December 2003 - cypherpunks-legacy

Re: ex encrypted script
by jim bell 17 Dec '03

17 Dec '03

At 11:20 PM 12/21/95 -0800, you wrote: difficult for the amateur attacker. >> >>A tale I hear is that when HP had to deliver operating system source to >>the french government they stripped all comments and changed all variable >>and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >>It still compiled but was 100% useless to human readers. > >There is a commercial product out there from Gimpel Software called _The C >Shroud_. It removes all structure from the code, replacing it with gotos, >renames all the symbols to axxxxxxx, converts constants and strings to hex, >substitutes all #defines and expands all macros, strips all formatting and >comments, etc., resulting in a perfectly compilable, but infuriatingly >obfuscated set of source files. >Steven Weller On the other hand, there are some programmers out there whose work product makes such a product totally redundant!

1 0

Re: Navy hacked by Air Force?
by RobL 17 Dec '03

17 Dec '03

At 04:58 PM 12/22/95 -0500, Vin McLellan wrote: > Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... > > I'm new to C'punks, so I don't yet have a grip on the context in >which you consider privacy, property, and other ultimate values. I do >wonder, though: Do you spend a lot of time pissin' on each other's shoes >like this? Laughing my ass off here.. not yet I have seen someone so precisely hit the nail on the head.. Seems this is happening a lot lately.. must be the tension of the holiday season.. <g> Guess I need to start adding plastic shoe-guards to the C-punk kit.. ;) ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

More developments in Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I have been updating my web page almost daily with developments in my case. The latest is that we've written and asked the Court to accept a Supplementary Memorandum opposing the government's motion to toss out our suit, and I've backed it up with a Supplementary Declaration. In it I explain how I just found all of the source code at issue (the Applied Cryptography diskette) on a public FTP site in Italy. This took about 10 minutes using Netscape. I then downloaded the Triple DES code referenced in the earlier Declarations by NSA Deputy Director Crowell and myself in 1.7 seconds, adding that this is somewhat less time that it takes me to move to my computer, insert a floppy disk and return to the keyboard. The government is now asking the judge not to accept these latest filings. Stay tuned! The URL again is http://www.qualcomm.com/people/pkarn/export Phil

1 0

Re: [ecash] Re: Multi-issuer questions
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

>On Tue, 19 Dec 1995, Marcel van der Peijl wrote in the ecash mailing list: > >> Q: If user A signs up with bank A, and merchant B signs up with bank B, >> can user A buy at merchant B? >> >> A: In theory: >> >> Bank A and bank B need to have an interbank clearing agreement. User >> A sends his money to merchant B. Merchant B contacts his own bank, >> bank B. Bank B recognizes the money as being issued at bank A, >> contacts bank A, and clears the coins there. Bank A credits bank B's >> account at bank A, bank B sends an acknowledge to merchant B and >> merchant B sends the goods to user A. > On Fri, 22 Dec 1995, Patiwat Panurach <pati(a)ipied.tu.ac.th> replied: > I dispute this even on theoretical grounds. > >Am I right in assuming that the only reason Bank B has in contacting Bank >A is to confirm that the ecash hasn't been double spent? Once that is >confirmed, there should be no need for contact between the two banks. >Bank A should not have to credit Bank B's account as there has been no >transfer from Bank A to Bank B. The transfer has been the deposit from --------------------- I guess you mean: from Bank B to Bank A >Bank B's customer to Bank B. Bank B is allready "credited", i.e., its >(e)cash researves have increased, the moment Bank A confirms that the >ecash is valid. > In my understanding - and I'm sure Marcel van der Peijl :-) will correct me :-( if I'm wrong - the only way Bank B can verify with Bank A that the ecash it has received from merchant B has not been spent before is by actually sending the _coins_ to Bank A. Hence there _is_ a transfer from Bank B to Bank A and thus Bank A has to credit Bank B's account... Marcel? Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

Houston C'punk gathering
by turner＠TeleCheck.com 17 Dec '03

17 Dec '03

For C'punks in the Houston area, there will be an informal gathering at Strack's Restaurant, tomorrow at approx. 11:00 a.m. I will attempt to get there a little early, and I will be the one with a red lamborghini countach on the table. Just come up and sit down. Strack's has a breakfast buffet which is reasonably priced, or at least it was the last time I went there. Possible Topics for Discussion: I will also be bringing the encryption algorithms used by VMS (the AUTODIN-II, Purdy with salted input, Purdy (Purdy V) with variable length username, and the Purdy (Purdy S) with additional bit rotation). I have tested these under VMS 6.2 and they seem to work fine, although they could be (and should be) optimized for brute forcing. I will also be bringing some password brute forcing code that utilize the system services to encrypt the password (and punch CPU usage through the roof). It will crack a three character password in under a minute on a loaded AXP 3000LX. I will also be bringing a copy of the infamous _Giant Black Book of Computer Viruses_ by Mark Ludwig. Interesting stuff. Directions (from Houston): Take I-45 North. You will pass 1960 and then will drive though a stretch of road riddled with construction barrels. Do not exit Holzworth, but take the next exit (Louetta). Get on Louetta (you will have to make a right turn and you will be on the overpass), and take the overpass west towards Tomball. You will cross through several intersections, Strack's will be on your left, after you cross Kukendaul (approx. 1-2 miles ahead). If anyone gets lost, or wants more info you can page me at: (713) 866-0989.

1 0

Re: CFS and Linux
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> 1: please make it install 'out-of-the-box' on Linux. AT&T's refusal to support CFS and other so-called "secure" software under Linux is typical and to be expected. Linux, the most popular alternative to Microsoft, represents a direct threat to AT&T's bread and butter and to their ability to control the security software market. The fact that the CFS install programme deletes other security software is no accident. We would be foolish to expect them to admit their malice - they will excuse it as a "mistake" or will ignore it altogether. I don't agree with all of the "Gates" character's claims against AT&T, however I think their motives can be summed up in three words: Greed, Greed, Greed. Use their software and you support the giant. Remember their theft from the Berkeley graduate students each time you accept "free" software from this greedy monster. I also do not accept Blaze's cowardly defense of his actions and of his too-comfortable situation; one cannot help but be reminded of the Nazi "just following orders" prattle repeated rote as they were called to answer for their crimes. It rings no less hollow to this day. But I will not condemn him, nor will I call on others to do so, preferring to leave that matter between him and his Maker. Weinstein, of course, is beast of another color, but that will have to wait. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 3

Re: Navy hacked by Air Force?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 22 Dec 1995, Vin McLellan wrote: > This might be relevant. This is a page from the NCCOSC web site > <http://www.nosc.mil> Thanks for posting this. It was very helpful. > The Naval Command, Control & Ocean Surveillance Center (NCCOSC) > is the U.S. Navy's warfare center for command, control and communication > systems and ocean surveillance and the integration of those systems which > overarch multiplatforms. NCCOSC is based in San Diego, CA. > > Note that NCCOSC recently decided to beef up NCI's user > authentication. See "Current Initiatives." Duly noted ... (as long as it don't lead to a false sense of security) > [* ] NCI net - What it is > > * An enterprise network serving NCCOSC and other communities of interest > * Modelled after the global Internet, logically part of the Internet ... > * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout > the organization and to the Internet > * Provides dialup access from home or TDY via 1-800 number, including > SLIP and PPP support Betchya that WATS line gets a whole lotta billings to it. <p> > * MIME adopted as corporate email standard, email systems upgraded > o Many user agents upgraded to MIME compliance > o Testing gateways for interoperability with non-compliant systems > o Performing extensive interoperability tests MIME??!!?? They adopted MIME??!!?? Good grief. This is not good ... not good at all. > * New sites connected > o CINCLANTFLT, Norfolk, VA > o The Pentagon > + BRAC Office > + OSS LAN > + DASN/C3I Oh no ... it's worse ... *sigh* ... no wonder that Newt and Dole had such a grim look on their faces when they emerged from their scheduled one-hour, (went for two) meeting with the US President -- the one that was the day before the freshman congress persons did their incredible end-run on their own leadership. Impressive. Truly. What would have caused both Newt and Dole to flush like they did? Did they demo a hack into the personal e-mail of the Vice-Chairman of the JCS? > * New Web server installed > o "neelix", a Sun SparcServer 1000, installed outside firewall > o "www.nosc.mil" now points at neelix Pretty firewall ... nice firewall ... <p> > * Enhancing Infrastructure to provide ISDN dialup service Good idea. ISDN dialup provides significant bandwidth. Very significant bandwidth. Almost enought to control a battleship. (If there were any battleships, I mean). > * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 > Mbps > * Getting sites 100% connected (TCP/IP to every desktop) > * Developing MIME to X.400 gateway for connectivity to DMS world Yep. Perfect. Just what the doctor ordered. TCP/IP to every desktop. And MIME for all. Oh, and to ice the cake, toll-free ISDN dial-ins. Hmm, let's see ... for Christmas Santa ... I'd like a packet-switched network with a public outdial to a toll-free ISDN dial-in ... oh, that and a Gulfstream V under the Christmas tree. What are they going to do next, give everyone some Czechoslovakian C-4? Stick a bit of civilian software into all of this, and let's all have a good look at whether someone can take over something a little more interesting than a battle ship. Like maybe an aircraft carrier?? Gee, that oughta harden their drawers ... Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. P.P.S. Feel free to repost widely ... IW ... c4i-pro ... wherever ...

1 0

IW Mailing List iw/951222 (fwd)
by fc＠all.net 17 Dec '03

17 Dec '03

The following is forwarded from Risks [...s indicate missing regions of text] > --------------------------------------------- > FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) > ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator > ... > Date: Fri, 22 Dec 1995 00:59:09 -0500 > From: RSRMadison(a)aol.com > Subject: Re: Naval Battleship takeover (Long, RISKS-17.55) > > A message from the InfoWar list noted that: <<There are NO active US > battleships!!! And there weren't any last September.>> > > As stated, this is true. However, let the record show that the US Navy still > flies the flag daily over 1 commissioned battleship, the USS Arizona, > permanently stationed in Honolulu. > > ... > Date: Fri, 22 Dec 1995 10:53:56 -0500 > From: Bob Brewin <brewin(a)access.digex.net> > Subject: Re: Naval Battleship takeover (Long, RISKS-17.55) > > Yikes. This story will not die -- it just lives on a Web site at the > Daily Telegraph in London. Having worked for a British news > organization (Reuters) for years, if you believe the Telly story, call > me about a bridge I have for sale. > > The Air Force did not hack the Navy over the Internet. They did it over > a secure network (SIPRNET) which is firewalled from the Internet. > > The Air Force conducted this attack with the Navy's knowledge and > permission. > > The Navy does not have any battleships on active duty. > > The Air Force did not get control of the none-existent battleship. > > Yep. This does have the makings of a legend. > > Bob Brewin editor-at-large (whatever that means) federal computer week > antenna(a)fcw.com brewin(a)access.digex.net > ... -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

PAN_maw
by John Young 17 Dec '03

17 Dec '03

12-23-95. WashP: CyberCash this week plans to offer its shares of stock to the public. It is one of a handful of fledgling companies that hope to coin profits by helping others make financial transactions on the Internet. But consumers still worry that hackers on the Internet can ferret out credit card information. CyberCash's technology blocks online seeing of unscrambled credit card numbers. CyberCash and its IPO advisors believe they have developed schemes that will convince lemmings that there is the equivalent of steel-plated armor around their life savings as they vanish into the Internet's mega-panamaW$. "This is the latest Internet digital currency slaughter- offer for fat-fee hacking our Widows and Orphans Ever-Safe Pensions," choraled a split-gut ice-eyed Santanalyst. PAN_maw (5 kb)

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... I'm new to C'punks, so I don't yet have a grip on the context in which you consider privacy, property, and other ultimate values. I do wonder, though: Do you spend a lot of time pissin' on each other's shoes like this?

2 1