December 2003 - cypherpunks-legacy

NSCP: Unch..vol rises...morn selling
by carolann＠censored.org 17 Dec '03

17 Dec '03

Volume Rose. Morning selling. Afternoon buying. It's now a good bull, bear tussle. I'd sure speculate on the "patch" until tomorrow afternoon. If not there, by 2:00 unload any position. This is a good day trading stock for now. Lots & lots of movement. Symbol : NSCP Exchange : NASDAQ Description : NETSCAPE COMMUNICATIONS CORP COM Last Traded at: 58 3/4 Date/Time : Sep 21 4:00 $ Change : 0 % Change : 0.000000 Bid : 58 3/4 Ask : 59 Volume : 436900 # of Trades : 550 Opening Price : 55 Last Shares : 5 Day Low : 54 1/4 Day High : 59 1/8 52 Week Low : 45 3/4 52 Week High: 74 3/4 -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: House National Security committee guts SAFE, worse than no
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jonah Seiger wrote: > The Administration WANTS legislation to impose key recovery and wants > continued export restrictions. It has passed the Senate Commerce > Committee, it's in the current export policy, and the FBI is likely to get > it approved by the Intelligence committee tomorrow. > > If they succeed and mandatory key recovery becomes law, there will > certainly be court challenges (and CDT would join that fight), but it won't > be as clear cut as the CDA case was, and it's doubtful we would have the > strength (and the resources) of as broad a coalition of plaintiffs. We may > be right, but that doesn't guarantee victory. *IF* they succeed? (You been on extended vacation?) Any bets that the double-secret guys nab a suitcase-nuke carrying dark-skinned person a few days before they need to win a crucial vote in the war against the citizens? Double-SecretMonger

3 2

Radioactive RNG & tracking systems...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, A friend of mine has been working on a radioactive RNG and while playing with it a potentialy interesting application came to mind. In short, by placing radioactive RNG's in some sort of grid across an area it becomes possible to track radioactive sources by comparing the magnitude of a correlation function between them. This could be extended to include just about any kind of RNG that is sensitive to some environmental factor, say air pressure or magnetic intensity... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

netscape bug
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DF8qC9.4Cw(a)sgi.sgi.com>, "Vladimir Z. Nuri" <vznuri(a)netcom.com> writes: > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? I question the accuracy of this. The fingerd bug was that a string in the static data area was read in with gets which could be overflowed. At some point in memory after this input buffer was the string constant that stored the name of the finger command. What the Morris work did was to overflow the input buffer and replace the string constant "finger" with "csh". When fingerd then exec'ed the command, that gave you a shell running on the machine. While it is certainly true that you can stomp on memory in static buffers, it's not clear that you can execute whatever code you insert there. If the buffer happens to be allocated off the stack (and the stack grows down) then you can modify the return address. Of course, you have to know the address of whatever code you want to execute. And that code has to do something useful. Presumably, if there are two bugs, one which lets you write over a static buffer and one for a buffer allocated from the stack, then you could execute code of your choosing. Of course, that also assumes that you can execute from the data area which is not always true. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

4 5

Fraud Fraut Froth
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

NY Times, Sept 21, 1995. Fraud Can Flourish Without the Internet To the Editor: Your Sept. 19 front-page article on the discovery by two University of California graduate students of a flaw in Netscape, the software used for purchases over the Internet's World Wide Web, raises a number of obvious questions. First, who needs high tech to perpetrate fraud? Any unscrupulous commercial employee could use or sell your credit card number without employing technology. Every time you hand your card to a waiter in a restaurant, it disappears for several minutes. The department store clerks and gas station attendants you deal with also have access to your card number. How secure is that? Ever give your credit card number over the phone to make a purchase from a mail-order house? Or to secure a reservation at a hotel? Who's to say that the employees you're speaking with are honest? Or that your phone is not tapped? Or theirs? I shop on the Internet; I may get ripped off. What's my liability? Fifty bucks -- same as the other scenarios I've described. That's in my credit agreement with the card issuer. So why all the hoopla? Is credit card fraud significantly more prevalent on the Internet than in other modes of purchasing? Or is the banking industry whipping up hysteria among purchasers to curb fraud losses? Was the work of those graduate students funded by someone -- directly or indirectly? If so, by whom? A banking consortium? A high-tech company working on some patentable security scheme? Robert Herrig Peekskill, N.Y., Sept. 19,1995. The writer is a systems consultant.

5 4

Re: GAK patents, anyone? Re: GAK patents, anyone?
by Antonomasia 17 Dec '03

17 Dec '03

Date Arrived: 10Sep_19:13:47 From: roach_s(a)alph.swosu.edu ----------- ... > Back up just a minute. > Aren't inventions protected if the patent is pending? If not, why do such > well known companies who undoubtly have savvy legal council produce products > stamped "patent pending"? I've always regarded it as "We applied for a patent and it hasn't actually been refused yet, so keep off." [The following is based on various magazine articles, net discussions etc.] Until the last year or so (when it harmonised with GATT) US law produced "submarine patents". These were patents applied for, subject to a period of waiting of course, and then (if granted) were valid _from the date of the application_ i.e. back-dated. This meant you could quite innocently find yourself being clobbered by a patent that had only just sprung into existence. There were other problems including the US granting patents to the 'inventor' - rather than the 'first to file'. 'First to file' is actually a good indication of who the inventor is. The other scheme just got inventor-identity disputed by the lawyers. For a vision of patents as they should be, I know nothing to beat Phil Karn's web pages. http://people.qualcomm.com/karn/patents.html -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Re: Renaming TEA remailer
by Antonomasia 17 Dec '03

17 Dec '03

Alex de Joode <adejoode(a)replay.com>: > Do they own the trademark in the UK ? If not you can still use > Anonymizer for whatever service you are providing in the UK. Don't know, don't care. There was a Nice Thing To Do. (Don't forget Lance Cottrell is connected with Infonex, and without him we wouldn't have mixmaster remailers to run.) -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Building in Big Brother, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

--- http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html The Netly News Network (http://netlynews.com/) September 10, 1997 Building in Big Brother By Declan McCullagh (declan(a)well.com) The U.S. Congress, bowing to law enforcement demands for more wiretap powers, is preparing to approve a scheme that endangers the personal freedom of every American. Nobody doubts that wiretaps are useful tools for law enforcement agents. FBI Director Louis Freeh, who as a young agent built his career on them, knows this well. But Freeh's plan would expand the FBI's eavesdropping ability by building Big Brother into every word processor, every e-mail program and every web browser. All computer software distributed after 1998 would have a special, secret backdoor for government access to your most private files. Even your Internet provider would be deputized as a cyber-snoop. It's the technological equivalent of requiring that every homeowner turn over a spare copy of his front door key to the FBI. This is the same FBI that has a long and disturbing history of abusing Americans' privacy. As director, J. Edgar Hoover built a successful career out of illegal wiretaps, secret files and political blackmail. Hoover despised Martin Luther King, Jr. -- branding him an "obsessive degenerate" -- and once sent him an anonymous letter, using information gathered through illegal surveillance, to encourage the depressed civil rights leader to commit suicide. Hoover's legacy? Having the FBI headquarters bear his name today. [...]

1 1

Cypherpunks Bay Area Meeting, This Satuday September 13th
by Hugh Daniel 17 Dec '03

17 Dec '03

What: Cypherpunks September 1997 Bay Area Meeting When: Saturday September 13, 12 noon till 5pm Where: PGP World Headquarters, 2nd floor meeting room Bayview Bank Building, just south of Hwy. 92 2121 S. El Camino Real, San Mateo California http://www.pgp.com/pgpcorp/contactpgp.cgi#head Agenda: Forbes Article background, everyone Cypherpunks at HIP'97, Lucky Green, David Del Torto Ecash announcement, Jeremey Barrett, BlueMoney Software Corp. Linux Onion Router, Jeremey Barrett Diffie-Helman Free of Patent, ??? New FBI Anti-Crypto Bill, how to react, everyone Domain name conference report, John Gilmore Attacks on US remailers etc., Bill Stewart ??? After: Eat dinner somewhere yet to be decided... PGP Building Access: This is an Open Meeting on US Soil and it is free for anyone to attend. There is a minor building security formality due to the facilities being in a bank building: anytime after 12 noon, approach the Bayview Building's Information window (in the plaza, see below for directions), and ask the Guard on Duty to let you up to the 2nd Floor for the Cypherpunks meeting (use the passphrase "cypherpunks release code"). If you have any difficulty (eg. if the guard is on a break), simply call DDT at +1 415 730 3583 he I'll let you in. You can arrive at any time during the scheduled meeting hours, though earlier is better if you want to hear the interesting stuff.

1 0

Re: Another Netscape Bug (and possible security hole)
by Halvor Kise jr. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 22 Sep 1995, Ray Cromwell wrote: > I've found a Netscape bug which I suspect is a buffer overflow and > may have the potential for serious damage. If it is an overflow bug, > then it may be possible to infect every computer which accesses a web > page with Netscape. To see the bug, create an html file containing > the following: Yes! Nice! At last I can include a big Netrape icon on my homepage. Maybye with the text "Netscape users, click here.." All the link does is to crash netscape... At last! Thanks Ray! :-) - - Halvor. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.0 iQCVAwUBMGJlamzoaW8/SAL5AQGGigP/Q0K5tT8pAxNp7xigYP3r8WB6oxQXa7n1 G6L9umkfIBhPeZ9hFhCmSNvZLds31qoczl9QW2u+kSV10QYBuDsTlW56R9Hjh6PM /U5h6Ig9eD3jcf74388YEw4iUyKT+kNbcYSiCCvcK22MdA3T8W5ZXpg7f9ODaLSk uVZBl+pEA3Q= =HBzy -----END PGP SIGNATURE----- -- *** MEMENTO MORI *** PGP-key by fingering halvork(a)frodo.hiof.no http://www.hiof.no/~halvork/ * Support The Phil Zimmermann legal defense fund * http://www.netresponse.com/zldf

1 0