from anonymous a report on breaking
>Mondex's pilot system by TNO along with a confidential
>1996 memo describing the break:
....
>Included is a letter from the Bank of New Zealand to
>Electronic Frontier Canada attempting to suppress
>publication of the memo.
>
>   http://jya.com/mondex-hack.htm

You mean the way <elided> had lawyers send threatening letters to <elided>
warning him not to further publicize the claimed security flaws in
<elided>, the security product sold by <elided>?

I myself received a phone call from <elided>, warning me to not to even
make reference to the rumors that <elided> had flaws in it.

Some of you know what I mean.

There's even a chance this vague note here will cause <elided> to again
contact me, warning me that even such <elisions> are not good enough for
them.

And I'm not at all surprised that those with financial interests in
products are attempting to supress technical or competitive analysis
reports. It's become the way of the world to hire lawyers and barristers to
intimidate whomever they can.

Fortunately, this is what remailers are so useful for. (Though the lawyers
and cops are going after the remailers, as several recent cases have shown.)

And the execrable copyright new world order would make such reverse
engineering illegal in many cases. More reason to nuke it with remailers.

--Tim May



There's something wrong when I'm a felon under an increasing number of laws.
Only one response to the key grabbers is warranted: "Death to Tyrants!"
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Tim May <tcmay@got.net> writes:

> You mean the way <elided> had lawyers send threatening letters to <elided>
> warning him not to further publicize the claimed security flaws in
> <elided>, the security product sold by <elided>?
>
> I myself received a phone call from <elided>, warning me to not to even
> make reference to the rumors that <elided> had flaws in it.
>
> Some of you know what I mean.

For those who still don't know what Tim May means, the barratrous
threats came from the crypto snake oil peddler C2Net and its Arab
owner Sameer Parekh.

Sameer's "product", StrongHold, is a hacked version of the free Web
server Apache, and has more backdoors and security holes than
Swiss cheese.

On Wed, 10 Sep 1997, Anonymous wrote:

> For those who still don't know what Tim May means, the barratrous
> threats came from the crypto snake oil peddler C2Net and its Arab
> owner Sameer Parekh.
> 
> Sameer's "product", StrongHold, is a hacked version of the free Web
> server Apache, and has more backdoors and security holes than
> Swiss cheese.

Well Vulis^h^h^h^h^hAnonymous, care to tell us what those holes are so we
can use them?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    |Prying open my 3rd eye.  So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were      |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
======================= http://www.sundernet.com ==========================

John Young wrote:
| We've received from anonymous a report on breaking
| Mondex's pilot system by TNO along with a confidential
| 1996 memo describing the break:
| 
|    TNO's Ernst Bovenlander gave some details of these 
|    attacks (though he didn't mention Mondex as the target). 

	This seems pretty cool (the point in the memo about 'security
being suitable for purpose' with purpose left undefined but implied by
Mondex to be 'low value' is very interesting).  However, its not clear
to me who TNO is?

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

The TNO is a Dutch research organization.  Based on this blind man's
view of the elephant, it's sort of like a national lab, but with a more
applied focus.

bd

On Wed, 10 Sep 1997, Adam Shostack wrote:

> John Young wrote:
> | We've received from anonymous a report on breaking
> | Mondex's pilot system by TNO along with a confidential
> | 1996 memo describing the break:
> | 
> |    TNO's Ernst Bovenlander gave some details of these 
> |    attacks (though he didn't mention Mondex as the target). 
> 
> 	This seems pretty cool (the point in the memo about 'security
> being suitable for purpose' with purpose left undefined but implied by
> Mondex to be 'low value' is very interesting).  However, its not clear
> to me who TNO is?
> 
> Adam
> 
> -- 
> "It is seldom that liberty of any kind is lost all at once."
> 					               -Hume
> 
> 
>