December 2003 - cypherpunks-legacy

Re: Legality of suverting computational cycles via Microsoft
by joelm＠eskimo.com 17 Dec '03

17 Dec '03

>Does anybody here know if it is illegal to get unwiting users to download >benign viruses via MSN? > >Doesn't this sort of hole, by its very nature, make it trivial for people >to violate Europes future electronic privacy laws? (despite Microsoft's >guarantee that MSN would follow those rules.) > >JWS > Yes, the whole MSN virus thing is quite interesting from a privacy standpoint. About 9 months ago (after I'd left Microsoft) I was evaluating the security risks of viruses that could be embedded in Word and Excel documents. It is actually quite trivial to develop a virus or Trojan-horse with macro BASIC that is completely transparent to the user. Once the document is opened, the code executes and does its thing. Many organizations use e-mail software that supports attaching a file to an e-mail message. You double click the file icon, it runs the creator application (i.e. Word, Excel), and loads the document. Everyone at Microsoft, uses MS Mail. An interesting scenario I proposed would be to send e-mail to Bill Gates (anonymously or with a spoofed address) with the text body reading something like "Bill, here's a way to get more marketshare away from Novell. Read the attached document." He'd obviously double click the file icon, which would have some real data in it to make it look legitimate. However, when the document opened, he would have unwittingly executed a macro that scanned his hard drive and e-mailed the directory contents or an interesting looking file or two elsewhere. As e-mail within MSN supports this type of object/file embedding, there are not only risks from destructive viruses but also potential attacks on your privacy (no, not the MSN online registration thing, but a targeted attack by an individual/organization). Concluding note: When I was at MS, the saying "Eat your own dog food" was popular (akin to "some things come back to haunt you"). Last week a friend told me the company was being plagued with a non-destructive version of a Word macro-virus. Let's say in the future someone "get's hurt" because of MSN's embedding feature and decides to sue Microsoft. It will be interesting to see the company's response when they knew that a security flaw existed internally, but did nothing to resolve it externally. Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you?

1 0

Save Up To $1000 on Your Grocery Bills!
by 94083120＠usa.net 17 Dec '03

17 Dec '03

Dear Fellow Internet User, I know you get bombarded with all kinds of offers over the Internet. However, here is one that actually pays you back much more than you need to pay out. If you go grocery shopping, you can save up to $1000 by getting our discount coupon books. And, you can even sell these books to others, earning you some part time income! GROCERY COUPONS = BIG SAVINGS Save up to 50% and more on your grocery bill with Coupon Connection of America. You choose the name brand coupons you want for the products you buy. No more clipping coupons from the newspaper. Imagine having a discount coupon for almost every item you buy. COUPONING IS FOR EVERYONE Over 90% of America's housholds save millions of dollars each year by using coupons. Everyone from middle class mothers on a budget to wealthy matrons use coupons. WHY? Because if you don't, you are throwing money in the trash. EVERYONE wants to save money, and we can help you do it. FANTASTIC SAVINGS If you use Coupon Connection of America, you are guaranteed to save money. You choose the coupons you want - for products you know you are going to buy from our list of over 1200 national name brand products. We send the coupons to you in about 10-15 working days. When you redeem the coupons at your favorite store, you will see an immediate savings in your grocery bill. You will pay less for asprin, cereal, soup, detergent, frozen dinners, ice cream, coffee, crackers, diapers, soda, shampoo, and much more. Select from over 1200 brand name products - Crest, Colgate, Kleenex, Kellogs, Ajax, Ivory, Tide, Parkay, Lipton, Kraft, Stouffers, Heinz, Purina, Del Monte ... the list goes on! You can use these coupons WHEREVER you shop, as often as you like. HERE IS HOW IT WORKS With the $500.00 coupon book you can select $500 worth of grocery coupons of your choice. The book contains fifty (50) ten dollar ($10.00) coupon certificates. You simply fill out the certificate with the code numbers of the products you want. You can make 35 coupon selections per certificate and we will fill the order with 1-3 coupons from each selection until we reach the $10.00 value of the certificate. Your working coupons are mailed to you in 10-15 days. IT'S THAT EASY! DOUBLE SAVINGS AVAILABLE If you take your coupons to a store that doubles the face value, your $500 in coupons are worth up to $1000! All this for a $20 investment. BECOME A DISTRIBUTOR - MAKE EXTRA MONEY Once you have purchased your first book, you are entitled to purchase additional certificate books for $5 each (in lots of 10). Sell them to your family, friends or co-workers. Market them using the following methods: Internet E-Mail Web Page Post Flyers at Supermarkets Run a Classified Ad If you wish a copy of our Distributor's Marketing Guide, please add $10 to your order. This guide will provide you with sample ads,a brochure and flyers to use to market the coupon books. A simple classified ad in your local newspaper will pull about 5 to 10 sales. Simply send callers a brochure and wait for the order. To order your grocery coupon book, send $20 ($30 with the Distributor's Marketing Guide) in the form of cash, check or money order to: Information Highway PO Box 513 Southampton, PA 18966

1 0

Re: A glance at the future of missing child identification
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> The car system used here in the U.S. is called "Lo-Jack," as in the > opposite of "hijack." I don't see how putting the transponders in ignition > keys would do much to stop theft, but maybe I'm unaware of European > developments. (There are keys with chips in them, acting as electronic > keys, or to make the keys harder to duplicate, but not to track the cars.) The computer which controls the engine checks whether there is a transponder in the ignition key. The key sends a 32 bit ID number. If this number was registered in the computer, the engine works, otherwise not. You can't start the engine just by shortcutting some wires. > >Perhaps a drug dealer may be more usefull if he moves free and > >has a transponder inside which he doesn't know about, that having > >him in jail. [ This should have been "than having him...". I was very tired yesterday evening. It's embarrassing to see how many typos I made :-( ] > Implausible. The theft detectors are not picking up specific transponders, > just the "on" or "off" state of the things attached to clothing, books, > CDs, etc. (I say "things" because some of them are strips inserted in > books, some are tag-like things clamped to clothing, etc.) No, the theft detectors don't. But they are big and unsuspicious enough to hide specific detectors for big brothers... > Again, the infrastructure is lacking. The simple detectors in stores would > have to be upgraded to track more sophisticated transponders. The stores > would have to cooperate, etc. Implausible. Why implausible? Stores cooperate. I know about a big department store in Germany (but I don't tell you which one) which has a large secret military hospital and a medical stock below it's basement. None of the employees knows about. If they cooperate in having a complete hospital inside, why shouldn't they cooperate in having some antennas and some wires? Hadmut

1 0

NEXT CHALLENGE...
by aba＠exe.ex.ac.uk 17 Dec '03

17 Dec '03

[Please note mail to me may bounce unless you are very careful with using addr aba(a)exe.ex.ac.uk, or aba(a)atlas.ex.ac.uk, as there are machines out here due to a physical breakin - a "RAM raid", I tried posting this on Sat, but the mailer was already out and mail is buffered, so may come out twice] A break down of Hal's challenge, could someone please check my logic in deriving an Andrew Roo's style config file for brutessl 1.0 and check my interpretation against Hal's interpretation in the previous challenge. Hal's previous challenge is indexed from his home page: http://www.portal.com/~hfinney/ I think the challenge file should look like this: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Below I will give my resoning for each field. Each field as it is derived will be quoted with >>> Could a few people check that I have made no mistakes. Andrew Roos code is on: http://www.brute.cl.cam.ac.uk/brute/ as "brutessl.tar.gz", use "save next link as" in netscape (hold shift key down and click in Netscape 1.1). Could someone with a PC, and a 32 bit MS Visual C++ compiler handy compile a PC executable from the tarred files, some people won't have access to TAR under DOS, and a precompiled binary would be useful. Please send the binary to Piete if you do this (be sure to turn on all optimisations). I tried but my VC++ is not 32 bit, is it possible to produce 32 bit binaries which can be run from DOS with VC++ at all? Are the binaries you get with win 95 / win NT likely to run under DOS ? The keyserver will not be doling yet but please pickup the software ready to start. There is a unix based client, and a windows NT based client both available from that page. ---------------------------------------------------------------------- First message from client 0x80 0x1c 0x01 0x00 0x02 0x00 0x03 0x00 0x00 0x00 0x10 0x02 0x00 0x80 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 0x80 0x1c Length field: 28 bytes follow in the packet. 0x01 MSG_CLIENT_HELLO 0x00 0x02 CLIENT-VERSION-MSB CLIENT-VERSION-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x00 SESSION-ID-LENGTH-MSB SESSION-ID-LENGTH-LSB 0x00 0x10 CHALLENGE-LENGTH-MSB CHALLENGE-LENGTH-LSB 0x02 0x00 0x80 CIPHER-SPECS-DATA SESSION-ID-DATA 0x07 .. 0xc6 CHALLENGE-DATA [16 bytes] CHALLENGE is: >>> CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 first message from server 0x82 0x14 0x04 0x00 0x01 0x00 0x02 0x01 0xf6 0x00 0x03 0x00 0x10 0x30 0x82 0x01 0xf2 0x30 0x82 0x01 0x5b 0x02 0x02 0x01 0x8a 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x30 0x47 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x10 0x30 0x0e 0x06 0x03 0x55 0x04 0x0b 0x13 0x07 0x54 0x65 0x73 0x74 0x20 0x43 0x41 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x30 0x1e 0x17 0x0d 0x39 0x35 0x30 0x37 0x31 0x31 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x17 0x0d 0x39 0x37 0x30 0x37 0x31 0x30 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x30 0x7f 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x08 0x13 0x02 0x43 0x41 0x31 0x16 0x30 0x14 0x06 0x03 0x55 0x04 0x07 0x13 0x0d 0x4d 0x6f 0x75 0x6e 0x74 0x61 0x69 0x6e 0x20 0x56 0x69 0x65 0x77 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x31 0x23 0x30 0x21 0x06 0x03 0x55 0x04 0x03 0x13 0x1a 0x45 0x2d 0x53 0x74 0x6f 0x72 0x65 0x20 0x54 0x72 0x61 0x6e 0x73 0x61 0x63 0x74 0x69 0x6f 0x6e 0x20 0x53 0x65 0x72 0x76 0x65 0x72 0x30 0x5c 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x01 0x05 0x00 0x03 0x4b 0x00 0x30 0x48 0x02 0x41 0x00 0xc7 0x24 0x0d 0xbd 0xfe 0x5f 0x21 0x09 0xb4 0x46 0x12 0xbb 0xc7 0x4c 0xbc 0x0c 0x98 0xe3 0x11 0x19 0x60 0x85 0x86 0x0a 0xa2 0xaf 0xae 0x8f 0xf9 0x43 0x86 0x92 0x1f 0xcc 0xd3 0x38 0xcf 0x92 0x14 0xa7 0x8c 0x89 0x07 0x26 0xd4 0x21 0x55 0xa8 0x43 0x2d 0xb4 0xec 0xce 0x24 0x73 0x5e 0x7c 0xe2 0xbe 0x22 0x2d 0xbd 0x96 0xbf 0x02 0x03 0x01 0x00 0x01 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x03 0x81 0x81 0x00 0x8f 0xbe 0x0c 0xae 0xc8 0xf0 0x22 0xef 0xae 0x83 0xb5 0xb1 0xe3 0xb4 0xd9 0xd6 0xa9 0x4a 0xb6 0x60 0x9c 0x0b 0x00 0x70 0x12 0x88 0x73 0xd1 0xef 0xe2 0x54 0xf6 0x3a 0xc7 0xa5 0xbe 0xe1 0xe0 0xdb 0x4d 0x20 0x10 0x3d 0x68 0x7c 0x8d 0xdb 0x16 0xf6 0x67 0xe7 0x1d 0x51 0xbc 0x19 0xa2 0xf6 0xbf 0x6f 0xa4 0x52 0xc7 0x7e 0x50 0x3d 0xb9 0x3e 0x1e 0x67 0xff 0xf6 0xf2 0x5d 0xe7 0x2b 0x7e 0x3a 0x7e 0x6c 0x40 0xb7 0x04 0x9c 0x2c 0x2b 0x89 0x0f 0x8c 0xb5 0x93 0xd8 0xac 0x94 0xe6 0x5f 0x84 0xe8 0x71 0x75 0x9e 0x10 0x6e 0x36 0xe6 0x14 0xfe 0xba 0xf8 0x11 0x71 0x9d 0x74 0x33 0x48 0x74 0xc1 0xba 0xcb 0xff 0x58 0x86 0x8c 0xba 0x9c 0x08 0xad 0xce 0x8a 0x02 0x00 0x80 0xd5 0xe6 0x38 0xd6 0x8c 0xa8 0xa1 0xae 0xca 0x2e 0xf8 0xc8 0xe2 0x96 0x02 0xa4 This is interpreted as follows: 0x82 0x14 Packet length, 532 bytes follow. 0x04 MSG-SERVER-HELLO 0x00 SESSION-ID-HIT 0x01 CERTIFICATE-TYPE 0x00 0x02 SERVER-VERSION-MSB SERVER-VERSION-LSB 0x01 0xf6 CERTIFICATE-LENGTH-MSB CERTIFICATE-LENGTH-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x10 CONNECTION-ID-LENGTH-MSB CONNECTION-ID-LENGTH-LSB 0x30...0x8a CERTIFICATE-DATA [502 bytes] 0x02 0x00 0x80 CIPHER-SPECS-DATA 0xd5...0xa4 CONNECTION-ID-DATA [16 bytes] CONNECTION-ID is: >>> CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 Second message from client 0x80 0x55 0x02 0x02 0x00 0x80 0x00 0x0b 0x00 0x40 0x00 0x00 0xfb 0xc0 0x09 0x91 0x60 0x10 0xa6 0x15 0x3f 0x8f 0x36 0x5a 0x19 0x06 0x8e 0x58 0xc4 0xfa 0xd0 0x73 0xd4 0x6d 0x20 0x97 0x2f 0x85 0x95 0xb3 0xa5 0x97 0xb5 0xe0 0x63 0x91 0x61 0xb7 0x76 0x3c 0x4e 0x62 0x8b 0x02 0x2b 0x05 0x98 0xd4 0x14 0x44 0x63 0xf3 0x43 0x7e 0xa0 0xa8 0x3f 0x16 0xb2 0x43 0x4b 0x24 0x76 0xae 0xba 0x8c 0x89 0x71 0xde 0x25 0x6b 0xce 0x89 0x77 0x8a 0x30 0x2a This is interpreted as follows: 0x80 0x55 Packet length, 85 bytes follow. 0x02 MSG-CLIENT-MASTER-KEY 0x02 0x00 0x80 CIPHER-KIND 0x00 0x0b CLEAR-KEY-LENGTH-MSB CLEAR-KEY-LENGTH-LSB 0x00 0x40 ENCRYPTED-KEY-LENGTH-MSB ENCRYPTED-KEY-LENGTH-LSB 0x00 0x00 KEY-ARG-LENGTH-MSB KEY-ARG-LENGTH-LSB 0xfb...0x36 CLEAR-KEY-DATA [11 bytes] 0x5a...0x2a ENCRYPTED-KEY-DATA [64 bytes] KEY-ARG-DATA So CLEAR-MASTER is: >>> CLEAR-MASTER fbc009916010a6153f8f36 Second message from server 0x80 0x21 0x9a 0xc5 0xf7 0xd1 0x6a 0x5b 0x26 0x43 0x57 0x67 0x65 0xb6 0x3f 0x9a 0xe3 0x82 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b This is interpreted as follows: 0x80 0x21 Packet length, 33 bytes follow 0x9a...0x82 RC4 encrypted MAC [16 bytes] 0x00 RC4 encrypted MSG-SERVER-VERIFY (0x05) 0x65...0x1b RC4 encrypted CHALLENGE-DATA from CLIENT-HELLO message [16 bytes] Plaintext (MSG-SERVER-VERIFY plus CHALLENGE-DATA): 0x05 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 Ciphertext (from SERVER-VERIFY packet): 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b SERVER-VERIFY is the encrypted MSG-SERVER-VERIFY plus the first seven bytes of the encrypted CHALLENGE-DATA: >>> SERVER-VERIFY 006599b6d2f2a736 So the completed challenge file is: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Adam

2 1

NEXT CHALLENGE: volunteers to compile brutessl for a few platforms
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Could someone with a few things handy compile Andrew Roos code so that we have a nice handy pre-compiled DOS binary. A must will be a DOS binary, what other platforms? - DOS (Need Microsoft visual C++ I think this is what Andrew used, there is an assembler speed up file) - OS/2? - PowerPC + MAC? Any other architecture you would like to see a binary made available for. Please send binary to Piete (cc line) or me, and it would be nice if you could provide a detatched PGP signature also. The tar file is at: http://dcs.ex.ac.uk/~aba/brutessl.tar.gz There is a pointer to brutessl.tar.gz. You'll need to use save next link ( "shift and click" on URL in netscape 1.1 ), or whatever mechanism your browser provides. You'll also need TAR.EXE and GZIP.EXE for DOS to unpack a .tar.gz file. In case this is a problem I have just created this: http://dcs.ex.ac.uk/~aba/brutessl/ containing these files: 2 -rw-r--r-- 1 aba phd 439 Jul 31 11:14 Makefile 2 -rw-r--r-- 1 aba phd 602 Jul 31 17:19 README 34 -rw-r--r-- 1 aba phd 16450 Jul 31 17:20 assembly.c 42 -rw-r--r-- 1 aba phd 21373 Jul 31 17:21 brutessl.c 6 -rw-r--r-- 1 aba phd 2776 Jul 31 17:21 brutessl.h 26 -rw-r--r-- 1 aba phd 12709 Jul 31 17:21 brutessl.txt 2 -rw-r--r-- 1 aba phd 351 Aug 19 20:31 chal2.pf 2 -rw-r--r-- 1 aba phd 264 Jul 31 17:21 chal1.pf 34 -rw-r--r-- 1 aba phd 16500 Jul 31 17:22 search.c 2 -rw-r--r-- 1 aba phd 296 Jul 31 17:22 test.pf You should be able to access them individually as: http://dcs.ex.ac.uk/~aba/brutessl/Makefile etc. (just in case you can't handle TAR / GZIP files on your DOS machine). chal1.pf is the challenge that Damien just broke, chal2.pf is my first attempt at producing a challenge file for Hal's next challenge. The challenge info will be at: http://www.brute.cl.cam.ac.uk/brute/ when it starts. Adam

1 0

NEXT CHALLENGE: plan of action
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Okay this a bit awkward because Piete doesn't appear to be in today, but there are a few things which need doing first (compiling which I mentioned in the previous message, and a 2nd opinion on the config file which I posted in the previous message to that), so perhaps this is not a problem. What we want to do (what I want to do!) with this latest challenge of Hal's is to try to see how fast it can be brute forced. To this end we need a kind of starting line effect, so everyone gets their software, and has it tested as running correctly. People using the socket doler have their clients ticking over, people using the WWW browser have their fingers poised over the button etc, and then Piete (when he gets back, let's say Monday 12:00 GMT to be safe, he can ammend that time later if necessary when he next gets on line) will start the race. Sound like a good plan? Where to find things... The brutessl software, the unix socket client, and the Windows NT client are on: http://www.brute.cl.cam.ac.uk/brute/ Also I have (temporarily, until Piete has a chance to update www.brute.cl.cam.ac.uk) the brutessl code here: http://dcs.ex.ac.uk/~aba/brutessl/ (both TAR file, and individual files untarred). If and when people compile binaries for architectures which don't typically come with compilers by default - such as DOS, OS/2, Macs, I'll put any binaries sent to me in this directory. When Piete gets back, he'll either make a pointer to this repository, or copy it on to www.brute. UNIX client. How to use the unix client... download brclient from the www page: http://www.brute.cl.cam.ac.uk/brute/ it is a perl program so you may have to edit the path to perl (the 1st line of the program should be #!/full/path/to/perl/binary), and you will have to mark it as executable. You will also need a shell script called brloop which uses brclient. It is on Piete's "sources" page, this page is indexed from the main brute page above, here it is explicitly. http://www.brute.cl.cam.ac.uk/ftp/pub/brute/README.html So get brloop. Get and compile the brutessl.tar.gz file. Run brloop. The brclient perl socket client talks to a machine with a DNS: sksp.brute.cl.cam.ac.uk on port number 19957 At the moment the server is not running so it will fail, but when Piete starts it up, your client will periodically ask for work, before the start time (Monday 12:00 GMT, or later time if this time is changed) your client will just be told to sleep for a while, when it wakes up it will ask for work again. In this way the client can be left ticking over, when work does arrive it will notice, as it will actually recieve some work when it makes the request, and start doing it, and reporting back when it finishes each chunk. For a more detailed description of the socket protocol that Piete's brclient will talk to the key server, have a look at this document "SKSP Simple Key Searching Protocol" an SMTP like protocol for requesting keys to search, and reporting back the results. http://www.brute.cl.cam.ac.uk/ftp/pub/brute/protocol.txt (This is indexed from the main www.brute page under "new protocol".) There is a windows NT socket client written by Andrew Brown, pointers to that also. If you want to write a socket client for another architecture (someone mentioned PowerPC?) the protocol is reasonably straight forward, and documented in the protocol.txt file above. Adam

1 0

Libertarians for whom Jim Bell tolls...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Vin Suprynowicz wrote: > FROM MOUNTAIN MEDIA > THE LIBERTARIAN, By Vin Suprynowicz > Three-way race in New Jersey, tax resister faces five years > > Dr. Murray Sabrin, talk show host, professor of finance at Ramapo > College in Mahwah, N.J. and author of the book "Tax Free 2000," says he > may be able to do something no other Libertarian can do in 1997: Appear in > a nationally televised debate. > > "If we raise $210,000 by August 31 we are in the debates. No commissions, > no review boards -- it's a matter of law," reports Libertarian nominee > Sabrin. > "With over $50,000 raised in funds and pledges, we're about 25 percent > of the way there. ..." > # # # > Forwarded from http://www.infowar.com comes this government report: > > "United States Attorney Kate Pflaumer announced that JAMES DALTON BELL, > 39, pleaded guilty today in the federal court in Tacoma to two felony > charges. BELL, a resident of Vancouver, Washington, pleaded guilty to > obstructing and impeding the Internal Revenue Service (IRS), and to falsely > using a Social Security number with the intent to deceive. ... > > "The charges stem from an investigation initiated in October, 1996 by IRS > Internal Security Inspectors into reports that BELL was gathering the names > and home addresses of IRS employees. ... > > "In the eight page plea agreement signed by BELL, he acknowledged that he > had gathered the names and addresses of the IRS employees in order to > intimidate them in the performance of their official duties. > > "During the course of their investigation, IRS Inspectors discovered that > BELL was advocating a scheme called "Assassination Politics", whereby > persons would be rewarded with "digital cash" for killing certain > undesirable people. BELL identified these undesirables as government > employees, such as IRS employees, who would be intimidated from enforcing > internal revenue laws for fear of being assassinated. In the plea > agreement, BELL admitted that he suggested using "Assassination Politics" > as an enforcement mechanism for the "Multnomah County Common Law Court", > and that this was part of his effort to obstruct and impede the enforcement > of internal revenue laws. ... > > "In the plea agreement, BELL also admitted that on March 16, 1997, he > conducted a chemical "stink bomb" attack on the IRS office in Vancouver, > Washington, using the noxious chemical mercaptan. ... This is interesting, since they had no evidence that he did so. However, they managed to get him to "confess" by illegally holding without bond for crimes which they never intended to charge him with in the first place. I hope that Jim's lawyer is suitably rewarded for his part in selling Jim down the river. > "IRS Inspectors indicated that the mercaptan attack may have been linked > to the Feb. 20, 1997 seizure of BELL's vehicle by the IRS for unpaid taxes. In effect, they are saying that since they didn't have any evidence against Jim for the crime that they wanted him to "pay" for, that they used the threat of major criminal charges to convince him to "confess" to the crime, and held him without bail to let him know that the Justice system is under the control of the IRS, and not the defendant. > "As part of the plea agreement, BELL also admitted that he used several > different social security numbers in order to hide assets from the IRS ... > to prevent the IRS from levying his wages. ... > > "BELL faces a maximum sentence of three years in prison and a $250,000 > fine for the obstruction charge, and five years and a $250,000 fine for > using a phony Social Security number." > > It appears Bell was held without bond until he signed. Probably more effective than beating him with a rubber hose. > Vin Suprynowicz is the assistant editorial page editor of the Las Vegas > Review-Journal. Readers may contact him via e-mail at vin(a)lvrj.com. The web > site for the Suprynowicz column is at http://www.nguworld.com/vindex/. The > column is syndicated in the United States and Canada via Mountain Media > Syndications, P.O. Box 4422, Las Vegas Nev. 89127. > > *** > > Vin Suprynowicz, vin(a)lvrj.com > > Voir Dire: A French term which means "jury stacking." Vin, Did you know that the IRS used the information gleaned from Jim Bell's hard drive to send the "chilling" details of Jim Bell's plea agreement to the individuals and mailing lists he corresponded with? Did you know that when he arrested, there were no Assassination Bot's in existence, and that there are now at least six prototypes currently in operation? God Bless AmeriKa. TruthMonger

1 0

NEXT CHALLENGE: please check my config file
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

As you may have surmised Hal has given us another challenge to satisfy the people who want to do a challenge to see *how fast* they can do it by involving as many people and their computers as possible. Here's my take on interpreting Hal's data to come up with a configuration file. I think the challenge file should look like this: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Below I will give my resoning for each field. Each field as it is derived will be quoted with >>> Could a few people check that I have made no mistakes. Please check, thanks. Adam >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> A break down of Hal's challenge, could someone please check my logic in deriving an Andrew Roo's style config file for brutessl 1.0 and check my interpretation against Hal's interpretation in the previous challenge. ---------------------------------------------------------------------- First message from client 0x80 0x1c 0x01 0x00 0x02 0x00 0x03 0x00 0x00 0x00 0x10 0x02 0x00 0x80 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 0x80 0x1c Length field: 28 bytes follow in the packet. 0x01 MSG_CLIENT_HELLO 0x00 0x02 CLIENT-VERSION-MSB CLIENT-VERSION-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x00 SESSION-ID-LENGTH-MSB SESSION-ID-LENGTH-LSB 0x00 0x10 CHALLENGE-LENGTH-MSB CHALLENGE-LENGTH-LSB 0x02 0x00 0x80 CIPHER-SPECS-DATA SESSION-ID-DATA 0x07 .. 0xc6 CHALLENGE-DATA [16 bytes] CHALLENGE is: >>> CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 first message from server 0x82 0x14 0x04 0x00 0x01 0x00 0x02 0x01 0xf6 0x00 0x03 0x00 0x10 0x30 0x82 0x01 0xf2 0x30 0x82 0x01 0x5b 0x02 0x02 0x01 0x8a 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x30 0x47 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x10 0x30 0x0e 0x06 0x03 0x55 0x04 0x0b 0x13 0x07 0x54 0x65 0x73 0x74 0x20 0x43 0x41 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x30 0x1e 0x17 0x0d 0x39 0x35 0x30 0x37 0x31 0x31 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x17 0x0d 0x39 0x37 0x30 0x37 0x31 0x30 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x30 0x7f 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x08 0x13 0x02 0x43 0x41 0x31 0x16 0x30 0x14 0x06 0x03 0x55 0x04 0x07 0x13 0x0d 0x4d 0x6f 0x75 0x6e 0x74 0x61 0x69 0x6e 0x20 0x56 0x69 0x65 0x77 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x31 0x23 0x30 0x21 0x06 0x03 0x55 0x04 0x03 0x13 0x1a 0x45 0x2d 0x53 0x74 0x6f 0x72 0x65 0x20 0x54 0x72 0x61 0x6e 0x73 0x61 0x63 0x74 0x69 0x6f 0x6e 0x20 0x53 0x65 0x72 0x76 0x65 0x72 0x30 0x5c 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x01 0x05 0x00 0x03 0x4b 0x00 0x30 0x48 0x02 0x41 0x00 0xc7 0x24 0x0d 0xbd 0xfe 0x5f 0x21 0x09 0xb4 0x46 0x12 0xbb 0xc7 0x4c 0xbc 0x0c 0x98 0xe3 0x11 0x19 0x60 0x85 0x86 0x0a 0xa2 0xaf 0xae 0x8f 0xf9 0x43 0x86 0x92 0x1f 0xcc 0xd3 0x38 0xcf 0x92 0x14 0xa7 0x8c 0x89 0x07 0x26 0xd4 0x21 0x55 0xa8 0x43 0x2d 0xb4 0xec 0xce 0x24 0x73 0x5e 0x7c 0xe2 0xbe 0x22 0x2d 0xbd 0x96 0xbf 0x02 0x03 0x01 0x00 0x01 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x03 0x81 0x81 0x00 0x8f 0xbe 0x0c 0xae 0xc8 0xf0 0x22 0xef 0xae 0x83 0xb5 0xb1 0xe3 0xb4 0xd9 0xd6 0xa9 0x4a 0xb6 0x60 0x9c 0x0b 0x00 0x70 0x12 0x88 0x73 0xd1 0xef 0xe2 0x54 0xf6 0x3a 0xc7 0xa5 0xbe 0xe1 0xe0 0xdb 0x4d 0x20 0x10 0x3d 0x68 0x7c 0x8d 0xdb 0x16 0xf6 0x67 0xe7 0x1d 0x51 0xbc 0x19 0xa2 0xf6 0xbf 0x6f 0xa4 0x52 0xc7 0x7e 0x50 0x3d 0xb9 0x3e 0x1e 0x67 0xff 0xf6 0xf2 0x5d 0xe7 0x2b 0x7e 0x3a 0x7e 0x6c 0x40 0xb7 0x04 0x9c 0x2c 0x2b 0x89 0x0f 0x8c 0xb5 0x93 0xd8 0xac 0x94 0xe6 0x5f 0x84 0xe8 0x71 0x75 0x9e 0x10 0x6e 0x36 0xe6 0x14 0xfe 0xba 0xf8 0x11 0x71 0x9d 0x74 0x33 0x48 0x74 0xc1 0xba 0xcb 0xff 0x58 0x86 0x8c 0xba 0x9c 0x08 0xad 0xce 0x8a 0x02 0x00 0x80 0xd5 0xe6 0x38 0xd6 0x8c 0xa8 0xa1 0xae 0xca 0x2e 0xf8 0xc8 0xe2 0x96 0x02 0xa4 This is interpreted as follows: 0x82 0x14 Packet length, 532 bytes follow. 0x04 MSG-SERVER-HELLO 0x00 SESSION-ID-HIT 0x01 CERTIFICATE-TYPE 0x00 0x02 SERVER-VERSION-MSB SERVER-VERSION-LSB 0x01 0xf6 CERTIFICATE-LENGTH-MSB CERTIFICATE-LENGTH-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x10 CONNECTION-ID-LENGTH-MSB CONNECTION-ID-LENGTH-LSB 0x30...0x8a CERTIFICATE-DATA [502 bytes] 0x02 0x00 0x80 CIPHER-SPECS-DATA 0xd5...0xa4 CONNECTION-ID-DATA [16 bytes] CONNECTION-ID is: >>> CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 Second message from client 0x80 0x55 0x02 0x02 0x00 0x80 0x00 0x0b 0x00 0x40 0x00 0x00 0xfb 0xc0 0x09 0x91 0x60 0x10 0xa6 0x15 0x3f 0x8f 0x36 0x5a 0x19 0x06 0x8e 0x58 0xc4 0xfa 0xd0 0x73 0xd4 0x6d 0x20 0x97 0x2f 0x85 0x95 0xb3 0xa5 0x97 0xb5 0xe0 0x63 0x91 0x61 0xb7 0x76 0x3c 0x4e 0x62 0x8b 0x02 0x2b 0x05 0x98 0xd4 0x14 0x44 0x63 0xf3 0x43 0x7e 0xa0 0xa8 0x3f 0x16 0xb2 0x43 0x4b 0x24 0x76 0xae 0xba 0x8c 0x89 0x71 0xde 0x25 0x6b 0xce 0x89 0x77 0x8a 0x30 0x2a This is interpreted as follows: 0x80 0x55 Packet length, 85 bytes follow. 0x02 MSG-CLIENT-MASTER-KEY 0x02 0x00 0x80 CIPHER-KIND 0x00 0x0b CLEAR-KEY-LENGTH-MSB CLEAR-KEY-LENGTH-LSB 0x00 0x40 ENCRYPTED-KEY-LENGTH-MSB ENCRYPTED-KEY-LENGTH-LSB 0x00 0x00 KEY-ARG-LENGTH-MSB KEY-ARG-LENGTH-LSB 0xfb...0x36 CLEAR-KEY-DATA [11 bytes] 0x5a...0x2a ENCRYPTED-KEY-DATA [64 bytes] KEY-ARG-DATA So CLEAR-MASTER is: >>> CLEAR-MASTER fbc009916010a6153f8f36 Second message from server 0x80 0x21 0x9a 0xc5 0xf7 0xd1 0x6a 0x5b 0x26 0x43 0x57 0x67 0x65 0xb6 0x3f 0x9a 0xe3 0x82 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b This is interpreted as follows: 0x80 0x21 Packet length, 33 bytes follow 0x9a...0x82 RC4 encrypted MAC [16 bytes] 0x00 RC4 encrypted MSG-SERVER-VERIFY (0x05) 0x65...0x1b RC4 encrypted CHALLENGE-DATA from CLIENT-HELLO message [16 bytes] Plaintext (MSG-SERVER-VERIFY plus CHALLENGE-DATA): 0x05 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 Ciphertext (from SERVER-VERIFY packet): 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b SERVER-VERIFY is the encrypted MSG-SERVER-VERIFY plus the first seven bytes of the encrypted CHALLENGE-DATA: >>> SERVER-VERIFY 006599b6d2f2a736 So the completed challenge file is: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Adam

1 0

ENE_mah
by John Young 17 Dec '03

17 Dec '03

8-21-95. NYPaper: "C.I.A. Re-examines Hiring Of Ex-Terrorist as Agent: Agency Has Misgivings About Some on Payroll." As the Central Intelligence Agency cleans house after the cold war, trimming its roster of foreign agents and writing new rules for hiring them, a retired terrorist who was until recently on the agency's payroll has given it cause for some soul-searching. The case is a classic example of the dilemma the C.I.A. continually faces in recruiting foreign agents. The intelligence agency struggles to balance the demand to obtain information with its desire to keep its own hands clean, though it frames the issue in terms of national security, not morality. The C.I.A. will draw on the experience of the Federal Bureau of Investigation and the Drug Enforcement Administration in dealing with informants in the future. That is a break from the past; the agency has long considered law enforcement procedures an enema. ENE_mah

1 0

Prior Restraint
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"In a stunning rebuke to overzealous prosecutors," reports the New York-based National Coalition Against Censorship, the owner and manager of the store called simply Newstand, in Bellingham, Wash., have been found not guilty and awarded $1.3 million "for prior restraint and for retaliatory prosecution" by a U.S. District Court jury in Seattle. Ira Stohl and Kristina Hjelsand had been charged with obscenity for selling the controversial magazine "Answer Me!" a short-lived but legendary periodical that offered extremely politically incorrect articles about rape, among other subjects. The NCAC earlier reported the owners of Newstand rejected an offer from the prosecutor to drop criminal charges in return for a promise not to carry further issues of "Answer Me!" or "anything remotely similar." Instead, the freedom fighters displayed the magazine in their store, chained, under lock and key. The jury found that the troglodytes in charge of Whatcom County had violated Stohl and Hjelsand's First Amendment rights, caused emotional suffering, and damaged their business. Censorship News, the quarterly newsletter of the NCAC, is published out of 275 Seventh Ave., New York, N.Y. 10001, e-mail ncac(a)netcom.com, web page http://www.ncac.org. Vin Suprynowicz is the assistant editorial page editor of the Las Vegas Review-Journal. Readers may contact him via e-mail at vin(a)lvrj.com. The web site for the Suprynowicz column is at http://www.nguworld.com/vindex/. *** Vin Suprynowicz, vin(a)lvrj.com Voir Dire: A French term which means "jury stacking."

1 0