December 2003 - cypherpunks-legacy

Re: Hack Java
by br＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

]Both of you are correct if you look carefully at the assumptions. Rich ]assumes that you have a 'malicious compiler'. Godmar is right that Java ]does not utilize pointers in the byte code. What would make the entire ]scenario work is a malicious interpreter or a 'NotJava Browser'(TM) that ]allowed malicious code to be executed. Couple a bad compiler and a bad ]interpreter and you are in buisness (nasty business that is). Yes. And if you also let an intruder in your house, have them sit at your computer with your newborn child in the room and go on vacation, things can get really, really nasty. Sort of like when you execute untrusted code in an untrusted environment... -- Benjamin Java Products Group

3 2

Re: Open NNTP servers and logging
by stephen_albert＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:33 AM 1/27/96 +0000, mianignad(a)outlook.net wrote: >Well, as bad as the lack of anonymity may be, NNTP server logs serve a very >usefull purpose, ie finding and eliminating trolls and spammers. >Unfortunatly, I would have to go logs given the state of UseNet. I wish that didn't make so much sense to me. I can certainly see things from th sysadmin's point of view. >Why not just read from the open server, and post anonyomously using anonymous >remailers and News-to-Mail Gateways? That's exactly what I'm doing for the moment. After my current job starts payin I'll shop around services like C2 and see who has a faster news feed than my current ISP. Things take way too long to get here sometime. By the way, plug plug plug, I wrote up a short set of instructions on posting through gateways with Private Idaho and put it on alt.security.pgp. An Alta Vista or Deja News search would turn it up. I can also mail it out to anyone wh would like a helping hand with it. Stephen "all the news that fits we print" Albert stephen_albert(a)alpha.c2.org <*> PGP key on request and on servers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQnPWkimCtQtWVIdAQHb0Af9Gu061sLCpF9IXmyhhjhYMQMOf2yS7jbc 7fC9Q+SsxwRCq3N9PKcY/3We73HB4p4Ksu+PHa0s6AsTZcrWpm372G+XEyRXxs4k MXxJHM21eqawy4SoQL8wccpgfRl0AHGyfhDJMiYPVMgUejugXo6npWh/13am2tA2 H+qQc/8f9YPcMa12k00WkH/fzfnldO+5A/p0OGxhip+ELwQR03UX3OJQuIAPJB91 qJQI90eu64yeE/MRCY4nNiQX3tX3+r5CtZFoYNQ2TSXPZlgvIzojcT8hyIteUbrd L/Ocfg7qRQP6P9iAVjq8xFhNjVAFvODvnEH07mNw4nq4YjdQ2i5f8g== =HvDS -----END PGP SIGNATURE-----

1 0

Possible Java hack.
by Steve＠aztech.net 17 Dec '03

17 Dec '03

I had a brainstorm this morning, and I think that I may have a possible hack against Java that might circumvent a few network access policies and the firewalls that support them. Looking at the Java APIs it seems pretty likeley to me that when a name to address lookup is performed, all it does is call gethostbyname() or the equivilant. If this is the case (and I don't have a source license at this point, or even a system that will run Java) there is the possiblility that a sytem with control of a web server and a DNS server could coerce a Java client into initiating TCP connections to clients other than the system that provided the applet (which should be a prohibited behavior, as I read the specs.) This is still at the WAG stage, since I don't have access to source code and have not received confirmation (nor denial) from any of the vendors that I have contacted, but I'd appreciate feedback (positive or negative) from the list(s). FWIW, my WAGs have about an 80% hit ratio, but this is the first that I've posted without confirmation. ObCrypto: _When_ will DNS be secured via PKE? -- Steve(a)AZTech.Net

2 1

Encrypted IP tunneling
by roy＠sendai.cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I suddenly find myself in a position where I really need to set up a secure IP pipe between my machine and another site. All the machines involved are running Linux, of slightly varying vintages (but all recent kernels). Recomendations appreciated. Save listwidth... email direct. Thanks. - -- Roy M. Silvernail [ ] roy(a)cybrspc.mn.org PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)cybrspc.mn.org -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQb5lWCl9Uka85MxAQEJqQf/Zqvq5wg8xGsiXliiyq9uWQzTI9ClVrk+ kKIJIYjpdkE8BJqbW+e5f56h6IDBUu+2wX+kl/AyBF714MIAXsHcG3CoMvwJ85Z+ 7Pni1rcnGesVyub32lUUuTFkGy1MWwFexMtMJLjeTV4nunrhVj6JX80cUQI2mnBG U+LscMhTfnln7Y55qPPMuVDrGOtu2cdA1foJ6AxGWmaTbz5Sa6tw0o1dVjlS4uQR iz61HVv44mzhN4EFEfdNNQHskWSmrx7lQwYAdmyTT8ii4qvMU0oT3TQ8ENq/XTfn lnqqRjd72XzTkgrFfi8DAHVOntOWwuS/S1McrbMs07jgv2QOF6uzVA== =eO7h -----END PGP SIGNATURE-----

1 0

ANNOUNCE: NEW MIXMASTER REMAILER
by lead remailer 17 Dec '03

17 Dec '03

Hello all, I am pleased to announce a new mixmaster remailer. This remailer was compiled and installed primarily using the mix-installer script available from Adam Shostack. To get the script, send a message to adam(a)lighthouse.homeport.org with Subject: get mix-installer. here is the relevant info: address: mix(a)zifi.genetics.utah.edu long name: lead remailer short name: lead for your type2.list file: lead mix(a)zifi.genetics.utah.edu a76c3fda7294a6695c5e6a931d1c0b73 2.0.3 Here is the public key for lead remailer: =-=-=-=-=-=-=-=-=-=-=-= lead mix(a)zifi.genetics.utah.edu a76c3fda7294a6695c5e6a931d1c0b73 2.0.3 -----Begin Mix Key----- a76c3fda7294a6695c5e6a931d1c0b73 258 AATH5fR56oEcdVRNn2SrjJ4XsoWb+lP2E2GgGdgI 2A3//3ctBkQ13xb5MHOfix8ra63PZmeCrK+6QbbV Ql1iwboMMaWz8NPmNpQz2K0/vnTnp8tWEyL5vo95 jlRmACXPefXdLOzszAgfMn02rzzXrq+9AnaUAUxD idxVglBkXRkriwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB -----End Mix Key----- Here is the mix-help file: From: mix(a)zifi.genetics.utah.edu (Mixmaster remailer at zifi) Subject: Instructions for using anonymous remailer This message is being sent to you automatically in response to the message you sent to mix(a)zifi.genetics.utah.edu with subject "remailer-help". This is a Mixmaster remailer. It provides an extremely high level of security. To use it, you must have a client program to produce the messages. This software is available from ftp://flame.alias.net:/pub/replay/pub/remailer Read the README file for instructions. Some information can be sent to you by the remailer by including the following commands (one per message) in the subject line of mail to the remailer. remailer-help This file. remailer-stats Useage statistics for the last 24 hours. remailer-key The mixmaster key file for this remailer. This section of the helpfile is blatantly plagarized from the mixmaster faq located at: http://www.obscura.com/~loki/remailer/mixmaster-faq.html. --- What is Mixmaster? Mixmaster is a new class of anonymous remailers. Inspired by the existing "cypherpunk" remailers and discussions on the Cypherpunk mailing list. Mixmaster is the next generation in the evolution of remailer technology. What is an anonymous remailer? Quoting from Andre Bacard's remailer FAQ: An anonymous remailer (also called an "anonymous server") is a free computer service that privatizes your e-mail. A remailer allows you to send electronic mail to a Usenet news group or to a person without the recipient knowing your name or your e-mail address. What do I need to use Mixmaster remailers? Unlike other remailers, you can't just make your own message and send it to the remailer. Mixmaster's security comes in part from using a special message format. The disadvantage of this is that you need a special program to make the message for you. Once you have that program (the client) remailing is as easy as running the program, and telling it which remailers you want to use. How do I get the Mixmaster client software? There are two sites for distribution. First, is ftp to obscura.com and read /pub/remail/README.no-export. The other is by anonymous ftp to jpunix.com. You will have to follow the instructions there to get Mixmaster. Because Mixmaster contains cryptography, it may not be exported from the U.S and Canada. The reason for the circuitous route to download Mixmaster is to show my good faith efforts to keep Mixmaster from being exported. I have heard rumors that someone has already broken this law, and that Mixmaster is available from Europe. I do not approve of this and will not support that site. Does Mixmaster use PGP? No, Mixmaster uses the rsaref package from RSA. Mixmaster uses its own keys and key file formats. To add a key to a key ring, simply append the key to your key file using your favorite text editor. Can mix(a)zifi.genetics.utah.edu post to News? No. News posting is not supported at this time. Abuse Policy: I consider the following to be inappropriate use of this anonymous remailer, and will take steps to prevent anyone from doing any of the following: - Sending messages intended primarilly to be harassing or annoying. - Use of the remailer for any illegal purpose. If you don't want to receive anonymous mail, send me a message, and I will add your email address to the block list.

1 0

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jim Bell writes: >I notice that you responded through an anonymous remailer, and didn't even >use a nym. This is strange. No it isn't. You run around talking about killing people anonymously, but have trouble with anonymous harsh words? Color me unimpressed. I might be someone you know. I might be a plant. I might be something else. Doesn't matter. The words are the words and stand on their own. >> are often that way because we think the *means* the State uses are evil, >not to be excused by any amount of >mumbo-jumbo. > >I think the state's ENDS are evil, too, not merely their MEANS. I have no argument here. But good ends do not execuse bad means. And killing people who are not an immediate threat to you (or someone in your immediate vicinity) is a bad idea. Play the game of the State and become just like it. >Actually, if you followed my arguments carefully, you will notice that my >position is most accurately described by pointing out that I _could_not_ >keep you from participating in this "immoral game", even if I wanted to. You also didn't mention the problem of fraud. I set up A. Nony Mouse's Hired Guns Service. You pay me a lot of money to go off someone. I come back and say "Sorry, couldn't do it. Bad traffic." Then I wander off with the money. Who are you going to complain to? I have this sneaky feeling that damn few courts, Statist or otherwise, are going to get worked up over your loss. And since the whole thing's done anonymously, you are left without a leg to stand on. Assassination Politics -> Scam-O-Rama. >For the record, I suspect some people who are total pacifists view the rest >of us, those willing use use violence to defend ourselves, as "immoral." I agree. But then I'm not a total pacifist. Self-defense is an inherent right. Llap-gauche is not. >Aha! You're implying (actually, implying is an understatement here) that I >am an "agent provocateur." Nope. Just pointing out that you are doing the job of an agent provacateur very well. But your reply goes a long way toward moving you out of that category and into the category of KoTM fodder. Signed, A Friend PS. This whole thing really is off-topic. I'm letting it drop now. Bluster to your heart's content.

1 0

Re: "Gentlemen do not read each other's mail"
by Rich Salz 17 Dec '03

17 Dec '03

> It is not merely ethical for one government to > read another's mail, it is a duty. You're too smart to really believe this. Or do you have some way for a foreign gov't to know that *this* call is about a murder while *that* call is about a CIA-sponsored hit against Castro? /r$

1 0

Re: [NOISE] Re: "Gentlemen do not read each other's bank statements"
by Bill Stewart 17 Dec '03

17 Dec '03

>> > The high cost of WW II made it a necessity for the gvm't to have more >> > money at a particular moment, and not wait for year-end. >> Not so. Govt has been able to print fiat money at will since the Fed >> Reserve was founded in 1913. The phrase "not worth a Continental" dates to several wars before that, and several governments of East-coast North America as well. tenuous-at-best connection to cypherpunks material - using a currency backed only by the supply of ones and zeroes requires a market mechanism to encourage the issuers not to overdo it.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:06 PM 1/26/96 -0600, Alex Strasheim <cp(a)proust.suba.com> wrote: >Why aren't foreign companies flooding America with strong crypto? Well, >there are clearly pressures of the sort Tim described at work. But there >are other factors as well: ..... Among other things, the RSA and other public-key patents in the US, combined with non-exportability, severely limit the ability of non-US companies to sell public-key-based software in the US. Banks often use moderately-strong crypto (single-DES), and there are some imported cash machines which support it, but it's not a big market. Other than that, most people don't care much about crypto, and assume that the password-"protection" that Microsoft products offer is enough for them. >Digicash is probably the first significant crypto product to be exported >to America. IDEA's pretty significant, though PGP 2.x could have used triple-DES if IDEA hadn't been available. The political significance of it being foreign, or at least non-NSA-tainted, has been somewhat important as well. Then you could also contend that Shamir, a significant crypto producer, exported himself to America :-) (I think he's the RSA member who's Israeli?) (You could also contend that Enigma and Purple were exported to America, and in Enigma's case, the ability to crack it was mainly Polish and British.) Digicash is highly significant as an idea, but will only be significant in reality if they can pull off a successful business strategy before the market gets saturated with less private solutions that everyone needs to be backwards-compatible with. >It's important to note that this extremely important product couldn't >have been produced here, patents aside. >Transaction systems need to be international, and our rules make > America an unsuitable place from which to launch tranaction software. Nicely put; I'll have to steal it sometime :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Reply: "This post is G-Rated"
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Nice addition to your .sig! root@heavily.censored.org....(lightly.censored.org coming soon) :) At 11:18 AM 1/25/96 -0800, you wrote: >[This post is classified as G-Rated by Tim May. >I see no agreed-upon labelling convention emerging. Fortunately. > >--Tim May > >Boycott espionage-enabled software! -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

At 01:44 PM 1/25/96 -0800, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: >it really bugs me how much cypherpunks try to point out the "gotchas" in all >the laws with crypto. when we become *experts* on these laws, and >tell people why they prevent them from doing various things, we >are actually *supporting* them. It's not often we see an active and overt defense of ignorance. Good work, Vladimir! But to really avoid being contaminated by evil knowledge, I recommend the following 12-step program: 1. Admit that you are powerless to get a clue. Print out this message for reference. 2. Unsubscribe from Cypherpunks, and all other sources of information that might be relevant. 3. Unsubscribe from all sources of information that probably aren't relevant, to avoid hostile agents forcing you into unwitting coercion. 4. Read William S. Burroughs books until you begin to see your neighbors as giant cockroaches and slugs. 4a. In the event that you already see them this way, read Burroughs until they look like something else. 5. Join as many religions as possible, so that you have incompatible memes busily protecting you from facts. <steps 6 through 11 deleted until receipt of a note delivered by the proper techniques, to be beamed into your mind later> 12. Seal your head in a plastic bag until you suffocate. This will protect you from such problems in the future. Hope this helps! Signed, A Friend

1 0

Hey, jdoe-agamemnon! Re: NOISE Test Ignore
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:00 PM 1/26/96 -0800, MAILER-DAEMON(a)alpha.c2.org wrote: >Unknown addressee: jdoe-agamemnon(a)alpha.c2.org > >----- Unsent Message Follows ----- > >Received: by alpha.c2.org for jdoe-agamemnon(a)alpha.c2.org > From stewarts(a)ix.netcom.com Fri Jan 26 20:12:47 1996 >Received: from ix2.ix.netcom.com (ix2.ix.netcom.com [199.182.120.1]) by infinity.c2.org (8.7.1/8.6.9) with SMTP > id UAA06971 for <jdoe-agamemnon(a)alpha.c2.org>; Fri, 26 Jan 1996 20:12:47 -0800 (PST) > Community ConneXion: Privacy & Community: <URL:http://www.c2.org> >Received: from pax-ca11-09.ix.netcom.com by ix2.ix.netcom.com (8.6.12/SMI-4.1/Netcom) > id UAA19713; Fri, 26 Jan 1996 20:17:46 -0800 >Message-Id: <199601270417.UAA19713(a)ix2.ix.netcom.com> >X-Sender: stewarts(a)popd.ix.netcom.com (Unverified) >X-Mailer: Windows Eudora Light Version 1.5.2 >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Date: Fri, 26 Jan 1996 20:17:45 -0800 >To: jdoe-agamemnon(a)alpha.c2.org >From: Bill Stewart <stewarts(a)ix.netcom.com> >Subject: Re: NOISE Test Ignore > >At 09:22 PM 1/25/96 -0800, you wrote: >>Test Test Test >> >> >Well, it got here, jd... >#-- ># Thanks; Bill ># Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 ># ># "Eternal vigilance is the price of liberty" used to mean us watching ># the government, not the other way around.... > > > #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Hey, jdoe-agamemnon Re: NOISE Test Ignore
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:00 PM 1/26/96 -0800, MAILER-DAEMON(a)alpha.c2.org wrote: >Unknown addressee: jdoe-agamemnon(a)alpha.c2.org > >----- Unsent Message Follows ----- > >Received: by alpha.c2.org for jdoe-agamemnon(a)alpha.c2.org > From stewarts(a)ix.netcom.com Fri Jan 26 20:12:47 1996 >Received: from ix2.ix.netcom.com (ix2.ix.netcom.com [199.182.120.1]) by infinity.c2.org (8.7.1/8.6.9) with SMTP > id UAA06971 for <jdoe-agamemnon(a)alpha.c2.org>; Fri, 26 Jan 1996 20:12:47 -0800 (PST) > Community ConneXion: Privacy & Community: <URL:http://www.c2.org> >Received: from pax-ca11-09.ix.netcom.com by ix2.ix.netcom.com (8.6.12/SMI-4.1/Netcom) > id UAA19713; Fri, 26 Jan 1996 20:17:46 -0800 >Message-Id: <199601270417.UAA19713(a)ix2.ix.netcom.com> >X-Sender: stewarts(a)popd.ix.netcom.com (Unverified) >X-Mailer: Windows Eudora Light Version 1.5.2 >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Date: Fri, 26 Jan 1996 20:17:45 -0800 >To: jdoe-agamemnon(a)alpha.c2.org >From: Bill Stewart <stewarts(a)ix.netcom.com> >Subject: > >At 09:22 PM 1/25/96 -0800, you wrote: >>Test Test Test >> >> >Well, it got here, jd... >#-- ># Thanks; Bill ># Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 ># ># "Eternal vigilance is the price of liberty" used to mean us watching ># the government, not the other way around.... > > > #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Reminder: Jan 28 Bay Area CA meeting, noon - 3 p.m.
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Bay Area California Cypherpunks Meeting January 28 12 noon - 3 p.m. B21, Sparcy's Cafeteria, Sun Microsystems Inc Directions: Take the Rengstorff Ave East exit from 101. If you're driving north on 101, this exit is labeled "Amphitheater Parkway". If you're driving south on 101, this exit is labeled "Rengstorff". At the end of the exit ramp, turn left onto Garcia. After .4 mile, turn right onto Marine Way. After .1 mile, turn right onto Coast. Building 21 is right there. Look for the big purple and white sign. Agenda: Roger Masterton, a producer/videographer, would like to film a discussion among cypherpunks about 1st amendment issues, for a PBS show named "Freedom Speaks." The show airs nationally on PBS. In San Francisco, currently on KMPT Thursdays at 5 p.m., and starting in March, on KQED. Their web site is http://www.fac.org/ There's a lot of 1st amendment issues to talk about these days regarding the internet, and so the first part of the meeting will be gathering topics. There's the first amendment principles of publishing information in digital form, and the fundamental right of people to carry on a private conversation. The discussion will take whatever organic form it takes, depending on who of us can make the meeting ... See you tomorrow if you're coming. I'll bring bagels again. Marianne mrm(a)eng.sun.com mrm(a)netcom.com

1 0

ahem, make that Saturday Jan 27
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Turns out the darn calendar on my computer goes ahead increments the date field sometime right round midnight. This is what I get for inferring today's date by glancing at the calendar manager, and "adding 1" for tomorrow. The cypherpunks meeting is on Saturday Jan 27. Sorry about that. --Marianne

1 0

No Subject
by hoppo 17 Dec '03

17 Dec '03

hi if you have anything interesting please send thanks,hoppo

1 0

SMTP mail failed
by postmaster＠ncr-sd.SanDiegoCA.ATTGIS.COM 17 Dec '03

17 Dec '03

message

1 0

Re: Possible Java hack.
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <Pine.ULT.3.91.960127013341.19154Q-100000(a)Networking.Stanford.EDU>, Rich Graves <llurch(a)networking.stanford.edu> wrote: # > [I've CCed this to cypherpunks, as well, I hope that you don't mind.] # Not at all, it was private only because I wasn't totally sure it wasn't a # stupid question. Not at all. I'm worried about similar respnses to my original post given my instable base. :) # > It would be very easy to conceal the "devious" portion of the applet # > inside of trojan horse that ran for a length of time greater than the # > minimum TTL for DNS caching. # Which I believe you will find is platform- and even application-dependent. I don't pretend to understand how every system on the market works, especially those that have "PC" somewhere in their offficial or onufficial name. # If you're talking about Windows NT or 95, for example, the winsock.dll # used by 16-bit applications caches DNS lookups in the TCP/IP stack # itself. I think TTL is listened to. [See the caveat above.] # wsock32.dll, on the other hand, doesn't do central DNS caching. So # applications implement it themselves. I'm not sure that applications even # have an opportunity to see the TTL information in the DNS response. I # doubt there's standard behavior; Netscape, HotJava, and other stuff will # probably time out DNS lookups differently. The thing to remember, with Java is that it's "platform independant" and thus the security of Java as a whole will be the product of its parts. # Real operating systems are probably a bit more standard about what they # do with DNS lookups, but I'm sure there's variance. There is. Actually its "real OS's" that I worry about most. If you run idenmtd, it might be possible for a java applet to determine who invoked it. If fingerd (or any other service) allows and responds to connections from 127.0.0.1 (ie. localhost...) # Still a really interesting idea, though. My first reaction was, well who # the hell controls a DNS server and a Web server and is likely to have a # piece of Java that you are likely to download? And the answer is, just # the kind of person you worry about. I didn't state it explicitly, but that's exactly my point. # This bait & switch thang can really be generalized to any kind of attack. # Of course, it's traceable, since not that many people own or can spoof a # DNS server. Traceable by what? If my assumptions are correct (which I'm willing to admit that they might not be) all the attacker has to spoof is name to address for a name that he/she already controls. I don't expect that most PCs and/or Macintosh's do this as a matter of course. Most firewalls probably do, but I wouldn't count on it. -- Steve(a)AZTech.Net

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:34 1/24/96, Derek Atkins wrote: >If I have a function that does something like this: > >authenticate (args) >{ > ... > > des_encrypt (); > ... >} > >I would have to remove the des_encrypt() call from the authenticate() >routine before it can be exported... What if you replaced it by rot_13 () ? Surely, they can't ban that. And someone later could just swap all rot_13 () for des_encrypt () -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

RSA in 4 lines of Scheme
by Ulf_Moeller＠public.uni-hamburg.de 17 Dec '03

17 Dec '03

(define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) ;;;; ;;;; (define c (RSA "The magic words are squeamish ossifrage" 5 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541)) (display (RSA c 45752650303155547067694311990458644804087318688496945025024737159778909096647814932594914301288138204957467016445183857236173773 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541))

1 0

Re: NOISE NOISE NOISE - clocks and other irrelevance
by jim bell 17 Dec '03

17 Dec '03

At 12:40 AM 1/27/96 -0500, Dave Emery wrote: > >> >> A peripheral I've long wanted to see, commonly available: ACCURATE time, >> broadcast to the millisecond/microsecond/nanosecond, available from sources >> as varied as TV VIR's, FM subcarriers, and other sources, available as an >> easy input (via a peripheral card) to a computer. > > The only technology that I'd trust to be useful much below >10-100 ms is GPS. The others are unlikely to be controlled well enough >at the source to be trusted. What about Loran? WWV(B)? Receptor-type signals? Now, I agree that CURRENTLY few people "depend" on those other (non-GPS, non-Loran, non-WWVB) systems, but to some extent that's a "chicken and egg problem" > Current TV broadcasting, for example, >usually involves multiple passes though digital frame stores and time >base correctors - most homes get the signal via cable which itself >involves significant uncontrolled delays (juat the thermal changes >in propagation delay in a long CATV cable and amplifier chain due to weather >changes run into the many microseconds). Perhaps, but I'm assuming broadcast tv. Single source. Limited variability in path length. I admit there are limitations; my argument is that the signals SHOULD contain accurately-defined points, even if it is only one per frame. > And humans beings being as imperfect as they are, it is hard to >beleive that making sure that the time being broadcast is really kept accurate >is going to be a priority when most people use it for purposes that require >plus or minus a few seconds timing. I think that if there WERE some reliably-available timecode system, plus a cheap single-chip system to drive it, it WOULD be kept reliable enough because of demand. >> I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, >> and had the foresight to install it with its computer interface option. >> (receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, >> containing "exact" time.) >> >> While I've never taken the time to connect it to my PC, it provides >> (through an RS232 jack) correct time with a rated accuracy of about 5 >> milliseconds, as I vaguely recall. (Even has a dipswitch setup on the bottom >> to tell it how many 500 mile increments you are away from WWVB... corrects >> for delay to a first order of magnitude.) >> > WWVB is the 60 khz broadcast (which is more accurate due to more >stable propagation) Not much of a difference, given the context. For example, I'm probably 1000 miles away from Boulder; it is highly unlikely that the path length differences for the HF bands could exceed about 100 miles, or about 0.5 millisecond. Given the context, it's accurate enough for anti-spoofing work in networks. . the HF ones are WWV. Commercial time receivers >are available that work off the 60 khz time code (very narrow bandwidth >ASK), but the 60 khz is most used as a standard frequency for long >term tracking of error in local standards. Any more? I don't think so. GPS has probably pretty much taken over as the "gold standard" for clock synchronization, I suspect. Path length is known, by definition, and the resolution must (as a consequence of the distance accuracy requirements) be in the low-nanosecond level. >> (BTW, if anybody knows how to easily connect it to the pc, or has the >> appropriate software, please tell me The task isn't difficult from a >> hardware standpoint; it's just RS-232 serial ASCII timecode at about 9600 >> bps which >> either continuously retransmits or on request. The problem is the software: > > If you run unix Nope. > there are some quite sophisticated programs that >can use this specific clock (connected to a serial port) that allow sync >to the full accuracy possible at good times of day (around 1 ms). The >programs also allow time distribution to other computers on a network - >thus their name - ntp - which stands for network time protocol (and the >network time program that implements it). This protocol and the various unix >programs that implement it are quite widely used on commercial LANs and >the Internet to sychronize time amoung unix workstations, servers, and >bridges and routers. Current implementations are capable of tracking >clock oscillator error on a system and adjusting the time periodically >to compensate for the frequency error of the clock and even to predict >(polynomial approximation) the change in frequency error with time. > > The man behind much of this (at least the early research) is >Dave Mills who used to be at louie.udel.edu which hosted a ftp >site for the programs. An archie search will reveal where they >are kept now, and there is a newsgroup (comp.protocols.time.ntp) for this >which no doubt has a substantial faq file about this. Thanks for the reference. >> (Then again, there are those "Receptor" watches which have (at least) similar >> accuracy, which as I understand it work on FM subcarrier principles.) > > Yes they use the RDS broadcast on the 57 khz subcarrier for this. >Of course there is no certainty the station has the clock set accurately. Chicken and egg, again. I assume that any radio station can afford $300 for a GPS receiver that can put out time accurate to 1 microsecond. If enough people start USING such broadcasts, they will be considered NECESSARY and will be maintained. The Receptor watch is an excellent interest-developing product to assist in this problem; the only problem might be that errors of greater than the 5 msec spec'd are not necessarily immediately apparent to the common watch-on-wrist user. > > TV stations could be made to maintain a local clock sync'd to >GPS and use that to do the final level of clocking out before feeding >the transmitter and could thus ensure that some reference point in some >frame happened at an exact time, but given that a user who can see a TV >signal can probably see GPS signals and can do the same timekeeping himself >for a couple hundred bucks it hardly seems worth it any more. I do >expect that time codes with modest accuracy (few tens of ms at best) >will become common as part of the Starsite (or whatever they call it >now) program guide distribution on PBS, simply because this has defined >a format that can conveniantly contain time messages multiplexed with >other data and the box displays the time. DSS and VC-II both also have >this capability, but of course the uncertainty of the satellite delay >limits accuracy and neither has provisions for providing time to other >devices. > This is possible, but I bet the variations in phase in the local >distribution system due to power factor, choice of phase to use, propagation >time through transmission lines and substations and so forth would >mean that phase as observed at two distant sites was rather random >and maybe even subject to shifts over time as load conditions varied. I'm hoping some HV engineer will make a comment as to this factor. >

1 0

Re: "Gentlemen do not read each other's mail"
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:47 PM 1/25/96 -0500, Perry wrote: >Why is he our patron saint? He was a government official coming out >against invasion of privacy. Isn't that what we are all after, in the >end? The reason we deploy cryptography is to assure privacy for >all. We often refer to those who listen in on conversations >(regardless of who they are) as, in some sense, our >opposition. Therefore, is not Stimson's remark in closing down >Yardley's "Black Chamber" to be praised rather than attacked? These days, I'd be happy with "Gentlemen only read _each others'_ mail".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: PGP in Eudora and other mail programs
by Chris Claborne 17 Dec '03

17 Dec '03

At 11:54 AM 1/25/96 -0800, you wrote: >At 2:13 PM 1/25/96, Clay Olbon II wrote: > >>Seriously, this just illustrates the idiocy of banning "hooks" in software. >>How does one define a "hook"? Just providing source code could be defined >>as providing a hook, since a good programmer could then modify it to do >>crypto. Also, how about the various kits and tools used to integrate pgp >>with pine, eudora, etc -- are these not "hooks"? > >And yet how many of these programs actually can transparently >(automatically, push-button, etc.) support PGP? I've been a user of Eudora >for several years, and have pressed for PGP hooks. The company, Qualcomm, >once told me it was on their list of things to do, but.... > >A few years later, still no PGP-in-Eudora. One would think that this would >be a powerful way of distinguishing their product from other mail packages. > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) I think what is going to happen is that Qualcomm will choose S/MIME instead of PGP, since they are one of the companies listed as jumping on the band wagon. S/MIME scares me since I believe it to (normally) use weak encryption. It is gaining in popularity and hype and might be just the product to lull mass amounts of users into using weak crypto (read government readable). Microsoft, Banyan, ConnectSoft, Frontier Technologies, Network Computing Devices, FTP Software, Wollongong, SecureWare Lotus, and others are on the band wagon as well. From section 2.2 of the S/MIME Implementation Guide published by RSA "... U.S. software manufactures have been compelled to incorporate an "exportable" content encryption algorithm in order to create a widely exportable versions of their product. " "... For outgoing messages, RC2 CBC at 40 bits is the recommended default. stronger content encryption is strongly recommended where there is some mechanism to indicate that the intended recipient(s) can support it. Even though S/MIME allows for any bulk encryption scheme to be used, all I ever see advertised is DES. Most companies, including Qualcomm who depend on government agencies to give them licenses (like FCC dudes), will bend like a reed in the wind when under pressure. Follow the money. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

OpSec Snooping
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Economist, 27 January 1995 Licence to make a killing Spies and fund managers seem to be cut from the same cloth. Both take calculated risks, are fickle when it comes to allegiances and have an annoying tendency to speak in code. More important, however, they both thrive on inside information. This may be why, in the headlong rush to exploit new emerging-market opportunities, a growing number of investment funds are turning to former spooks for some help. The latest fund to tap the know-how of the intelligence community is the Scottish American Investment Company, based in Edinburgh, which invests heavily in international equities. On January 17th it announced that Sir Colin McColl, the former head of M16, Britain's foreign-intelligence service, is joining its board of directors. The fund hopes that Sir Colin's experience in gauging political risks -- he has worked in Eastern Europe and SouthEast Asia -- will improve the quality of its investment decisions. Another ex-spy turned fund manager is Harry Fitzgibbons, a former American agent and now managing director of Top Technology Limited, a fund-management group based in London. Last year, he teamed up with Alexey Vlasov, a former Soviet agent, to launch a new high-technology fund for investment in Russia. It employs three other former Soviet agents in its St Petersburg office. Why are spooks so sought after by international investors? The reason, says Mr Fitzgibbons, is that spying is the ideal training ground for a career in emerging-market investing. Not only are intelligence agents good at spotting when someone is lying, but they are also experts at building relationships and waiting patiently for them to develop: two essential traits for successful long-term investors. Mr Fitzgibbons argues that it is these general skills, rather than any specific local knowledge, that makes former spies such attractive partners. Unfortunately, old adversaries do not always get on as swimmingly as Messrs Fitzgibbons and Vlasov. In 1994, for example, the Vietnam Frontier Fund invited William Colby, a former director of America's Central Intelligence Agency, who headed the agency's Vietnam station during the Vietnam War, to join its board of directors. His appointment prompted the fund's chairman, Nguyen Xuan Oanh, a former deputy prime minister of South Vietnam, to quit. Not only did the fund lose its chairman, but it was unable to take advantage of Mr Colby's experience: he left the board in December 1994 after Hanoi refused him a visa. Despite such drawbacks, the demand for former spooks is rumoured to be growing. One such hint comes from Parvus, a consultancy (with offices in Moscow and Silver Spring, Maryland) that employs a number of ex-spies. The firm claims that it has just been contacted by a headhunter looking for recruits. The mission, should anyone choose to accept it, is to head up a new intelligence unit for a big New York mutual fund. Unfortunately for potential applicants, the headhunters say that the fund's name is still top secret. ------------------- For more on Parvus (not the Utah corp) and its stable of ex-spooks see: URL: http://www2.indigo-net.com/Indigo/INT/INTpublic/1995/ INT275/INT275-a3.html and other AltaVista links to globalization of OPSEC. ------------------- URL: http://www.cais.com/zhi/OPSHomePage.html OPERATIONS SECURITY PROFESSIONALS SOCIETY The OPSEC Professionals Society was established in March 1990 to further the practice of Operations Security as a profession and to foster the highest quality of professionalism and competence among its members. OPSEC is a process used to deny to potential adversaries information about capabilities and/or intentions by identifying, controlling and protecting evidence of the planning and executing of sensitive activities. This process is equally applicable to government, its contractors, and to private enterprise in the protection of their trade secrets and other proprietary information. While military strength and capability still are required during the next years of uncertainty, we must likewise protect our critical economic information and technologies from those who seek to exploit them to their benefit and to our disadvantage. -------------------- URL: http://www.cais.com/zhi/OPSCIND1.html COUNTERINTELLIGENCE NEWS & DEVELOPMENTS Issue No. 1 Letter from the Director, National Counterintelligence Center I am pleased to present the inaugural issue of the National Counterintelligence Center's (NACIC) Counterintelligence News and Developments (CIND). This periodic publication is designed to meet the information needs of US private industry by communicating important, yet unclassified information on the threat posed by foreign countries against US interests. The CIND is part of the NACIC's effort to develop a more effective mechanism to disseminate information on foreign intelligence targeting activities against both the US Government and private industry. This initial issue includes some information you may have already seen in our Annual Report to Congress on Foreign Economic Collection and Industrial Espionage and the Survey of the Counterintelligence Needs of Private Industry. From time to time, we will republish or extract information from such key publications to highlight data we perceive to be of interest to private industry. Furthermore, we will solicit additional information from all sources in order to better understand and support private industry through this unclassified forum. The NACIC will not generally republish information readily available to the general public. Our goal is to make the CIND's contents substantive and relevant to customer needs. Therefore, I cannot overemphasize the importance of receiving feedback from each of you. Future issues will respond to the requirements of industry as a whole and will be driven by your needs and interests. The responses received from you, the customer, will determine the future content, format, and frequency of the CIND. The final page of the current edition provides information on how to forward responses to the CIND Editor. Michael J. Waguespack Director, National Counterintelligence Center _________________________________________________________________ What Is the NACIC? The National Counterintelligence Center (NACIC) was established in 1994 by Presidential Decision Directive/NSC-24. The NACIC's creation was one of the recommendations made by PDD-24 to improve US counterintelligence (CI) effectiveness by enhancing coordination and cooperation among various US CI agencies. An interagency organization staffed with CI and security professionals from the FBI, CIA, NSA, DIA, and the Departments of Defense and State, the NACIC is primarily responsible for coordinating national-level CI activities, and reports to the National Security Council through the National Counterintelligence Policy Board (NACIPB).

2 1

Re: "Gentlemen do not read each other's mail"
by James A. Donald 17 Dec '03

17 Dec '03

At 06:39 PM 1/25/96 -0500, Jay Holovacs wrote: >I might suppose that a significant reason why the nuclear arms race did >not come to blows was the balance of espionage between NSA/CIA/KGB etc. >With accurate information on your enemy, one is less likely to be >panicked into a preemtive strike. On the other hand, with inaccurate information concerning enemy capabilities and will, one is more likely to believe that the enemy is incapable of destroying you from the grave, or lacks the necessary will to destroy the world in response to a small "surgical" nuclear strike. They called it the peace of fear, the peace of terror, and the pax atomica. They did not call it the peace of the NSA --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1