December 2003 - cypherpunks-legacy

Recovery after flood
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I'd appreciate a response from M.Aldrich and anyone else who's into disaster recovery: Someone I know had their (paper) files submerged in water. Now all the papers (most of them xerocopies, some photographs) are stuck together. They are, of course, confidential to some degree. Can someone refer us to someone in the Boston area who could assist in recovering the files? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 4

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 6:56 PM 11/23/1996, The Deviant wrote: >On Sat, 23 Nov 1996, John Anonymous MacDonald wrote: >> The good news is that you can prove a negative. For example, it has >> been proven that there is no algorithm which can tell in all cases >> whether an algorithm will stop. > >No, he was right. They can't prove that their system is unbreakable. >They _might_ be able to prove that their system hasn't been broken, and >they _might_ be able to prove that it is _unlikely_ that it will be, but >they *CAN NOT* prove that it is unbreakable. This is the nature of >cryptosystems. Please prove your assertion. If you can't prove this, and you can't find anybody else who has, why should we believe it? >> diGriz > >Use an anon. remailer and sign your posts. Brilliant. Just brilliant. Oops! diGriz

4 6

Re: Does John Gilmore eat ass?
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

aga <aga(a)dhp.com> writes: > The question is, does this John Gilmore really take it > up the ass? Whether or not he is a FAGGOT is a very relevant issue > here, and it must not be overlooked. The Evil Queen of Cypherpunks swings both ways. John Gilmore also eats Dorothy Denning's (clean-shaven) pussy. He won't eat Esther Dyson's pussy because it smells so bad.

1 0

Re: Does John Gilmore eat ass?
by test 17 Dec '03

17 Dec '03

unsuscribe :-) ---------- > From: John Anonymous MacDonald <nobody(a)cypherpunks.ca> > To: cypherpunks(a)toad.com; freedom-knights(a)jetcafe.org; denning(a)cs.georgetown.edu; edyson(a)edventure.com > Subject: Re: Does John Gilmore eat ass? > Date: Sunday, November 24, 1996 10:31 AM > > aga <aga(a)dhp.com> writes: > > > The question is, does this John Gilmore really take it > > up the ass? Whether or not he is a FAGGOT is a very relevant issue > > here, and it must not be overlooked. > > The Evil Queen of Cypherpunks swings both ways. John Gilmore also > eats Dorothy Denning's (clean-shaven) pussy. He won't eat Esther > Dyson's pussy because it smells so bad.

1 0

Britannica Online Subscription Offer
by beta＠eb.com 17 Dec '03

17 Dec '03

Dear Pathfinder Free Trial Participant, Thank you for participating in this special free trial subscription offer of Britannica Online exclusively for Time Warner's Pathfinder users. This free trial will be ending soon, and I would like to extend you a special discount to encourage you to become a Britannica Online subscriber. I hope you have had ample opportunity to sample all Britannica has to offer, and if you haven't used our service recently, I encourage you to take these *final weeks* to experience the only information resource offering this degree of depth, breadth, and interactivity. As a Pathfinder reader you know that NASA recently sent a Mars probe to begin a 10-month interplanetary voyage. Read our "Mars" article to find out what scientists have already discovered about the Red Planet, then follow an Internet link to the Los Alamos National Laboratory to view craters on Mars. Are you interested in health and nutrition? Review the extensive "Nutrition" article in Britannica Online, and look for the nutrient content in what you had for breakfast. Planning a trip over the holidays? Visit our "Nations of the World" feature to review the history, map, flag, and national statistics of the country you're considering before you finalize those travel plans. So whether you're interested in learning more about Mars, troubles in Iraq, or the latest hurricane, Britannica Online is regularly updated to give you access to articles on people, places, and events around the world. It includes the text of the entire 32-volume Encyclopaedia Britannica, plus more than 2100 articles not available anywhere else. Articles are written by notable scholars in their fields of expertise, including more Nobel Prize winners than any other encyclopedia. For about 50 cents a day you'll have access to the only reference source that combines the information power of the world's premier encyclopedia with thousands of direct links to related information. To sign-up for Britannica Online -- * Access the registration form at http://www.eb.com:195/bol/ by selecting either the monthly or annual subscription option * Enter PTF149A in the promotion code box for an annual subscription of $149 (our normal $25 registration fee will be waived for you as a Pathfinder user) Enter PTF149M in the promotion code box for a monthly subscription of $14.95 * Review to make sure information is complete and accurate, then submit Every day you and your family can learn something new about the events that are making history now. Your free trial will end in two weeks, so please don't let this opportunity pass you by. I'm positive you'll discover that finding quality information has never been easier. Sincerely, Lisa Girolimetti Marketing Manager, Online Products Encyclopaedia Britannica, Inc.

1 0

Re: IPG Algorith Broken!
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:00 AM 11/24/96 -0500, Black Unicorn wrote: >On Sun, 24 Nov 1996 eli+(a)gs160.sp.cs.cmu.edu wrote: > >> Maybe this one's different from all of those. How valuable a secret >> would you like to wager on that? If IPG wants credibility, they should >> retain a respected cryptographer, or several, to attack their scheme. > >"They" attempt this nearly daily by trying to taunt c'punks into >evaluating the product for free. Then someone should not do it for free. They should do it as a "data recovery tool", advertise widely, make a few bucks, and show what a piece of crap the IPG snakeoil is in the first place. Cracktools are starting to become a profitable business as more and more snakeoil products appear on the market. (Most are marketed to law enforcement, but that will probibly change...) There is a buck or two to be made here. --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

4 4

Don Woods -- Crypto Creationist
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:18 AM 11/24/96 -0600, snow wrote: > The algorythm cannot be considered secure until it has been >peer-reviewed. They refuse to release the algorythm for review, simply saying >that "you can't break the code" therefore "it is secure". Furthermore, in "Real Science", the burden of proof is on the one making the claim, not on the one everyone else to disprove it. So far Mr. Wood has not provided any *proof* as to the substance of his claims. He has provided some of the more interesting rants I have seen of late. (Analysis of his style of posting is probibly better left to the Psychceramics list than Cypherpunks.) Until he posts the algorythm (or at least some basis as to why we should trust his claims), his claims are worthless. (As they would say on talk.origins: "Evidence is the coin of the realm here!".) The reason that names like Shamir and Rivest and the host of others are trusted is because their material has been reviewed by the rest of the cryptographic community for errors. They have a reputation in the community. Mr. Woods does not. He has to earn it. So far he has not done so... --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: IPG Algorith Broken!
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:21 AM 11/24/96 -0500, Black Unicorn wrote: > >> > On Sat, 23 Nov 1996, John Anonymous MacDonald wrote: >> > > diGriz >> > >> > Use an anon. remailer and sign your posts. Brilliant. Just brilliant. > >Actually, rather clever if you're trying to estlablish reputation. Just >make sure you use the right key. Reputation is not the only reason to use a "name" with an anon remailer. Sometimes you want to post (and have a reputation) that is entirely seperable from your "real life" persona. Maybe you have a job where being involved with "The Evil Cypherpunks(tm)" could result in hastles at work (or even firing) if known. (I recieved flack from one company I worked with for posting here... Until they needed a remailer set up and someone to explain how their software worked... But that is another story.) Cypherpunks is gated to a number of Usenet News servers. (Teleport is a good example.) It is also archived in a number of search engines. (Altavista if I remember correctly, is one of them.) Someone who does not want their words to come back any byte them might just use such a method to protect themselves. --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: kickouts done the Cypherpunks way...
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

killfiles work fine with me too. that was not the point. i was not really interested in the practical problem that this list just had, but rather was wondering whether it was theoretically possible to identify and exclude one untrusted person from a trusted list. igor lcs Mixmaster Remailer wrote: > > ichudov(a)algebra.com (Igor Chudov @ home) writes: > > > Hi, > > > > Suppose Mr. X, owner of foobarpunks mailing list, wants to kick out Mr. Y, > > for his obnoxious letters to the mailing list. > > > > Mr. X, however, is concerned that Mr. Y would subscribe through some > > proxy address and would continue replying to messages to foobarpunks. > > > > It is assumed that the only person out of the whole universe, Mr. Y, > > cannot be trusted. The problem is that X does not know which of the > > subscribers is Mr. Y. > > > > The question is, is there a technical way to disable Mr. Y from > > reading the list, or detect which subscription address is a proxy for Y? > > The answer is no. Plenty of sites gate mailing lists to local > newsgroups, and allow open or relatively open NNTP access. It's also > silly to assume every other person in the universe is trustworthy. > > If Mr. Y sends lots of obnoxious mail to a mailing list or news group, > the proper thing to do is to put Mr. Y in your killfile and encourage > others to do so. That way you don't get bothered by his annoying > messages, and if enough people follow suit, people stop responding to > Mr. Y's messages. This can be even be extended to cover anonymous > posts using NoCeM-like systems. > > If you try to boot Mr. Y off the mailing list using technical means, > several bad things will happen: First of all you will fail, which > will give Mr. Y a great deal of satisfaction. Second of all, you will > drive Mr. Y to start posting under different names, making him > considerably harder to killfile. Third of all, you will double the > traffic on the mailing list by starting flamewars about whether this > failed booting attempt was ethical, legal, intelligent, homosexual, > scatological, or just plain useless. Since at this point tons of > people will be replying to threads, a killfile becomes even harder to > manage. > > So don't look for convoluted technical solutions to Mr. Y's > personality problems. Just use a little basic common sense. If you > don't like the way someone behaves on a mailing list, just ignore the > damn person. Anything else is just going to make matters worse, as > recent history clearly demonstrates. > - Igor.

1 0

Virus-Hoax
by nobody＠replay.com 17 Dec '03

17 Dec '03

> > Date: Sat, 23 Nov 1996 18:43:18 -0800 > From: "David Crawford by way of Fence-Walker(UNCL clicking in fm home)" <crawford(a)eek.llnl.gov> > Subject: CIAC Bulletin H-05: Internet Hoaxes > X-Digest: Volume 9 : Issue 230 > > - ----BEGIN PGP SIGNED MESSAGE----- > > > __________________________________________________________ > > The U.S. Department of Energy > Computer Incident Advisory Capability > ___ __ __ _ ___ > / | /_\ / > \___ __|__ / \ \___ > __________________________________________________________ > > INFORMATION BULLETIN > > Internet Hoaxes: PKZ300, Irina, Good Times, Deeyenda, Ghost > > November 20, 1996 15:00 GMT Number H-05 > ______________________________________________________________________________ > PROBLEM: This bulletin addresses the following hoaxes and erroneous > warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and > Ghost.exe > PLATFORM: All, via e-mail > DAMAGE: Time lost reading and responding to the messages > SOLUTION: Pass unvalidated warnings only to your computer security > department or incident response team. See below on how to > recognize validated and unvalidated warnings and hoaxes. > ______________________________________________________________________________ > VULNERABILITY New hoaxes and warnings have appeared on the Internet and old > ASSESSMENT: hoaxes are still being cirulated. > ______________________________________________________________________________ > > > Introduction > ============ > > The Internet is constantly being flooded with information about computer > viruses and Trojans. However, interspersed among real virus notices are > computer virus hoaxes. While these hoaxes do not infect systems, they are > still time consuming and costly to handle. At CIAC, we find that we are > spending much more time de-bunking hoaxes than handling real virus incidents. > This advisory addresses the most recent warnings that have appeared on the > Internet and are being circulated throughout world today. We will also address > the history behind virus hoaxes, how to identify a hoax, and what to do if you > think a message is or is not a hoax. Users are requested to please not spread > unconfirmed warnings about viruses and Trojans. If you receive an unvalidated > warning, don't pass it to all your friends, pass it to your computer security > manager to validate first. Validated warnings from the incident response teams > and antivirus vendors have valid return addresses and are usually PGP signed > with the organization's key. > > PKZ300 Warning > ============== > > The PKZ300 Trojan is a real Trojan program, but the initial warning about it > was released over a year ago. For information pertaining to PKZ300 Trojan > reference CIAC Notes issue 95-10, that was released in June of 1995. > > http://ciac.llnl.gov/ciac/notes/Notes10.shtml > > The warning itself, on the other hand, is gaining urban legend status. There > has been an extremely limited number of sightings of this Trojan and those > appeared over a year ago. Even though the Trojan warning is real, the repeated > circulation of the warning is a nuisance. Individuals who need the current > release of PKZIP should visit the PKWARE web page at http://www.pkware.com. > CIAC recommends that you DO NOT recirculate the warning about this particular > Trojan. > > Irina Virus Hoax > ================ > > The "Irina" virus warnings are a hoax. The former head of an electronic > publishing company circulated the warning to create publicity for a new > interactive book by the same name. The publishing company has apologized for > the publicity stunt that backfired and panicked Internet users worldwide. The > original warning claimed to be from a Professor Edward Pridedaux of the > College of Slavic Studies in London; there is no such person or college. > However, London's School of Slavonic and East European Studies has been > inundated with calls. This poorly thought-out publicity stunt was highly > irresponsible. For more information pertaining to this hoax, reference the > UK Daily Telegraph at http://www.telegraph.co.uk. > > Good Times Virus Hoax > ===================== > > The "Good Times" virus warnings are a hoax. There is no virus by that name in > existence today. These warnings have been circulating the Internet for years. > The user community must become aware that it is unlikely that a virus can be > constructed to behave in the manner ascribed in the "Good Times" virus > warning. For more information related to this urban legend, reference CIAC > Notes 95-09. > > http://ciac.llnl.gov/ciac/notes/Notes09.shtml > > Deeyenda Virus Hoax > =================== > > The "Deeyenda" virus warnings are a hoax. CIAC has received inqueries > regarding the validity of the Deeyenda virus. The warnings are very similar > to those for Good Times, stating that the FCC issued a warning about it, > and that it is self activating and can destroy the contents of a machine > just by being downloaded. Users should note that the FCC does not and will > not issue virus or Trojan warnings. It is not their job to do so. As of this > date, there are no known viruses with the name Deeyenda in existence. For a > virus to spread, it must be executed. Reading a mail message does not execute > the mail message. Trojans and viruses have been found as executable attachments > to mail messages, but they must be extracted and executed to do any harm. CIAC > still affirms that reading E-mail, using typical mail agents, can not activate > malicious code delivered in or with the message. > > Ghost.exe Warning > ================= > > The Ghost.exe program was originally distributed as a free screen saver > containing some advertising information for the author's company (Access > Softek). The program opens a window that shows a Halloween background with > ghosts flying around the screen. On any Friday the 13th, the program window > title changes and the ghosts fly off the window and around the screen. Someone > apparently got worried and sent a message indicating that this might be a > Trojan. The warning grew until the it said that Ghost.exe was a Trojan that > would destroy your hard drive and the developers got a lot of nasty phone > calls (their names and phone numbers were in the About box of the program.) > A simple phone call to the number listed in the program would have stopped > this warning from being sent out. The original ghost.exe program is just cute; > it does not do anything damaging. Note that this does not mean that ghost > could not be infected with a virus that does do damage, so the normal > antivirus procedure of scanning it before running it should be followed. > > History of Virus Hoaxes > ======================= > > Since 1988, computer virus hoaxes have been circulating the Internet. In > October of that year, according to Ferbrache ("A pathology of Computer > Viruses" Springer, London, 1992) one of the first virus hoaxes was the > 2400 baud modem virus: > > SUBJ: Really Nasty Virus > AREA: GENERAL (1) > > I've just discovered probably the world's worst computer virus > yet. I had just finished a late night session of BBS'ing and file > treading when I exited Telix 3 and attempted to run pkxarc to > unarc the software I had downloaded. Next thing I knew my hard > disk was seeking all over and it was apparently writing random > sectors. Thank god for strong coffee and a recent backup. > Everything was back to normal, so I called the BBS again and > downloaded a file. When I went to use ddir to list the directory, > my hard disk was getting trashed again. I tried Procomm Plus TD > and also PC Talk 3. Same results every time. Something was up so I > hooked up to my test equipment and different modems (I do research > and development for a local computer telecommunications company > and have an in-house lab at my disposal). After another hour of > corrupted hard drives I found what I think is the world's worst > computer virus yet. The virus distributes itself on the modem sub- > carrier present in all 2400 baud and up modems. The sub-carrier is > used for ROM and register debugging purposes only, and otherwise > serves no othr (sp) purpose. The virus sets a bit pattern in one > of the internal modem registers, but it seemed to screw up the > other registers on my USR. A modem that has been "infected" with > this virus will then transmit the virus to other modems that use a > subcarrier (I suppose those who use 300 and 1200 baud modems > should be immune). The virus then attaches itself to all binary > incoming data and infects the host computer's hard disk. The only > way to get rid of this virus is to completely reset all the modem > registers by hand, but I haven't found a way to vaccinate a modem > against the virus, but there is the possibility of building a > subcarrier filter. I am calling on a 1200 baud modem to enter this > message, and have advised the sysops of the two other boards > (names withheld). I don't know how this virus originated, but I'm > sure it is the work of someone in the computer telecommunications > field such as myself. Probably the best thing to do now is to > stick to 1200 baud until we figure this thing out. > > Mike RoChenle > > This bogus virus description spawned a humorous alert by Robert Morris III : > > Date: 11-31-88 (24:60) Number: 32769 > To: ALL Refer#: NONE > From: ROBERT MORRIS III Read: (N/A) > Subj: VIRUS ALERT Status: PUBLIC MESSAGE > > Warning: There's a new virus on the loose that's worse than > anything I've seen before! It gets in through the power line, > riding on the powerline 60 Hz subcarrier. It works by changing the > serial port pinouts, and by reversing the direction one's disks > spin. Over 300,000 systems have been hit by it here in Murphy, > West Dakota alone! And that's just in the last 12 minutes. > > It attacks DOS, Unix, TOPS-20, Apple-II, VMS, MVS, Multics, Mac, > RSX-11, ITS, TRS-80, and VHS systems. > > To prevent the spresd of the worm: > > 1) Don't use the powerline. > 2) Don't use batteries either, since there are rumors that this > virus has invaded most major battery plants and is infecting the > positive poles of the batteries. (You might try hooking up just > the negative pole.) > 3) Don't upload or download files. > 4) Don't store files on floppy disks or hard disks. > 5) Don't read messages. Not even this one! > 6) Don't use serial ports, modems, or phone lines. > 7) Don't use keyboards, screens, or printers. > 8) Don't use switches, CPUs, memories, microprocessors, or > mainframes. > 9) Don't use electric lights, electric or gas heat or > airconditioning, running water, writing, fire, clothing or the > wheel. > > I'm sure if we are all careful to follow these 9 easy steps, this > virus can be eradicated, and the precious electronic flui9ds of > our computers can be kept pure. > > ---RTM III > > Since that time virus hoaxes have flooded the Internet.With thousands of > viruses worldwide, virus paranoia in the community has risen to an extremely > high level. It is this paranoia that fuels virus hoaxes. A good example of > this behavior is the "Good Times" virus hoax which started in 1994 and is > still circulating the Internet today. Instead of spreading from one computer > to another by itself, Good Times relies on people to pass it along. > > How to Identify a Hoax > ====================== > > There are several methods to identify virus hoaxes, but first consider what > makes a successful hoax on the Internet. There are two known factors that make > a successful virus hoax, they are: (1) technical sounding language, and > (2) credibility by association. If the warning uses the proper technical > jargon, most individuals, including technologically savy individuals, tend to > believe the warning is real. For example, the Good Times hoax says that > "...if the program is not stopped, the computer's processor will be placed in > an nth-complexity infinite binary loop which can severely damage the > processor...". The first time you read this, it sounds like it might be > something real. With a little research, you find that there is no such thing > as an nth-complexity infinite binary loop and that processors are designed > to run loops for weeks at a time without damage. > > When we say credibility by association we are referring to whom sent the > warning. If the janitor at a large technological organization sends a warning > to someone outside of that organization, people on the outside tend to believe > the warning because the company should know about those things. Even though > the person sending the warning may not have a clue what he is talking about, > the prestigue of the company backs the warning, making it appear real. If a > manager at the company sends the warning, the message is doubly backed by the > company's and the manager's reputations. > > Individuals should also be especially alert if the warning urges you to pass > it on to your friends. This should raise a red flag that the warning may be > a hoax. Another flag to watch for is when the warning indicates that it is a > Federal Communication Commission (FCC) warning. According to the FCC, they > have not and never will disseminate warnings on viruses. It is not part of > their job. > > CIAC recommends that you DO NOT circulate virus warnings without first > checking with an authoritative source. Authoritative sources are your computer > system security administrator or a computer incident advisory team. Real > warnings about viruses and other network problems are issued by different > response teams (CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by > the sending team using PGP. If you download a warning from a teams web site or > validate the PGP signature, you can usually be assured that the warning is > real. Warnings without the name of the person sending the original notice, or > warnings with names, addresses and phone numbers that do not actually exist > are probably hoaxes. > > What to Do When You Receive a Warning > ===================================== > > Upon receiving a warning, you should examine its PGP signature to see that it > is from a real response team or antivirus organization. To do so, you will > need a copy of the PGP software and the public signature of the team that > sent the message. The CIAC signature is available from the CIAC web server > at: > > http://ciac.llnl.gov > > If there is no PGP signature, see if the warning includes the name of the > person submitting the original warning. Contact that person to see if he/she > really wrote the warning and if he/she really touched the virus. If he/she is > passing on a rumor or if the address of the person does not exist or if > there is any questions about theauthenticity or the warning, do not circulate > it to others. Instead, send the warning to your computer security manager or > incident response team and let them validate it. When in doubt, do not send > it out to the world. Your computer security managers and the incident response > teams teams have experts who try to stay current on viruses and their warnings. > In addition, most anti-virus companies have a web page containing information > about most known viruses and hoaxes. You can also call or check the web site > of the company that produces the product that is supposed to contain the virus. > Checking the PKWARE site for the current releases of PKZip would stop the > circulation of the warning about PKZ300 since there is no released version 3 > of PKZip. Another useful web site is the "Computer Virus Myths home page" > (http://www.kumite.com/myths/) which contains descriptions of several known > hoaxes. In most cases, common sense would eliminate Internet hoaxes. > > - ----------------------------------------------------------------------------- > > CIAC, the Computer Incident Advisory Capability, is the computer > security incident response team for the U.S. Department of Energy > (DOE) and the emergency backup response team for the National > Institutes of Health (NIH). CIAC is located at the Lawrence Livermore > National Laboratory in Livermore, California. CIAC is also a founding > member of FIRST, the Forum of Incident Response and Security Teams, a > global organization established to foster cooperation and coordination > among computer security teams worldwide. > > CIAC services are available to DOE, DOE contractors, and the NIH. CIAC > can be contacted at: > Voice: +1 510-422-8193 > FAX: +1 510-423-8002 > STU-III: +1 510-423-2604 > E-mail: ciac(a)llnl.gov > > For emergencies and off-hour assistance, DOE, DOE contractor sites, > and the NIH may contact CIAC 24-hours a day. During off hours (5PM - > 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, > or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two > Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC > duty person, and the secondary PIN number, 8550074 is for the CIAC > Project Leader. > > Previous CIAC notices, anti-virus software, and other information are > available from the CIAC Computer Security Archive. > > World Wide Web: http://ciac.llnl.gov/ > Anonymous FTP: ciac.llnl.gov (128.115.19.53) > Modem access: +1 (510) 423-4753 (28.8K baud) > +1 (510) 423-3331 (28.8K baud) > > CIAC has several self-subscribing mailing lists for electronic > publications: > 1. CIAC-BULLETIN for Advisories, highest priority - time critical > information and Bulletins, important computer security information; > 2. CIAC-NOTES for Notes, a collection of computer security articles; > 3. SPI-ANNOUNCE for official news about Security Profile Inspector > (SPI) software updates, new features, distribution and > availability; > 4. SPI-NOTES, for discussion of problems and solutions regarding the > use of SPI products. > > Our mailing lists are managed by a public domain software package > called ListProcessor, which ignores E-mail header subject lines. To > subscribe (add yourself) to one of our mailing lists, send the > following request as the E-mail message body, substituting > CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or SPI-NOTES for list-name and > valid information for LastName FirstName and PhoneNumber when sending > > E-mail to ciac-listproc(a)llnl.gov: > subscribe list-name LastName, FirstName PhoneNumber > e.g., subscribe ciac-notes OHara, Scarlett W. 404-555-1212 x36 > > You will receive an acknowledgment containing address, initial PIN, > and information on how to change either of them, cancel your > subscription, or get help. > > PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing > communities receive CIAC bulletins. If you are not part of these > communities, please contact your agency's response team to report > incidents. Your agency's team will coordinate with CIAC. The Forum of > Incident Response and Security Teams (FIRST) is a world-wide > organization. A list of FIRST member organizations and their > constituencies can be obtained by sending email to > docserver(a)first.org with an empty subject line and a message body > containing the line: send first-contacts. > > This document was prepared as an account of work sponsored by an > agency of the United States Government. Neither the United States > Government nor the University of California nor any of their > employees, makes any warranty, express or implied, or assumes any > legal liability or responsibility for the accuracy, completeness, or > usefulness of any information, apparatus, product, or process > disclosed, or represents that its use would not infringe privately > owned rights. Reference herein to any specific commercial products, > process, or service by trade name, trademark, manufacturer, or > otherwise, does not necessarily constitute or imply its endorsement, > recommendation or favoring by the United States Government or the > University of California. The views and opinions of authors expressed > herein do not necessarily state or reflect those of the United States > Government or the University of California, and shall not be used for > advertising or product endorsement purposes. > > LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) > > G-43: Vulnerabilities in Sendmail > G-44: SCO Unix Vulnerability > G-45: Vulnerability in HP VUE > G-46: Vulnerabilities in Transarc DCE and DFS > G-47: Unix FLEXlm Vulnerabilities > G-48: TCP SYN Flooding and IP Spoofing Attacks > H-01: Vulnerabilities in bash > H-02: SUN's TCP SYN Flooding Solutions > H-03: HP-UX_suid_Vulnerabilities > H-04: HP-UX Ping Vulnerability > > RECENT CIAC NOTES ISSUED (Previous Notes available from CIAC) > > Notes 07 - 3/29/95 A comprehensive review of SATAN > > Notes 08 - 4/4/95 A Courtney update > > Notes 09 - 4/24/95 More on the "Good Times" virus urban legend > > Notes 10 - 6/16/95 PKZ300B Trojan, Logdaemon/FreeBSD, vulnerability > in S/Key, EBOLA Virus Hoax, and Caibua Virus > > Notes 11 - 7/31/95 Virus Update, Hats Off to Administrators, > America On-Line Virus Scare, SPI 3.2.2 Released, > The Die_Hard Virus > > Notes 12 - 9/12/95 Securely configuring Public Telnet Services, X > Windows, beta release of Merlin, Microsoft Word > Macro Viruses, Allegations of Inappropriate Data > Collection in Win95 > > Notes 96-01 - 3/18/96 Java and JavaScript Vulnerabilities, FIRST > Conference Announcement, Security and Web Search > Engines, Microsoft Word Macro Virus Update > > - ----BEGIN PGP SIGNATURE----- > Version: 2.6.1 > Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface > > iQCVAwUBMpN8qrnzJzdsy3QZAQHpZgP/V+NTN7AwEtWCM46sSBMFnEuz0NxmN9X2 > DMOFnATcUSNvukXBPAMc3LMYmnjhp+CrqDyfQCWVBUaHDTmb3yKTTsexYev5alyd > cSR4uZjQrMjO1pu16HG7BS+faxaP+E/FVEcbAof9a+tjX4aj9LTOM/Nt8Hb6Aazo > eRHTBH+AYy4= > =fBQM > - ----END PGP SIGNATURE----- > > ------------------------------ > >

1 0

[Noise] Re: Thanks/was:This is your last warning
by Black Unicorn 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996, aga wrote: > > > Not really, I had an I.Q. of 149, and a perfect 4.00 from > > > two different colleges, before I did my Doctorate in Law. > > > > 149 puts you at the low end of the scale, or used to, around here. > > > > True, they say genius only starts at 150; but I think I have > improved since then. This betrays your ignorance. I.Q. is scaled according to age. One does not "improve." > > The fact (if true) that you bothered to get a Doctorate in Law, rather > > than a Juris Doctor, tends to disprove the above however. > > > > Look dude, a Juris Doctor IS a Doctorate of Law. Incorrect. One can obtain a Doctorate in Law, (As in Dr.) but it is generally a pointless endeavor except in some civil law jurisdictions. (Liechtenstein is a good example, where many attornies have a Dr.Iur. (Dr.) while others merely have a Lic.Iur. (J.D.) ). A J.D. requires no dissertation. A Doctorate in Law does. I submit you know too little about any of these to have attained either one. > Do not confuse it with a L.L.D. which is a "Doctorate > of Legal Letters" A J.D. is the only current valid > Doctorate that you can do in plain "Law." Incorrect. A J.D. is not a true Doctorate, and even if it were, it would not be the only current valid "Doctorate" that you can "do" in "plain Law." Georgetown, as an example, offers a Doctorate in Law degree which requires a J.D., an LL.M. and three years of legal teaching experience simply to qualify for the program. A Doctor of Judicial Science program is also available with many of the same requirements. Both programs require a dissertation and a defense of same. San Marcos University is also known for an exceptional Doctor of Laws program. Incidently, LL.D.s are rare and generally useful only in European circles. As usual, you have overextended your bounds and now find yourself swimming in water over your head. > > > > > > > Go to law school. In the meantime, shut up. > > > > > > > > > > Go and eat your swiss cheese, as that is apparently all you > > > are good for. My mercenaries are too busy to go to europe > > > right now. > > > > I prefer Chedder. > > > > Be careful who you threaten. It might get you in trouble. > > > > Threatening to wipe out your location on the InterNet is > not against ANY law whatsoever, and I can mailbomb you, do > a DOS attack, fork-bomb attack and virus attack against you, > all of which are perfectly legal. Actually, they are not. Unauthorized access of a computer system is a crime. Anyone who had a "doctorate" in law would know this. I doubt your reference to mercenaries was merely a threat to my system, but keep pushing if you like. > > > Look asshole, I graduated from Law School with a Doctorate > > > in 1975. Now just go away and stop interfering with our > > > American Net. Which law school? And did you do a dissertation? What is its title? Do you practice? What state are you licensed in? > Face the real fact of life though dude. There is absolutely NO LAW > which prevents me from attacking and/or eliminating any address > outside of the USA, that is, even if there were any law which would > prevent me from doing the same thing to any non-government > computer right here, which there is not. Ok, do it. We'll see. > Your only protection on this Internet is to have a dozen different > addresses to access from. I can put a dozen computers up on > a dozen different T1's right now, if need be. I suggest a hobby which entails more physical activity. -- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland

5 6

Re: GELP/was:Word List
by Sven 17 Dec '03

17 Dec '03

>That should be a "what" is GELP. It's a type of sea weed. GOAT |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

1 0

Photobuster to beat radar...
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Nov 24 18:19:39 1996 At URL: http://www.havenofhope.org/photobuster/photob2.html Photobuster is a spin off from a specialty electronics company (Grand Systems) who saw the need for a system to foil the photo radar picture. We realize that people like your selves don't usually speed on purpose and can't afford to pay hundreds of semolies just because you look away from the speedometer from time to time. Our easily installed electronic Photobuster unit is a an electronically triggered device that mounts in the rear window with a satellite unit that mounts at the license plate. It watches the right side of the road for a photo radar setup. If you are driving at speeds in excess of the operators setting on the photo radar, it will attempt to photograph your car. When it does this the Photobuster senses the attempt and triggers a return response rendering the radar photo useless. It has an audible warning and a visual light to let you know each time you save 100 bucks. This unit only triggers if the photo radar attempts to photograph your car. NOTE: Photobuster has nothing covering your plate as is with other filter, poleroid and lenticular optical devices. We are told it is not legal in most areas, to install any kind of plastic cover over the plate, see through or not. ************************************************************ Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison(a)mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMpjYDD5A4+Z4Wnt9AQGEiwP+OwSodqT2IMQJIFxf/OPFIr7JSJJY7uWc tBfpskpydWvpcKe49PZMbflNOsTgjuW/MyRXLwu8j/mMIEKqwe7KvYPEVUIHNjx3 by3dLMglaihuObbAViewOTS2mjat2bWtB24cGwHI1/94gc8trLlXS3VTtCQYcnkl Btw1KpGDCek= =pfBU -----END PGP SIGNATURE-----

1 0

Re: IPG Algorith Broken!
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:16 PM 11/24/96 +0000, The Deviant wrote: >On Sat, 23 Nov 1996, Bill Frantz wrote: >> I thought Shannon proved one-time-pads to be unbreakable using information >> theory. > >Different ball game. OTP isn't "unbreakable" . OTPs are secure because >no matter what key you use, it _will_ decrypt, so your plaintext is still >hidden simply because it could decrypt to whatever the person trying to >decrypt it wants it to. Its not that its unbreakable, its that its >breakable in _so many ways_. I think we differ on the definition of "unbreakable". A quick stab at my (admittedly very vague) definition includes the inability of the analyst to determine (by the structure of the plaintext) that he has a correct decryption. When I look in AC2, Schneier uses "break" in many ways. Let me evaluate OTP against his taxonomy of attacks: Ciphertext-only: Unbreakable Known-plaintext: Unbreakable, since the pad is never reused Chosen-plaintext: Unbreakable, ditto Adaptive-chosen-plaintext: Unbreakable, ditto Chosen-ciphertext: This attack doesn't seem to apply Chosen-key: This attack requires that the OTP doesn't have 1-bit-of-entropy/bit which implies it isn't an OTP. Rubber-hose: Since any decryption is equally plausable, OTPs are resistant to this attack. OTOH, it means they may keep beating you even after you've given them the correct decryption. Purchase-key: This attack seems the only way to break an OTP. If you accept Purchase-key as a valid attack, and it certainly has worked in many real-life situations, then no system is "unbreakable" and there is not any point in using the term. If you leave it out of the valid forms of attack, because all systems are vulnerable to it so it doesn't help in selecting a cryptosystem, then the OTP is "unbreakable". How do you want to define "unbreakable"? ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

2 1

Aga is talking to himself
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:15 AM 11/24/96 -0500, aga <aga(a)dhp.com> wrote: >On Sun, 24 Nov 1996, John Anonymous MacDonald wrote: actually the message was from lucifer(a)dhp.com: >> aga <aga(a)dhp.com> writes: ... messages suppressed It looks like our juvenile "friend" is talking to himself. I am truely sorry that he feels a need to harass ladies who have actually made something of their lives. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> The algorythm cannot be considered secure until it has been > peer-reviewed. They refuse to release the algorythm for review, simply saying > that "you can't break the code" therefore "it is secure". This isn`t strictly true. Don Wood (spit) has actually released the algorithm details for review. It`s just that no-one considers it even worthy of looking at. I wearily downloaded the details then realised I had better things to do than sift through pages of pompous self important drivel about "software one time pads." Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 3

Re: Killfiling stupid faggots
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

abostick(a)netcom.com (Alan Bostick) writes: > > In article <199611220304.VAA02832(a)manifold.algebra.com>, > ichudov(a)algebra.com (Igor Chudov @ home) wrote: > > > Dr. John Martin Grubor is the most harmless and most entertaining > > among all kooks. > > > > His posting volume is a bit high, but other than that DrG never > > got anyone in trouble. > > I dunno about "harmless". Publishing lists of "known homosexuals" > can have repercussions that outweigh their entertainment value. Yes. John Gilmore met Alan Bostick through Grubor's list. They fucked each other in the ass (how's that for entertainment!) but now John Gilmore has AIDS. P.S. Whoever said Gilmore is bi and eats pussy is a fucking liar. Gilmore is 100% queer. He hasn't touched pussy since he was born. diGriz

2 1

Sameer R.I.P.
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

C2 has a nice corporate-style fig leaf on its site. Sameer has decided, it seems, to get out of the anonymity business and pursue other interests. Nice run while it lasted. FYI, Sameer does mention that his recent legal brouhaha had nothing to do with this decision.

4 3

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 7:10 AM 11/24/1996, The Deviant wrote: >On Sun, 24 Nov 1996, John Anonymous MacDonald wrote: >> At 6:56 PM 11/23/1996, The Deviant wrote: >> >On Sat, 23 Nov 1996, John Anonymous MacDonald wrote: >> >> The good news is that you can prove a negative. For example, it has >> >> been proven that there is no algorithm which can tell in all cases >> >> whether an algorithm will stop. >> > >> >No, he was right. They can't prove that their system is unbreakable. >> >They _might_ be able to prove that their system hasn't been broken, and >> >they _might_ be able to prove that it is _unlikely_ that it will be, but >> >they *CAN NOT* prove that it is unbreakable. This is the nature of >> >cryptosystems. >> >> Please prove your assertion. >> >> If you can't prove this, and you can't find anybody else who has, why >> should we believe it? > >Prove it? Thats like saying "prove that the sun is bright on a sunny >day". Its completely obvious. In other words, you can't prove it. Thought so. >If somebody has a new idea on how to attack their algorithm, it might >work. Then the system will have been broken. You never know when >somebody will come up with a new idea, so the best you can truthfully >say is "it hasn't been broken *YET*". As I remember, this was mentioned >in more than one respected crypto book, including "Applied Cryptography" >(Schneier). Page number? Perhaps it would be helpful to hear a possible proof. If somebody were to show that breaking a certain cryptographic algorithm was NP-complete, many people would find this almost as good as proof that the algorithm is unbreakable. Then if a clever person were to show that the NP-complete problems were not solvable in any faster way than we presently know how, you would have proof that a cryptographic algorithm was unbreakable. There is no obvious reason why such a proof is not possible. diGriz

2 1

kickouts done the Cypherpunks way...
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hi, Suppose Mr. X, owner of foobarpunks mailing list, wants to kick out Mr. Y, for his obnoxious letters to the mailing list. Mr. X, however, is concerned that Mr. Y would subscribe through some proxy address and would continue replying to messages to foobarpunks. It is assumed that the only person out of the whole universe, Mr. Y, cannot be trusted. The problem is that X does not know which of the subscribers is Mr. Y. The question is, is there a technical way to disable Mr. Y from reading the list, or detect which subscription address is a proxy for Y? If we assume that, at the moment when Y was kicked out, he was not subscribed through any other addresses, the solution becomes simple: for any new subscription request we require a letter of recommendation from some other subscriber. Since other subscribers are presumed to be trustworthy, their recommendations would be sufficient. It is actually being done in some of the mailing lists. The problem becomes more complex when Mr. Y is already presumed to have infiltrated the mailing list, possibly through several proxy addresses. Is there any way to detect/find which if the subscriber is Y? One of the simple-minded solutions is to _mutate_ mailing list messages so that all readers get slightly different copies of mailing list messages for each recipient. (Such mutations may include common misspellings, inserting spaces, etc) If the mailing list bot keeps track of what changes were made in messages to which individual, and if we assume that Mr. Y has to quote significant parts of messages he replies to, finally the variations in messages may be reconciled with variations in quoted parts. Mr. Y is not stupid, and may go as far as comparing letters, received through different proxy addresses, in order to detect "variations" and avoid quoting them. The question is, is there a strategy of making variations and detecting them in quotes to finally catch Mr. Y? - Igor.

4 4

The American Black Chamber - Yardley - Re: 1996 Codebreakers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)homeport.org> wrote: > I just got a review copy of the new (1996) ed. of Kahn's The >Codebreakers from my local used bookstore. Its a little disapointing, >about 20 new pages of material. Kahn states in the forward that all >the new material is in a chapter at the end. ....... > Anyway, copies should be in bookstores soon. If you don't >have a copy already, Kahn is the definitive history book, and is well >worth having. I just got a copy* of the 1981 "The American Black Chamber", by Herbert O. Yardley, with a new (1981) intro by Kahn. ISBN 0-345-29867-5. The original had been published in 1931, went through a couple printings, and sold twice as many copies in Japan as the US. In 1933 the US passed a law banning the publishing of any material that had been published in diplomatic codes, and of course they withheld permission for future printings. Lots of good material on the state of crypto from WWI through the 1920s. Crypto wasn't yet on a mathematical basis, though it was starting to emerge in cryptanalysis. After the World War ended, most of the traffic was cracking diplomatic correspondence, especially for disarmament negotiations. Getting users to take crypto seriously was a problem - most of the US communications during the Spanish-American war used a sort of "rot-1898", and even during the World War, military plans were often broadcast on radio using wimpy codes, causing much damage to both sides. Codes were generally designed by people who didn't have extensive cracking experience, and therefore most new codes were easily cracked as well. Yardley's organization diverted some of its expertise to cracking secret inks, which were extensively used by German spies. Language and cultural differences caused surprising difficulties - there was one person they could find who knew German shorthand systems, and finding Japanese language experience after the war was difficult, since they didn't want to use Japanes immigrants for security reasons and most missionaries wouldn't do military work (both for ethical reasons and because it would lead the Japanese government to crack down on missions to Japan, Korea, and China.) Kahn speculates that the ability to crack Japanese naval codes in WWII was probably enhanced by Yardley's people's work - PURPLE was much stronger than the earlier Japanese diplomatic codes, but the Japanese Navy believed that "This time, it's all right" (cable chief, to foreign minister :-), when it wasn't. Yardley reports at the end of the book that he believed the science of cryptography would die out - AT&T had invented a cypher machine during the war, and had invented one-time pads, and the combination would make code clerks obsolete and codes unbreakable...... Shortly after that, in 1929, the new Secretary of State was shocked to discover that his department was funding eavesdropping. "Gentlemen don't read each others' mail." # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

public
by rudd_a＠alph.swosu.edu 17 Dec '03

17 Dec '03

I am new here, and I was wondering, why are there still stupid, immature people on line who have the audacity, here in the 90's, to still call people a "cocksucking faggot". I mean no offense here, but please, stop using such offensive words! Thanks.... As I said, I am new here, and am a libertarian/anarchist who wants the government to butt out of our lives...I am very interested in privacy, and am also against censorship. I hope there are others out there who feel as I do, but if not, I guess I'll find out I'm on the wrong place!! :-) Anyhow, I hope you can welcome a Cincinnati goth who lives in Oklahoma...thanks!!....Amy **************************************************************************** ***** * * It's better to regret something you did than something you * * didn't do. * * * * * ********************************************************************************

3 2

P.S. on chain letters
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A week or so ago I was ranting about chain letters and other memes - well, today I came across some well-research Web site hosted by Kenneth Han (Black Unicorn may know him) - check out http://www.gwu.edu/~khan if you care about more analysis of the Craig Sherhorn phenomenon. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Symantec's claim.
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:45 PM 11/25/96 +0200, cracker(a)icon.co.za wrote: > >In light of recent claims,i would like somebody to clear this up for me. >There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. >Symantec denies it's existence,although i hear differently?? >Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt usually deal with this topic of thought ;) >Anyone come across the pkz300 trojan,if you have it send it please. >A student,a paper,and a possible future career are at stake here,so please dig deep into your >pockets!!!!!! Asking a lot i know! Deeyenda is a hoax. (Very similar to "Good Times" and aimed towards the same audience.) Info on it can be found at: http://www.kumite.com/myths/myth027.htm --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

A source of entropy?
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

Last weekend I spent time formatting a little over 100 new floppies. When I was staring at the monitor between changes, I started looking at the volume serial number that was being thrown up for each disk. These *appeared* to be unpredictable from the previous serial number given. If the serial number is represented as xxxx-yyyy then sometimes yyyy would be one less than the previous yyyy but xxxx always seemed to be "random". The disks were all brand new, no errors (from a couple of boxes of 50 and some odd ones), formatted at the Win95 DOS prompt with 'format a: /u' no volume labels and pressing 'y' to format the next disk. Would anyone like to comment on the possible entropy from these serial numbers, even if it's only to say "Don't be daft, DOS derives the numbers like this..." I'll probably be doing a similar number next weekend. If any interest is generated from this post, I could always record the serial numbers given to the next batch to look for correlations. (Please don't reply with 'invest in a bulk-formatter' - I can't afford one right now.) ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!!! - http://river.tay.ac.uk/~i95dl/index.html **********************************************************************

2 1

Fwd: Your Email Privacy Has Been Compromised
by EBDAVIS＠aol.com 17 Dec '03

17 Dec '03

FYI --------------------- Forwarded message: From: securityadmn(a)netsecurity.yes Date: 96-11-18 05:31:58 EST This Message Contains Important Information About Violations of Your On-Line Privacy. *Email and Online Security Violations.* Please be advised that information contained in email is similar to a post card. It can easily be read in transit and does not go directly from your computer, to the computer of the recipient. Your message often passes through the hands of countless computer systems on its path to where you sent it. Because of this, it can easily be seen by many prying eyes on the way to its destination. If you are mailing personal, business or financial data it is unwise to use traditional email. There are many people on the net who profit by snooping in the open "post card" style email that most account holders utilize. Programs are readily available to make this task simple. Additionally, many people are purchasing mailing lists which contain your email address. If you do not wish to receive unsolicited email, there are a number of free and highly effective steps you can take to recapture your privacy. The personal exposure spoken of is not limited to email. If you make use of other internet services such as the World Wide Web, your privacy is at even greater risk. Unless secure, any information you enter on a form can be read in transit, just like email. Additionally, most of the information providers you contact on the web routinely collect information about you in high detail. This information goes right down to where you are located, and what kind of computer and operating system you use! To combat this problem, many countermeasures have been developed of which most account holders remain unaware. The on line criminals would like to keep it that way. Every net citizen needs to learn to stop sending "Post Cards" and stop allowing distant machines to accumulate large amounts of information about who they are and their interests. There are many simple things you should be doing right now to protect your privacy. Most of the best countermeasures available are FREE. This is because there is still a very strong vein of computer experts on the net who believe in an individual's right to privacy. There are excellent, completely free programs that you should be using right now to browse the web in an untraceable and private manner, and send email that only the recipient can read! You don't need to be a computer expert to use these tools. They often take little or no additional time and are designed to be very simple for the computer illiterate to use. The computer gurus that designed these programs know that it is extremely important that average net citizens make use of them. They have designed and continually revised them with that in mind. My name is Jeff Martin, my associates and I have spent a great deal of time researching this subject. It is my goal to provide you with access to the best resources available to keep your communications private. My information relates to both email and other aspects of the internet such as the World Wide Web. This information was put together because I don't feel that others are making it available in this form of wide distribution, and it needs to be done. The internet is just like a city in that you need some street smarts to keep yourself as safe as possible. That's the kind of information I wish would have been provided to me when I began to go on line, and it is what I have tried hard to put together to help you out. In my program you'll learn: *How to send email that cannot be traced. *How to send email to your friends and associates that cannot be read in transit. *How to post anonymously to Newsgroups. *How to browse the web and download files anonymously. *Why you should (almost) never send financial information over the net. *How to prevent your name from being gathered and sold for bulk email use. *And Much, Much, Much, More .... My package is a treasure trove of valuable information collected to guarantee your privacy! This is the first time I am making this information available. In a short while, the program will be retailing for $59.95. However, if you respond within the next 7 days of receiving this message you will receive the special price of $19.95. Because of the amazing expansion of the internet, I have decided to make this offer so that everyone can afford to learn how to protect themselves from the net's growing criminal element. After seven days you may still order the program at its retail price of $59.95. Additionally, if you order within the next 48 hours, I'll include a very special report about how you can get a free email address and account to use from just about anywhere in the U.S. I'll show you how, but you must order within the next 48 hours! HOW TO ORDER I strive very hard to protect your security. I do not accept unsecure credit card or check information by email, because it is too easily intercepted. While this could increase my orders, I feel that your security as a customer is more important. I am a small business person and keeping up with phoned and faxed in orders has proven to be too difficult for me. Therefore I now only accept orders via postal (snail) mail. Please be certain to give me your email address when ordering. I prefer to ship orders via email so that you can have my information as soon as possible. To order send a check, money order, or credit card information (Visa, MasterCard, Discover) to me at: Jeff Martin POB 72106 Newport, Kentucky 41072 Any credit card orders must use the attached form below. Thank you very much for your time. Best Wishes, Jeff Martin This information will always be held in the strictest confidence. Credit Card: Visa Mastercard Discover Card #:______________________________________ Expiration Date:__________________ Name on Card:________________________________ Please indicate amount $__________ ($19.95) or (59.95) SIGNATURE:x________________________ DATE:x__________________ Copyright 1996, Jeff Martin. All rights reserved.

2 1

Symantec's claim.
by cracker＠icon.co.za 17 Dec '03

17 Dec '03

In light of recent claims,i would like somebody to clear this up for me. There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. Symantec denies it's existence,although i hear differently?? Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt usually deal with this topic of thought ;) Anyone come across the pkz300 trojan,if you have it send it please. A student,a paper,and a possible future career are at stake here,so please dig deep into your pockets!!!!!! Asking a lot i know! J a m e s "Lead.Follow. Or get out of the way" ----------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Symantec's claim.
by cracker＠icon.co.za 17 Dec '03

17 Dec '03

In light of recent claims,i would like somebody to clear this up for me. There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. Symantec denies it's existence,although i hear differently?? Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt usually deal with this topic of thought ;) Anyone come across the pkz300 trojan,if you have it send it please. A student,a paper,and a possible future career are at stake here,so please dig deep into your pockets!!!!!! Asking a lot i know! J a m e s "Lead.Follow. Or get out of the way" ----------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel remailer accepts PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 25 Nov 96 6:45:17 PST remailer email address history latency uptime ----------------------------------------------------------------------- weasel config(a)weasel.owl.de -++---++++++ 1:58:22 99.99% jam remailer(a)cypherpunks.ca ************ 14:14 99.98% haystack haystack(a)holy.cow.net **--#+**#**# 7:03 99.89% cyber alias(a)alias.cyberpass.net ++**++***** 35:06 99.84% balls remailer(a)huge.cajones.com ****** ***** 5:08 99.79% lucifer lucifer(a)dhp.com ++++++++++++ 38:35 99.62% lead mix(a)zifi.genetics.utah.edu +++++-+*++++ 39:55 99.61% extropia remail(a)miron.vip.best.com ---.------- 7:31:23 99.55% nym config(a)nym.alias.net *#**###*+## 1:05 99.51% squirrel mix(a)squirrel.owl.de -++ ++++++ 2:02:00 98.98% mix mixmaster(a)remail.obscura.com ++++--+++-+ 1:16:28 98.92% reno middleman(a)cyberpass.net +*--------- 2:30:43 98.78% replay remailer(a)replay.com ********** * 10:10 98.48% middle middleman(a)jpunix.com +------ -- 2:40:34 97.86% dustbin dustman(a)athensnet.com - .-+*+ ++ 3:09:24 95.37% exon remailer(a)remailer.nl.com ######### 1:40:10 86.24% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: GELP/was:Word List
by wireinfo 17 Dec '03

17 Dec '03

>>That should be a "what" is GELP. > >It's a type of sea weed. it's a dessert topping. <bong gurgle>, iMp ------------------------------------------------------------------------ "Call any vegetable, and the chances are good / That the vegetable will respond to you." Frank Zappa ------------------------------------------------------------------------ | any replies go here | no e-mail replies to usenet posts | ------------------------------------------------------------------------

1 0

Re: John Gilmore is playing with himself
by nobody＠replay.com 17 Dec '03

17 Dec '03

frantz(a)netcom.com (Bill Frantz) wrote: >At 6:15 AM 11/24/96 -0500, aga <aga(a)dhp.com> wrote: >>On Sun, 24 Nov 1996, John Anonymous MacDonald wrote: >actually the message was from lucifer(a)dhp.com: > >>> aga <aga(a)dhp.com> writes: >... messages suppressed You bet they want to suppress the truth about them being faggots! Faggot John Gilmore does NOT eat pussy. He only eats asshole if it's got a big dick up in front. Whoever calls Gilmore bisexual is a fucking liar. John likes to suck cocks at his San Fransicso bathhouse (the Toad Hole). >It looks like our juvenile "friend" is talking to himself. I am truely >sorry that he feels a need to harass ladies who have actually made ^ >something of their lives. Gilmore's friends try to drag every lady Gilmore knows into this shit. Gilmore is a fag. Gilmore does NOT eat pussy. Not Denning's, not Dyson's. >------------------------------------------------------------------------- >Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting >(408)356-8506 | those who can't do math. | 16345 Englewood Ave. >frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA You can say that again, good buddy. diGriz

3 3

DCSB: Money Laundering -- The Headless Horseman of the Infocalypse
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE-----BY SAFEMAIL----- The Digital Commerce Society of Boston Presents "Black Unicorn" "Money Laundering -- The Headless Horseman of the Infocalypse" Tuesday, December 3, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA S. L. vonBernhardt, <mailto:unicorn@schloss.li>, is an attorney, a member of the board of directors of two European financial institutions, author of "Practical and Legal Problems Confronting the Asset Concealer in Relation to Offshore Financial and Corporate Entities" and a former member of the intelligence community. He is currently working to develop and preserve institutions dedicated to traditional standards of financial privacy. One of the most disturbing products of the "war on drugs" has been the effective criminalization of many forms of formerly legal financial transactions. The resulting legislation places serious burdens on financial institutions in the form of "due diligence" requirements, as well as building what can be an inflexible barrier before those who would implement uncompromised digital commerce systems. Mr. vonBernhardt will address the legislative burdens imposed on financial institutions, the likely impact on future systems of digital commerce, potential solutions through regulatory arbitrage, and the practical problems facing jurisdictions seeking to enforce regulations in the face of advanced systems of digital commerce. No cameras, please. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, December 3, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, November 30, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: January Rodney Thayer Applying PGP To Digital Commerce February David Kaufman 1996 in Review / Predictions for 1997 March TBA April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE-----BY SAFEMAIL----- Version: 1.0b4 e22 iQCVAwUBMpmydfgyLN8bw6ZVAQEvkQQAnmg8R3OF4IJpc+xVCRut8O0O9M4ZKOkG 5iD8b+XkdAZ7UTCqAQqqL8CTIlhEn9KLzRGIQbhx+V66qAbs/9nNRFMcFgmAjKy8 TuJlRNmjgF09jrr5tWgGpH9J5K1jmGqMDOc27Cr7TLMmgdTbzcQS9oUfpmoRpNns SFShKt2JHxA= =5/Zo -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Secret Powers
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i have just completed Secret Powers (reading it, that is). unless you live in NZ, i don't think that there is much here for you. even the NZ stuff was pretty tame, unless you have been living under a rock, there is nothing here that wasn't already known. lots of pictures of NZ politicians and such stuff. also, a picture of a vax with a caption that implies that these are the NSA's echelon-network computers, sigh. the author can't seem to stay focused for very long. also, it's hard to see what his underlying message is, unless, of course, it's simply to sell books and make money, which is in no way a bad thing. on the one hand, he keeps harping on the theme of how the UKUSA (but really NSA) is forever telling NZ what to collect and what to do, and how NZ should be their own masters, but then he talks about how very much data NZ receives every day from the NSA. i guess he never heard the one about the one who pays the piper getting to call the tune. he also keeps trying to make something sinister about the use of acronyms and code words, and insists that the radomes are to prevent anyone from calculating the look angle and therefore the likely satellites that the dish is looking at. at another point, however, he mentions how the salt water corrosion destroyed an antenna array, but never seems to be able to figure out that radomes also protect the equipment inside from these very destructive elements. in general, a lot of nonsense that doesn't every get tied together. there is also this recurring theme about NZ's independence and it's nuclear-free shit. perhaps there are really people in NZ that care about this stuff, but in this day and age, it's hard to image that there would be. it's not like the book is poorly written or researched or anything like that, and it's certainly a hell of a lot more than i have done, but otherwise, ....... money isn't much of a problem to me, so i don't regret buying this book, but if you aren't in the same position, i'd give this one a miss. better to wait for the new release of The Puzzle Palace. BTW, does anyone have an update on this? are the authors having friendly chats with the boys from the fort, or something like that? if however, you really want to read it, the publishers were very prompt about selling me a copy and shipping it to me via air, and were generally pleasant to deal with. cheers, -paul

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

[This should make you feel better about GAK] New York Times: Thursday, November 21, 1996 Social Security Workers Held In Frauds Using Credit Cards By LYNDA RICHARDSON Federal officials announced the arrests of a group of Social Security Administration employees Wednesday, charging them with passing confidential information on at least 1,000 people to credit-card thieves for bribes as little as $10. Under the scheme, the employees would give out confidential information that would allow the credit-card thieves to use the cards when they made purchases. The authorities think the thieves were able to obtain the cards by stealing them through the mail, in some cases. The authorities said six current or former employees and a former security guard with the agency were arrested Tuesday in the scheme, which resulted in at least $10 million in losses to credit card issuers from October 1995 to this June. The credit card issuers are Citibank, Visa and Mastercard. The employees were charged with bribery and misuse of a government computer, and face prison terms of 2 to 15 years and fines up to $250,000. The arrests resulted from a federal investigation that began in February into what computer experts say may be one of the biggest breaches of security of federal government data on residents. Officials said 20 people have been arrested, including 10 current or former employees of the Social Security Administration. The scheme was first detected in February by Citibank, which noticed an unusual amount of fraudulent charges on credit cards it had mailed to customers but that the customers said they had not received, officials said. Like many banks, Citibank has a security procedure that requires customers who receive new cards to activate them by calling a toll-free telephone number and provide some personal information, like their mother's maiden name, to activate the credit card. The bank discovered that its security system had been foiled in dozens of cases in which cards were activated by someone who was not the cardholder but had access to the cardholder's mother's maiden name. Investigators for the Social Security Administration, which keeps files of maternal maiden names and records the identification number of employees who call up files, determined that an employee at the Brooklyn Social Security office had illegally looked at the personal records of nearly two dozen people and sold the information to conspirators, who activated credit cards, said Philip A. Gambino, an agency spokesman. Based on information from that employee, the agency identified several other employees who had illegally released confidential information, often in exchange for bribes. Those arrested this week were described as low-level workers, including claim representatives and clerks. In 1,000 cases, credit cards were activated using information illegally provided by the government employees, Gambino said. ``Most have been fired and the others are in the process of being fired,'' he said. Officials said the thieves who approached the Social Security employees already had access to Social Security numbers and wanted the numbers run through the agency's database. Social Security numbers are the closest thing to a universal identifier that Americans have, and are widely available from public sources like college and employee ID cards and hospital tags, and even driver's licenses in more than 30 states. The investigation has resulted in the arrests of nine people, including seven Nigerians, who are accused of receiving or using the stolen confidential information to commit various types of credit card fraud, said Brian F. Gimlett, the special agent in charge of the Secret Service in New York. He said the stolen or reissued credit cards were used to buy merchandise, obtain cash advances and line-of-credit checks and make illegal withdrawals from automated teller machines. Gimlett said the conspirators who approached the government workers were not part of an organized crime ring. ``Actually, most were individual operations, but doing the same type of crime,'' he said. ``This is another example of greedy people finding new ways to compromise the security systems to financially gain from credit card fraud and other types of fraud.'' EFT Report: November 20, 1996 Micro Card Targets U.S. Smart Card Market Bull CP8 Transac, of France, says it wants to help U.S. banks issue smart cards through its U.S. subsidiary, Micro Card Technologies, of Billerica, Mass. The company believes that 60 percent of the smart card opportunity resides here, says Gerald Hubbard, vice president of marketing. That market is expected to grow to a total of about $100 million to $200 million by the year 2000, according to industry figures. Debit and stored-value cards are targeted as the first smart-card applications to be issued in the United States. As a result, Micro Card is forming alliances throughout the card industry to penetrate the U.S. market. It recently partnered with NBS, of Plainfield, N.J., one of the nation's largest card manufacturers. Bull's strategy is similar to that of its competitors, says Ben Miller, president of CardTech/SecurTech in Bethesda, Md. All the world's major smart card firm are bringing smart card capabilities in from offshore and have set up acquisitions or partnerships with U.S. card manufacturers to build strength and confidence from American bankers, Miller says. Schlumberger, also of France, recently bought Malco. The existing manufacturing facilities are secure and card association compliant, helping the companies earn industry trust. The firms, in turn, receive an existing revenue stream from the magnetic stripe sales, Miller says. Micro Card claims it has the longest U.S. history of its competitors. It set up shop here in 1984 and has since participated in several smart card closed-system initiatives. For example, U.S. Marine Corp.'s recruits in Parris Island, S.C., receive their pay on CP8 Micro Cards, which are accepted at post exchanges for cash withdrawals and purchases. Micro Card also has been selected to provide half of the card readers in the Citibank and Chase Manhattan Bank smart card pilot in New York. Micro Card sells readers, encoders and several different types of cards ranging from the basic one-issuer, multiple-application system, called SCOT, to its high-end electronic purse card that can handle multiple applications from several unconnected service providers, says Hubbard. Its crypto card uses public key cryptography to secure transactions, Hubbard says. Micro Card's systems all contain microprocessors and comply with Europay, MasterCard and Visa (EMV) standards as well as International Standards Organization specifications, he adds. Micro Card also is partnering with Redmond, Wash.-based Microsoft and several smart card vendors to develop integration standards for smart cards and personal computers. Evening Standard (London): Monday, November 18, 1996 Smart Card Code is Cracked By Flora Hunter A Cambridge scientist has broken the smart card code, casting doubt over the card's future as the ultimate security device. Dr Ross Anderson's work, published today, has been kept secret for six months to allow institutions such as the Bank of England to review security. The Cambridge University computer expert claims his methods of accessing information from smart cards, which were previously thought impenetrable, could be used by organised criminals using simple equipment. He is warning banks and other financial institutions to rethink their security operations, as his breakthrough could lay bare the private financial secrets of everyone from governments to the holders of High Street bank accounts. Smart cards are used as identity tokens in satellite TV cards and bank cards. They are also used as top-level security passes at nuclear installations. The Government recently announced plans to store information such as driving licence, tax, social security and pension details on individual smart cards. Today, Dr Anderson said: 'For a number of years these smart cards and processors have been marketed as tamper-proof. If you try and get into their chip using whatever method, they are supposed to be inaccessible. 'We have developed techniques that can get into most of these smart cards and I believe they can all be accessed. Banks are moving away from magnetic cards towards smart cards to improve security but they are going to have to think again. 'They are going to have to rethink their whole security process because we have shown the security processors can be attacked with the kind of equipment available to any undergraduate. 'Organised criminals could use the techniques to cause disaster to financial institutions.' Smart cards can store information on a tiny microchip embedded in the plastic which lets the user access electronic and computer systems. Banks and other financial institutions must now make immediate changes to their sophisticated security systems, which could cost millions of pounds. In conjunction with an American colleague, Dr Anderson has perfected techniques that could cause havoc. Dr Anderson said: 'We have been in consultation with the Bank of England and various national intelligence agencies. We agreed to postpone publishing our paper to give them a chance to look at the findings. A lot of people have put all their eggs in one basket by relying on smart cards for security. Now the basket has been tipped over.' American Banker: Thursday, November 21, 1996 Wells, 31 Others Ease Downloading of Account Data from Internet By DREW CLARK Wells Fargo & Co. and 31 community banks and credit unions announced that their customers will be able to download account information from the Internet with the click of a button. The technology is one of the first uses of Microsoft Corp.'s set of standards for electronic financial connections, which were introduced last March. Called Active Statement Technology, advocates say that it will simplify the process of transferring account files from the World Wide Web to personal financial software programs. Making data on Web sites easier to download is likely to encourage banking customers to go to the sites, industry observers said. That, in turn, would offer banks more chance to promote their services on the Internet. "Today we offer both our Quicken and our Microsoft Money customers the ability to download information into their software spreadsheets," said Wells Fargo spokeswoman Janet Otsuki. But the features of Microsoft's new technology "will allow Money customers to have a more direct and more efficient downloading experience." The benefits of that arrangement are hardly accidental from the standpoint of Microsoft, which has been aggressively battling Intuit Inc. for a greater share of the personal financial software market. Intuit's Quicken leads Money by 75% to 20%, according to a recent independent consumer study. Microsoft offers its technology for free to all financial institutions, and it encourages banks to link their Web sites so that their customers will find a trial offer for the Money product. Competing Web browsers will be able to download financial data, but Microsoft Money 97 is the only financial software able automatically to receive the information. "We expect this will be a de facto technology that any bank would want to incorporate," said Matthew Cone, a business development manager at Microsoft. Others familiar with Active Statement Technology said the program's ability to recognize information that has already been recorded offers a crucial advantage over the widely used Quicken Import Format. "Comparing the Quicken Import Format to (Microsoft's technology) is like comparing apples to oranges," responded Intuit senior vice president Eric Dunn. "Automatic reconciling has been possible in both Quicken and Money for over a year." By now, 275 financial institutions offer some form of PC banking, and 46 let customers gain access to their accounts from the Web, according to the Seattle-based Online Banking Report. But encouraging customers to come over via the Web may hold benefits for banks. "Instead of starting with Money or Quicken, customers start at the bank's Web site," said Paul Fiore, chief executive of Digital Insight. The Camarillo, Calif., company has helped 28 credit unions develop transactional Web sites. Without having to pay Microsoft for a direct connection, all those institutions now offer their customers the ability to download their finances easily into Money 97. How soon will that affect consumers at those institutions? Cathi Cavanagh, home banking coordinator at the Plano, Tex., Community Credit Union, is already watching: "I am personally going to look to see if people are converting from Quicken to Microsoft Money."

1 0

Israel crypto restrictions
by Jyri Kaljundi 17 Dec '03

17 Dec '03

Does anyonw knoe about crypto export restrictions in Israel? The Crypto Law Survey (http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm) says that there are some restrictions, but "their scope is not clear". Also I have been iformed of occasions when a company in Israel does not export strong crypto. Still I believe I have seen many programs from Israel that have unlimited strong algorithms. The real question is, why can't Checkpoint who manufactures the Firewall-1 sell DES version in Europe, but only in US and Canada. Elsewhere they use a proprietary algorithm called FWZ (48-bit). I have not any analysis done on FWZ so I don't think anyone is using it. Jüri Kaljundi AS Stallion jk(a)stallion.ee WWW ja andmeturvateenused http://www.stallion.ee/

3 6

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

[This should make you feel better about GAK] New York Times: Thursday, November 21, 1996 Social Security Workers Held In Frauds Using Credit Cards By LYNDA RICHARDSON Federal officials announced the arrests of a group of Social Security Administration employees Wednesday, charging them with passing confidential information on at least 1,000 people to credit-card thieves for bribes as little as $10. Under the scheme, the employees would give out confidential information that would allow the credit-card thieves to use the cards when they made purchases. The authorities think the thieves were able to obtain the cards by stealing them through the mail, in some cases. The authorities said six current or former employees and a former security guard with the agency were arrested Tuesday in the scheme, which resulted in at least $10 million in losses to credit card issuers from October 1995 to this June. The credit card issuers are Citibank, Visa and Mastercard. The employees were charged with bribery and misuse of a government computer, and face prison terms of 2 to 15 years and fines up to $250,000. The arrests resulted from a federal investigation that began in February into what computer experts say may be one of the biggest breaches of security of federal government data on residents. Officials said 20 people have been arrested, including 10 current or former employees of the Social Security Administration. The scheme was first detected in February by Citibank, which noticed an unusual amount of fraudulent charges on credit cards it had mailed to customers but that the customers said they had not received, officials said. Like many banks, Citibank has a security procedure that requires customers who receive new cards to activate them by calling a toll-free telephone number and provide some personal information, like their mother's maiden name, to activate the credit card. The bank discovered that its security system had been foiled in dozens of cases in which cards were activated by someone who was not the cardholder but had access to the cardholder's mother's maiden name. Investigators for the Social Security Administration, which keeps files of maternal maiden names and records the identification number of employees who call up files, determined that an employee at the Brooklyn Social Security office had illegally looked at the personal records of nearly two dozen people and sold the information to conspirators, who activated credit cards, said Philip A. Gambino, an agency spokesman. Based on information from that employee, the agency identified several other employees who had illegally released confidential information, often in exchange for bribes. Those arrested this week were described as low-level workers, including claim representatives and clerks. In 1,000 cases, credit cards were activated using information illegally provided by the government employees, Gambino said. ``Most have been fired and the others are in the process of being fired,'' he said. Officials said the thieves who approached the Social Security employees already had access to Social Security numbers and wanted the numbers run through the agency's database. Social Security numbers are the closest thing to a universal identifier that Americans have, and are widely available from public sources like college and employee ID cards and hospital tags, and even driver's licenses in more than 30 states. The investigation has resulted in the arrests of nine people, including seven Nigerians, who are accused of receiving or using the stolen confidential information to commit various types of credit card fraud, said Brian F. Gimlett, the special agent in charge of the Secret Service in New York. He said the stolen or reissued credit cards were used to buy merchandise, obtain cash advances and line-of-credit checks and make illegal withdrawals from automated teller machines. Gimlett said the conspirators who approached the government workers were not part of an organized crime ring. ``Actually, most were individual operations, but doing the same type of crime,'' he said. ``This is another example of greedy people finding new ways to compromise the security systems to financially gain from credit card fraud and other types of fraud.'' EFT Report: November 20, 1996 Micro Card Targets U.S. Smart Card Market Bull CP8 Transac, of France, says it wants to help U.S. banks issue smart cards through its U.S. subsidiary, Micro Card Technologies, of Billerica, Mass. The company believes that 60 percent of the smart card opportunity resides here, says Gerald Hubbard, vice president of marketing. That market is expected to grow to a total of about $100 million to $200 million by the year 2000, according to industry figures. Debit and stored-value cards are targeted as the first smart-card applications to be issued in the United States. As a result, Micro Card is forming alliances throughout the card industry to penetrate the U.S. market. It recently partnered with NBS, of Plainfield, N.J., one of the nation's largest card manufacturers. Bull's strategy is similar to that of its competitors, says Ben Miller, president of CardTech/SecurTech in Bethesda, Md. All the world's major smart card firm are bringing smart card capabilities in from offshore and have set up acquisitions or partnerships with U.S. card manufacturers to build strength and confidence from American bankers, Miller says. Schlumberger, also of France, recently bought Malco. The existing manufacturing facilities are secure and card association compliant, helping the companies earn industry trust. The firms, in turn, receive an existing revenue stream from the magnetic stripe sales, Miller says. Micro Card claims it has the longest U.S. history of its competitors. It set up shop here in 1984 and has since participated in several smart card closed-system initiatives. For example, U.S. Marine Corp.'s recruits in Parris Island, S.C., receive their pay on CP8 Micro Cards, which are accepted at post exchanges for cash withdrawals and purchases. Micro Card also has been selected to provide half of the card readers in the Citibank and Chase Manhattan Bank smart card pilot in New York. Micro Card sells readers, encoders and several different types of cards ranging from the basic one-issuer, multiple-application system, called SCOT, to its high-end electronic purse card that can handle multiple applications from several unconnected service providers, says Hubbard. Its crypto card uses public key cryptography to secure transactions, Hubbard says. Micro Card's systems all contain microprocessors and comply with Europay, MasterCard and Visa (EMV) standards as well as International Standards Organization specifications, he adds. Micro Card also is partnering with Redmond, Wash.-based Microsoft and several smart card vendors to develop integration standards for smart cards and personal computers. Evening Standard (London): Monday, November 18, 1996 Smart Card Code is Cracked By Flora Hunter A Cambridge scientist has broken the smart card code, casting doubt over the card's future as the ultimate security device. Dr Ross Anderson's work, published today, has been kept secret for six months to allow institutions such as the Bank of England to review security. The Cambridge University computer expert claims his methods of accessing information from smart cards, which were previously thought impenetrable, could be used by organised criminals using simple equipment. He is warning banks and other financial institutions to rethink their security operations, as his breakthrough could lay bare the private financial secrets of everyone from governments to the holders of High Street bank accounts. Smart cards are used as identity tokens in satellite TV cards and bank cards. They are also used as top-level security passes at nuclear installations. The Government recently announced plans to store information such as driving licence, tax, social security and pension details on individual smart cards. Today, Dr Anderson said: 'For a number of years these smart cards and processors have been marketed as tamper-proof. If you try and get into their chip using whatever method, they are supposed to be inaccessible. 'We have developed techniques that can get into most of these smart cards and I believe they can all be accessed. Banks are moving away from magnetic cards towards smart cards to improve security but they are going to have to think again. 'They are going to have to rethink their whole security process because we have shown the security processors can be attacked with the kind of equipment available to any undergraduate. 'Organised criminals could use the techniques to cause disaster to financial institutions.' Smart cards can store information on a tiny microchip embedded in the plastic which lets the user access electronic and computer systems. Banks and other financial institutions must now make immediate changes to their sophisticated security systems, which could cost millions of pounds. In conjunction with an American colleague, Dr Anderson has perfected techniques that could cause havoc. Dr Anderson said: 'We have been in consultation with the Bank of England and various national intelligence agencies. We agreed to postpone publishing our paper to give them a chance to look at the findings. A lot of people have put all their eggs in one basket by relying on smart cards for security. Now the basket has been tipped over.' American Banker: Thursday, November 21, 1996 Wells, 31 Others Ease Downloading of Account Data from Internet By DREW CLARK Wells Fargo & Co. and 31 community banks and credit unions announced that their customers will be able to download account information from the Internet with the click of a button. The technology is one of the first uses of Microsoft Corp.'s set of standards for electronic financial connections, which were introduced last March. Called Active Statement Technology, advocates say that it will simplify the process of transferring account files from the World Wide Web to personal financial software programs. Making data on Web sites easier to download is likely to encourage banking customers to go to the sites, industry observers said. That, in turn, would offer banks more chance to promote their services on the Internet. "Today we offer both our Quicken and our Microsoft Money customers the ability to download information into their software spreadsheets," said Wells Fargo spokeswoman Janet Otsuki. But the features of Microsoft's new technology "will allow Money customers to have a more direct and more efficient downloading experience." The benefits of that arrangement are hardly accidental from the standpoint of Microsoft, which has been aggressively battling Intuit Inc. for a greater share of the personal financial software market. Intuit's Quicken leads Money by 75% to 20%, according to a recent independent consumer study. Microsoft offers its technology for free to all financial institutions, and it encourages banks to link their Web sites so that their customers will find a trial offer for the Money product. Competing Web browsers will be able to download financial data, but Microsoft Money 97 is the only financial software able automatically to receive the information. "We expect this will be a de facto technology that any bank would want to incorporate," said Matthew Cone, a business development manager at Microsoft. Others familiar with Active Statement Technology said the program's ability to recognize information that has already been recorded offers a crucial advantage over the widely used Quicken Import Format. "Comparing the Quicken Import Format to (Microsoft's technology) is like comparing apples to oranges," responded Intuit senior vice president Eric Dunn. "Automatic reconciling has been possible in both Quicken and Money for over a year." By now, 275 financial institutions offer some form of PC banking, and 46 let customers gain access to their accounts from the Web, according to the Seattle-based Online Banking Report. But encouraging customers to come over via the Web may hold benefits for banks. "Instead of starting with Money or Quicken, customers start at the bank's Web site," said Paul Fiore, chief executive of Digital Insight. The Camarillo, Calif., company has helped 28 credit unions develop transactional Web sites. Without having to pay Microsoft for a direct connection, all those institutions now offer their customers the ability to download their finances easily into Money 97. How soon will that affect consumers at those institutions? Cathi Cavanagh, home banking coordinator at the Plano, Tex., Community Credit Union, is already watching: "I am personally going to look to see if people are converting from Quicken to Microsoft Money."

1 0

Smart card attacks vs. clipper?
by Mike McNally 17 Dec '03

17 Dec '03

Has any work been done (yet) using the recently-publicised techniques used to foil smart card tamperproofing against Clipper implementations? Seems like it's a bit of a different story, since in the Clipper's case the algorithm is (ostensibly) unknown, but I'm just curious as to whether there is some compromise of its security-through-obscurity. -- ______c_________________________________________________________________ Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data http://www.io.com/~m101/ * processing" are different!

1 0

Forming a multinational
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

Hi, I am physically located in India and want to start up a US firm that will operate in India. Basically the firm will be a multonational with regional offices in couple of countries, to start with India and prolly one somewhere in Europe sometime later. The business involves a tie up with another US firm. These people will obviosly require USD payements, while most of the money we'll make will be in Indian rupees, since initially we'll be _actually_ operating only in India. The problems here are : x. Can I, an Indian citizen start a US firm? x. Is it _legal_ to transfer Rupees funds to our root US firm and buy dollars with it to pay our partners there? x. Who will sell us USDs? Foreign Exchange offices? Firms like Accu-Rate? x. What is the tax situation in US for non-citizens? x. Is US the best place to start such a firm, primary need is to be able to pay dollars to US partner, while earning in rupees, without any legal hassles. Any help will be appreiciated, Best, Vipul -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

Re: Symantec's claim.
by cvhd＠indyweb.net 17 Dec '03

17 Dec '03

At 03:45 PM 11/25/96 +0200, you wrote: >In light of recent claims,i would like somebody to clear this up for me. I'll try... >There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. >Symantec denies it's existence,although i hear differently?? You "hear" incorrectly... >Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt >usually deal with this topic of thought ;) That's correct. Try subscribing to the the Virus List Digest for this type of information. >Anyone come across the pkz300 trojan,if you have it send it please. Yeah, Right... >A student,a paper,and a possible future career are at stake here,so please dig deep into your >pockets!!!!!! Asking a lot i know! Well, gee since a student, a paper and a possible future career are at stake, here goes.... __________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Internet Hoaxes: PKZ300, Irina, Good Times, Deeyenda, Ghost November 20, 1996 15:00 GMT Number H-05 ______________________________________________________________________________ PROBLEM: This bulletin addresses the following hoaxes and erroneous warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and Ghost.exe PLATFORM: All, via e-mail DAMAGE: Time lost reading and responding to the messages SOLUTION: Pass unvalidated warnings only to your computer security department or incident response team. See below on how to recognize validated and unvalidated warnings and hoaxes. ______________________________________________________________________________ VULNERABILITY New hoaxes and warnings have appeared on the Internet and old ASSESSMENT: hoaxes are still being cirulated. ______________________________________________________________________________ Introduction ============ The Internet is constantly being flooded with information about computer viruses and Trojans. However, interspersed among real virus notices are computer virus hoaxes. While these hoaxes do not infect systems, they are still time consuming and costly to handle. At CIAC, we find that we are spending much more time de-bunking hoaxes than handling real virus incidents. This advisory addresses the most recent warnings that have appeared on the Internet and are being circulated throughout world today. We will also address the history behind virus hoaxes, how to identify a hoax, and what to do if you think a message is or is not a hoax. Users are requested to please not spread unconfirmed warnings about viruses and Trojans. If you receive an unvalidated warning, don't pass it to all your friends, pass it to your computer security manager to validate first. Validated warnings from the incident response teams and antivirus vendors have valid return addresses and are usually PGP signed with the organization's key. PKZ300 Warning ============== The PKZ300 Trojan is a real Trojan program, but the initial warning about it was released over a year ago. For information pertaining to PKZ300 Trojan reference CIAC Notes issue 95-10, that was released in June of 1995. http://ciac.llnl.gov/ciac/notes/Notes10.shtml The warning itself, on the other hand, is gaining urban legend status. There has been an extremely limited number of sightings of this Trojan and those appeared over a year ago. Even though the Trojan warning is real, the repeated circulation of the warning is a nuisance. Individuals who need the current release of PKZIP should visit the PKWARE web page at http://www.pkware.com. CIAC recommends that you DO NOT recirculate the warning about this particular Trojan. Irina Virus Hoax ================ The "Irina" virus warnings are a hoax. The former head of an electronic publishing company circulated the warning to create publicity for a new interactive book by the same name. The publishing company has apologized for the publicity stunt that backfired and panicked Internet users worldwide. The original warning claimed to be from a Professor Edward Pridedaux of the College of Slavic Studies in London; there is no such person or college. However, London's School of Slavonic and East European Studies has been inundated with calls. This poorly thought-out publicity stunt was highly irresponsible. For more information pertaining to this hoax, reference the UK Daily Telegraph at http://www.telegraph.co.uk. Good Times Virus Hoax ===================== The "Good Times" virus warnings are a hoax. There is no virus by that name in existence today. These warnings have been circulating the Internet for years. The user community must become aware that it is unlikely that a virus can be constructed to behave in the manner ascribed in the "Good Times" virus warning. For more information related to this urban legend, reference CIAC Notes 95-09. http://ciac.llnl.gov/ciac/notes/Notes09.shtml Deeyenda Virus Hoax =================== The "Deeyenda" virus warnings are a hoax. CIAC has received inqueries regarding the validity of the Deeyenda virus. The warnings are very similar to those for Good Times, stating that the FCC issued a warning about it, and that it is self activating and can destroy the contents of a machine just by being downloaded. Users should note that the FCC does not and will not issue virus or Trojan warnings. It is not their job to do so. As of this date, there are no known viruses with the name Deeyenda in existence. For a virus to spread, it must be executed. Reading a mail message does not execute the mail message. Trojans and viruses have been found as executable attachments to mail messages, but they must be extracted and executed to do any harm. CIAC still affirms that reading E-mail, using typical mail agents, can not activate malicious code delivered in or with the message. Ghost.exe Warning ================= The Ghost.exe program was originally distributed as a free screen saver containing some advertising information for the author's company (Access Softek). The program opens a window that shows a Halloween background with ghosts flying around the screen. On any Friday the 13th, the program window title changes and the ghosts fly off the window and around the screen. Someone apparently got worried and sent a message indicating that this might be a Trojan. The warning grew until the it said that Ghost.exe was a Trojan that would destroy your hard drive and the developers got a lot of nasty phone calls (their names and phone numbers were in the About box of the program.) A simple phone call to the number listed in the program would have stopped this warning from being sent out. The original ghost.exe program is just cute; it does not do anything damaging. Note that this does not mean that ghost could not be infected with a virus that does do damage, so the normal antivirus procedure of scanning it before running it should be followed. History of Virus Hoaxes ======================= Since 1988, computer virus hoaxes have been circulating the Internet. In October of that year, according to Ferbrache ("A pathology of Computer Viruses" Springer, London, 1992) one of the first virus hoaxes was the 2400 baud modem virus: SUBJ: Really Nasty Virus AREA: GENERAL (1) I've just discovered probably the world's worst computer virus yet. I had just finished a late night session of BBS'ing and file treading when I exited Telix 3 and attempted to run pkxarc to unarc the software I had downloaded. Next thing I knew my hard disk was seeking all over and it was apparently writing random sectors. Thank god for strong coffee and a recent backup. Everything was back to normal, so I called the BBS again and downloaded a file. When I went to use ddir to list the directory, my hard disk was getting trashed again. I tried Procomm Plus TD and also PC Talk 3. Same results every time. Something was up so I hooked up to my test equipment and different modems (I do research and development for a local computer telecommunications company and have an in-house lab at my disposal). After another hour of corrupted hard drives I found what I think is the world's worst computer virus yet. The virus distributes itself on the modem sub- carrier present in all 2400 baud and up modems. The sub-carrier is used for ROM and register debugging purposes only, and otherwise serves no othr (sp) purpose. The virus sets a bit pattern in one of the internal modem registers, but it seemed to screw up the other registers on my USR. A modem that has been "infected" with this virus will then transmit the virus to other modems that use a subcarrier (I suppose those who use 300 and 1200 baud modems should be immune). The virus then attaches itself to all binary incoming data and infects the host computer's hard disk. The only way to get rid of this virus is to completely reset all the modem registers by hand, but I haven't found a way to vaccinate a modem against the virus, but there is the possibility of building a subcarrier filter. I am calling on a 1200 baud modem to enter this message, and have advised the sysops of the two other boards (names withheld). I don't know how this virus originated, but I'm sure it is the work of someone in the computer telecommunications field such as myself. Probably the best thing to do now is to stick to 1200 baud until we figure this thing out. Mike RoChenle This bogus virus description spawned a humorous alert by Robert Morris III : Date: 11-31-88 (24:60) Number: 32769 To: ALL Refer#: NONE From: ROBERT MORRIS III Read: (N/A) Subj: VIRUS ALERT Status: PUBLIC MESSAGE Warning: There's a new virus on the loose that's worse than anything I've seen before! It gets in through the power line, riding on the powerline 60 Hz subcarrier. It works by changing the serial port pinouts, and by reversing the direction one's disks spin. Over 300,000 systems have been hit by it here in Murphy, West Dakota alone! And that's just in the last 12 minutes. It attacks DOS, Unix, TOPS-20, Apple-II, VMS, MVS, Multics, Mac, RSX-11, ITS, TRS-80, and VHS systems. To prevent the spresd of the worm: 1) Don't use the powerline. 2) Don't use batteries either, since there are rumors that this virus has invaded most major battery plants and is infecting the positive poles of the batteries. (You might try hooking up just the negative pole.) 3) Don't upload or download files. 4) Don't store files on floppy disks or hard disks. 5) Don't read messages. Not even this one! 6) Don't use serial ports, modems, or phone lines. 7) Don't use keyboards, screens, or printers. 8) Don't use switches, CPUs, memories, microprocessors, or mainframes. 9) Don't use electric lights, electric or gas heat or airconditioning, running water, writing, fire, clothing or the wheel. I'm sure if we are all careful to follow these 9 easy steps, this virus can be eradicated, and the precious electronic flui9ds of our computers can be kept pure. ---RTM III Since that time virus hoaxes have flooded the Internet.With thousands of viruses worldwide, virus paranoia in the community has risen to an extremely high level. It is this paranoia that fuels virus hoaxes. A good example of this behavior is the "Good Times" virus hoax which started in 1994 and is still circulating the Internet today. Instead of spreading from one computer to another by itself, Good Times relies on people to pass it along. How to Identify a Hoax ====================== There are several methods to identify virus hoaxes, but first consider what makes a successful hoax on the Internet. There are two known factors that make a successful virus hoax, they are: (1) technical sounding language, and (2) credibility by association. If the warning uses the proper technical jargon, most individuals, including technologically savy individuals, tend to believe the warning is real. For example, the Good Times hoax says that "...if the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop which can severely damage the processor...". The first time you read this, it sounds like it might be something real. With a little research, you find that there is no such thing as an nth-complexity infinite binary loop and that processors are designed to run loops for weeks at a time without damage. When we say credibility by association we are referring to whom sent the warning. If the janitor at a large technological organization sends a warning to someone outside of that organization, people on the outside tend to believe the warning because the company should know about those things. Even though the person sending the warning may not have a clue what he is talking about, the prestigue of the company backs the warning, making it appear real. If a manager at the company sends the warning, the message is doubly backed by the company's and the manager's reputations. Individuals should also be especially alert if the warning urges you to pass it on to your friends. This should raise a red flag that the warning may be a hoax. Another flag to watch for is when the warning indicates that it is a Federal Communication Commission (FCC) warning. According to the FCC, they have not and never will disseminate warnings on viruses. It is not part of their job. CIAC recommends that you DO NOT circulate virus warnings without first checking with an authoritative source. Authoritative sources are your computer system security administrator or a computer incident advisory team. Real warnings about viruses and other network problems are issued by different response teams (CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by the sending team using PGP. If you download a warning from a teams web site or validate the PGP signature, you can usually be assured that the warning is real. Warnings without the name of the person sending the original notice, or warnings with names, addresses and phone numbers that do not actually exist are probably hoaxes. What to Do When You Receive a Warning ===================================== Upon receiving a warning, you should examine its PGP signature to see that it is from a real response team or antivirus organization. To do so, you will need a copy of the PGP software and the public signature of the team that sent the message. The CIAC signature is available from the CIAC web server at: http://ciac.llnl.gov If there is no PGP signature, see if the warning includes the name of the person submitting the original warning. Contact that person to see if he/she really wrote the warning and if he/she really touched the virus. If he/she is passing on a rumor or if the address of the person does not exist or if there is any questions about theauthenticity or the warning, do not circulate it to others. Instead, send the warning to your computer security manager or incident response team and let them validate it. When in doubt, do not send it out to the world. Your computer security managers and the incident response teams teams have experts who try to stay current on viruses and their warnings. In addition, most anti-virus companies have a web page containing information about most known viruses and hoaxes. You can also call or check the web site of the company that produces the product that is supposed to contain the virus. Checking the PKWARE site for the current releases of PKZip would stop the circulation of the warning about PKZ300 since there is no released version 3 of PKZip. Another useful web site is the "Computer Virus Myths home page" (http://www.kumite.com/myths/) which contains descriptions of several known hoaxes. In most cases, common sense would eliminate Internet hoaxes. - ----------------------------------------------------------------------------- CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 510-422-8193 FAX: +1 510-423-8002 STU-III: +1 510-423-2604 E-mail: ciac(a)llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC duty person, and the secondary PIN number, 8550074 is for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://ciac.llnl.gov/ Anonymous FTP: ciac.llnl.gov (128.115.19.53) Modem access: +1 (510) 423-4753 (28.8K baud) +1 (510) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. CIAC-NOTES for Notes, a collection of computer security articles; 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 4. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called ListProcessor, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or SPI-NOTES for list-name and valid information for LastName FirstName and PhoneNumber when sending E-mail to ciac-listproc(a)llnl.gov: subscribe list-name LastName, FirstName PhoneNumber e.g., subscribe ciac-notes OHara, Scarlett W. 404-555-1212 x36 You will receive an acknowledgment containing address, initial PIN, and information on how to change either of them, cancel your subscription, or get help. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver(a)first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) G-43: Vulnerabilities in Sendmail G-44: SCO Unix Vulnerability G-45: Vulnerability in HP VUE G-46: Vulnerabilities in Transarc DCE and DFS G-47: Unix FLEXlm Vulnerabilities G-48: TCP SYN Flooding and IP Spoofing Attacks H-01: Vulnerabilities in bash H-02: SUN's TCP SYN Flooding Solutions H-03: HP-UX_suid_Vulnerabilities H-04: HP-UX Ping Vulnerability RECENT CIAC NOTES ISSUED (Previous Notes available from CIAC) Notes 07 - 3/29/95 A comprehensive review of SATAN Notes 08 - 4/4/95 A Courtney update Notes 09 - 4/24/95 More on the "Good Times" virus urban legend Notes 10 - 6/16/95 PKZ300B Trojan, Logdaemon/FreeBSD, vulnerability in S/Key, EBOLA Virus Hoax, and Caibua Virus Notes 11 - 7/31/95 Virus Update, Hats Off to Administrators, America On-Line Virus Scare, SPI 3.2.2 Released, The Die_Hard Virus Notes 12 - 9/12/95 Securely configuring Public Telnet Services, X Windows, beta release of Merlin, Microsoft Word Macro Viruses, Allegations of Inappropriate Data Collection in Win95 Notes 96-01 - 3/18/96 Java and JavaScript Vulnerabilities, FIRST Conference Announcement, Security and Web Search Engines, Microsoft Word Macro Virus Update C.V.H.D. Lord, grant me the serenity to accept the things I cannot change, the courage to change the things I can, and the wisdom to hide the bodies of the people I had to kill because they pissed me off!

2 1

SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by sameer 17 Dec '03

17 Dec '03

For Release November 25, 1996 C2Net Contact: Douglas Barnes, +1 510 986 8770 UK Web Contact: Dave Williams, +44 0113 222 0046 SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE Oakland, CA -- C2Net and UK Web, Ltd., announced today the beta release of a new product, "SafePassage Web Proxy." International users of popular web browsers such as Netscape or Microsoft Internet Explorer can use SafePassage to make secure web connections using full-strength cryptography. Prior to this release, international users of these browsers had to use weak cryptography, which could be easily broken. "SafePassage is the perfect complement to our Stronghold web server," said Mark Cox, Stronghold Product Manager for UK Web. "we've been marketing the international version of Stronghold with full strength cryptography for two months now, but we knew we would need matching strong cryptography on the browser side as well. SafePassage Web Proxy answers this need." SafePassage provides secure connections using strong cryptography for any browser that supports standard SSL tunneling. It currently runs on Windows 3.1 and Windows 95. "We don't believe in using codes so weak that foreign governments, criminals or bored college students can break them," said C2Net President Sameer Parekh, "we also oppose plans to put all your cryptography keys in a few places, where they can be sold to the highest bidder by traitors like Aldrich Ames, or recent suspect Harold J. Nicholson." Current "export" versions of Netscape and MSIE use a weak cipher that has been broken by online groups, such as the "Cypherpunks." Companies like HP and IBM, bowing to government pressure, have been promoting seemingly innocuous "key recovery" plans that would require centralized key storage and easy government access to -- or abuse of -- cryptography keys. Beta versions of SafePassage can be downloaded at no cost from UK Web's site at: http://stronghold.ukweb.com/safepassage. It is currently unavailable for distribution within the US and Canada, but a domestic version will be made available in the near future. The final release will be free for personal, educational, or other non-commercial use; for information on site licenses and bundling, send e-mail to safepassage(a)c2.net; or by phone, contact Douglas Barnes at +1 510 986 8773, or Dave Williams at +44 0113 222 0046. UK Web Limited is a leading Internet services company specialising in server technology, Internet security, business solutions and effective site design. C2Net is the leading provider of uncompromising security on the Internet. C2Net provides a wide array of Internet privacy services and powerful network security software. Netscape Navigator and Netscape Enterprise are trademarks of Netscape Communications Corporation. Microsoft Internet Explorer and Microsoft Internet Information Server are trademarks of Microsoft Corporation. Stronghold and SafePassage are trademarks of C2Net.

2 1

Where do I send this to get them stopped?
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, How can we stop such aweful programs? Is there a group I can send this to who trouble shoots spam? thanks, -lile (a webmaster(a)art.net) ----- Begin Included Message ----- >From 10ehnmugs6l6(a)MAIL-CLUSTER.PCY.MCI.NET Sun Nov 24 11:40:48 1996 Date: Sun, 24 Nov 1996 12:45:02 +0000 From: Emerald(a)earthstar.com Subject: FREE demo To: Emerald11249601(a)MAIL-CLUSTER.PCY.MCI.NET Reply-to: Emerald(a)earthstar.com MIME-version: 1.0 X-Mailer: Pegasus Mail for Windows (v2.32) Content-Type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Priority: normal Comments: Authenticated sender is <10ehnmugs6l6(a)mail14.MCI2000.com> Content-Length: 175 Are you interested in sending bulk e-mails? I know of a great new program! You can even test out the demo for FREE! Send me an e-mail for more details. Emerald(a)earthstar.com ----- End Included Message -----

1 0

(Fwd) New Mersenne Prime!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- New Mersenne Prime! 2^1398269-1 is prime! ------------------------------------------ Thanks to everyone's hard work, GIMPS (Great Internet Mersenne Prime Search) has discovered the 35th known Mersenne Prime! Joel Armengaud made the discovery on November 13. Amazingly, he kept this secret while he double-checked the find on two other computers. On the 18th, he notified Richard Crandall, Chris Caldwell, and myself. I verified it on my machine on the 20th. Slowinski, who was out of town at the time, provided the independent verification on the 22nd. More information can be found at these three web sites: http://www.sjmercury.com/business/compute/prime1122.htm http://ourworld.compuserve.com/homepages/justforfun/1398269.htm http://www.utm.edu/research/primes/notes/1398269.html As had been agreed upon before hand, credit for this new prime will go to Armengaud, Woltman, et. al. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Pyramid schemes and cryptoanarchy
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 11:23 AM 11/10/96 -0500, clay.olbon(a)dynetics.com wrote: >It seems that pyramid scheme spamming has increased of late (if that is >possible!). In my lifetime, I can only remember a single snail-mail >instance of a pyramid scheme - over the net it is an entirely different >story (although the number of instances is probably proportional to the >number of lists I subsribe to). With fully anonymous digital cash will come >the ability to develop untraceable pyramid schemes. As a staunch believer >in the free market, I find laws against these schemes distasteful, quite >hypocrytical (i.e. Social Security), and soon to be unenforceable. Aside from illegality, snail-mail pyramid spamming is rare because it costs enough money per piece of mail that it's hard to make money given the fraction of recipients who are both suckers and not too lazy to respond. Email, on the other hand, is cheap, and sending large quantities is easy. So you can expect to see a lot more email pyramid spamming, and electronic money, whether digicash or traceable, will make it more popular. On the other hand, I don't see anonymity helping it much - to the extent that the public understands it, they'll realize that the people higher up on the pyramid may all be tentacles, and they've got to mail out an address that's "theirs" to collect any money from lower-down suckers. Dealing with complexity tends to encourage clues, or at least delay, which is death for most pyramid scams. Pyramid schemes benefit more from traceable cash and non-anonymous suckers who can be targeted for later scams. Multi-level marketing reacts interestingly with the Internet. Where it's relatively legitimate, rather than a scam, it's a scaleable way for a company to hire a bunch of sales people that grows about as fast as the sales of the product, who don't have to be paid if sales drop off, and pay for advertising through sales people and word-of-mouth rather than expensive broadcasting. The Internet and electronic communication in general encourage small, flexible niche businesses that grow, sell stuff, and close. So MLM is useful for them, especially if their product is physical stuff rather than bits, and lower transaction costs make it easier to pay the sales people (either anonymously or taxably....) On the other hand, lower transaction costs make it easy to broadcast and deliver information to potential customers and deliver stuff by NextDayAir, and of course you can deliver bits for almost-free. So MLM probably won't work well for commodities with competing suppliers, like phone cards, soap, and high-tech motor oil, but may survive for products where personal recommendations are important, like Super Blue-Green Algae and Smart Drugs, (where the sales rep and customer know each other and anonymity at most keeps out greedy tax collectors and meddling FDA censors) or where the sales person performs some useful part of the process, like made-to-measure lingerie or direct personal loan collections. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

Provably "Secure" Crypto (was: IPG Algorithm Broken!)
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Our friend Don Woods seems to have inadvertently sparked what could be a useful and serious discussion regarding "provably secure cryptography." Not to be confused with the usual "unbreakable" snake oil we see peddled so often, I refer to systems for which rigorous mathematical proof that "there are no shortcuts" exists. To my knowledge, no such systems, with the exception of a real one-time pad, exist today. However, I also under the impression that ongoing research on this topic continues. For example, consider the work being done on "Lattice" cryptosystems (see http://jya.com/lattice.htm) "diGriz" is right. Nothing precludes the existence of a cryptographic algorithm for which a rigorous mathematical proof of "security" exists --- where "security" means a provable lower bound on the time required for recovery of the key. Indeed, it seems that finding such an algorithm --- or providing the necessary rigorous proof for a current algorithm --- is a laudable goal of academic cryptographic research. Rigorous proofs of the non-existence of an algorithm are not new. Neither are rigorous proofs that any algorithm which can solve a given problem requires a minimal running time. Or, in an even stronger sense, that a particular known algorithm for a given problem is indeed a (provably) optimal algorithm for that problem. For a (non-cryptographic) example of a proof of the first sort --- that is, that "there exists no algorithm" --- consider the famous "Halting Problem" for Turing machines. (I believe someone else has also mentioned this.) There are many proofs such as this one, often related, though the Halting Problem itself is perhaps the most famous example. For an (again, non-cryptographic) example of a proof of the second sort --- that is, that "any algorithm that solves a given problem requires a minimal running time" --- consider the proof that the "minimal" number of key comparisons in the worst case required to sort a random list of elements for which only an ordering relationship is known is O(nlog(n)). See Knuth, Volume 3, section 5.3. For a simpler example, a standard "binary" search which requires O(log(n)) comparisons to find a given element in the worst case is provably the optimal algorithm for this task. Turning once again to cryptography, there is presumably an "optimal" algorithm for factoring a "general" number in the "worst" case. Of course, known algorithms for factorization seem to regularly improve and no one has even suggested that any current algorithm is (provably) the "optimal" algorithm. Worse case bounds on running time for currently known algorithms can certainly be produced, but no one currently knows if these are the best algorithms. However, just as one can say, "How do you know that tomorrow some brilliant mathematician will not produce a polynomial time factorization algorithm?" one can also say, "How do you know that tomorrow some brilliant mathematician will not provide a rigorous proof that all factorization algorithms --- in the worse case --- require some specified minimal running time?" While the current state of mathematical knowledge suggests that this is not likely to happen anytime soon for the factorization problem, it is encouraging to see work in areas where more rigorous proofs of security are within closer reach. Again, I refer to work on Lattice problems. If the types of rigorous proof regarding "what can't be done" that are known for the Halting Problem, sorting, and searching are available for cryptographic problems, then this is indeed a major (and laudable) advance in cryptography. Obviously, discussion on this topic is unrelated to such security problems as implementation mistakes, fault analysis, outright theft of keys, etc. I hope that I've been careful to explain what I mean by "provably secure" and that it's not interpreted to include these types of attacks. I'm interested in the current state of research (if any) on this topic. Other than what John Young sent to the list some time ago about Lattice stuff --- which is certainly far from prime time --- I've not seen anything else. I also haven't devoted a lot of time to looking. Relevant pieces of the earlier thread are included below. Comments, anyone? Dana W. Albrecht dwa(a)corsair.com ---------------------------------------------------------------------------- Eric Murray <ericm(a)lne.com> writes: > Don Wood <wichita(a)cyberstation.net> writes: > > Do not belive it, it will never happen. It is impossible, and we can > > prove it to your satisfaction. > > No, you can't. It's impossible to prove an algorithim unbreakable. > You can only say that it hasn't been broken yet, but you can't > predict the advances in cryptoanalysis. > > If, in two or three years, no one's broken it then maybe it'll seem > like a reasonably-secure algorithim. Of course when someone does break > it you'll just say "oh, that wasn't the real algorithim" like you did > last time. [ Snip ] > You can't prove a negative. The best IPG could say is that > it can't be broken with current technology. > Next week someone might come up with a new way > to break ciphers that renders the IPG algorithim breakable. > > You point could have been that the same problem exists > for proofs- that next week someone could come up > with a way to prove, for all time, that an algorithim > really IS unbreakable. So, to cover that posibility > I should have said "it's currently impossible to > prove an algorithim unbreakable". :-) ---------------------------------------------------------------------------- "diGriz" anonymously writes: > The good news is that you can prove a negative. For example, it has > been proven that there is no algorithm which can tell in all cases > whether an algorithm will stop. [ Snip ] > The best they can say is what they did say: they have a proof that > their system is unbreakable. What you question, quite reasonably, > is whether they have such a proof. [ Snip ] > Or, more accurately, nobody credible has seen such a proof. But, a > clever person might invent one. ---------------------------------------------------------------------------- The Deviant <deviant(a)pooh-corner.com> writes: > No, he was right. They can't prove that their system is unbreakable. > They _might_ be able to prove that their system hasn't been broken, and > they _might_ be able to prove that it is _unlikely_ that it will be, but > they *CAN NOT* prove that it is unbreakable. This is the nature of > cryptosystems. > > > >The best IPG could say is that > > >it can't be broken with current technology. > > >Next week someone might come up with a new way > > >to break ciphers that renders the IPG algorithim breakable. > > > > The best they can say is what they did say: they have a proof that > > their system is unbreakable. What you question, quite reasonably, > > is whether they have such a proof. > > It is impossible to prove such a thing. It's like saying you have proof > that you have the last car of a certain model ever to be built. Anybody > could come along and build another, and then you don't have the last one. > > > > > >You point could have been that the same problem exists > > >for proofs- that next week someone could come up > > >with a way to prove, for all time, that an algorithim > > >really IS unbreakable. So, to cover that posibility > > >I should have said "it's currently impossible to > > >prove an algorithim unbreakable". :-) > > > > Or, more accurately, nobody credible has seen such a proof. But, a > > clever person might invent one. > > There *IS NO SUCH PROOF*. Just like you can't prove that god created the > universe, or that Oswald shot Kennedy, and so on and so forth. It can't > be proven. It never has been proven, and it never will be proven. People > have new ideas, new algorithms are invented. Someday, somebody will crack > _all_ the cryptosystems that have now been invented. [ Snip ] > diGriz anonymous writes: > > At 6:56 PM 11/23/1996, The Deviant wrote: > > >No, he was right. They can't prove that their system is unbreakable. > > >They _might_ be able to prove that their system hasn't been broken, and > > >they _might_ be able to prove that it is _unlikely_ that it will be, but > > >they *CAN NOT* prove that it is unbreakable. This is the nature of > > >cryptosystems. > > > > Please prove your assertion. > > > > If you can't prove this, and you can't find anybody else who has, why > > should we believe it? > > Prove it? Thats like saying "prove that the sun is bright on a sunny > day". Its completely obvious. If somebody has a new idea on how to > attack their algorithm, it might work. Then the system will have been > broken. You never know when somebody will come up with a new idea, so the > best you can truthfully say is "it hasn't been broken *YET*". As I > remember, this was mentioned in more than one respected crypto book, > including "Applied Cryptography" (Schneier). ---------------------------------------------------------------------------- "diGriz" Anonymously responds: > Page number? > > Perhaps it would be helpful to hear a possible proof. If somebody > were to show that breaking a certain cryptographic algorithm was > NP-complete, many people would find this almost as good as proof that > the algorithm is unbreakable. > > Then if a clever person were to show that the NP-complete problems > were not solvable in any faster way than we presently know how, you > would have proof that a cryptographic algorithm was unbreakable. > > There is no obvious reason why such a proof is not possible. > > diGriz

8 7

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

>Is the concept here that: Whereas conventional crypto generates/hashes >a *key* with which to encode the text, IPG generates a *pad* from a key, >more or less the length of the text, with which to encode the text?? It makes no difference whatsoever, no PRNG can have more entropy in the output stream than there was in the initial seed. Indeed, in general, the longer the PRNG runs for the more chance an adversary has of breaking it due to an increased amount of output. >It seems to me they're putting an additional layer of stuff ("OTP") between >the key generation and the actual encoding, so what's the problem with that, >as a concept? Well for a start it`s not a one time pad because that requires a totally real random pad. They have a stream cipher, as for whether it is any good or not I would normally not trust a man with the talent for bullshit Don Wood has. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

4 3

Anarcho-Science Fiction
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:08 am -0500 11/24/96, Roy M. Silvernail wrote: >[ I freely admit this is noise ] Yeah. What he said. >C'mon, both of you... 'First Contact' falls _way_ short of Doc Smithean >proportions. Although Data's charade did kinda remind me of the fourth >Skylark book, in terms of plot-device rescue of a failing direction. >(IMHO, Doc Smith is the master of the over-the-top school of sci-fi >plotting) Unfortunately, I've had trouble sticking my tounge in my cheek far enough for people to see it lately. My apologies. >> Even Babylon 5, AKA "Science Fiction He Wrote", has a bigger clue. > >B5 is my current favorite TV sci-fi, when I even turn the damned thing >on. Ditto. Again, I was trying so hard to be facile that I wasn't clear enough. :-). For all the constraints of televised science fiction, I *really* like JMS and B5. Especially compared to the pseudoscientific sugar-coated totalitarian happy horseshit that passes for Star "Treck" these days. Much less such scienceless silliness as the X-Files, or Lois and Clark. However, at the risk of being forced into the trap of science fiction which tells more about when it was written than the future, I find the presentation in science fiction of faster-than-light travel, "alien" visits or travel to "alien" cultures, time travel, prophecy, telepathy, (or any other pseudomystical claptrap) to be extremely annoying. Almost as annoying as "fantasy", which doesn't even belong near the science fiction bookrack (how about the "romance novels" section? ;-)). Much less, a science fiction bookstore. For instance, I think the concepts of faster-than-light travel and anything beyond rudimentary interstellar radio reception of other civilizations belongs in the era of the Lensman's "inertialess" drive. An almost pretelegraphic, age-of-sail world view, developd when sea power was still the dominant form of "projecting" force. However, I do look forward to science fiction with cryptoanarchic economies, and, interestingly enough, a solarcentric universe. People just don't understand that we have a monsterous amount of undeveloped physical resources in this solar system. I expect that when we actually look down with any accuracy on the moon's poles, for instance, we'll find water buried there ("where the sun don't shine" as a friend put it a few days ago), just like it is on Murcury. The belt alone is big enough for us to spread out into into it for the next, say, 7000 years. That's at the human species' historic argicultural and industrial growth rates, the very same "frighteningly asymtotic" growth rates that had the Club of Rome gibbering hysterically in the early 70's. Before, of course, we came to our senses and remembered that Malthus is still quite dead. A central fact of human existance is that progress is always more "geometric" than population growth. Every time we discover a way to extend human life expectancy, the population grows until everyone goes through a demographic transition and figures out they don't have to breed so much to get the same rewards out of life anymore. We're humans. We build stuff. We always find new resources, and we always use them to our own advantage. So, what else is new? The extinction rates that happen and the habitat modifications that humans *always* make when they take over a new ecosystem have been with us ever since we had the ability to kill at a distance and use fire. A very long time. Modern humans grew up living on savannahs, so they cut or burn down forests so they can hunt game or grow food. (Or suburban lawns, for that matter.) The aborigines burned their habitat for 40,000 years. The American prairies have evolved to burn, a process immesurably accellerated by the active burning by 14,000 years of humans. Fortunately, we're about to be confronted with our toughest resource challenge yet. An "ecosystem", or more properly, a set of ecosystems, that we're going to have to build ourselves, from scratch, outside the earth's atmosphere, either free-floating in space, or on the surface of an inhospitable planet. I used to think that that will mean that we would then use the opportunity to "save" the rest of the species of this planet from certain extinction. Earth as biopark. Now I see that kind of thinking is pure romantic hogwash. We are not anti-nature. We *are* nature. We will do what it takes for us to survive, like any other species. Earth will not be "saved", it will continue to be modified to our own needs. Because, like the metaphorical dog, we can. <ewww!!!> :-). We may not make the same disaster of it that we made of the Tigris-Euphrates valleys or the Southeastern Mediterranean, but the "conserving" nature is an oxymoron. Or maybe even a tautology. Anyway, this also means taking other species with us when we move off the earth, and changing those species, and ourselves, to meet the physical conditions of survival in a new paradigm of extraterrestrial resources. By way of my own politically correct "reclaiming" of language, I mean "extraterrestrial resources" literally, of course. Not "extraterrestrial" as in ETs or BEM's, or LGM's or UFO's, or any other such "alien" bunk. I'm carving my own crop circles into the landscape of pseudoscience, if you will, ;-), and using "extraterrestrial" to mean just what it says: off the earth. Speaking of other "species", I now also see the technology of cryptofinance to be integral to this next stage of human expansion. Centralized industrial control regimes aren't suited to extremely decentralized automated decisions, like the kind that could happen in a micromarket. I think that eventually, the idea of micromoney as processor food will create the economic efficiencies necessary to coordinate the very large macroengineering projects that extraterrestrial existance will require. If you can use cryptofinancial controls to organize a swarm of habitat-building bots, then your structure appears to an observer like it's building itself. The bots work because they're paid to. They "evolve" into more efficient builders of stuff because they make more money when they do, and they compete with each other to do it. By the same token, the money is not raised by some kind of central financial "action-figure" like McNamara, or William Sword, or J. Pierpont Morgan, (and especially not a World Bank McNamara-mandarin) but by a swarm of millions (or billions) of finance-bots of various kinds living throughout a geodesic economy looking for places to park their excess cash. Central project planning considers such competition wasteful, and the paradox is that the Misian calculation argument holds for a manager of a macroenterprise the same way it did for any Soviet Commisar. Sooner or later, you can't figure it all out in enough detail to execute it, and that's where the project stops. I think we'll step through this dilemma into a world where everything is, as Kevin Kelly says, "Out of Control", where stuff happens not because someone planned it down to the last detail, but because, like the above dog, it can <ewwww!>. So, what does that mean in terms of science fiction? Well, certainly Stevenson understands all this, only he's not as much of a space-opera hound as I am. Sterling's "Schismatrix" handles extraterrestrial society fairly well, but it certainly is pre-cryptoanarchy. I didn't like "Islands in the Net" even though it had the same theme of taking someone out of their mileu and stopping time around them while the world passed them by. In IitN, the heroine was being captured by guerillas, in Schmatrix, it was kidnapping and putting people in suspended animation for a decade or two, just for kicks. Frankly, protocrypto or no, Vinge strikes me as more than a little silly at times, with stasis fields, and physical constants varying with your distance from the galactic core, and talking dogs and all that other stuff. Cherryh writes almost perfect space opera, among other things, and I see her as a perfect decendant of Smith and Heinlein. People I think I now lump in with Forrester's classic "Hornblower" novels. I really like Ian Banks, but even his ideas and certainly his politics (and not his story telling, of course) now pales in comparison to the stuff you get from imagining the consequences of a geodesic economy. Gibson now seems positively industrial, and even the Difference Engine makes perfect sense when seen in this light... One of the reasons I don't like science fiction anymore is that, like a lot of people here have said about themselves, and for the first time in my life, I'm out in front of the science fiction writers on something which is so fundemental that, frankly, their stuff now makes me laugh. This from someone who not too long ago read science fiction by the yard. I suppose this will eventually make me want to evangelize stuff like cryptoanarchy, financial cryptography, and micromoney mitochondria to science fiction authors. Or, maybe, just by shooting our mouths off here and by being archived doing so, all of us already have done our evangelizing. On the other hand, some day this stuff will be old hat, and I can go back to buying science fiction by the yard to learn about new stuff. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Skipjack patent and GATT
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Since Skipjack is protected by a secrecy order, the NSA can patent the algorithm without disclosing it. As soon as it is reverse-engineered, the patent is officially issued and expires 17 years from the time it was issued. GATT now changes the patent laws so that a patent expires 20 years after application. Does anyone know how this will affect the Skipjack patent? If the secrecy order is considered application, then that would shorten the lifetime of the patent considerably (assuming it isn't disclosed or reverse- engineered any time soon). I doubt this is the case, and I suspect that either the 17 year lifetime will still apply or the patent will expire 20 years after the patent is issued. TIA. Mark - -- finger -l for PGP key PGP encrypted mail prefered. 0xf9b22ba5 now revoked -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMpoTWyzIPc7jvyFpAQFHywf8Do9Fni5GC0kfL0XR7FGM6yLhVwLNgf4h XJZlpMMML46MWmmqwjfJnCgi+ktMQMHxTT2mCYA2eIzEBq0FbAc8M9340Xkx0KPH L1qi2tQ1ZCKnUdVWYENYL65uJAk4dB3lgsnmBJwNb80GD3tP6LVSq5wFSa2pz/Pu 3HO5YNUHmTfvrtZE2wt/7CMwJNxEPTKpTGAbDnwkri6y2u2aDrUD1nhnlfzqUz86 85TNTIpqPo06d3g1wKSKmddwqYeu3kpyu0khdUzS5rjj/7sJAECLQi2IlXkXOLjo OsaKG+sl9UNSYn9wrU+HvE9BbhlmC4B1sfOHPBqJDQ405QWurQHSZg== =sRxa -----END PGP SIGNATURE-----

1 0

Re: Smart card attacks vs. clipper?
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

(snip) > Seems like it's a bit of a different story, since in the Clipper's > case the algorithm is (ostensibly) unknown, but I'm just curious as > to whether there is some compromise of its security-through-obscurity. Actually, in a more recent attack to be published at USENIX (if i remember correctly) the attack being performed can also be utilized to help determine unknown algorithms. I will try to dig up the reference (unless someone gets to it first). Matt > -- > ______c_________________________________________________________________ > Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that > mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data > http://www.io.com/~m101/ * processing" are different! > >

1 0

Donate your spare cycles to a good cause
by Lucky Green 17 Dec '03

17 Dec '03

It's that time of year. Please donate the spare cycles on your Pentium or PowerPC to a good cause and help find a new Mersenne prime while you sleep. See http://ourworld.compuserve.com/homepages/justforfun/range.htm for details. Seriously, folks, what is your PC's CPU doing half the time? I thought so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

1 0

Re: Exon Countdown Clock and farewell messages
by azur＠netcom.com 17 Dec '03

17 Dec '03

This is a draft of my letter to our dear retiring senator. Any suggested improvements? ------------- Honorable Senator Exon, Although in all likelyhood you will never read this memorandum, I wish to express my sincere regret at your retirement and thanks for your many years of ignoble service to our nation misrepresenting the wishes of your constituents. You have served as a stallwart against change as did those who resisted the telephone, automobile, radio, television and computer (to name but a few) before you. You are a champion of politically correct thinking and behaviour, perhaps the most dangerous manifestation of an American trend to intolerence and obedience to social rules. It is a shame we will not have your carcass to kick around in the halls of Congress come next term. All the luck you're due. -- Steve Schear

2 1