December 2003 - cypherpunks-legacy

Re: WSJ on Netscape Hole 3
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <199509252300.QAA29812(a)infinity.c2.org>, sameer(a)c2.org (sameer) writes: > He's -asking- for an exploit. Tshirts to Ray and the person who > does the exploit, if it gets written. Maybe I should just ring up 8lgm and > have them do one. > > > > > > On Mon, 25 Sep 1995, John Young wrote: > > > > > The Wall Street Journal, September 25, 1995, p. B12. > > > > > Marc Andreessen, vice president of technology at Netscape, > > > said the company will issue fixes for the recent glitches > > > later this week. He added that it's unclear whether > > > anything other than temporarily crashing a user's computer > > > could result trom the recent flaw. > > > > Oh Marc, you didn't really want to say that, did you? > > > > -Thomas > > I asked Marc about this one, since it bothered me too. Apparently Jared asked Marc if he was aware of specific examples of how this bug might be exploited. Marc replied that we had not seen anything other than what was already posted on cypherpunks. Since the original article did not use quotes, I assume that what was written was a paraphrase, and as such it has been interpreted by the author. That said, we take this problem seriously, and have taken steps to fix it. The patch that will be released tomorrow will include fixes for this buffer overflow, and others that we found during a review of all of our code. I think it would be more constructive to pound on the new version than one that is known to be busted, and will be patched by tomorrow. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Internet draft on MIME/PGP
by P.J. Ponder 17 Dec '03

17 Dec '03

Don't want to start another MIME war, but thought some on the list might be interested in this. ---------- Forwarded message ---------- Date: Tue, 26 Sep 95 15:10:57 -0400 From:Internet-Drafts@CNRI.Reston.VA.US To: IETF-Announce: ; Subject: I-D ACTION:draft-elkins-pem-pgp-00.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : MIME Security with Pretty Good Privacy (PGP) Author(s) : M. Elkins Filename : draft-elkins-pem-pgp-00.txt Pages : 3 Date : 09/25/1995 This document describes how Pretty Good Privacy (PGP) can be used to provide privacy and authentication using the Multipurpose Internet Mail Extensions (MIME) security content types described in RFCXXXX (draft-ietf-pem-sigenc-03.txt). Internet-Drafts are available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-elkins-pem-pgp-00.txt". A URL for the Internet-Draft is: ftp://ds.internic.net/internet-drafts/draft-elkins-pem-pgp-00.txt Internet-Drafts directories are located at: o Africa Address: ftp.is.co.za (196.4.160.8) o Europe Address: nic.nordu.net (192.36.148.17) Address: ftp.nis.garr.it (192.12.192.10) o Pacific Rim Address: munnari.oz.au (128.250.1.21) o US East Coast Address: ds.internic.net (198.49.45.10) o US West Coast Address: ftp.isi.edu (128.9.0.32) Internet-Drafts are also available by mail. Send a message to: mailserv(a)ds.internic.net. In the body type: "FILE /internet-drafts/draft-elkins-pem-pgp-00.txt". NOTE: The mail server at ds.internic.net can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e., documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. For questions, please mail to Internet-Drafts(a)cnri.reston.va.us. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.

1 0

Re: Netscape Stock Prices
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:45 PM 9/26/95, Jeff Simmons wrote: >Date High Low Close Volume > >950809 75.000 53.750 55.500 3851.8 : : >950925 69.000 62.250 67.000 684.0 WSJ article re: overflow bug Yup. Looks like the old "wall of worry" trick to me. Stand back and let the train go buy folks, madness of crowds and all that. Actually, Netscape is still the only game in town as far as Wall Street goes. What the market needs is a foregone alternative, and some lucky sailor to mistake a tulip bulb for an onion... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

weak links in DigiCash system
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jerod, I'm forwarding your message to a couple of lists. I thought you made good points. Of course DigiCash is only running a demo, but still-- why demo poor security? I think it doesn't make a good impression. Bryce, signatures at end - ------- Forwarded Message To: ecash-feedback(a)digicash.com cc: netherto(a)taussky.cs.colorado.edu, wilcoxb(a)taussky.cs.colorado.edu Subject: Security in your ecash project. Date: Tue, 26 Sep 1995 17:00:15 -0600 From: Jerod D Netherton <netherto(a)taussky.cs.colorado.edu> I have a couple of problems/complaints with your ecash project. When I was sent my Acct ID and Passwd they were sent to me plain text instead of being PGP-encrypted first. This means that some malicious hacker could have intercepted the e-mail message and stolen the free cyber-bucks you were so generous as to give me. Second, on the WWW-page where one downloads the software it does not seem to do a secure connection between my browser and your server (on netscape there is a small key in the lower-left hand corner that is supposed to show when one is securely connected to a secure server). So someone could sniff my password from the transaction when I GET the software. Also When I'm buying/selling things it would be smart for all parties involved to be using PGP, and I think you should stress this point more in your page. Otherwise this is another vulnerable point in your system IMHO. Thank you for your time. /\ The Scottish Claymore of All CyberSpace UgradLab DumpMeister /\ Watcher of Anime. Addictor to Muds. WebMaster of OAA at CU! < E A N O R JaDuN Comes. Shade and Sweet Water \/ Yuri, Miyu, Nene, Ranma-chan, Ryoko, B-ko! \/ Anime, Chivalry, and Physics Forever!!!! Finger for PGP Key Email:netherto@colorado.edu Phone:(303)786-8311 Pager:(303)610-1203 http://ugrad-www.cs.colorado.edu/~netherto/Home.html Lab:(303)492-6207 - ------- End of Forwarded Message signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGiNz/WZSllhfG25AQHFMAQApc6Td8e6bQsBqpCU+EnfbYhueJthyYPS rkHfFrenHNwG/MCEFtwXBBxEQP3yyvnY2qD9RrrhC3cN0HcFw2jE8r++2Y3Z9H7u dJuIKodi2LP8POoW6dJPlW93N5E/+LhuCZvfqe78T2bIl20GIYQ5x0UUTm+APo2f MLu6wUEAHTE= =ofwj -----END PGP SIGNATURE-----

1 0

Re: Cypherpunks Press release
by tcmay＠got.net 17 Dec '03

17 Dec '03

I guess you all know how much I hate this "who will be our spokesman?" thread, but my opinion has been explicitly asked, so I will again comment. Hopefully, adding a few new points. At 6:55 AM 9/26/95, Craig Hubley wrote: >Damn fine idea, but how do a bunch of (p)anarchists choose a mouthpiece ? >Should we assign someone to be 'our' lawyer ? > >I'd volunteer to be 'spokespunk', I've certainly been interviewed for TV and >print enough, and know how to handle and present myself to the press, but if >this is considered an 'honor' rather than a 'pain in the ass and potential >legal lightning rod' then I'd like to suggest someone with a longer pedigree >who has been writing more code lately take it on. Tim ? I've turned down several recent chances for interviews, for these reasons: 1. I feel the people doing the work should be interviewed, not just someone who has some visibility (whatever mine might be). If PGP is the issue, then they should talk to those working on PGP. If anonymous remailers are the issue, etc. If, by some chance, they are interested in things I have directly worked on or written extensively about, then maybe they should interview me. (Although for other reasons I refused to have my name attached to the cover story in "Information Week" about "Internet Theft," BlackNet, etc.) 2. Location, location, location! The media foci are Washington, New York, and San Francisco, at least for our area of interest. Occasional forays into Austin, Miami, L.A., etc. This is where the taped interviews are done. Several "crews" recently in SF wanted "sound bites" and "video bites" from people like me. I refused, pointing out the wastefullness of my time in driving 100 miles over mountain roads to SF, fighting parking problems, waiting around, and ending up with a 7.89 second clip of me saying something scripted. (In February I stupidly agreed to travel to LA for a filming of a BBC show about encryption. Left at dawn, drove to San Jose, flew to LA, took shuttle to Hollywood, waited around for several hours while crew finished taping Alvin and Heidi Toffler, set up my laptop, was interviewed by show's producer, agreed at her repeated prodding to say "I am a Cypherpunk." Got back to my house at midnight. Guess what they used? The stupid line "I am a Cypherpunk" and maybe about 20 seconds of other random comments. This is what we face, as other high tech shows I see have the same disjointed, out-of-context flavor.) The point? These "journalists" are tuned to looking for catchy quotes, all the more so on video than in print. Text journalists can handle complex themes much better than video reporters can, for many and oft-discussed reasons. (Even more disgusting than this was a more recent appearance of a BBC film crew at a Cypherpunks meeting. They wanted to "stage" the news, to have the meeting discuss a 2-year-old topic, because that's what their script called for. I got up and left, as did several other people. I haven't seen this BBC show, but I gather from a URL that this is the one that has "performance art" examples of crypto....) Any "spokesman" needs to be easily accessible when they need a "filler quote," or a "reaction quote." However: 3. THERE IS NO SPOKESMAN, THERE IS NO CENTRAL OFFICE, THERE IS NO BOARD OF DIRECTORS! With no organization, no office, no coordination, we cannot "feed the media machine" the way it expects to be fed. Nor can we "elect" such folks. I didn't help start this list--not that this gives me more moral sway--in order that J. Random Volunteer will start speaking for "our beliefs" or will start explaining "our goals" and "our plans." Far better that journalists like Steven Levy and John Markoff subsribe to the list, or to condensations by people like Eric Blossom, and then deal directly with the experts in some area. Thus, on the latest Netscape flaw, they would contact Ray Cromwell directly, not deal with the press releases written by J. Random Volunteer. Anarchy is part of our charm. More importantly, part of our theme. Face it, we don't have a press office, we don't have staffing, and--most importantly--there is no one out there who speaks for me. A spokesman for the Cypherpunks is an oxymoron. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

Re: Hack Microsoft?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 00:04:08 -0400 (EDT) you wrote: > > > Microsoft recently got C2-security status approved for Windows NT by >the National Computer Security Center, a division of the NSA. They >are supposed to put systems through "laborious testing and review" before > If Cypherpunks can find flaws that the NSA can't, or won't divulge, >what does that say about their so-called COMSEC ability. > For fun ways to hack NT, check out http://www.somar.com/security.html. Some of these are really laughable. You can use NT's LogonUser API call to repeatedly guess passwords until you hit it, since NT offers no way to limit number of login attempts. There also is no way to stop remote users from modifying the registry. *Any* user with an account can remotely dump and modify the system registry. So in theory you can write a bruteforce program to keep guessing until it gets a password, then modify the registry to make the system to "interesting" things. The worst part of all this is that the Registry is very poorly documented, MSoft must consider most of that info "confidential." Fortunately, when using NT's SMB services such as drive and file sharing, passwords are never sent in the clear. Just make sure you disable that "Guest" account.:) Dan Bailey *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

2 1

(fwd) FBI COMPUTER FRAUD WEB SITE DIVISION
by imschira＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

Path: mnemosyne.cs.du.edu!uunet!in2.uu.net!noc.near.net!das-news2.harvard.edu!oitnews.harvard.edu!newsfeed.rice.edu!news.sesqui.net!news.concom.com!news From: Rick Casimir <rikkkk(a)concom.com> Newsgroups: misc.forsale.computers.pc-specific.misc Subject: FBI COMPUTER FRAUD WEB SITE DIVISION Date: 21 Sep 1995 17:47:42 GMT Organization: Connections.Com Lines: 9 Message-ID: <43s8fu$r4t(a)carbon.concom.com> NNTP-Posting-Host: dial139.concom.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 1.1PE (Windows; I; 16bit) HELLO, If you or someone you know who has been scammed or did"nt ship you products after you prepaid or for whatever reason who screwed you. REPORT THEM TO THE FBI: <http://www.fbi.gov/compcrim.htm> -- -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information To be a skeptic is to refuse to be a victim. "This is my .sig. There are many like it, but this one is mine." Freedom...yeah, right.

1 0

CHA_cha
by John Young 17 Dec '03

17 Dec '03

Worth Magazine, October, 1995, has a longish, easy-reading, supportive article on David Chaum and digital cash. Virtually alone among E-money thinkers, Chaum insists on creating anonymity for all transactions -- building a tamper-proof system that works just as "real" cash always has, from cowne shells to $100 bills. The key, he says, is this: Without the spender's say-so, no one should be able to trace who paid whom for what, whether a transaction takes place online or in a swipe of a card at a coffee shop. It's a libertarian approach in tune with Chaum's roots in freewheeling communities such as Berkeley and Amsterdam -- but it is anathema to control freaks like the FBI, the IRS, and corporate information marketers. Chaum says every digital-cash system but his has the potential to be abused or compromised -- and the math seems to bear him out. His competitors, however, insist their plans will prove plenty secure in practice. They dismiss Chaum as an incorrigible purist, a brilliant mathematician and innovator whose political views are hindering his chances of success. Like many in the digital elite, Chaum, an unabashed utopian, does want to create a new world. To him, electronic money is just the first consumer use of an arcane field he hopes will transform society: cryptology, the science of secret codes. In cyberspace, these codes can prove a powerful way of shielding a person's identity -- or of verifying an identity without giving away extra information. Armed with personal computers and good software, says Chaum, ordinary people will finally have the power to do and say things without being tracked by Big Brother. CHA_cha (31 kb in two parts)

1 0

Netscape as vehicle for cypherpunk agenda/the cypherpunk bully pulpit
by sameer 17 Dec '03

17 Dec '03

I was thinking recently how the events of the past week or so have turned me into a sort of a Netscape advocate. Granted, there are bugs in Netscape, and there probably will be more bugs uncovered (someone needs to write an exploit if they want themself & Ray to get a T-shirt btw), but Netscape is interested in fixing problems and the new 2.0 is doing encrypted email, probably with a really nice interface (Haven't seen it yet, of course) and they are working to make the 128-bit version downloadable. (The 128bit version is available overseas already anyway, I hear.) The really big sticking point I see, however, is the certification authorities. There is a single point of failure here and that is at Verisign. This becomes a large problem I think if the en rypted email that Netscape does requires personal x509 certificates (I read that Versign is issuing those for $9/each.) This is a problem because for one thing I don't think Versign will want to issue certs to psudonyms, and Netscape may not talk encrypted email to non-certified people. (I am not sure) The solution to this, of course, is to allow Navigator to accept alternate certification hierarchies, so we can setup a Cypherpunks cert agency or a c2.org cert agency, which -will- sign nym's keys, etc. The question exists though, as to whether or not Netscape will allow for alternate agencies in Navigator. I haven't seen any mention of this feature in 2.0, so if the feature exists in 2.0, then great! Otherwise, unless Netscape is going to allow for alternte cert agencies on a specific timescale, I think we have to do something about it in order to force the issue. Along the same lines of what happened recently-- because of the exposed hole and the pressure put on Netscape, management was finally willing to let some of the code be available for public review. If something happened to show how relying on a single point of failure such as Verisign was bad and resulted in much press & publicity, then perhaps Netscape management would be convinced to allow for alternate cert hierarchies.. Some sort of hack which demonstrates this would be great. I am feeling uncreative and can't think of anything effective short of stealing Verisign's private key, but that would be pretty damn tough. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

4 3

Re: cypherpunks press releases/contact list: YES!! DO IT!!
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" There is this widespread and wholely misplaced affection for "cypherpunks". We aren't a company or an organization. This is a mailing list, and occassionally a seminar series in places like NoCal. It isn't a "group". .............................................. And you of all the cpunks, Perry, are the most affectionately considered. :>) Actually, those who want to become official spokewheels should consider that the cypherpunk agenda is to promote anarchic (i.e. individualistic, self-responsible) action. That is, that the individual who chooses to act in a 'cypherpunkish' mode does so at their own risk by their own motivation by their own decision and their own discretion. Not everyone on the list subscribes to this ideal of complete independence; furthermore, for anarchist types to identify with a "group" would be inconsistent with the philosophical attitude of the "members", who come-&-go as they please. However, it would be an amazing event to see VZ Nuri-logical (Cypherpunk Extraordinaire) on TV, saying something like, "Yes, I fully and completely subscribe to the Cypherpunk agenda: black markets, anarchy, overthrow of governments. National borders are just speed bumps on the information superhighway." <g> (It would be a *cold* day in Hell!) .. Blanc

1 0