December 2003 - cypherpunks-legacy

Re: One-Time-Pad generation from audio device
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

>Date: Mon, 2 Oct 1995 16:42:04 +0100 (BST) >From: "Rev. Mark Grant" <mark(a)unicorn.com> >Sender: owner-cypherpunks(a)toad.com >To: cypherpunks(a)toad.com >Subject: One-Time-Pad generation from audio device > > >Over the weekend I hacked up a one-time-pad generator from > the random >number code I've been writing for Privtool, which uses noise > from the >audio device to generate random numbers. > >The code basically reads in a 512-byte block from > /dev/audio, then takes >the MD5 of that block to generate 16 bytes of the OTP. The > raw audio data >I'm getting is not particularly random and will compress by > 3:1 using gzip >or compress, so I'm assuming that using a 32:1 ratio here > via MD5 will >give a truly random output (it's certainly uncompressible). > >Before I release the source code to the Net, can anyone give > me any good >reasons to believe that this won't produce physically random > output, or >make suggestions on how to test, or improve, the generated > output ? There's >a #define which can be used to easily increase the amount of > data fed into >the MD5, but at the moment it will only generate about 1 MB > per hour on a >Sparcstation (limited by the audio input rate), so I don't > want to >increase that if I don't have to. > > Mark There are many ways to test for randomness. you might want to start by accumulating instance of "1" and "0" and over a long time you should have roughly an equal number of both. If you have access to a spectrum analyzer with an auto-correlation function (or cross-correlation will do) feed in similar lengths of output at different time intervals and check to ensure a low (close to zero) correlation exists. Also while you are at it you might want to checks the ouput's frequency spectrum, it should be fairly uniform accross the generating range. Noise (or randomness) which is not normally distributed can lead to nasty hacks. Be Well!! >

1 0

re: `NOISE' what crypto is that ? [was Re: NT and C2]
by Weld Pond 17 Dec '03

17 Dec '03

>Weld Pond writes: >[...] > > http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7= >i/ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex= >UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8Di31= >MRmypd > > >What kind of (en)coding is that ? some kind of rot13++ ? > I know it looks funny but that is the actual URL. I think it is some kind of verity search engine they use at IQuest. To get it to work I had to paste in the 4 lines individually into Netscape because the URL edit windows doesn't seem to do linefeeds. It's getting pretty bad when you feel like you should uuencode the URL so that people get it straight. Here is the URL again: http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7i /ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8D i31MRmypd Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 10/2/95, MIGUELDIAZ(a)megaweb.com () wrote: >I don't know about everyone else, but a T-shirt seems a very >small reward for uncovering a "hole" in the encryption >algorithm of Microsoft products. Does that apply to any and >all bugs?? i.e. not necessarily security problems?? You are of course welcome to offer a richer prize. Meanwhile, Sameer is the one making the offer, so it's not for us to say he's being cheap. Also, the history of science is filled with cases where bets with trivial payoffs intensely motivated people. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Information, We want information
by Glenn Mackintosh 17 Dec '03

17 Dec '03

> From: todd(a)lgt.com (Todd Glassey) > I an immediate need of info on the liabilities of BSD type systems, and in > particular the BorderWare products. > > I heard that in the BorderWare product itself, there are several recently > discovered potential "holes"... > > I have a particular interest in both the Attack MO against the BSD > platforms in general and the Border products in particular... > > Please do not send the reply to the lists but to me personally > (todd(a)lgt.com) I will summarize if I get enough info to be worth the > effort. > > Any comments? Let me make a very clear statement. No site protected by BorderWare has ever had its Firewall penetrated. Never. This is the second time I've heard rumors about insecurities in the BorderWare software with nothing being brought out to substantiate them. I guess this is just an unfortunate part of doing business - especially in the security domain. I get a bit annoyed by this kind of thing since, regardless of whether we refute such comments, after the discussion itself is forgotten people will often remember that they heard something about a problem with product X. This isn't a criticism of you Todd - you are just reporting that you've heard rumors and asking about them, which is a perfectly reasonable thing to do. Obviously the rumors you heard haven't come along with any facts since you're asking here for the "Attack MO". I would very much like to here about any problem that is real, since if there were any weaknesses we would want to fix them and disseminate the fix as fast as possible. Border takes any potential problem very seriously. A couple of months ago there was a potential weakness that was discovered in the process of Border's ongoing efforts to ensure the security of the product. It was only a security risk with a very specific configuration. No customer has ever reported seeing this. Within two days of this discovery we had a fix and the fix was being actively pushed through the distribution channels to the customer base. It was given high priority and we had our support people calling down to the reseller channels to ensure that they were aware and that they got it out to their clients. We intended to make sure that this potential problem was immediately removed from the firewall even though no one had actually reported a problem. The fix was given free of charge to anyone whether they had a support contract or not. Some customers were even upgraded to a newer version of BorderWare so they could receive the fix. We strongly believe that our customers are entitled to the best available protection. They bought a Firewall for security and they should expect it to be secure. Border will do everything that we can to ensure this is always the case. So, anyone out there if you believe you have some real attack mechanism we want to know. Now that you've sat through the general ranting part of my comments, let me try to answer the BSD specific part. As far as BSD based OS's in general I don't think there is reason to believe that they are any more or less secure than System V based Unix's (or other non-Unix based operating systems for that matter). They all have pro's and con's and they have all had problems and I don't think that one variant has had more problems historically than the other. That said, Border doesn't use a stock BSD based OS anyway. We have put a large amount of effort into "hardening" the kernel so that it is a solid base upon which to build a secure firewall. We don't believe that any stock OS which was designed for a dynamic environment with users on it will really be secure. There are far too many instances (with just about any OS, Unix or otherwise) where someone has gained privilege or increased access to a system by taking advantage of some feature once they managed to get on the box. A firewall should be a static, non-user environment which means that many features are just not required and can be removed or their behavior significantly changed and limited. We spent a considerable amount of manpower stripping down the kernel and leaving only what was really needed. We removed the mechanisms which can be used to gain privilege or increase the levels of access to the system. The BorderWare kernel is in fact one of its strongest assets, and not a potential weakness. Glenn Mackintosh V.P. Technology ------------------------------------------------------------------------ Border Network Technologies Inc. Email: glenn(a)border.com 20 Toronto Street, Suite 400, Tel: +1 416 368 7157 Toronto, Ontario, Canada, M5C 2B8 Fax: +1 416 368 7789

1 0

SAIC Ideas SCI
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://baretta.ideas.com/capabilities SAIC Ideas Group 7120 Columbia Gateway Dr. Columbia, MD 21046-2115 (410) 312-2000 Fax:(410) 312-2250 Contact: Bill Howard (410) 312-2060 wjh(a)ideas.com [Snip] 1.2 SAIC acquired the government sectors of IDEAS, Inc. in November 1994. Now known as the SAIC Ideas Group, this business area encompasses 230 technical people (165 SCI cleared) located in a company owned 100,000 Sq. Ft. Columbia, Maryland facility. [Snip] 2. TECHNICAL SKILLS The SCI cleared skills mix for the SAIC Ideas Group is listed in the table below. Table 1: Ideas Group SCI Cleared Skills Mix (7/95) Skill Category SCI Cleared Staff Project Management 8 Software Engineering 48 Hardware Engineering 10 Hardware Technician 14 Test Engineering 24 ILS 12 Training 12 Systems Engineers 28 Administrative 9 3. COLUMBIA, MD FACILITIES The SAIC, Ideas Group, 100,000 square foot building is located at 7120 Columbia Gateway Drive, Columbia, MD. This facility offers "one-stop shopping" for your system and hardware needs. [Snip] 3.2 Sensitive Compartmented Information Facility (SCIF) features: 13,000 square foot certified SCIF Secure conference areas Secure office spaces Project rooms Raised floor staging areas Two large shielded rooms Class A storage vault Secure STU-III telephone Secure Facsimile The largest SCIF conference room will support approximately 65-75 people; smaller conference rooms are available. Secure staging areas have self-contained environmental control and AC wiring for single or three phase, 50 or 60 Hz, power. The staging areas also provide separate digital and analog ground radials referenced to a single-point independent earth ground to effectively emulate most customer locations. Several SCIF areas can be arranged to provide secure space -- screened if necessary. Systems with 200 racks of equipment have been staged and operated in the Ideas Group SCIF. [Long snip] _________________________________________________________________ webmaster(a)ideas.com // (c) Copyright 1995 by Science Application International Corporation

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

Sorry David, The offer was for a server/filter/MITM/proxy that logged clear text not cyphered text for the SSL stream. Combine your program with SLL code from other sources and 95% of the program is complete. Add to that a way to produce a valid certificate for the client and you will earn the $50 and a lot of praise for a job well done from everybody. > > I have a Fifty dollar bill for the first person to submit to the mail box > > nethack(a)dmsd.com a working Unix server (with cleartext session logs) which > > accepts all connections on a unix based host to the www port and redirects > > them to netscape.com leaving a clear text log of each session's SSL packets > > in /tmp by session. All entries become the property of DMS Design. The winner > > and I will submit a claim for one of Community COnneXion's "I HACKED NETSCAPE" > > tee shirts as a server hack. (Have Fun!!) > > > > This is a trivial program! I can't believe anyone considers this > technically difficult. But hey, who am I to question, if you'll > pay $50! > > Ok, let me back that up with real code. Here's a proxy I've been > using for experimenting, in lieu of root access & tcpdump. For the rest of you, David gave you a small jump start. Checkout the web pages at C2.org and netscape.com for access to the ssl prototype code. Have fun, John Bass Owner, DMS Design

1 0

SAIC Snags INFOSEC
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.disa.mil/ciss/itsc/docs/brochure.html INFOSEC Technical Services Contract The Solution to Your Security Needs Now! What is INFOSEC Information Systems Security (INFOSEC) is defined as the protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats. For operations and for economic efficiencies INFOSEC is an enabling feature. It is the discipline that protects the integrity, availability, and confidentiality of our information assets and systems. All information is important and valuable to its users and requires some level of protection from unauthorized disclosure (confidentiality), assured access by users (availability), and protection from unauthorized change (integrity). We believe that good security is a mission enhancer, not a mission detractor! Our overall approach to information systems is security is to PROTECT information using a layered defense based on risk management and cost benefit analysis. We must be able to monitor all our systems and networks in real time to DETECT intrusions or hostile actions at all levels, and then REACT to isolate the systems, correct the security breach, restore service to the users, and act to prevent future attempts. Center for Information Systems Security Background In July 1990, the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence ASD(C3I), started an investigation effort for coordinated DOD-level management of defense INFOSEC initiatives. DCA, now DISA, was designated as the lead agency with assistance from the National Security Agency (NSA). A DISA/Center for Information Systems Security (CISS) and NSA plan was developed and approved for establishment of the Defense Information Systems Security Program (DISSP). CISS has its origin in the Defense Information Systems Security Program (DISSP), a joint DISA/NSA program. Continuing as a joint program office CISSs mission is to manage, coordinate and provide direct INFOSEC application support to DOD programs, develop standards and protocols for INFOSEC and expedite the implementation of MLS command, control and communications systems for DOD. The CISS provides a means to fully review, coordinate, and make recommendations concerning the implementation of policy, architecture, and products to support DOD objectives. Mission The Center for Information Systems Security (CISS) is a joint DISA/NSA organization charged with executing the centrally managed Defensive Information Warfare (IW-D) and INFOSEC functions within DOD. CISS is the focal point for assuring availability, integrity, and confidentiality of all DII systems and information. We provide direct support to DOD services and agencies, and define requirements for DII INFOSEC standards. Additionally, CISS provides central coordination and reporting response to all DOD INFOSEC incidents, and operational protection, detection, reaction, and vulnerability analysis to the DII. What is the INFOSEC Technical Services Contract? DISA awarded the INFOSEC Technical Services Contract (INFOSEC TSC) on 12 July 1995 to two large businesses (CSC and SAIC) and one small business (MERDAN Group, Inc.). CISS, a joint DISA/National Security Agency (NSA) program, has been chartered to provide INFOSEC services throughout DoD. INFOSEC support will be provided by CISS infrastructure resources with contractual assistance from the INFOSEC TSC. The primary responsibility of the joint program office is to assure the effective and coherent application of INFOSEC to the overall Defense Information Infrastructure (DII). The contract offers technical support in the areas of: * INFOSEC Security Policy * INFOSEC Requirements Support * INFOSEC Architecture and Engineering * INFOSEC Independent Validation and Applications Verifications * INFOSEC Products and Applications DoD Goal Security Architecture (DGSA) * INFOSEC Certification and Accreditation Master Transition Plan * INFOSEC Technology and Training Documentation, and Countermeasures Information Dissemination * INFOSEC Multilevel Security Technology * INFOSEC Technical Managemet and Capabilities Planning (TMP) * INFOSEC ProfessionalizationProgram and Project Management * INFOSEC Standards and Protocols The contract is not a Federal Information Processing (FIP) hardware or software procurement contract. All DOD departments and agencies requiring INFOSEC services can utilize the INFOSEC TSC. The contracts are Indefinite Delivery, Indefinite Quantity (IDIQ) with individual firm fixed price, cost plus fixed fee, and time and material Delivery Orders (DOs) awarded for each requirement. Ceiling on the INFOSEC TSC is $1.095B which includes authority for other Federal (non-DOD) Agency use of 10% of current contract value. An additional 10% authority for non-DOD federal agencies is anticipated from GSA. There will be a 2 percent fee applied to all Delivery Orders. Details for submitting requirements are spelled out in the Guide for the INFOSEC TSC. Advantages of Using the INFOSEC Technical Services Contract * Provides contractual assistance in support of INFOSEC and INFOWAR requirements * Provides a means to obtain assistance in addressing complex systems security issues * Provides a high level of expertise to support systems certification and accreditation * Provides necessary DII/NII security support for DII/NII open systems architecture * Provides hardware and software support for INFOSEC prototyping and incidental hardware/software required to perform the task _________________________________________________________________ The INFOSEC TSC guide can be obtained from the: INFOSEC Technical Support Office (ITSO) Center for Information Systems Security 5111 Leesburg Pike, Suite 100 Falls Church, VA 22041-3201 Attention: Ms. Nanette Chopin (703) 681-1331 ---or--- Attention: Mr. James Lindou (703) 681-1333 FAX (703)681-1393 ---or--- through the World Wide Web at http://www.disa.mil/ciss/itso.html. _________________________________________________________________ SAIC Team Members * Bell Atlantic * Bellcore * CTA, Inc. * George Mason University * Information Security Systems, Inc. * JANUS Associates * Lockheed Martin * MICON Services Company * Pailen-Johnson Associates, Inc. * Secure Solutions, Inc. * Sprint * Technautics, Inc. * TeleCommunication Systems (TCS) * TELOS CSC Team Members * A.B. Floyd * Automation Research Systems (ARS), Ltd. * Bowie State * Computer Associates * DEC * DMR Group * Group Technologies * Intermetrics * IRE * Metters Industry * MIS Training Institute * Northrop Grumman * ORA * Oracle * RSSI * Space Applications Corporation * Systems Engineering Solutions, Inc. * Sparta * Spyrus * SRA * TASC * USATREX * Xerox Merdan Group, Inc. Team Members * Advanced Data Concepts, Inc. * Management Technology Strategic Association, Ltd. _________________________________________________________________ For More Information Contact the INFOSEC Technical Support Office Ms. Nanette Chopin, COR/DPM Voice: (703) 681-1331 Fax: (703) 681-1393 E-Mail to Ms. Nanette Chopin Mr. Jim Lindou, ACOR/PM Voice: (703) 681-1333 Fax: (703) 681-1393 E-Mail to Mr. Jim Lindou Defense Information Systems Agency 5111 Leesburg Pike, Suite 100 Falls Church, Virginia 22041 _________________________________________________________________ Return to: CISS TSC Home Page DISA CISS Home Page DISA Home Page _________________________________________________________________ You can mail any questions about these documents to: Ms. Nanette Chopin You can mail any questions about the DISA server to: yorkw(a)ncr.disa.mil - Last revision: 16 August 1995 okonw(a)ncr.disa.mil _________________________________________________________________

1 0

Keyserver keyrings
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The public keyrings at MIT and Uni-Hamburg haven't been updated since August. Does anyone know why? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMHGqnN74r4kaz3mVAQEdjwP8DnOUAYZa4PqtiMprEaRtwnO2d2RvI2KW jPgeL/99bv/8DwlmbpE2+SYv6AXw4E+MQjPVSbxnpFlH/YuZaGEnJ4mMI6xnvD5X /vFaGI9B82YJ9aLx2MD8Lqu82dCPhk91ZxriyhPkAwfPhe8DfihPwtWaohTDygx5 Uwcifpl49eY= =9xkB -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)left.webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

4 3

Re: Certificate proposal & X509 clarifications
by Rich Salz 17 Dec '03

17 Dec '03

> Therefore, you >have to get someone owning an OBJID tree branch to define meanings for you >- -- and you have to publish some worldwide book of mappings, etc. While I am no big fan of OID's (and I really dislike ASN.1 -- and nobody ever explained to my why the ISO RPC standard doesn't use it), if anybody really needs an ISO OID tree, I will probably be willing to tear off a piece of OSF's: 1.3.22 { iso(1) identified-org(3) osf(22) }

1 0

Re: Time Lag
by Rich Salz 17 Dec '03

17 Dec '03

Internet email is highly dynamic. Hosts can be up/down. Routers can be up/down. Gateways can be up/down. Routing databases can be out of date. Cables can be cut. Load averages can affect whether a host accepts SMTP connections. And so on. Sending one message and rigorously studying timestamps in the Received lines and using that to draw conclusions about mail propagation is a complete waste of time. /r$

1 0

RNG's and time-stamps
by Jim Choate 17 Dec '03

17 Dec '03

Now that is an idea, exploit the dynamic nature of Internet. Us the difference in times between the stamp and when the mail arrives to generate a RNG. Just a thought.

1 0

Re: Time Lag
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> Sending one message and rigorously studying timestamps in the Received > lines and using that to draw conclusions about mail propagation is a > complete waste of time. Ah, but when there seems to be an ongoing pattern of delays, and many people check many messages and find that indeed there is a pattern, it's not a waste of time, no? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by blancw＠accessone.com 17 Dec '03

17 Dec '03

> Community Connexion, an Internet service provider that last week > promised a free T-shirt to anyone who found a flaw in Netscape > Communications Corp.'s software, extended the challenge Friday to > include holes in Microsoft products. ....................................... So what message will the T-shirts have on the front, Sameer? .. Blanc

1 0

Re: CYPHERPUNK considered harmful.
by Ironwolf＠Minotaur.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently Peter Trei <trei(a)process.com> called for new names and slogans to replace the negatively loaded name "Cypherpunks." Here is one effort (partially based on his suggestion, but with refinements.) Note that I intend the term "strong privacy" to include both cryptography-based tools, and other tools such as remailers. I hereby place the following into the public domain. * * * I lock my car. I secure my house. I send my letters in envelopes. I store my valuables in safe places. I don't let strangers hold my wallet. I don't wear a name tag everywhere I go. I carry my cash and credit cards out of sight. I don't show off my key number when visiting the ATM. I protect my e-mail and files with strong privacy tools. Don't you? A message from SPAN: the Strong Privacy Advocates Network -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGvwfwsQtf7CdTI1AQFSGwP9HWusresWaRsQig2fSNW/nXt+oKVv6Np7 5EuziM3v1ihP4Clr4dqUtEE+Yujf7o71I7nb1UrVvwpIOt5yWXtiZc2/5VPZFBUY bTUHlQ/NkgKum9RMnntb8BprtpiTSrb+o2s9iYDJLfFnCeT8n2zEn97GgandKA2o rbXWVIEKSpc= =mBAk -----END PGP SIGNATURE----- ------------------------------------------------------------------------- NOTE: Currently travelling on sabbatical. Expect responses within 7 days. ------------------------------------------------------------------------- ROBERT McNALLY - MINOTAUR CONSULTING Ironwolf(a)Minotaur.com * 714/648-2248 Specializing in Computer Games and Digital Entertainment Software Over 15 Years of Industry Experience: Creative * Technical * Managerial -------------------------------------------------------------------------

2 1

Re: NetScape's dependence upon RSA down for the count!
by Don.Stephenson＠Eng.Sun.COM 17 Dec '03

17 Dec '03

> From cmcmanis@scndprsn Mon Oct 2 09:07:33 1995 > Why forge it? Why not simply buy a netsite server with a valid certificate. > Let's say you paid full list for it $5000. It is the classic MITM attack > but the protection against that attack was generally that the parties > communicating "knew" each other. Of course, the attacker would be leaving a very strong pointer back to themselves as evidence. > This is a fundamental weakness of putting the security at the SSL level as > opposed to a possibly higher level. With the netscape attack since your > client never cares "how" (or to whom) the SSL connection is made, it never > shows you the information about where the source key came from. Only that > it is valid. I'm not sure this is really an issue of where the security is layered, but rather a flaw in the use of it, in not requiring the unambiguous specification of the "service name" (what's in the certificate) beforehand, or confirming it after the connection is established. You must have a binding between the target URL and the desired "service name", regardless of whether you have the security protocol in the session layer (SSL) or the application/http layer (Secure-HTTP). - Don

1 0

Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape'sdependence upon RSA down for the count!)
by cman＠communities.com 17 Dec '03

17 Dec '03

The idea here is to use multiple alternative channels for distributing the checksums (newsgroups, mailing lists, telephone support lines, fax-back service, e-mail, etc.), in addition to the ftp sites. Also, since you guys use (relatively untrusted) mirror sites, you can distribute the checksums on your official sites, so that people can verify them from you directly, even if it's more practical for their main download to be from a "local" mirror. > > I've been thinking about this recently for obvious reasons. My concern >is that if someone can attack your download of netscape, they could also >attack your download of the program that validates netscape. Is there >really any way out of this one? > > --Jeff

1 0

Re: Crypto APIs
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt writes: <snip> >Yes. (ICE, by the way, is funded by ARPA and run by TIS. Strange notion >of "experiment", given that the result of the "experiment" will be to see >whether the government will allow it. So one part of DoD is funding TIS >to find out how another part of DoD behaves...) Your tax dollars at work. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHC9lW1lp8bpvW01AQHg4gQAge0AzJBK7zlQux8Mc6evJZm/Z87noNYM qtS9cc6OPtcBP7kvrwf/sAa1X+vsHQkKec/WsJ3xH944P8m8WuDgTa2/gMoro50E rymwS6ZtIftrmCis4vpTg6xSPhMXDSHg9NcffLNrKXDQh4xW1aRzIgiixRbBCg1s gXyQ5GoGPqk= =TVrb -----END PGP SIGNATURE----- Regards, Jim Ray "One of the penalties for refusing to participate in politics is that you end up being governed by your inferiors." -- Plato ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

New Netscape bug (in version 1.12)
by Ray Cromwell 17 Dec '03

17 Dec '03

C'punks, I just got back from a vacation in Raleigh, and downloaded the new "fixed" Netscape 1.12. It took me about an hour, but I've discovered another bug and potential security hole. This one relates to mailto:. The bug is as follows. Create a HTML file with a hyperlink containing the following URL foo This bug doesn't seem to crash Netscape, instead, it crashes my XServer as soon as the mail window pops op. I'm too tired right now to try to analyze it, but it might be another stack bug, this time, in the X libraries because Netscape isn't doing any sanity checking. I need help testing this bug on other platforms. I have created a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html to test. I have also found 2 other bugs that cause stack trashing in v1.1 however, they are random and I haven't been able to isolate them completely yet. (I have created a page on my system, such that if you visit it, after you visit about 3 more pages, it crashes) What's my point in pursuing this? Netscape's browser is a piece of software that runs on millions of computers and in effect, allows outside agents to input arbitrary data into that software. As such, it is unlike most applications made. Sure, Microsoft Word may have bugs, but how many people are downloading hundreds of MS Word documents everyday and viewing them? Users of Web browsers are exposing themselves like this everyday, and so I think, that web browsers must have higher standards of robustness. I think Netscape represents an enormous risk to computer security, and while I think they are heading in the right direction, there are some very basic implementation issues they need to clear up which are orthogonal to SSL and credit card transactions. All the cryptography in the world won't help you if someone can subvert your cryptobox. Netscape needs to do some serious quality assurance work. I've never been a QA person in my life, but within a few minutes, I have been able to find serious bugs in the software. And while I'm sure Netscape's coders are fine people, proof reading your own code, code that you look at everyday, becomes rather hard because you tend to "see through it". (just like proof reading essays, or messages) I think Netscape should hire some outside firm/group to review their code under non-disclosure for potential implementation holes. -Ray Cromwell <rjc(a)clark.net> P.S. I am running Netscape v1.12 under BSDI2.0 and the XAccel/2.0 server

6 7

CISS TSP MISSI
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.disa.mil/ciss/tsp.html INFOSEC TRAINING AND SECURITY PRODUCTS (TSP) DEPARTMENT The INFOSEC Training and Security Products Department is responsible for developing, coordinating and executing a DoD-wide INFOWAR education, training and awareness program; creating an INFOWAR Career Management Program for DoD; and developing, coordinating, documenting and executing DoD-wide procedures to identify and disseminate INFOSEC products to meet DoD-wide INFOWAR requirements. This department of CISS is also responsible for the update and distribution of the Multilevel Information Systems Security Initiative (MISSI) Implementation Guide. The MISSI Guide is a planning tool, enabling DoD and other agencies to determine resource requirements to implement various MISSI services into their infrastructure. [Insert Multilevel Security (MLS) excerpt] The MLS Program is partnered with NSA's Multilevel Information Systems Security Initiative (MISSI). The MISSI Program is intended to provide a set of MLS technologies that comply with the DoD Goal Security Architecture. These technologies, when developed over the next five years, will be implemented in operational environments by the MLS Program. In the meantime, the MLS Program will continue to identify, assess, and implement commercially available MLS technologies to satisfy immediate MLS requirements throughout DoD. [End insert] The DISSPATCH newsletter, an INFOSEC publication is published 4 times per year by TSP. Electronic copies will be loaded here soon. The Security Products Database is a stand-alone database containing information on over 400 security products, to include their technical characteristics and points of contact. TSP is also building an INFOSEC Training Facility (ITF) at our Falls Church, Virginia location. The ITF will provide state of the art information systems security training to include the suite MISSI educational offerings. Commercial telephone: (703) 681-1325, DSN: 761-1325 Back to the CISS Page yorkw(a)cc.ims.disa.mil Last Revision - 31 August 1995

1 0

Re: New Netscape bug (in version 1.12)
by Arve Kjoelen 17 Dec '03

17 Dec '03

It doesn't crash Solaris 2.4 running X11R5 (Netscape 1.1N) > I need help testing this bug on other platforms. I have created > a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html > to test. -Arve

2 1

Telco Blob
by John Young 17 Dec '03

17 Dec '03

Financial Times of October 3 has a humongous 40-page insert on international telecommunications -- markets, business, technology, and, to be sure, the tele-players lying, cheating, fearing the "computer hacking industry," whimpering with delirious greed at the bountiful, multicultured consumer's mindless credulity of tekkie- gadgets. For the mil-beguiled Colin Powells there's even a colored global map of Big Blob telco strategic rapacity. A tiny cheering blip of machine-wash-n-readable T-stupidity on p. 34: Sutton dismisses worries out security -- despite a recent successful attempt to break the security on Internet financial transactions. An incident in August, when a researcher at the French National Institute of Computer Science and Control (INRIA) broke into the Internet security system, raised concerns about security. "A lot of security is about perception -- after all, every code can be broken. The INRIA incident only involved breaking a single code and needed massive computer resources to do it," says Mr Sutton.

1 0

ZIT_pus
by John Young 17 Dec '03

17 Dec '03

10-3-95. Wash Rag: "Employment Database Proposal Raises Cries of 'Big Brother'." Critics say that in its zeal to combat illegal immigration, Congress is steering the nation toward an "Orwellian nightmare," an era of all-knowing federal oversight whereby officials will be able to verify citizenship by using high-tech national identification cards. So far, no member of Congress has openly called for a national ID card, at least by that name. Rep. Bill McCollurn (R-Fla.) said he intends to offer an amendment on the House floor to create a "more secure" Social Security card with a photo, a hologram and "perhaps a biometric identifier." Microchip technology can make ID cards especially intrusive. According to an analysis by the Cato Institute, one newly patented ID card can hold a photo and 1,600 pages of text. Another identification system developed by a major defense contractor consists of a microchip the size of a grain of rice that can be implanted under the skin with a syringe and read with a scanner. ZIT_pus (7 kb)

1 0

Re: New Netscape bug (in version 1.12)
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From owner-cypherpunks(a)toad.com Tue Oct 3 04:39:23 1995 | Subject: New Netscape bug (in version 1.12) | X-Mailer: ELM [version 2.4 PL24alpha3] | Content-Transfer-Encoding: 8bit | Sender: owner-cypherpunks(a)toad.com | X-Status: | | | C'punks, | I just got back from a vacation in Raleigh, and downloaded the | new "fixed" Netscape 1.12. It took me about an hour, but I've | discovered another bug and potential security hole. This one relates | to mailto:. Well, I'm still in Raleigh :-) but this doesn't do much of anything to my Macintosh, Netscape 1.1N, under System 7.5. Looks like a bug in your X server. However, Netscape 1.1N for Solaris, running under X11R6 X server, dumps core fairly quickly. I haven't had a chance to try out the 1.12 version on UNIX or Mac, but the 1.22 32-bit Windoze version handles it fine under NT 3.5.1. Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

2 1

Re: New Netscape bug (in version 1.12)
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ray Cromwell wrote: > The bug is as follows. Create a HTML file with a hyperlink containing >the following URL > > foo > >This bug doesn't seem to crash Netscape, instead, it crashes my XServer >as soon as the mail window pops op. I'm too tired right now to try to >analyze it, but it might be another stack bug, this time, in the X >libraries because Netscape isn't doing any sanity checking. > >I need help testing this bug on other platforms. I have created >a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html >to test. Nothing on Mac Netscape 1.12 nor on the latest Windows 3.x Netscape. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMHFRwHIf3YegbdiBAQGR6wJXTcCiqgHeunkdLyd1kGUhRTx2JP0p1PN3 UKdThUKLTL7utPDFevRORjF/3B/ziVszJlk+5PASfQeF6DlKYG8ib9Fr0OdW1E0p CPRK =6T18 -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0

Re: CISS TSP MISSI
by Rich Salz 17 Dec '03

17 Dec '03

I don't know which is more annoying: The silly 3/4K of Comments that the freezone remailer puts out. (The use constraints are useless to email recipients, after all); or That some anonymous bozo is posting open WWW data to cypherpunks. I hope that the first, at least, can be fixed. Avoid clutter; note the reply-to. /r$

1 0