December 2003 - cypherpunks-legacy

hardware
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

is there any Hardware involved in cryptology and code hacking other than a comp andf some accelerator chips? CyberPunc X

1 0

Welcome to the list
by Rich Salz 17 Dec '03

17 Dec '03

You will probably find it most helpful to read through a few months archives of the list (ask around for back digests, usenet access, etc). And read the Tim's cyphernomicon. You'll find most intro-level answers there, and you're less likely to annoy the natives. :) /r$

1 0

Re: 90%
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: zoetrope(a)infinet.com > > Can I ask a question....are you guys into cryptology for the interesting > facts and knowledge or fer cracking unix codes and raising havoc? > For the cyphergroupies of course...they rule! Some day I'm going to write a book about the better known, shall I say "famous" ones, and then I'll be a bazillionaire...oh yeah, that's the other reason I'm on cypherpunks, to get rich! (Did I mention fame?) And they serve a great breakfast too! You can get anything you want at the cypherpunks restaraunt, ta da da da da da da, you can...help me help me Mr. Blobby, I think my neural nets are insufficiently trained! Bzzzt! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: 90%
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:01 PM 10/12/95 -0400, you wrote: >Can I ask a question....are you guys into cryptology for the interesting >facts and knowledge or fer cracking unix codes and raising havoc? Cryptography can cause far more interesting kinds of havoc than scaring a few marketroids about crackers cracking their market shares, or scaring a few spooks that they might not be able to eavesdrop on the American public. Cryptography is a way of changing the balance of power about who owns your personal information. Computers are very good at centralizing and combining information - once something's in a major database, it's easy for the people who own databases to compare them with other databases, so your Social Security Number and Driver's License Number and credit cards and phone numbers and TRW credit report all pretty much tell people what you're doing, what kind of lifestyle you lead, where you're travelling, what magazines you read, where to find you if they want, where your money is, what kind of junk mail to send you, whether your house is worth burglarizing, whether you'd be a good target for the draft or a tax audit, etc. Not much you can do about it except not give people information, and that's getting tougher to do, especially if you like conveniences of modern American life like employee-style jobs and renting or buying houses or having a driver's license when the cops stop your car for no good reason. But with cryptography, you can structure transactions so that people get all the information they need to do business with you (if you want them to), and none of the information they don't need. Imagine if your credit smart-card didn't have your name on it (because only you have the PIN), and gave out a different number every time you used it (but Visa doesn't mind, because they know who you are.) Imagine if, instead of having one master SSN that you write on every bloody form you fill out in your life, you have a list of tax id numbers, and can get more if you need them, so everybody who needs to send the IRS a chunk of your money can do so, but the numbers aren't tied together except back at the tax office, where nobody's going to care until you retire. (That doesn't even take cryptography, though it helps.) Imagine if people started thinking that your own private information was your own, and didn't _need_ to see three kinds of picture ID to let you rent a mailbox or a car, because you could use crypto methods to give them the information they need to charge you for the car if you rip it off, without all the other baggage. And imagine if all you need to do business is that barcode tattooed on your arm, which you can wave by the machines anywhere you go, for everything you do. Crypto's the alternative. ===== Now, as far as the things you first asked about go, the theoretical stuff _is_ pretty neat, and has finally given me an excuse to go study up on number theory, and scaring the public about weaknesses of the computer products they use is something the mass media and legislators like better than many of us do (though having your friends get their pictures in Wired and the New York Times is kind of fun...) - it'd be nice if the people who make popular software would take security seriously, instead of putting out some of the thoughtlessly weak stuff that they do. Sometimes it takes a 2x4 to do the job; sometimes the press just overreacts. I do occasionally hang out with people who have the police watch them because their politics aren't correct (whether to the left, right, or deep center), or because they like recreational chemicals that are safer than tobacco and alcohol, or just because they're weird. That's wrong, and people have a right to their privacy. (Hasn't stopped me from offering the Philadelphia Police Red Squad coffee when they were watching a convention I was at (they'd brought their own :-) - but those guys really still are in business.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

NNTP holes paper updated thatnks to Rich Salz
by fc＠all.net 17 Dec '03

17 Dec '03

Rich Salz read over the NNTP paper and helped greatly to improve it. The new version is now on-line. Thank you Rich. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Insecurity Section of the Internet Handbook
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

For zoetrope, and others curious about the Insecurity section of the Internet Handbook, we pass along this Yellow Pages advert-insert comp sec teaser from SAIC -- with only dribbles of cryptography. The puffery appears to be artfully fattened and out-of-date. Like most security porkers, SAIC sells its nitrated sec services dearly (security by deep pockets of the fearful engorgers) while feigning Net public-spirit to mask IP search and steal. In a telling slight, SAIC does not cite outturned- pockets, beef jerky Cypherpunks. _______________________________________________________ URL: http://mls.saic.com/library.html [which links to the listed contents] SECURITY LIBRARY The SAIC Security Library contains security-related infomation and programs from around the Net. SAIC does not verify or endorse such files or any use thereof. Notices and Upcoming Events [Not included here] Advisories and Alerts Newsgroups Documents Programs Other Security Sites _______________________________________________________ URL: http://mls.saic.com/alerts.html SECURITY ADVISORIES AND ALERTS Alerts * Sun Security Alerts * CERT - Computer Emergency Response Team * ASSIST - Automated Systems Security Incident Support Team * AUSERT - Australian Security Emergency Response Team * NASIRC - NASA Automated Systems Incident Response Capability * DDN - Defense Data Network * FIRST - Forum of Incident Response and Security Teams Advisories * 8lgm Advisories * Bugtraq Archives, threaded * CERT Advisories * CIAC - Computer Incident Advisory Capability _______________________________________________________ URL: http://mls.saic.com/docs.html SECURITY DOCUMENTS These documents are from the Net and cover a wide area of topics concerning computer security. They are for the education and legitimate use of computer security techniques only. All non-FAQ documents are in PostScript format unless otherwise noted. ______________________________________________________ Frequently Asked Questions * Basic Computer Security * Firewalls * Setting Up Anonymous FTP * What To Do If Your Machine Is Compromised * Security Patches * Vendor Contacts * Pretty Good Privacy (PGP) * #hack FAQ * Cryptography FAQ _______________________________________________________ Firewalls Introductory Papers * Internet Firewalls - An Introduction (August 1994, 221K) * Keeping Your Site Comfortably Secure: An Introduction to Internet Firewalls (Undated, 1.8M) General Firewall Documents * A Network Firewall (June 1992, 374K) * A Toolkit and Methods for Internet Firewalls (Undated, 185K) * Proper Care and Feeding of Firewalls (November 1994, 121K) * A Network Perimeter with Secure External Access (Undated, 268K) * An Internet Gatekeeper (Undated, 149K) * Thinking About Firewalls (Undated, 109K) * X Through Firewalls, and Other Application Relays (May 1993, 430K) _______________________________________________________ WWW Security * Security and the World Wide Web (June 1994, 10K HTML) * NCSA on Mosaic Security Issues(December 1994, 1.6K HTML) * Shen: A Security Scheme for the Web (Undated, 1.7K HTML) * Using PGP/PEM Encryption (Undated, 7.6K HTML) * Secure HTTP (Undated, 2.2K HTML) _______________________________________________________ Intrusion Detection * A Software Architecture to support Misuse Intrusion Detection (March 1995, 250K) * An Application of Pattern Matching in Intrusion Detection (June 1994, 674K) * Algorithm for Distrubuted Recognition and Accountability (Undated, 209K) * A Pattern Matching Model for Misuse Intrusion Detection (Undated, 191K) * AI Approach to Intrusion Detection (June 1994, 168K) * Intrusion Detection In Computers (January 1991, 12K text) * USTAT - A Real-time Intrusion Detection System for UNIX (November 1992, 1.3M) _______________________________________________________ Improving your UNIX Security Technical Tips * Setting up Sun Security (March 1992, 7K text) * Miscellaneous Security Tips (October 1992, 23K text) * CERT Generic Security Tips (July 1992, 17K text) * UNIX Site Security Handbook (July 1991, 253K text) Finding and Fixing Your Security Problems * Improving the Security Of Your Site By Breaking Into It (Undated, 51K text) * Finding Holes in Your System (October 1993, 16K text) * Improving the Security of Your UNIX System (April 1990, 274K) * Becoming An Uebercracker to Stop Uebercrackers (December 1993, 9K text) _______________________________________________________ The Internet Worm * A Report on the Internet Worm (November 1988, 16K text) * Technical Report on the Internet Worm Incident (September 1991, 173K) * The Internet Worm Program: An Analysis (December 1988, 283K) * A Tour of the Worm (Undated, 166K) _______________________________________________________ Tales of Computer Attacks and Countermeasures * Five Incidents At Columbia University (Undated, 93K) * "An Evening With Berferd" (Undated, 82K) * Internet Attack on Texas A&M (1993, 294K) * "There Be Dragons" (August 1992, 185K) * Computer Break-ins: A Case Study (Undated, 94K) * System Admin Horror Stories (1992, 148K text) _______________________________________________________ Networking TCP/IP Security * TCP Wrapper Security (Undated, 59K) * A Weakness in the 4.2BSD TCP/IP Software (February 1985, 27K) * Security Problems in the TCP/IP Protocol Suite (April 1989, 107K) * Network (In)Security Through IP Packet Filtering (September 1992, 123K) General Networking Documents * Architecture and Implementation of Network-Layer Security under UNIX (Undated, 124K) * Information Security And Privacy In Networks (Undated, 809K .tar file) * Paving the Road to Network Security (May 1994, 162K) * NFS Tracing By Passive Network Monitoring (Undated, 170K) * Addressing Weaknesses in the DNS Protocol (August 1993, 406K) * Countering Abuse of Name-Based Authentication (Undated, 243K) * An Architectural Overview of UNIX Network Security (May 1993, 50K text) * NIS Security Warning (December 1991, 7.5K) _______________________________________________________ Trusted Systems * The Orange Book (August 1983, 264K text) * Understanding Configuration Management in Trusted Systems (March 1988, 138K text) * Understanding DAC in Trusted Systems (September 1987, 87K text) * Understanding Facility Management in Trusted Systems (June 1989, 106K text) * Understanding Trusted Distribution in Trusted Systems (December 1988, 55K text) * Understanding Audit in Trusted Systems (July 1987, 56K text) _______________________________________________________ Newsletters * COAST Newsletter * Privacy Forum * Cipher - Electronic Newsletter of the IEEE Technical Committee on Security and Privacy _______________________________________________________ Miscellaneous Documents * Security Term Glossary (Undated, 70K text) * Open Systems Security - An Architectural Framework (June 1991, 300K text) * Password Security: A Case History (Undated, 36K) * Extracts from various security articles (Undated, 61K text) * Coping with the Threat of Computer Security Incidents (June 1990, 102K text) * Threat Assessment of Malicious Code and Human Threats (October 1992, 231K) * Tty Security - a Tty Session Manager (Undated, 98K) * Electromagnetic Emanation Eavesdropping (1989, 45K text) * GAO Report on Internet Security (June 1989, 104K text) * ACM SIG on Security, Audit, and Control _______________________________________________________ URL: http://mls.saic.com/programs.html SECURITY PROGRAMS These programs are from various locations around the Net; SAIC does not verify their functionality and/or consequences of use. All programs are for assumed legal uses and education. Unless noted, all programs are intended for UNIX platforms. Local (load directly to disk; gzip tar files unless noted) * COPS - Bulletproof your system from intruders * Crack - Password cracker * Cryptography File System (CFS) - Encrypted filesystems for SunOS * Internet Security Scanner (ISS) - Checks UNIX sites for vulnerabilities * ifstatus - Checks interfaces for promiscuous mode * probe_ports - Finds open ports on UNIX systems * Secure-Sun Check - Shell script to check several common SunOS vulnerabilities (no compression) Remote * Arpwatch - Ethernet monitor, keeps track of ethernet/IP address pairings * Chalance - Intercept-proof password authentication * chrootuid - Run network programs in a mininal environment * CBW - Code Breaker's Workbench * Courtney - Identifies the use of SATAN * Dig - Sends domain name query packets to name servers * DNSWalk * Drawbridge - A bridging filter from TAMU * Kerberos - Provides secure networking * MegaPatch - Large number of SunOS patches in one bundle * Netlog - TCP/UDP traffic logging system * PGP - Pretty Good Privacy * Portmap - Portmapper replacement, with access control * SATAN - Checks computers/networks for security vulnerabilities * Securelib - Protects RPC daemons * screend - Filters IP packets * Smrsh - Sendmail restricted shell * Socks - Allows Internet access to firewalled machines * SRA - Secure RPC Authentication for Telnet and FTP * TAMU - Texas A&M Security Tool Package * tcpdump - captures protocol packets from networks * TCP Wrapper - ACLs for network services * Tiger - Scans your UNIX system for security problems * TIS Firewall Toolkit - Firewall package from TIS * Tripwire - Watch for system file changes * Watcher - Watches your system for security problems _______________________________________________________ URL: http://mls.saic.com/sites.html OTHER SECURITY SITES Cryptography * International Assoc. for Cryptologic Research * Cryptography Web Page at UMBC * Cryptography Export Control Archives * Lawrie's Cryptography Bibliography * RSA Data Security, Inc. * Quadralay's Cryptography Archive * Cryptography, PGP, and Your Privacy * PGP Web Page Firewall Vendors and Information * Harris Computer Systems * Sun Microsystems (SunScreen) * Trusted Information Systems * Cohesive Systems * Sea Change Corp. * Raptor Systems * Greatcircle Firewall Server * Virtual-One Network Environment Corp (V-ONE) * CheckPoint Software Technologies Ltd. * Firewalls.R.Us Security Gophers * InterNIC's Computer and Network Security * NIST Security * Security, Audit & Control (SIGSAC) World Wide Web Security * WWW Security Mailing List Archive * WWW Security at Rutgers University Intrusion Detection * Intrusion Detection Systems Archives (threaded) PC Security * Safetynet, Inc. Various Security Sites * Computer Security Research Lab at UC Davis * Computer Security at chalmers.se * Harris Computer Systems * Szymon Sokol's Security Site * The Uebercracker's Web Site * COAST Project and Laboratory * Computer Underground Digest Archive * Security News Clippings Archive * EINet's Computer Virus and Security Page * Crimelab * Phrack Magazine Home Page * TANSU's Security Reference Index * Digital Equipment's Secure Systems Index * Bellcore Security Products * Texas A&M security tools * ftp.win.tue.nl * NIST Computer Security Resource Clearinghouse * Christopher Menegay's Security Page * Security Papers at Johns Hopkins University * Dartmouth Security Tools * CERT FTP Archive * Computer Systems Consulting * Computer Systems Consulting (Local Files) * MIT's Athena Project * Yahoo's Security and Encryption Page * NIST Computer Security * ALW Unix Security Information * ALW's List of Unix Security Programs * ESNet FTP site * Bennet Yee's Security Page * Various security FTP pointers _______________________________________________________ Send questions and comments to Webmaster(a)mls.saic.com.

3 2

Re: Welcome to the list
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:45 AM 10/13/95, Rich Salz wrote: >You will probably find it most helpful to read through a few months >archives of the list (ask around for back digests, usenet access, etc). >And read the Tim's cyphernomicon. You'll find most intro-level answers >there, and you're less likely to annoy the natives. :) Thanks, Rich, for the mention of my extremely long FAQ, available (if you're lucky and Netcom isn't too jammed up) at ftp.netcom.com in /pub/tc/tcmay, as "CP-FAQ." Also in compressed forms. A better version is the Web version at; http://www.oberlin.edu/~brchkind/cyphernomicon/ (And there are a couple of other sites that have it.) It is very long, and doesn't include specific things about the Netscape hack, the au courant topic, but it does have a lot of history, background, motives, and interesting (to me at least) applications/implications. (The problem with most FAQs is that that they're either too basic, or too long. I opted for the encycopedic, figuring people could use search tools. Even so, lots of topics don't get enough coverage.) The best way to get rolling with the Cypherpunks list is, I think, to do what Rich says. Read for a while, look at the archives, get a copy of Schneier's book and maybe a few others (Bamford, Kahn, the Springer-Verlag books, etc.), and find an area that interests you. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

what are these people selling????
by an116512＠anon.penet.fi 17 Dec '03

17 Dec '03

why is the cp meeting sponsored by sun? so we can hear a sales pitch on java? --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

3 2

Netscape beta 2.0
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

For Finding a security bug in Netscape, is it true you only get a measly shirt? if that is true why not just start a virus?

4 3

Netscape 2.0b1J still core dumps on Java
by Raph Levien 17 Dec '03

17 Dec '03

I pointed the latest beta (Solaris 2.4) towards this URL: http://java.sun.com/JDK-prebeta1/applets/CardTest/example1.html ...and, lo and behold, it core dumped with a Bus error. It's unlikely that the bug is in Java itself, as I was able to successfully run the example from Sun's JDK appletviewer. Not impressed yet. Raph

3 2