December 2003 - cypherpunks-legacy

Re: hmmm, port 25
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

nutty elf writes, from tower.stc.housing.washington.edu, the message below. If I'd been watching recently for postings from that machine, I could point out who he probably was..... > From toad.com!owner-cypherpunks(a)ig1.att.att.com Sun Jan 22 03:18:20 1995 > Return-Path: <toad.com!owner-cypherpunks(a)ig1.att.att.com> > Received: from ig1.att.att.com by anchor.ho.att.com (4.1/EMS-1.1.1 SunOS) > id AA28663; Sun, 22 Jan 95 03:18:19 EST > Received: from att!toad.com by ig1.att.att.com id AA09271; Sun, 22 Jan 95 03:20:16 EST > Received: by gw1.att.com; Sun Jan 22 03:19:52 EST 1995 > Received: from toad.com by relay2.UU.NET with SMTP > id QQxzth02499; Sun, 22 Jan 1995 03:16:33 -0500 > Received: by toad.com id AA25129; Sun, 22 Jan 95 00:12:52 PST > Received: from northpole.org (tower.stc.housing.washington.edu) by toad.com id AA24523; Sun, 22 Jan 95 00:10:24 PST > Date: Sun, 22 Jan 95 00:09:36 PST > From: nutty_elf(a)northpole.org > Message-Id: <9501220810.AA24523(a)toad.com> > Subject: hmmm, port 25 > To: cypherpunks(a)toad.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > Status: RO > > That's strange, that last port 25 forgery didn't behave as expected. > Just checking it. > > --nutty elf >

1 0

Re: Clinton freezes U.S. assets of Mideast groups
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

> The Eurodollar market got started because Russia feared > arbitrary confiscation of its dollar bank accounts. Not actually true. It was because US banks were subject to statutory limits on the amount of interest they could pay on dollar deposits. > At present it seems to me that unix machines on the internet > are intrinsicly insecure -- the methods used to secure them > are a collection of ad hoc patches. For example all > unix machines are vulnerable to the trojan > horse attack. Banks are intrinsically insecure. All banks are subject to the "sawn-off shotgun" attack, also the "kidnap the managers family" attack and several others. > Windows NT is supposedly secure. Certainly its design makes > it possible to write software that is intrinsicly secure, Why do you think that? Certainly it's compartmentalism is better than UNIX, and as a "ground-up" design it's probably seen better QA than UNIX. However, it hasn't had 20 years of interest from hackers and others. Also, while the NT kernel may be *better*, several subsystems have all the problems of UNIX, e.g. TCP/IP and the sequence number attack. I like NT, but it will never be a security panacea. -- Richard Parratt

7 8

Re: Security of UNIX, NT, etc. (Was: Clinton Freezes...)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

James Donald writes: > > At present it seems to me that unix machines on the internet > > are intrinsicly insecure -- the methods used to secure them > > are a collection of ad hoc patches. For example all > > unix machines are vulnerable to the trojan > > horse attack. Depends on what trojan horse attack you have in mind. Well-designed B1-secure systems can get rid of most of the Trojan Horse attacks by storing the trusted computing base System Low and requiring root to only execute programs at that level, and running all users at higher classifications, like Unclassified. Since users can't write down, they can't hack the TCB, so the main opportunity for Trojan Horses is to trick trusted programs into interpreting data in dangerous ways (e.g. executable editor macros in email, or exploitation of a much smaller set of bugs than usual.) > > Windows NT is supposedly secure. <ftp://sounds.sdsu.edu/somedir/evillaugh.au> And Perry replies: > NT is about as secure as VMS was, i.e. not at all. Its just got > different bugs. As is any system that was designed for purposes other than security and had security added on. (On VMS: The C2-rated VMS systems came out somewhat before the Worms Against Nuclear Killers takeover of a NASA(?) network; it seems that being rated C2 doesn't prevent you from shipping systems with the factory-equipped SYSTEM and FIELD account passwords left alone.) > > Certainly its design makes it possible to write software that is > > intrinsicly secure, rather than creating a particular fix for each > > particular hole. > > You mean, it makes proof of security possible for real programs? > That there is a proof of security available for the NT kernel? > I'd settle for a proof of non-crashing myself. Short of that I'm > unaware of any system that is "intrinsically" secure. I thought there were systems at at least the B3 level, if not A1; Honeywell SCOMP comes to mind. Of course, all those levels are just Orange Book, and extending genuinely provable multilevel security to the multi-computer networked problem was far beyond current research when I was last current on the stuff. (They could update me, but then they'd have to kill me :-).) There was also KSOS, but I don't remember what level of security it reached. There have been B2-rated networks which let single-level machines share a LAN (Verdix VSLAN), and there's a certain level of security you can get running uucp on B1 systems, but bug-free shared networked general-purpose systems are, uh, not very common. And didn't Boeing have a high-rated fiber LAN of some sort? Actually, before networking, MS-DOS was perfectly secure. After all, there's only one User in the universe, and She is allowed to do anything She wants, however ill-advised.... Bill

1 0

Markoff/NYT on IP spoofing
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

John Markoff writes in Monday's New York Times about a rash of computer security breaches using IP spoofing to penetrate routers and firewalls. That's all the technical info I coudld glean from the story; CERT is supposed to "make an announcement" later today and tell us what brands of routers can and cannot be modified to defend against this type of attack. Towards the end of the article Markoff puts in a nice plug for crypto: Most computer security experts say that real security on the Internet awaits the widespread adoption of encryption technology for scrambling data and authenticating messages. ``The right answer is encryption because when you encrypt your business data you don't care how many people get a copy,'' said Eric Schmidt, the chief technical officer of Sun Microsystems. ``My prediction is that this will be the only real solution to these problems.'' --bal

3 4

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)204.95.228.28 This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk hash"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk pgp hash latent cut ek"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. Use "premail -getkeys remailer.help.all(a)204.95.228.28" as a stopgap to get PGP keys for the remailer, at least until Matt Ghio gets his machine situation straightened out. Fingering this address works too. Last ping: Mon 23 Jan 95 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- syrinx syrinx(a)c2.org #+ 4:59 99.14% penet anon(a)anon.penet.fi *******+**** 33:13 99.99% rebma remailer(a)rebma.mn.org _..-*.--.- 18:00:23 97.74% rahul homer(a)rahul.net ****#-** *-# 31:58 96.61% bsu-cs nowhere(a)bsu-cs.bsu.edu ***+#-#* *+* 7:18 96.59% ideath remailer(a)ideath.goldenbear.com --+---+- --- 1:57:47 96.59% alumni hal(a)alumni.caltech.edu ++-*#+-- **# 40:31 96.47% extropia remail(a)extropia.wimsey.com ++++++.. +++ 5:46:02 96.10% soda remailer(a)csua.berkeley.edu -..-.._. . 8:44:34 96.08% portal hfinney(a)shell.portal.com ##- ***- **# 20:48 95.82% mix mixmaster(a)nately.ucsd.edu +++++--+ ++ 1:01:24 95.72% nately remailer(a)nately.ucsd.edu ++++++-+ ++ 48:18 95.72% q q(a)c2.org +++--+-- + 1:41:44 95.06% usura usura(a)replay.com - +--+- -** 39:18 93.78% xs4all remailer(a)xs4all.nl - *-+++ -** 27:43 92.93% myriad remailer(a)myriad.pc.cc.cmu.edu *** 4:16 87.80% vox remail(a)vox.xs4all.nl -- - -- 9:08:07 84.62% c2 remail(a)c2.org _ + 26:06:32 75.08% flame tomaz(a)flame.sinet.org _ -+ 9:15:23 34.58% desert remail(a)desert.xs4all.nl .--____ 62:05:22 29.80% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Raph Levien

1 0

TJOAUC 1-7
by bart＠netcom.com 17 Dec '03

17 Dec '03

Recently received by email: ======================================================================= THE JOURNAL OF AMERICAN UNDERGROUND COMPUTING / Published Quarterly ====================================================================== ISSN 1074-3111 Volume One, Issue Seven January 17, 1994 ====================================================================== available for download as jauc1-7.zip of 180Kbytes from ** ftp site: etext.archive.umich.edu /pub/Zines/JAUC ** ftp site: ftp.fc.net /pub/tjoauc of cp interest I thought: Call Security / Voice Crypto FAQ Neil Johnson Telecommunications Security Howard Fuhs and seen here first: My Life As An International Arms Courier Matt Blaze lots more deleted for brevity, listed in the titles.txt file in the .zip

3 3

Writer Sets Sights on Net
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I noticed the following solicitation mini-spamming its way into a number of newsgroups yesterday. Looks like yet another person plans a lurid expose of online services, BBS systems, and the Net. ------ From: FMGG44A(a)prodigy.com (Jerome Haden) Subject: Writer Seeks On-Line Crime Info REQUEST FOR INFORMATION I am currently writing a book length manuscript entitled : "Crash and Burn: A Parents Guide To The Dangers On The Information SuperHighway." I am seeking real events that are "public record" either newspaper articles or court documents which involve the following criminal activity: 1.) Sexual predators who have commited sex crimes on minors with a connection to a local computer bulletin board or a national on-line service such as Prodigy, Compuserve, or America On Line. 2.) Teenage computer hackers who have been charged with any type of telephone fraud, unauthorized access to another computer, or similar crimes. 3.) Any teenagers involved in making explosives with information obtained from a computer bulletin board. 4.) Any selling of illegal drugs involving minors on a computer bulletin board. 5.) Any other crimes invloving teenagers as either victims or perpetrators with the use of modems or any manner in "cyberspace". Any information must be a public record that can be verified by my literary agency and my publisher. Also would be interested in hearing from victims or perpetrators willing to be interviewed "off the record", and/or willing to appear on national talk shows. If you have any such information please contact me as follows: Jerome Haden E-Mail: FMGG44A(a)prodigy.com -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

NYT on Net Threat
by John Young 17 Dec '03

17 Dec '03

Toad is choking on a try 3 hours ago to send today's Markoff article on the new Net security threat Brian and others noted. Nail-biters can get it by email (if this passes the gory hole). Send blank message with subject: NEW_hak

1 0

Perry E. Metzger: I would suggest...
by Perry E. Metzger 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Mon, 23 Jan 95 10:54:16 EST From: perry(a)imsi.com (Perry E. Metzger) Message-Id: <9501231554.AA28483(a)webster.imsi.com> To: bugtraq(a)fc.net Subject: I would suggest... I would suggest that people interested in the threat described in this morning's times find a copy for themselves of Steve Bellovin's classic paper "Security Problems in the TCP/IP Protocol Suite." It is available from ftp://research.att.com/dist/internet_security/ipext.ps.Z People may also want to examine ftp://research.att.com/dist/internet_security/117.ps.Z Perry ------- End of Forwarded Message

1 0

bruce serlings talk
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Got this from a friend: >To: rah(a)shipwright.com >Date: Mon, 23 Jan 95 09:09:41 PST >Subject: bruce serlings talk > >bob; >can you get me a copy of bruce serlings talk given to law enforcement >offcials (at some conference) about computer crime.. I saw it published in >some rag but I wonder if it's posted on cyperpunks?? > I saw it here before. Is there a URL for it out there? Thanks, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0