December 2003 - cypherpunks-legacy

Re: netscape bug
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Vlad Nuri said (with some exerpting) > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? It's been noted on this list before that some programs give uid information out...sendmail comes to mind...this GREATLY narrows the search for a pid. > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? It requires knowledge of how the stack is set up and of assembler for the target. Most people in computer science know at least one assembler and could easily add enough of another to launch an attack like this. I did one once to attack one of my programs as an example for a class. Please don't overestimate the difficulty of this attack or underestimate the number of folks out there that are qualified to launch it. It's just that most of us would rather be writing constructive code:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Council of Europe proposes to outlaw strong encryption (fwd)
by wb8foz＠netcom.com 17 Dec '03

17 Dec '03

********************************************************** > SUBJECT: Euroclipper > Apologies if this is old news to you folks, but thought I should > pass it on. Date: Thu, 21 Sep 1995 00:42:39 -0400 Subject: IP: Council of Europe proposes to outlaw strong encryption According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tries to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disppointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson ------- End of Forwarded Message -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

1 0

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>Forwarded message: > >> From: amp(a)pobox.com >> Date: Tue, 09 Sep 1997 09:26:21 -0500 >> Subject: Re: Removing Tyranny from Democracy (Part II), >> was Democracy is the true enemy... >> >> > I don't believe there are intrinsic flaws in democracy, so much as >> > there are intrinsic flaws in *human*nature* that are coming to light >> > after decades. government is a reflection of our human natures. >> > one cannot really expect a government to correct the flaws of its >> > users, any more than software could do the same. >> >> No intrinsic flaws in democracy? >> >> Surely you jest. > >Please be so kind as to detail your top three flaws... I think my Parts II and III detailed a number of shortcomings of democracy, at least when the franchise goes to 'employees' as opposed to 'customers' of government. --Steve

1 0

Re: FROM A FRIEND . . . (or the joys of boating)
by s675570＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

On Thu, 21 Sep 1995, Landon Dyer wrote: > naturally, commuting to canada is probably a *lot* cheaper than > owning a boat. the uninitiated have little idea what these holes- > in-the-water really cost.... :-) *Loud* chuckles. Who says you have to *own* the boat? (haha) A suitably paid Canadian boat-captain could easily testify that you arrived every day to the boat with your trusty laptop, to develop your software within Canada. The disk with your saved code on it never left the boat. When you finished your development, you used a borrowed satellite phone to call up your ISP in Canada (we're talking physical Canada, not virtual, maritime, and bullshit Canada) to post your code and uuencoded executables to sci.cript, and alt.test. And since you used a satellite phone, for the modem transmission, no US phone lines were used (a cellphone wouldn't do). Of course you wouldn't actually have to do any of this. The gentleman just has to say it in court. The truth, the whole truth and nothing but.

1 0

Persistent Services Needed
by tcmay＠got.net 17 Dec '03

17 Dec '03

One of the problems we're facing with "Cypherpunks" services is that they are catch-as-catch-can, or, bluntly, "flaky." Archive sites stop being archives, remailers vanish overnight (*), and other experiments pop up and then vanish with regularity. (My favorite example, and one which always makes me smile, is the example of a remailer in Europe a couple of years ago which became inoperative with the message: "The foo remailer will stop operating tonight because I have to take my laptop with me for the summer to Portugal.") I'm not criticizing these folks. Rather, I'm just saying something pretty obvious, that _persistence_ is important. This probably means commercialization, or formalized business relationships. With such persistent business set-ups, "the show must go on." Another reason for digital money. --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Mondex Broken
by John Young 17 Dec '03

17 Dec '03

We've received from anonymous a report on breaking Mondex's pilot system by TNO along with a confidential 1996 memo describing the break: TNO's Ernst Bovenlander gave some details of these attacks (though he didn't mention Mondex as the target). He showed an electron micrograph of a fuzed link in a smartcard; while intact, this link activated a test mode in which the card contents were simply dumped to the serial port. The TNO attack was to bridge the link with two microprobes. At the last RSA conference, Tom Rowley of National Semiconductor reported a similar attack on an unnamed chip using an ion beam to rewrite the link . Included is a letter from the Bank of New Zealand to Electronic Frontier Canada attempting to suppress publication of the memo. http://jya.com/mondex-hack.htm

6 5

Re: FROM A FRIEND . . . (the joys of boating)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:00 PM 9/21/95, Landon Dyer wrote: > here's a possible bullshit wrinkle. i'm not a lawyer, but one of my >bosses was, once. > > said boss owned a boat that was of canadian registry. he was a >canadian citizen with a green card. he *claimed* that, even when >docked in the SF bay area, his boat was technically considered >canadian territory, due to some maritime law malarky. US authorities >theoretically had to go through various hoops to legally board his >vessel. > > i wouldn't try to halt a SWAT team, or even the local fuzz, with >this tidbit of legal gaga. but doing crypto development on such a >vessel might hold up in court for something as squishy as ITAR. I'm skeptical of this, as boating friends of mine tell me they are much more easily boarded by the various water.cops who check for compliance with navigation laws, with drug laws, with Customs laws, etc. Within the 3-mile limits, or further out (?), broad discretion is given to the water.cops who tell you to "Prepare to be boarded." That a ship or boat is of Panamanian, Liberian, or even Candian registry does not seem to have any effect on enforcement of drug-smuggling, gun-running, waste-dumping, or reckless-manouvering laws. I've already expressed my views on the hype surrounding the "This T-Shirt Has Been Declared to be a Munition" hoopla, so I won't draw the obvious inference about whether someone wearing an RSA-in-Perl t-shirt while scrubbing their decks will be shot on sight. (Was Randy Weaver's wife wearing an illegal t-shirt? Hmmmhhh, many conspiracy angles here!) --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: netscape bug
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>netscape bug "Vladimir Z. Nuri" writes: >I am willing to bet that the netscape bug would have been fixed quickly if it >had been quietly brought to their attention, without the blaring media >lights (I enjoy the media circus as much as the next guy, but on the >other hand, doing some things quietly may actually advance the cypherpunk >cause further than by making a noisy hullaballoo in cyberspace). I can't speak for Netscape in particular, but from bitter personal experience (in a previous life) I would be more willing to bet that bringing such a flaw to management's attention would raise the priority a bit to perhaps just below whatever their equivalent of the 'cut line' is. The rationale: "we are so resource limited; can't just keep it under wraps and fix it in the next release?" just rings in my ears. I can really empathize with what the developers at Netscape must be going through, but the 'social good' of raising security flaws to the level of the front page of the NYT is hard to deny. Rather than saying "security through obscurity is bad" you can point to a precedent of the consequences of being found out. --Joe

1 0

Euro-Clipper
by Ian Goldberg 17 Dec '03

17 Dec '03

I don't think I've seen this here (but it was on a bunch of security newsgoups...) - Ian Forwarded message: > > According to an article in `Communications Week International', the > 34-nation Council of Europe has agreed to outlaw strong encryption > products which do not make keys available to governments. > > The article, `Euro-Clipper chip scheme proposed', is on the front page > of the magazine's issue 151, dated 18th September, which arrived in my > mail this morning. > > It relates that the policy was approved on the 8th September at > Strasbourg by the Council, and coincides with an attempt by the > European Commission to propose a pan-European encryption standard. The > Council - unlike the Commission - has no statutory powers to enforce > its recommendations. However, Peter Csonka, the chairman of the > committee that drafted the document (and an administrative officer at > the Council's division of crime problems) says that `it is rare for > countries to reject Council of Europe recommendations'. > > The proposal would make telecomms operators responsible for decrypting > traffic and supplying it to governments when asked. It would also > `change national laws to enable judicial authorities to chase hackers > across borders'. > > Opposition to this measure was expressed by Mike Strezbek, VP > responsible for European telecomms at JP Morgan, who said that his > organisation `will challenge any attempt to limit the power of our > network encryption technologies very strongly'. > > Czonka said that the Council had given consideration to business > interests but had tries to strike a balance between privacy and > justice. However, `it remains possible that cryptography is available > to the public which cannot be deciphered,' his document says. `This > might lead to the conclusion to put restrictions on the possession, > distribution, or use of cryptography.' > > Apparently another international organisation, the OECD, has called a > conference of its members in December to devise a strategy on > encryption. > > I for one will be making clear to my MP that his stand on this issue > will determine how I cast my ballot at the next election. I note that > John Major stated in a 1994 parliamentary written reply to David Shaw > MP that the government did not intend to legislate on data encryption. > I am disppointed that government policy has changed to the point of > supporting the Council of Europe, and that this change has sneaked > through during the parliamentary recess. > > Ross Anderson > > > >

3 2

Re: NSA and Netscape Crack
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 3:46 PM 9/19/95, Jim Ray wrote: .... >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? >JMR .... Once upon a time NSA would find weeknesses in friends' crypto systems and tell them about it -- depending, of course, on the situation. It was a reciprocal practice. We don't know that NSA didn't tell Netscape.

3 2

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 9 Sep 1997 19:02:37 -0700 > From: Steve Schear <azur(a)netcom.com> > Subject: Re: Removing Tyranny from Democracy (Part II), (fwd) > >> No intrinsic flaws in democracy? > >> > >> Surely you jest. > > > >Please be so kind as to detail your top three flaws... > > I think my Parts II and III detailed a number of shortcomings of democracy, > at least when the franchise goes to 'employees' as opposed to 'customers' > of government. I have read 'The Sovereign Individual' as well so am somewhat familiar with the thesis they propose. I will ask you the same question I would ask of Davidson & Rees-Mogg... Assume that we accept this thesis that the best way to run a government is to structure it such that customers set policies and procedures. What inherent protections does that give me regarding abuse by the system? How do you propose to keep the majority from deciding that it is uneconomical to protect my rights as some minority group? A careful study of business practices versus race or socio-economic group (as expressed by dress) will quickly show that persons of the wrong 'type' receive less service than those of more acceptable groups. The sort of service the customer receives is after all in the hands of the salesperson, not the customer. Let's look at an admittedly contrived example but I believe it will suffice. There are two fires at opposite ends of the coverage area for a fire house. On Saturday they receive a call to go to one end, where the wealthy live. Would you have the owner pay prior to the firemen putting the fire out? Would they pay some premium beforehand? Now on Sunday a fire occurs on the other end where the poor are. Assuming they can't pay the bill would the firemen drive away? If so, wouldn't this in fact pose a threat not only to the other poor but also the wealthy since the fire might spread if it got large enough. Would the wealthy then be asked to pay for that run of the fire truck? What if they refused, how would the firemen pay for the food to feed their family? Perhaps go out and burn down more rich houses... If there are not some inherent or explicit checks in place then such a econo-government would reduce to mob-rule just as happens with democracy without explicit bills of rights. Neither you or Davidson/Rees-Mogg address this issue sufficiently. Furthermore, neither you or the authors address exactly why such a government would abandon the use of force totaly. Exactly why would this form of government reduce say burglary, thereby eliminating the need for police. Is this form of government going to do away with bomb weilding weenies, I doubt it, so we clearly have a need for federal or national level law enforcement fully armed. Since it is clear that all 200+ world governments would not abandon their current forms of government there is a clear and present danger from outside our borders. How do we protect ourselves from this threat? You can't pay them not to attack you, otherwise you are doing exacly what the system was supposed to avoid doing - paying tributes. You want a government with minimal intervention, the issue is not whether it is a democracy or a econo-government or even a communism. What measures that is the rights of the people recognized by the government and how the government respects those rights. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: netscape's response (source code review)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > It is becoming gradually clearer in cryptanalysis that you can't test > security of pieces in isolation. Their interaction with the > surrounding code and protocols is key to their security. Ross I don't think this is a new realization, attacks on crpyto systems have always considered the whole system. _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Has anyone seen the CatMan (catburgler)?
by Anarchist 17 Dec '03

17 Dec '03

I am trying to find someone who calls himself catman or catburgler. In nov. 94 He was serving in Albany County Jail in NY. If anyone has any information that may help like his E-mail address, Id really like to hear from you... My address is below. ********************************************** Email: rr251070(a)academ.hvcc.edu Email alias: Anarchist At: Hudsen Valley Community College 80 Vandenburgh Ave Troy, NY 12180 ---------------------------------------------- Anarchy- A movement to rid society of structured government, and to create a system based on co-operation and non-violence! **********************************************

1 0

Re: EMP & Cars (fwd)
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/8/97 7:00 AM, Peter Trei (trei(a)process.com) passed this wisdom: >Ham radio operators have been dealing with this issue for years. >There's a lot of (mostly anectodotal) stories of mobile operators >keying up their rigs and having either their own or neighbouring >cars misfiring or dieing. Shielded ignition cables seem to fix >things (though they are actually bought to prevent ignition noise >from getting into the radio, not the other way around). My 1988 Bronco II used to drop out of Cruise Control if I used 25 watts or more on 440 MHz FM. On the 50 watt setting at 440 MHz the engine would start running rough, though it never died. de ka2bqe Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" -- of Steve Jobs (1997) "He gazed up at the enormous face. But it was all right. Everything was all right, the struggle was finished. He had won the victory against himself. " "He loved Big Brother." -- George Orwell, "1984"

1 0

US Govt., Hackers, & security - Cable TV
by Jim Choate 17 Dec '03

17 Dec '03

Hi, There is some show on TDC about the Internet and how it can be used as a threat to national security. It is 9:41pm Ctl. so check your schedule. Looks like good advertising... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FREE Trial offer for Computer Magazine Archives
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- ZDNET ANNOUNCEMENT 9/10/97 ---------------------------------------------------------------- Two-week FREE trial offer on Computer Magazine Archive. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ Make your Web research more productive with ZDNet's Computer Magazine Archive--an extensive collection of computing articles online. CMA is a powerful database of over 100,000 full-text articles and abstracts from the industry's leading publications. Find articles related to product reviews, your competitors, the latest IPO, acquisition, or merger and just about anything else related to high-tech. With informative articles from over 80 of the industry's leading publications, everything you need for researching the computer industry can be found in Computer Magazine Archive. Now your research on the Web can be quicker, easier, and more focused. Now you can try Computer Magazine Archive FREE for two weeks. Simply point your Web browser to: http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com to start your search right now. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ _______________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _______________________________________________________________ Powered by InfoBeat: http://www.infobeat.com ===============================================================

1 0

Re: NSA and Netscape Crack
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:46 PM 9/19/95, Jim Ray wrote: >In the relatively short time I've been on this list, Cypherpunks >have bruted, and then found a weakness in, two kinds of Netscape >software. >[A fine public service, IMO. Congrats to all involved.] > >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? Indeed, Jim is underscoring the point I was making, facetiously, that the NSA has abandoned all pretense of helping to actually secure commercial transactions (and no, I wasn't referring to Clipper...rather, I was facetiously referring to the short-lived Commercial COMSEC Endorsement Program, circa 1988-89). As I said in my message, I don't _want_ the NSA or NIST (the same, really) to be vetting commercial encryption. But I also don't want them claiming a role in securing commercial encryption when they clearly are not even doing as much as the Cypherpunks are doing. By the way, if we count our own Matt Blaze's work on exposing weaknesses of the Tessera/Skipjack/Clipper (they blur together) card as a "Cypherpunks achievement," then the Cypherpunks have actually played a dominant role in cracking these recent standards. (Not to mention the RC4 code postings, the various Cypherpunks involved in the RSA-129 and "BlackNet" factorizations, etc.) Well done, of course! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Please send me SSL prob
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>>Please send me SSL problems... Jeff: The name chosen for SSL was, perhaps, unfortunate and misleading, but should not get in the way of the kind of service it provides. I keep combing the spec looking for socket-like api's, and so far have not found any :-). > I've looked at >what it takes to make some existing protocols work with SSL, and I'm not >convinced that its always appropriate. For example FTP and RCMD use >multiple connections, which is a royal pain. Doesn't HTTP use a new connection for every GET? > If a secure IP standard emerges that is widely deployed and provides >similar services, I don't see why SSL couldn't just go away (this is my >opinion, not an official position of netscape). The ipsec people are currently debating what it means to do replay detection on an unreliable datagram service, what it means to authenticate individual users in a layer that only knows how to name host endpoints, how a protocol specification deals with how policy would be set for mixed encryption service requirements, etc. This is not the first time these points have been debated in the history of the universe, nor the first attempt at a 'one size fits all' security protocol. I, personally, would not be too quick to expect IP security to solve all of your problems, but it will do a better job on, say, host-to-host disclosure protection. It will, however, require new kernel code or low-level driver or hardware hacks, which simultaneously provide the better protection and a barrier to security deployment for a product like Netscape's. Now, how about fixing SSL's keying so it has perfect forward secrecy? -Joe

1 0

Re: FidoNet Remailer
by RobL 17 Dec '03

17 Dec '03

At 04:34 PM 10/20/95 -0400, Jim Cannell wrote: > >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > >-----BEGIN PGP SIGNED MESSAGE----- > >I have been a long time lurker on this list, as well as having a long time >interest in crypto. Most of my activity in this area has been on FidoNet >rather than the internet. Due to the control phreak nature of much of >FidoNet, I've spent a lot of time and effort in an attempt to just simply >route around the bastards. I created the SecureMail system, which is a >network of FidoNet nodes that agree to route any and all traffic without >monitoring or censorship. Within SecureMail, encrypted traffic is not >only permitted, it is encouraged. At the end of the month, I will be putting my BBS back online with new software which is more Fido friendly than what I had been using.. I would be interested in your SecureMail system as an alternative to the mind-numbing strickness normally associated with FidoNet.. Any chance I can get more info? Thanks- RobL

1 0

Re: require for new remailer list tag?
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

sameer suggests the creation of a new remailer list property, "permanent", to denote a remailer expected by its operator(s) to persist indefinitely. I'm curious about the potential sociological effects of such a move. I imagine that pseudonyms would be attracted to "permanent" remailers for use in their reply chains. But this phenomenon could/should be mitigated by the possibility that sting remailers would tend to advertise themselves as "permanent" (truthfully, even !), in anticipation of the bias in pseudonym remailer chain inclusion. Enemies of anonymity might specially target remailers claiming to be "permanent" for antisocial uses. This is all similar to the effects (observed and supposed) of the existing reliability ratings for remailers. But the sharp contrast of a binary property might make the effects more pronounced. Perhaps it would be useful/meaningful to note the duration (or starting date) of each remailer's term of operation, on the theory that past survival is some indicator of the chances for continued existence. Anyway, I think it would be an interesting experiment to try. -Futplex <futplex(a)pseudonym.com>

2 1

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>> The idea that Netscape (like Microsoft) thinks they can get free >> testing services from all over the net by real experts just by offerring >> a tee shirt is down right offensive. > > >THE NETSCAPE BUGS BOUNTY > >(major snip) > > And if the security bug you find is severe as defined by Netscape, and > hasn't been previously found, and can be reproduced by us, we'll write > you a check for $1000. Ha! I reported a serious problem to Netscape ten days ago, on Thursday the twelfth. They haven't even returned an answer to my email yet nor even acknowledged its receipt. Yep, I guess that their check is in the mail .... Has anyone else seen or heard anything?? T-shirt's, mugs, checks, or email being returned or answered?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

CSP
by Frosty 17 Dec '03

17 Dec '03

Frosty ::: AT&T ACCUSED OF DEFRAUDING !!! New York - AT&T Corp. is accused in a lawsuit of cheating millions of residential long-distance customers out of billions of dollars by rounding off calls to the next full minute. The Lawsuit, filed Thursday in state Supreme Court, claims AT&T residential calls are billed in full minutes, meaning a call lasting one minute and one second would be billed as a two-minute call. Business customers, on the other hand, are billed in six-second intervals, meaning a one-minute, one-second call would be billed as one minute, six seconds, the lawsuit claims. -The Associated Press -The Sun Herlad - 21 Oct 1995 * sotmesc(a)datasync.com aka ---* Frosty, ilKhan of the SotMESC * To send a submission, use this address with 'CSP' in the Subject line * Thanks to: Voyager, 2600, LOD, Knight Lightning for supporting us * Finger SotMESC or http://www.datasync.com/~sotmesc/sotmesc.html

3 2

Re: crypto export from the UK
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Jon Baber <jbaber(a)mi.leeds.ac.uk> writes: > sameer <sameer(a)c2.org> wrote: > > Could people in the UK please tell me what the crypto export > > laws are like there? I know someone who wrote some really great crypto > > code in the UK but isn't willing to distribute it because of crypto > > export laws... I was under the impression that it was legal to export > > crypto from the UK. > > I believe that the laws regarding the export of crypto from the UK are > very similar to the ITAR regs in the US. I thought they were markedly different! I always understood there were NO restrictions on crypto export, import or use to western countries. There used to be COCOM agreements which said that you should get approval to send commercially produced crypto to some blacklisted countries (Iraq, etc). I also read that the COCOM restrictions did not claim to apply to free software. Anyway, I read that the COCOM agreement has expired, so none of this applies anymore, even. There are a number of surveys around, and the above is my understanding from reading those. If you have any thing else I should be reading I'd like to see it. > However our Government seems to take the view that putting crypto > software on the net is not exporting it, the exporting is done > whenever anyone from an export restricted country downloads the > software and is done by them rather than by the person who made the > software available. I also have heard this. > Strong crypto is therefore openly available from a number of places in > this country, particually sable.ox.ac.uk at the university of Oxford. Indeed. > Of course IANAL and the government may change it's mind about the > interpretation of these things but I would expect that your > acquaintance would be perfectly safe distributing his software via > sable (the ftp site (and its predicessor) have been distributing > crypto software for a number of years and I have not heard of any > problems). I think he would be safe emailing it, putting it on the WWW, or posting it to USENET. There are no selective access restrictions on *any* crypto ftp/http sites that I know of in the UK (like various ones in the US which make a sho of enforcing the export restriction by not allowing export to non-US domain names.) Adam

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com ******+***** 7:15 99.99% mix mixmaster(a)remail.obscura.com + --------- 1:36:59 99.84% hacktic remailer(a)utopia.hacktic.nl * ******** 10:05 99.80% portal hfinney(a)shell.portal.com ******### 1:52 99.78% alumni hal(a)alumni.caltech.edu + ++-*+++#* 6:28 99.71% rmadillo remailer(a)armadillo.com + ++++++++++ 43:31 99.67% ecafe remail(a)ecafe.org - ****### 3:31 99.67% spook remailer(a)valhalla.phoenix.net ** ********* 16:56 99.60% wmono wmono(a)valhalla.phoenix.net * ********** 13:16 99.58% penet anon(a)anon.penet.fi -+-- ----+ 5:07:54 99.03% ideath remailer(a)ideath.goldenbear.com --------.- 4:44:16 96.61% c2 remail(a)c2.org + +++++ 57:02 96.35% flame remailer(a)flame.alias.net + ****+ * * 26:48 94.29% vishnu mixmaster(a)vishnu.alias.net * **** * * 9:26 93.72% bsu-cs nowhere(a)bsu-cs.bsu.edu # ** *** 1:20:32 92.71% rahul homer(a)rahul.net *# ** ****## 2:20 99.71% ford remailer(a)bi-node.zerberus.de . ----._ 22:58:20 73.77% syrinx syrinx(a)c2.org - ---+-- 1:30:08 57.37% extropia remail(a)extropia.wimsey.com - ------ 4:48:34 50.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Netscape Logic Bomb detailed by IETF
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

With all of the Noise on this list, and all of the opinion that has been expressed, opinion which would seek to slander, misrepresent or opinion which would like to represent itself as fact, it has increasingly become difficult to separate the wheat from the chaff. Clearly, someone has a vested interest which they are expending a great deal of effort to protect. My email to Netscape detailing their logic bomb has gone unanswered, and unacknowledged for ten days now. Ten days is a long time for no "official" comment. Just as ten days is a long time not to answer email. Rather than attacking individual posters, rather than questioning credentials, rather than scaring journalists, rather than intimidating and wilfully spreading misinformation to create confusion, rather than doing any of this, I will simply quote the official minutes of the Internet Engineering Task Force (IETF) which is the protocol engineering, development and standardization arm of the Internet Architecture Board (IAB). The IETF is a large open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet protocol architecture and the smooth operation of the Internet. Request-For-Comments are a series of memorandums which act as official minutes of the IETF. Request-For-Comments No. 1521 (RFC-1521) Subsection 7.4.2 is authoritative and has been reviewed and has received international approval. To avoid the accusation, of misquoting, I will simply quote Section 7.4.2 of RFC1521 in its entirety. This memorandum has unlimited distribution and is available by FTP from DS.INTERNIC.NET, NIS.NSF.NET, NISC.JVNC.NET, FTP.ISI.EDU, WUARCHIVE.WUSTL.EDU, FTP.CONCERT.NET, or FTP.SESQUI.NET. European readers might be advised to use the United Kingdom repository at SRC.DOC.IC.AC.UK. Asian & Pacific Users should probably use the local mirror for WUARCHIVE.WUSTL.EDU, or alternatively, their local National RFC repository. >7.4.2. The Application/PostScript subtype > > A Content-Type of "application/postscript" indicates a PostScript > program. Currently two variants of the PostScript language are > allowed; the original level 1 variant is described in [POSTSCRIPT] > and the more recent level 2 variant is described in [POSTSCRIPT2]. > > PostScript is a registered trademark of Adobe Systems, Inc. Use of > the MIME content-type "application/postscript" implies recognition of > that trademark and all the rights it entails. > > The PostScript language definition provides facilities for internal > labeling of the specific language features a given program uses. This > labeling, called the PostScript document structuring conventions, is > very general and provides substantially more information than just > the language level. > > The use of document structuring conventions, while not required, is > strongly recommended as an aid to interoperability. Documents which > lack proper structuring conventions cannot be tested to see whether > or not they will work in a given environment. As such, some systems > may assume the worst and refuse to process unstructured documents. > > The execution of general-purpose PostScript interpreters entails > serious security risks, and implementors are discouraged from simply > sending PostScript email bodies to "off-the-shelf" interpreters. > While it is usually safe to send PostScript to a printer, where the > potential for harm is greatly constrained, implementors should > consider all of the following before they add interactive display of > PostScript bodies to their mail readers. > > The remainder of this section outlines some, though probably not all, > of the possible problems with sending PostScript through the mail. > > Dangerous operations in the PostScript language include, but may not > be limited to, the PostScript operators deletefile, renamefile, > filenameforall, and file. File is only dangerous when applied to > something other than standard input or output. Implementations may > also define additional nonstandard file operators; these may also > pose a threat to security. Filenameforall, the wildcard file search > operator, may appear at first glance to be harmless. Note, however, > that this operator has the potential to reveal information about what > files the recipient has access to, and this information may itself be > sensitive. Message senders should avoid the use of potentially > dangerous file operators, since these operators are quite likely to > be unavailable in secure PostScript implementations. Message- > receiving and -displaying software should either completely disable > all potentially dangerous file operators or take special care not to > delegate any special authority to their operation. These operators > should be viewed as being done by an outside agency when interpreting > PostScript documents. Such disabling and/or checking should be done > completely outside of the reach of the PostScript language itself; > care should be taken to insure that no method exists for re-enabling > full-function versions of these operators. > > The PostScript language provides facilities for exiting the normal > interpreter, or server, loop. Changes made in this "outer" > environment are customarily retained across documents, and may in > some cases be retained semipermanently in nonvolatile memory. The > operators associated with exiting the interpreter loop have the > potential to interfere with subsequent document processing. As such, > their unrestrained use constitutes a threat of service denial. > PostScript operators that exit the interpreter loop include, but may > not be limited to, the exitserver and startjob operators. Message- > sending software should not generate PostScript that depends on > exiting the interpreter loop to operate. The ability to exit will > probably be unavailable in secure PostScript implementations. > Message-receiving and -displaying software should, if possible, > disable the ability to make retained changes to the PostScript > environment, and eliminate the startjob and exitserver commands. If > these commands cannot be eliminated, the password associated with > them should at least be set to a hard-to-guess value. > > PostScript provides operators for setting system-wide and device- > specific parameters. These parameter settings may be retained across > jobs and may potentially pose a threat to the correct operation of > the interpreter. The PostScript operators that set system and device > parameters include, but may not be limited to, the setsystemparams > and setdevparams operators. Message-sending software should not > generate PostScript that depends on the setting of system or device > parameters to operate correctly. The ability to set these parameters > will probably be unavailable in secure PostScript implementations. > Message-receiving and -displaying software should, if possible, > disable the ability to change system and device parameters. If these > operators cannot be disabled, the password associated with them > should at least be set to a hard-to-guess value. > > Some PostScript implementations provide nonstandard facilities for > the direct loading and execution of machine code. Such facilities > are quite obviously open to substantial abuse. Message-sending > software should not make use of such features. Besides being totally > hardware- specific, they are also likely to be unavailable in secure > implementations of PostScript. Message-receiving and -displaying > software should not allow such operators to be used if they exist. > > PostScript is an extensible language, and many, if not most, > implementations of it provide a number of their own extensions. This > document does not deal with such extensions explicitly since they > constitute an unknown factor. Message-sending software should not > make use of nonstandard extensions; they are likely to be missing > from some implementations. Message-receiving and -displaying software > should make sure that any nonstandard PostScript operators are secure > and don't present any kind of threat. > > It is possible to write PostScript that consumes huge amounts of > various system resources. It is also possible to write PostScript > programs that loop infinitely. Both types of programs have the > potential to cause damage if sent to unsuspecting recipients. > Message-sending software should avoid the construction and > dissemination of such programs, which is antisocial. Message- > receiving and -displaying software should provide appropriate > mechanisms to abort processing of a document after a reasonable > amount of time has elapsed. In addition, PostScript interpreters > should be limited to the consumption of only a reasonable amount of > any given system resource. > > Finally, bugs may exist in some PostScript interpreters which could > possibly be exploited to gain unauthorized access to a recipient's > system. Apart from noting this possibility, there is no specific > action to take to prevent this, apart from the timely correction of > such bugs if any are found. Hopefully this sets the record clear, once and for all with authority whose credentials cannot be questioned nor attacked. I wonder though, did Netscape not know about RFC1521?? You'd expect them to, wouldn't you?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

20 36