December 2003 - cypherpunks-legacy

Mailing list
by accw5＠glen-net.ca 17 Dec '03

17 Dec '03

I wish to join the mailing list accw5(a)glen-net.ca

1 0

Re: Keyserver keyrings
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

syrinx(a)c2.org (Syrinx Anonymous Remailer) writes: > According to 'Derek Atkins': > > > The name pgp.mit.edu is now > > pointing at another machine (which I do not maintain). For access to > > the keyring, send email to pgp-public-keys(a)pgp.mit.edu -- that is the > > supported method of access. > > does anybody out there maintain a current keyring that can be grabbed > via anon ftp instead? It seems like a waste of time for hundreds of > users to continually add updates to their own keyrings when the whole > keyserver ring can be picked up at one time, updates and all? ftp is > much more convenient than stringing together multiple sections received > by e-mail. That's what I did with WS_FTP until they stopped updating it on August 24th. [Pgpkeys] HOST=ftp.informatik.uni-hamburg.de UID=anonymous LOCDIR=c:\pgp DIR=/pub/virus/crypt/pgp -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: New Netscape bug (in version 1.12)
by Jeff Weinstein 17 Dec '03

17 Dec '03

On Oct 4, 11:00am, sameer wrote: > Subject: Re: New Netscape bug (in version 1.12) > Isn't there a resolver #define or something in limits.h called > MAXHOSTNAMELEN ? Something like that? (Perhaps not, but that's what I > recall..) We are using MAXHOSTNAMELEN if it exists, both in 2.0, and in the security patch that we shipped. If it doesn't exist we just assume 64. As a quick sample, on sunos and irix it is 64, and on solaris it is 256. On sunos and irix it is defined in sys/param.h, and on solaris it is defined in netdb.h. I wasn't able to find any mention of it or any other limits on the host names passed in to gethostbyname() in the man pages on any of these systems. --Jeff Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Rich Salz 17 Dec '03

17 Dec '03

>If the cancel cannot be authenticated (e.g., because the original article lacks >the "Cancel-lock: M2" header, or the cancel lacks the "Cancel-key: M1" header >such that H(M1)=M2), then INN should forward the unauthenticated cancel to one >or more "collection centers" so the author of the original article may be >notified. So if 70% of Usenet follows this scheme a handful of forged cancels can easily cause melt down. >Each "collection center" deamon should wake up periodically (say, every hour), >group the collected unauthenticated cancels by message-ids of the cancelled >articles, and e-mail the (distinct) addresses (other than "usenet@*" or >"news@*") mentioned in the "From:", "Sender:", "Authorized:", and >"X-Cancelled-By:" headers, quoting the unauthenticated cancel and the Path's as >seen at many different sites that forwarded the cancels. This way, if the >unauthenticated cancel is indeed forged, its author will see within hours that >it has been fraudulently cancelled _and_ will automatically receive enough >"Path:" samples from all over the world to see where it was posted, by >comparing the "Path:" headers in several forwarded copies. I can post a handful of articles and forge the From line, and create my own Cancel-lock headers by "rolling the dice." I can then get their mailbox bombed by forging cancels. A little more complicated then "sendsys-bombing" but not much more so. /r$

1 0

Re: Serious Windows TCP/IP Security Hole
by Rich Graves 17 Dec '03

17 Dec '03

I'm forwarding you a couple messages. I haven't run SAMBA myself, but people who have have been able to read files on my machine that aren't supposed to be shared. -rich On Wed, 4 Oct 1995, Henry Sanders (Exchange) wrote: > Hi, I've jumped in late on this thread. What is the bug referred to in the note below? I might be able to give you current status on it. > > Thanks, > Henry Sanders > henrysa(a)microsoft.com > > >In article <44amc4$ft6(a)nntp.Stanford.EDU>, llurch(a)networking.stanford.edu > says... > >> > >>FYI for those of you still running WFW. Could anybody confirm or deny > >>that Microsoft has patched this hole in the shipping version of 95? > >>As with most such serious "oopsies," Microsoft has not made any > >>information on this issue available in their Knowledge Base. > > > >Nope, it is still there. > > Can you demonstrate that this is true? I'll give you an account on my box. > I've received several notes and flames that the problem either never > existed (which I know is untrue) or was fixed at a specified (often > specified different) patch level. > > I should really try this myself, but I don't have time, and the only UNIX > box I can really mess with is my Linux box, which is also my Win95 box. > -rich

1 0

Re: Serious Windows TCP/IP Security Hole (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 30 Sep 1995 02:01:56 -0700 (PDT) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Ken Simler <krs2(a)cornell.edu> Subject: Re: Serious Windows TCP/IP Security Hole (fwd) I don't really know, I'm just passing on news... maybe talk to these folks. -rich ---------- Forwarded message ---------- Date: Thu, 28 Sep 95 19:56:38 PDT From: Tom Czarnik <czarnik(a)netmanage.com> To: Rich Graves <llurch(a)Networking.Stanford.EDU> Subject: Re: Serious Windows TCP/IP Security Hole On Thu, 28 Sep 1995 18:31:07 -0800 Rich Graves >Can you demonstrate that this is true? I'll give you an account on >my box. I've received several notes and flames that the problem >either never existed (which I know is untrue) or was fixed at a >specified (often specified different) patch level. We can do it your way or if you are physically located at Stanford, you can schedule an appointment to come by NetManage. We are located in Cupertino, right off 280 at DeAnza Blvd. The choice is yours.

1 0

Re: Serious Windows TCP/IP Security Hole (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 30 Sep 1995 02:03:58 -0700 (PDT) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Ken Simler <krs2(a)cornell.edu> Subject: Re: Serious Windows TCP/IP Security Hole (fwd) This doesn't work for you? Please get back to me if you figure it out. I'd like to document the problem accurately. -rich ---------- Forwarded message ---------- Date: Thu, 28 Sep 95 23:45:49 -0400 From: Mark Thornton <markt(a)eng.umd.edu> To: llurch(a)networking.stanford.edu Newgroups: comp.os.ms-windows.win95.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.networking.tcp-ip Subject: Re: Serious Windows TCP/IP Security Hole I can confirm that the complete(floppy) version of Windows 95 STILL has the ../ bug ;-( The ... bug has been fixed correctly returning the following message chkpath: ERRDOS - ERRbadpath (Directory invalid.) But cd ../ WILL put you in the root directory of the share with the rights you had in the intial directory. Very bad... I've had to share all my drives read-only until the problem gets fixed.

1 0

McNeil Lehrer on Net Insecurity
by John Young 17 Dec '03

17 Dec '03

McNeil Lehrer has a segment on net boogers this evening, reported by Time's anxious Elmer-Dewitt. Diffie, Farmer and Shimomura, all beautifully coiffed, offer sagacious views. It includes a clip of Kevin, unbeautifully cuffed and mutely eloquent. Says most of the charges against him have been plea-bargained away.

1 0

GSS sample/demo?
by David K. Merriman 17 Dec '03

17 Dec '03

Sorry for the 'broadcast', but I'm looking for some source code that shows how GSS 'works' in real-world applications, as well as opinions on how good it is. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

SAIC Bags Tier 1 Job
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

SAIC Awarded Multimillion Dollar Communications Security Contract San Diego, Oct. 3 /PRNewswire/ -- Science Applications International Corp. (SAIC) said it has been awarded a three year, $28 million contract to support the Space and Naval Warfare Systems Command (SPAWAR). The Common Tier 1 System will integrate computers and software to implement and field the Tier 1 element of the Department of Defense's Electronic Key Management System. This program will provide automated communications security and key management system support for the Navy, Army, Air Force, Marines, Coast Guard and other government agencies. Common Tier 1 will help implement the Electronic Key Management System and support its integration with COMSEC material management in the Navy, Army, Air Force and joint key management systems. The work performed on this contract will be split between San Diego (66%) and Camden, New Jersey (34%), and is expected to be completed in October 1998. "We expect to hire an additional 65 employees in San Diego during this contract to primarily work on software development," said SAIC Program Manager Tom Trebelhorn. "This is a very significant win that allows SAIC to continue its involvement in this key information security program and extend the company's commitment to the communication security field," Trebelhorn added. SAIC provides high-technology services and products for government and private industry in the areas of space, transportation, national security, environment, health care, energy and systems integration. With nearly $2 billion in annual revenues, the employee-owned, San Diego based company has 20,000 employees in more than 350 locations worldwide. Contact: Tom Trebelhorn, Operations Manager of SAIC, 619-552-5319, or fax, 619-452-3540, or e-mail, tom_trebelhorn(a)cpqm.saic.com/

1 0

Re: Crypto APIs
by James A. Donald 17 Dec '03

17 Dec '03

At 04:29 PM 10/2/95 -0400, Matt Blaze wrote: > It seems best to encourage the realistic > side of NSA as much as possible... Why? Surely the realists are more dangerous than the nuts. > [...] > > In other > words, the parts of the military that are concerned with actually > securing communications want exactly what we want, and are just > starting to realize it. This does not necessarily protect our right to cryptography, any more than it protects our right to full auto guns. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Digestable
by Man In Black 17 Dec '03

17 Dec '03

Would whoever posted information on a free cypherpunks digest please repost? Thanks. =]=

1 0

Macneil-Lehrer tonight.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Whitfield Diffie, Dan Farmer, and another Sun Microsystem guy whose name I can not spell but who tracked down Kevin Mitnik are on the Newshour right now. JMR No PGP .sig Regards, Jim Ray "Every act of visibility is an act of resistance." Suzanne Pharr - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> - ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHOTMCoZzwIn1bdtAQHsDQF/ZUbX7FTGpQRuuS/vyPIBqlPO9ovW26un Q5CalRK8OSwX1IuNG0H9Nqj14QhsAfnd =qUCL -----END PGP SIGNATURE-----

1 0

Simple hardware RNGs
by John A. Thomas 17 Dec '03

17 Dec '03

Having built devices for generating random data, I can tell you the problem is more difficult than it appears. The problem is removing biases and correlations from the process. A good place to start is Murry, Herschell, "A General Approach for Generating natural Random Variables", IEEE Transactions on Computers, December 1970, p. 1210-1213. --------------------------------------------------------------------- John A. Thomas | (214) 263-4351 | jathomas(a)netcom.com Bowles & Thomas, L.L.P. | Voice | CompuServe 75236,3536 410 N.W Eleventh St. | (214) 262-6520 | Grand Prairie, Tx 75050 | Fax | PGP public key available ---------------------------------------------------------------------

1 0

$BN_air
by John Young 17 Dec '03

17 Dec '03

10-5-95. FTPeach: "A David and Goliath fight, the battle between Netscape and Microsoft over software for the Internet." For all of his success in outwitting the likes of IBM to become the leader of the world's biggest software company, Bill Gates has long said that the competition he most feared would come from a software start-up with breakthrough, innovative technology. Netscape Communications may be such a company. But a war over technology standards, which could delay the progress of electronic commerce and potentially impede Netscape's growth, now seems inevitable. Netscape's hand has been weakened by recent incidents in which flaws in the security features of its browser software were discovered by two "cyberpunks" [sic]. $BN_air (8 kb)

1 0

xus_ORN
by John Young 17 Dec '03

17 Dec '03

10-5-95. Wash Rag: "Congress Debates Adding Smaller Spy Satellites to NRO's Menu." Top members of the House and Senate intelligence committees are carrying on a behind-the scenes debate over the nation's spy satellite system, with one group arguing that the governmeat could save hundreds of millions of dollars by building a new generation of small satellites to be launched in place of some of the big ones already planned. The Combest group wants to start production now of 2,000-pound space vehicles, each costing about $100 million and nicknamed "small-sats." "$1.6 Billion in NRO Kitty Helped Appropriators Fund Pet Projects." On the morning of Sept. 21, security men bustled around Room H-140 on the first floor of the Capitol, sweeping it to ensure that the space was free of electronic eavesdropping devices. This year's session turned out to be different from any in recent memory. The conferees took more than $1 billion from the once-sacrosanct spy satellite program of the National Reconnaissance Office (NRO) to help make room in the budget to speed up purchases of hundreds of millions of dollars worth of big-ticket defense items, including the B-2 "stealth" bomber. xus_ORN (17 kb)

1 0

Re: Oct 14 meeting Agenda? (DC Cypherpunks)
by Tom Rollins 17 Dec '03

17 Dec '03

>>I figure that as long as we are going to receive... >> ? a commercial message from Digex ? >> >>We might be able to tap their knowledge base in assesing >>the various risks and rewards available by using a Commercial >>ISP. >> >>After all, with the FBI and Scientologists waging war on >>the Internet ( capturing keystroaks, siezing computers, >>and rummaging through everyones E-mail ), There may be a >>way to make life a little more interesting for them. >I will be glad to send in my two cents worth - I am not sure that >I understand the question though. While, I believe in strong crypto for everyone (what cypherpunks doesn't), I also believe that much can be done to prevent the wholesale snooping of Commercial ISP customers data. I believe that this data is snooped because the ISP's and large number of customers (ignorant of security) make this data too easy a target (cost effective). While the NSA may follow it's motto (In GOD we trust, the rest we monitor). Others may take hostile actions agenst someone whose password or personal information has been obtained. (ex. drain bank account, or just send spam) Some questions that I would like to ask... 1 - Assuming that someone from an agengy or someone pretending to be from an agency wanted to capture one or all the ISP customers key presses. What method would they use ? Would they capture the data at the phone company? Would they tap the raw data stream at the initial ISP router ? Would they route IP packets from the initial ISP router through their own equipment before arriving at the ISP maching running the shell account ? Would they use a Trojin Shell (or telnetd) on a shell account ? Would they inform the ISP and get his help or root access ? 2 - What methods could be put into place by the ISP or it's customers to help prevent this snooping activity ? Perhaps an alternative login method (like deslogin or idealogin) trying to protect data through the phone company and IP route to the target machine. Perhaps having a crypto checksum on the shell (telnetd) to detect trojin software. Perhaps sendmail could public key encrypt mail on it's way to the customers directory. Perhaps just raising the customer awareness of security issues and methods at the ISP. This could affect the mainstream user (joe sixpack) as well as the PGP user. Perhaps ISPs could offer a data archive service/site (foreign site) where data in the form of PGP encrypted E-mail can be saved and retrieved via a robot (something like majordomo). That way, if your home computer breaks, burns, is stolen, or siezed. You can still retrieve your data at a later time. Granted these methods do not prevent a determined attacker from squashing an ISP cutomer. However, it does raise the cost of the effort to single out a user and attack him rather that grab cleartext from everyone. -tom

1 0

Re: Oct 14 meeting Agenda ? (DC Cypherpunks)
by Tom Rollins 17 Dec '03

17 Dec '03

> >>I figure that as long as we are going to receive... > >> ? a commercial message from Digex ? > >> > >>We might be able to tap their knowledge base in assesing > >>the various risks and rewards available by using a Commercial > >>ISP. > >> > >>After all, with the FBI and Scientologists waging war on > >>the Internet ( capturing keystroaks, siezing computers, > >>and rummaging through everyones E-mail ), There may be a > >>way to make life a little more interesting for them. > > >I will be glad to send in my two cents worth - I am not sure that > >I understand the question though. > > While, I believe in strong crypto for everyone (what cypherpunks doesn't), > I also believe that much can be done to prevent the wholesale snooping > of Commercial ISP customers data. I believe that this data is snooped > because the ISP's and large number of customers (ignorant of security) > make this data too easy a target (cost effective). > > While the NSA may follow it's motto (In GOD we trust, the rest we monitor). > Others may take hostile actions agenst someone whose password or > personal information has been obtained. (ex. drain bank account, or just > send spam) > > Some questions that I would like to ask... > > 1 - Assuming that someone from an agengy or someone pretending to > be from an agency wanted to capture one or all the ISP customers > key presses. What method would they use ? > > Would they capture the data at the phone company? > Would they tap the raw data stream at the initial ISP router ? > Would they route IP packets from the initial ISP router through their > own equipment before arriving at the ISP maching running the shell > account ? > Would they use a Trojin Shell (or telnetd) on a shell account ? > Would they inform the ISP and get his help or root access ? > > 2 - What methods could be put into place by the ISP or it's customers > to help prevent this snooping activity ? > > Perhaps an alternative login method (like deslogin or idealogin) > trying to protect data through the phone company and IP route > to the target machine. > Perhaps having a crypto checksum on the shell (telnetd) to detect > trojin software. > Perhaps sendmail could public key encrypt mail on it's way to the > customers directory. > Perhaps just raising the customer awareness of security issues > and methods at the ISP. This could affect the mainstream > user (joe sixpack) as well as the PGP user. > Perhaps ISPs could offer a data archive service/site (foreign site) > where data in the form of PGP encrypted E-mail can be saved and > retrieved via a robot (something like majordomo). That way, > if your home computer breaks, burns, is stolen, or siezed. You > can still retrieve your data at a later time. > > Granted these methods do not prevent a determined attacker from squashing > an ISP cutomer. However, it does raise the cost of the effort to single > out a user and attack him rather that grab cleartext from everyone. > > -tom >

1 0

Re: NSA Realists v. Nuts (Was: Re: Crypto APIs)
by James A. Donald 17 Dec '03

17 Dec '03

Matt Blaze writes: > > > It seems best to encourage the realistic side of NSA as much as > > > possible... James Donald writes: > > Why? Surely the realists are more dangerous than the nuts. At 03:57 AM 10/5/95 -0400, Futplex wrote: > (I'm assuming that a Realistic Agenda has at least as good a chance > of success as a Nutty Agenda. [...] ) Language problem: If that is the case, then the "Nutty Agenda" is perfectly sane. They want to rule over us. There is nothing crazy about that. Evil yes. Crazy no. Their objective is to create a surveillance state, where all actions are known and recorded by the state, in order to facilitate detailed state control over every aspect of our lives. Our agenda is the opposite. There is no commonality of purpose, hence no possibility of cooperation. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: FORGED CANCELS of posts on n.a.n-a.m
by James A. Donald 17 Dec '03

17 Dec '03

At 06:11 PM 10/5/95 +1000, David Gerard wrote: > One thing that occurs to me: suppose I go to control, collect cancel messages, > and build myself a collection of M1's that will work with a given M2? > > That is, I can't actually invert the hashing function. But if a given > hash function is standard, then I can eventually build up a collection of > M1s for M2s that will let me cancel quite a few things I may want to. > How many cancel messages come through in a day? Considerably less than 340,000,000,000,000,000,000,000,000,000,000,000,000 --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

In article <45040d$8cd(a)cougar.vut.edu.au>, gerdw(a)cougar.vut.edu.au (David Gerard) writes: >One thing that occurs to me: suppose I go to control, collect cancel messages, >and build myself a collection of M1's that will work with a given M2? > >That is, I can't actually invert the hashing function. But if a given >hash function is standard, then I can eventually build up a collection of >M1s for M2s that will let me cancel quite a few things I may want to. Good point -- if M1 is known to be small in size (say, a 128-bit MD5 of the article body + newsgroups + message-id + date + secret passphrase), then an organization with a lot of $$$$$$$ and computing resources (like Co$ or NSA) might even try to pre-compute M2 = H(M1) for many possible M1's, sort the result by M2, and build a (partial) lookup table of inverted H. This would be a humongous table. Would someone bother to do it just to cancel a few Usenet messages? Possibly. But I see an easy fix: change Hujskonen and Franz's original proposal so that an article posted with message-id X contains the header "Cancel-lock: M2", where M2 is now H(X + M1), not just H(M1). This way, even if two different articles happen to share the lock M2, they'll need different keys M1's to be cancelled because their unique message-id's are different. A pre-computed table of inverse values of H would be useless. To cancel a given X, a brute force attacker would have to compute M2 = (X + M1) for all possible M1's. Hopefully, the article X will expire naturally long before this can be done. :) And in article <9510042317.AA14344(a)sulphur.osf.org>, Rich Salz <rsalz(a)osf.org> writes: >>If the cancel cannot be authenticated (e.g., because the original article lacks >>the "Cancel-lock: M2" header, or the cancel lacks the "Cancel-key: M1" header >>such that H(M1)=M2), then INN should forward the unauthenticated cancel to one >>or more "collection centers" so the author of the original article may be >>notified. > >So if 70% of Usenet follows this scheme a handful of forged cancels can easily >cause melt down. (Thank you for looking at this!) If 70% of Usenet followed this convention and refused to honor unauthenticated cancels and supersedes's, then forged cancels would be much less harmful than they are now, and there would be less need to notify the victims and to track down the perpetrators. Perhaps, not _every site should send out notifications. The purpose of getting notifications from multiple sites is to compare the Path: header and see where it was forged. I suppose notifications from just 5--10 well-positions sites would often suffice. But if these sites are well-known, then an attacker might put their names in the Path: of the forged cancel, to bypass the notification and still propagate the cancel to a lot of other sites. We can start implementing this scheme gradually, first by patching our posting software to insert the "Cancel-lock:/Cancel-Key:" headers, and by running a few "watchers" based on Homer Wilson Smith's Lazarus that'll notify the poster when an article with a Cancel-lock: header is being cancelled without a matching Cancel-Key: -- in all newsgroups, not just in a.r.s. Notifications about articles without a "Cancel-Key:" header can be added much later, if ever. >>Each "collection center" deamon should wake up periodically (say, every hour), >>group the collected unauthenticated cancels by message-ids of the cancelled >>articles, and e-mail the (distinct) addresses (other than "usenet@*" or >>"news@*") mentioned in the "From:", "Sender:", "Authorized:", and >>"X-Cancelled-By:" headers, quoting the unauthenticated cancel and the Path's as >>seen at many different sites that forwarded the cancels. This way, if the >>unauthenticated cancel is indeed forged, its author will see within hours that >>it has been fraudulently cancelled _and_ will automatically receive enough >>"Path:" samples from all over the world to see where it was posted, by >>comparing the "Path:" headers in several forwarded copies. > >I can post a handful of articles and forge the From line, and create my >own Cancel-lock headers by "rolling the dice." I can then get their mailbox >bombed by forging cancels. A little more complicated then "sendsys-bombing" >but not much more so. Yes -- someone can post an article with random noise in the Cancel-lock: header, and it would be impossible to cancel except by NoCeM. As for mailbombing, one can do it much easier by forging a sendsys in the victim's name, or by e-mailing the victim megabytes of junk from a phoney "From:" address. This is done, but not too often because the perp is likely to be tracked down and beaten up. :) Why would someone use this attack and not straight forged sendsys? One could address this by limiting the number of notifications e-mailed to one address or even to one site in a period of time. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Certificates, Attributes, Web of Trust
by Bill Stewart 17 Dec '03

17 Dec '03

Carl and I and others have been discussing whether the Web of Trust ought to use certificates to tie keys to people or attributes. It's taken a while to sink in, but I now think he's basically right :-) ; on the other hand, it can also still be done using the ugly X.509 format. This means that we can begin to go out and corrupt users who might otherwise want Driver's Licenses for the Infotainment Superhighway into realizing that the Net can give them _more_ privacy instead of less. >Alternatively, I can have First Security Bank open account 01732 for me and >create a certificate binding my public key to that account number. Now, I >can use that key to sign anonymous checks. (The bank knows me, perhaps, >but the payee doesn't need to.) Yeah. Consider a slightly-abused Distinguished Name for a checking or credit card. /Account=01732/Type=Checking/Org=FooBank/Country=com/ with key aaa signed /Title=Accountsigner/Org=FooBank/Country=com/ with key bbb signed /Title=MasterKey/Org=FooBank/Country=Com/ with key mmm signed /OU=Corporate/O=Verisign/Country=com/ with key vvv When you sign a check/credit card today, your name and signature are there as vague verification for the payee and bank that it's authentic; with digital signatures, the fact that you can sign a note saying "Pay $X to $Y Signed aaa" is all the verification they need, though the name business makes it easier for them to find what attributes the signer had and how to get the actual money... Even the account number could be the public key instead, but that's pretty long. (Credit cards may be a slight wrinkle, since there are lots of laws about them.) What the name also gives you is a handle to hang marketing data on. Sometimes, you may have that data from the transaction (card cccccc wanted 5 plutonium widgets sent to Resident, 1600 Penn.Ave, WashDC 20017), sometimes you've got less (card cccccc wants to receive results of a stock search at IP address 199.35.212.164, which is way less since that's just a Netcom port server :-) So a credit card or checking account with just an account number and key gives you _far_ more privacy than a current conventional one - even if it's not the full mathematically subpoena-proof privacy that Chaumian digicash could give. And if your bank wants to offer extra privacy, it can let you create sub-accounts - send a request for "Create Sub-account Key SSS Account AAA Parameters p1,p2,p3" signed aaa, and it sends you a new certificate /Account=NewUnique#/etc. with key SSS signed by bbb. So you can give everybody a different-looking check, at least if the cost is low. [> Key signing "I use this name" vs. names not being able to sign "I use this key"] I still think you often want both directions, especially for privacy. (For authentication, anybody who's got the attribute you want or claim will often do; for privacy, you really want to identify the _person_ you're talking to, so the attribute "where the _real_ Carl Ellison gets his mail" is important. Pseudonyms have an easier time of this, as long as they start using their keys at the same time as their names.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:47 AM 10/4/95 EDT, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >When an article is posted, two quantities are computed by the posting program: >M1 = H(article body + newsgroups + message-id + date + passphrase) and >M2 = H(M1). The posted article contains the header "Cancel-lock: M2". >[.. Cancel-key: M1 to cancel or supersede.] >[..Daemons forward suspected forged cancels to originator] Aside from the forged-From:-bogus-cancel spam /r$ proposed, this has the problem that it still only allows the originator to cancel a message, and not either the moderator of a moderated group or a Good Spam-canceller like CancelMoose, as well as stopping censors and cancel-spammers. Cancellation is a sufficiently local-policy-dependent issue, and reasonably low volume compared to the rest of news, that it probably makes sense for the various news programs to hand cancellation requests off to an external program, which can be locally modified as desired. One approach is to add digital signature and verification capability to News, at least to support cancels; doing this in an outboard cancel-daemon is obviously easier. RIPEM-SIG is a signature-only version of RIPEM which is exportable, probably just in binaries. The local cancel-daemon could accept cancellation requests that were signed by anybody on the list of locally-approved cancellers; one site could accept cancels from Cancelmoose, newsgroup moderators, and Helena Kobrin; another could do authors only. This would, of course, encourage people to get their digital signatures out there to allow themselves to cancel their own messages. ---------------- BTW, on the general topic of spam, I got a nice note back from the Johnson-Grace folks saying they were sorry they posted their ad/announcement to the list and it won't happen again. And you can download their compression stuff from www.jgc.com but they're not actually making the algorithms public... ----- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 3

Re: FORGED CANCELS of posts on n.a.n-a.m
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> One thing that occurs to me: suppose I go to control, collect cancel > messages, and build myself a collection of M1's that will work with > a given M2? > > That is, I can't actually invert the hashing function. But if a > given hash function is standard, then I can eventually build up a > collection of M1s for M2s that will let me cancel quite a few things > I may want to. How many cancel messages come through in a day? You would have to collect quite a few cancels just to get one pair of valid hashes for a message you want to cancel... You don't even need to collect cancels from control; you could just start hashing 128-bit strings until you got one that hashed to M2. The catch is you would have to hash on the order of 2^64 strings for MD5, for instance. That's a lot of hashing to cancel one article... It's likely going to be much less work to try to guess the passphrase used to generate M1. There is also a better than average chance that the target used the same passphrase to lock multiple posts... andrew

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:11 PM 10/5/95 +1000, you wrote: >One thing that occurs to me: suppose I go to control, collect cancel messages, >and build myself a collection of M1's that will work with a given M2? MD5 produces a very random 128-bit output; you're not going to collect any appreciable fraction of the 2**128 possible M2s. As long as M1 is even as simple as MD5(messageid,passphrase), it's pretty open territory. Targeted attacks, however, are still possible, as long as M1 retains the form MD5(known-stuff, passphrase) - assuming the user uses one of the few hundred million wimpiest passphrases, you can search that moderately fast; if you're willing to burn some resources, you might be able to take out most of alt.religion.spam, at least until people use better passphrases. The amount of work depends somewhat on whether you use MD5(known-stuff, passphrase) or MD5(passphrase,known-stuff). For the first case, the cracker would calculate the MD5 context after doing known-stuff (once) and then grind away on passphrases. For the second, the cracker could pre-compute a table of MD5 context for the wimpy password list, and then add known-stuff to each. Since known-stuff is probably longer than passphrases here, the latter is probably more secure for this application. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0