November 2002 - cypherpunks-legacy

RE: New Protection for 802.11
by Trei, Peter 07 Nov '02

07 Nov '02

> James A. Donald[SMTP:jamesd@echeque.com] wrote: > > > Reading the Wifi report, > http://www.weca.net/OpenSection/pdf/Wi- > Fi_Protected_Access_Overview.pdf > it seems their customers stampeded them and demanded that the > security hole be fixed, fixed a damned lot sooner than they > intended to fix it. > > I am struck the contrast between the seemingly strong demand > for wifi security, compared to the almost complete absence of > demand for email security. > > Why is it so? > > --digsig > James A. Donald > How many stories have you read in the last year about non-LEOs stealing email? How many stories in the last year have you read about wardriving? Further, tapping into 802.11b nets * gives the attacker access to your internal network. You already know what you're sending in email, and eavesdropping on data you've already decided to send to someone else feels different than someone trolling through your file system without your knowledge. * requires that the tapper be more or less nearby physically. This feels a lot different than worrying that a distant router is compromised. Peter Trei --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: New Protection for 802.11
by James A. Donald 07 Nov '02

07 Nov '02

-- Reading the Wifi report, http://www.weca.net/OpenSection/pdf/Wi- Fi_Protected_Access_Overview.pdf it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it. I am struck the contrast between the seemingly strong demand for wifi security, compared to the almost complete absence of demand for email security. Why is it so? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG IWe4JFeDeor04Pxb96ZsQ7xX+JAwxSs8HQfoAeG5 4rQX6tgLhAvAwLjF+SXlRswSmphBhw4cOXLe9Y4r5 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

New Scott shows how to globalize your business.
by Scott K 07 Nov '02

07 Nov '02

Hi cypherpunks(a)Algebra.COM, Have you known it yet? A perfect globalization tool for your business. It's the best marketing tool that save your time, money and increase your revenue! http://www.thcity.com/importerlist/directory.html - Every worry how to sell the products to other countries? - Finding the customers in a specified industry from around the world? - Searching the potential customers in a country? - Expanding your business in other regions of the world? ***** NOW YOU CAN MAKE IT EASILY! with the World Importer Directory ***** A bulk of interesting world importer directories are here http://www.thcity.com/importerlist/directory.html Over 152,000 importers from around the world are here. They are from 6 regions, over 150 countries, assembling in a single file for each directory. To meet your need as much as possible, they are designed and classified by country, region and industry. The data contain company name, e-mail, URL, contact address, contact person, telephone number, fax number, product imports. The World Importer Directories are available in 4 file formats, i.e. Application (.exe), MS Excel (.xls), Acrobat Reader (.pdf) and Text (.txt). You can choose upon your preference. http://www.thcity.com/importerlist/directory.html BEST SELLER!!! ************ Email of Importer Directory contains 11,900 email records. Interested? CLICK HERE to buy it. Don't be delay, the gold opportunity is on your hand right now! http://www.thcity.com/importerlist/directory.html Your sincerely, Scott Kayler

1 0

****Business Proposal****
by jmusa4＠myself.com 07 Nov '02

07 Nov '02

NATIONAL ELECTRIC POWER AUTHORITY NIGERIAN WATER WAYS APAPA, LAGOS.NIGERIA CELL PHONE:234-804-213-8559 REPLY TO: jmusa(a)myself.com DEAR FRIEND, YOUR COMPANY'S NAME AND ADDRESS WAS GOTTEN FROM A BUSINESS DIRECTORY IN MY SEARCH FOR A WELL KNOWN BUSINESSMAN WHO HAS NO QUESTIONABLE CHARACTER AND MUST BE A SUCCESSFUL BUSINESSMAN. AS A MATTER OF FACT, I AM JUSTICE MUSA , A DIRECTOR IN THE NATIONAL ELECTRIC POWER AUTHORITY (N.E.P.A). ALSO I WAS PRIVILEGED TO BE A MEMBER OF TENDER'S BOARD THAT AWARDED AND SUPERVISED THE EXECUTION OF A MULTIMILLION U.S. DOLLARS CONTRACT IN 1998. THE CONTRACT HAS BEEN COMPLETED AND COMMISSIONED IN AUGUST 1996,AND ORIGINAL CONTRACT VALUE PAID IN OCTOBER 2000, TO THE FOREIGN FIRM THAT ACTUALLY EXECUTED THE CONTRACT. HOWEVER, AS A RESULT OF OVER-INVOICING AND SERIES OF REVISION CARRIED OUT IN THE COURSE OF THE CONTRACT EXECUTION, THERE NOW EXISTS A FLOATING SUM OF US$45.5M(FORTY FIVE MILLION FIVE HUNDRED THOUSAND U.S DOLLARS ONLY). THIS MONEY IS NOW DUE FOR PAYMENT IN THE GOVERNMENT QUARTERLY PAYMENT SCHEDULE AND WE WISH TO REMIT THIS FUND INTO YOUR DESIGNATED PERSONAL OR CORPORATE ACCOUNTS OVERSEAS. WE SHALL SECURE THE PAYMENT APPROVALS FROM THE RELEVANT OFFICE/MINISTRIES HERE FOR THE RELEASE OF THIS CONTRACT SUM IN FAVOUR OF YOUR COMPANY WITH DOCUMENT AND INFORMATION WE SHALL REQUEST FROM YOU TOO, WE HAVE NOW CONCLUDED ARRANGEMENTS IN THE CENTRAL BANK OF NIGERIA TO REMIT THIS MONEY AS SUM REALIZED BY A COMPANY THROUGH LEGITIMATE MEANS IN NIGERIA. TERMS AND CONDITIONS THE FUND WILL BE SHARED 35% FOR YOU AND 60% FOR US. THE REMAINING 5% TAKES CARE OF ALL INCIDENTAL EXPENSES. TO FORMALISE THIS TRANSACTION IN NIGERIA IN FAVOUR OF YOUR DESIGNATED COMPANY WE REQUIRE YOUTOFORWARD THE FOLLOWING: 1. AN ASSURANCE OF YOUR ABILITY, WILLINGNESS AND READINESS TO FULLY CORPORATE WITH US DURING DISBURSEMENT OVERSEAS AND TO MAINTAIN THE MAXIMUM CONFIDENTIALITY REQUIRED IN A BUSINESS OF THIS NATURE IN ALL PLACES AT ALL TIMES ON BOTH SIDES. 2. PARTICULARS OF YOUR BANKS INCLUDING NAME OF BANK, ADDRESS, ACCOUNT NUMBERS, TELEX AND FAX NUMBERSANDE-MAIL NUMBER OF YOUR BANK. 3.YOUR PRIVATE TELEX, FAX AND TELEPHONE NUMBERS FOR SAFE, QUICK AND EFFECTIVE COMMUNICATION INCLUDING HOME AND MOBILE PHONES (IF ANY). 4.WILLINGNESS & READINESS TO ASSIST ME IN PROCURING RELEVANT DOCUMENTS/APPROVALS. THIS REMITTANCE IS GUARANTEE IN LESS THAN 14(FOURTEEN) WORKING DAYS UPON RECEIPT OF THE ABOVE MENTION PARTICULARS BY FAX, HOWEVER, IT REQUIRES THE HIGHEST CO-OPERATION, SERIOUSNESS, MUTUAL TRUST, HONEST AND STRICTLY CONFIDENTIAL ON BOTH SIDES TO AVOID JEOPARDIZING THE POSITION OF THE OFFICERS WHO ARE TOP GOVERNMENT FUNCTIONARIES. ALSO WE WANT TO USE PART OF OUR PERCENTAGE TO IMPORT ANY QUICK SELLING GOODS WITH YOUR ASSISTANCE AFTER THE FUND HAS BEENTRANSFERREDINTO YOUR BANK ACCOUNT. LOOKING FORWARD TO HEARING FROM YOU THROUGH MY TELEPHONE:234-804-213-8559 OR REPLY TO: jmusa(a)myself.com BEST REGARD. JUSTICE MUSA

1 0

Re: Did you *really* zeroize that key?
by pgut001＠cs.auckland.ac.nz 06 Nov '02

06 Nov '02

>[Moderator's note: FYI: no "pragma" is needed. This is what C's "volatile" > keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. [Moderator's note: I'd be curious to hear a summary -- it appears to work fine on the compilers I've tested. --Perry] Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Amsterdam loses electricity, lots of internet service
by Harmon Seaver 06 Nov '02

06 Nov '02

On Wed, Nov 06, 2002 at 04:02:54PM -0800, Bill Stewart wrote: > Reported on the NANOG list > > There's been an explosion in a power distribution center in amsterdam, > over > > half the city is without power, and, as far as I know, the Nikhef building > > is competely powerless, Telecity is running on backup generators. Redbus > > building seems at least partially up, but the link between Telecity and > > Redbut is dead. Power company is working on the problem, but as yet, its a > > big mess. > > --- > >> http://www.ams-ix.com/hugegraph.html > >> That can only be an error, I heard ams-ix got a power outage at the > moment... > > > 80% of Amsterdam is without power, one AMS-IX site is without no-break > > power for an other few weeks, others are running out of UPS capacity. Shit! Holy Shit! What will happen to all those grow rooms? This is an unparalled disaster. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com "War is just a racket ... something that is not what it seems to the majority of people. Only a small group knows what its about. It is conducted for the benefit of the very few at the expense of the masses." --- Major General Smedley Butler, 1933 "Our overriding purpose, from the beginning through to the present day, has been world domination - that is, to build and maintain the capacity to coerce everybody else on the planet: nonviolently, if possible, and violently, if necessary. But the purpose of US foreign policy of domination is not just to make the rest of the world jump through hoops; the purpose is to faciliate our exploitation of resources." - Ramsey Clark, former US Attorney General http://www.thesunmagazine.org/bully.html

1 0

Re: Did you *really* zeroize that key?
by Shawn K. Quinn 06 Nov '02

06 Nov '02

On Wednesday November 6 2002 10:22, Trei, Peter wrote: > What it really needs is the addition of a #pragma > dont_remove_this_code_you_bastard in the compiler. > Until then, a lot of security code will be affected by this problem. Somehow I don't think they'll quite call it this. But you've got to admit it is cute. :-) How about either: #pragma no_optimize or #pragma security -- Shawn K. Quinn

1 0

Re: German Wiretappers Bill Victims
by Steve Schear 06 Nov '02

06 Nov '02

At 08:09 AM 11/6/2002 +0100, Eugen Leitl wrote: >On Tue, 5 Nov 2002, Bill Stewart wrote: > > > http://www.theregister.co.uk/content/5/27917.html > > > > German secret service taps phones, bills buggees I wonder if its possible if this billing incident wasn't a mistake, but an activist "pulling down the pants" of their security services. steve

1 0

Did you *really* zeroize that key?
by Trei, Peter 06 Nov '02

06 Nov '02

>From RISKS: http://catless.ncl.ac.uk/Risks/22.35.html#subj6 Those of us who write code need to be reminded of this now and then. Peter Trei --------------- Software leaves encryption keys, passwords lying around in memory Monty Solomon <monty(a)roscom.com> Wed, 30 Oct 2002 22:31:46 -0500 http://online.securityfocus.com/archive/82/297827 Date: Thu, 31 Oct 2002 05:11:31 +1300 (NZDT) From: pgut001(a)cs.auckland.ac.nz (Peter Gutmann) Subject: Software leaves encryption keys, passwords lying around in memory The following problem was first pointed out (in private mail) by Michael Howard from Microsoft. His writeup is now available at http://msdn.microsoft.com/library/en-us/dncode/html/secure10102002.asp. From a representative check of a few widely-used open source crypto programs, this affects quite a bit of software. The problem he points out is that clearing sensitive information such as encryption keys from memory may not work as expected because an optimising compiler removes the memset() if it decides it's redundant. Consider for example the following: int encrypt( const void *key ) { puts( key ); /* Normally we'd encrypt here */ } void main( void ) /* Because we can */ { char key[ 16 ]; strcpy( key, "secretkey" ); encrypt( key ); memset( key, 0, 16 ); } When compiled with any level of optimisation using gcc, the key clearing call goes away because of dead code elimination (see the MSDN article for more details on this, which uses VC++ to get the same effect). While you can kludge enough stuff around a custom memory-clear call to fool the optimiser (hacks with 'volatile', touching the memory after it's cleared and hoping the optimiser is fooled, etc etc) there's no guarantee that it'll work for anything but the compiler(s) you happen to test it with - any future enhancement to the optimiser may turn it back into a nop. What it really needs is the addition of a #pragma dont_remove_this_code_you_bastard in the compiler. Until then, a lot of security code will be affected by this problem. [In RISKS, I tend never to alter British spellings. However, in American English, an "optimiser" must be the ultimate miser.]

1 0

Respond for Your FREE Euro!
by oil9783hj2157h37＠cs.com 06 Nov '02

06 Nov '02

1 0