December 2003 - cypherpunks-legacy

EFF Compromises, as described in "Wired"
by tcmay＠got.net 17 Dec '03

17 Dec '03

If Eric Hughes can break his silence to comment on the FV "discovery" of keystroke-capture programs (funny, I've had a couple on my Mac for years, for error recovery), then I guess I can break my silence about "Wired" articles. This afternoon I sat in a bookstore and skimmed the article on what happened at the EFF, about the Digital Telephony compromise that was approved by the EFF board (our own John Gilmore was reported to have been the sole negative vote), and about how the EFF was effectively "chased out of town" as a result of trying to be a political entity. I can't comment on this outlook, as I am nowhere near the inner circles of the EFF. But it underscores a belief I have: that if you play _their_ game, they have already won, and you just don't know it. What's the alternative? Get them to play _your_ (_our_) game, and maybe they won't win. I'm still a member of the EFF, but the more I read about their problems, including a $200,000 debt, the more convinced I am that the Cypherpunks model is a better place to devote one's efforts and hopes to. We're still going strong after almost three and a half years, with no debt (no assets except ourselves, of course) and no "relocations" from Boston to Washington to San Francisco. So, maybe we're doing OK. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: more RANTING about NSA-friendly cpunks
by Bruce Baugh 17 Dec '03

17 Dec '03

At 12:41 PM 1/29/96 -0800, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: >when you choose to be in fear of it, the bureacrats win. On the contrary. Fear is a right and proper response to irrational demands made by people with lots more force and public support than me. Fear becomes bad only in our response to it. If I get scared into inaction, _then_ the bureaucrats win. If I take the fear as motivation to improve my own security and reduce my dependence on the whims of others, then the bureaucrats lose. It is fear of the risks I run in an unsecured state that motivates me to work on my own privacy, and to pass the info I learn on to others. But fear, in this case, is merely the acknowledgement of the vast potential for harm. Denying it is just foolish. >sheep on the planet, all the way up to the head sheep TCM, who writes >long explanations of why the police state is inevitable and nothing >we can do will stop it, You must be reading an alternate universe's version of Cypherpunks - check to make sure that your quantum stabilizers are in order. In _my_ universe, Tim May is a prominent advocate for freedom and self-government, who has written well on why the collapse of the police state (and all states) is inevitable, and what we can do in the meantime. Side note to list owner: perhaps we need a majordomo hack to check this cross-universe traffic problem. It seems to be becoming increasingly common. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: Java Sniffer (Was: Re: FV Announces That The Sky Is Falling)
by lyalc＠ozemail.com.au 17 Dec '03

17 Dec '03

>Much more likely, IMHO, than a Java sniffer is a Java Trojan horse that pops >up an innocuous dialog box and asks you to enter some sensitive piece of >information, then sends it off somewhere. About all it takes to write that is >a modicum of skill in user interface design. You could write it in any >programming language, but in Java it may be particularly effective, since >people may come to expect to be prompted for sensitive info over the net by >Java apps. Maybe the Java folks who just left Sun decided to seize the >opportunity ;> > >Futplex <futplex(a)pseudonym.com> > A very realistic scenario - any comments or reasons it can't happen ?? second question: How can you be sure you receive the applet that you "think" you've requested ? Any illuminating comments to assit my awareness of java ? lyal

2 1

Re: PGP Shell Integrity
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:13 PM 1/29/96 -0800, you wrote: >Firstly, if this is viewed as "Noise" rather than "Signal", please accept my apologies. Looks like a real technical discussion instead of a flame - obviously the wrong list :-) >The matter at hand concerns my concern over my inability to check the > "integrity" of a PGP windoze shell written by Michael R. Lyman at Aegis Research Corp. > >I worry that since the shell has access to my secret ring that it might > be sending it somewhere without my knowledge. I don't know that package, but most of them act as wrappers around DOS PGP rather than filtering keystrokes or doing PGP internals. There are several risks - getting your secret ring, getting your passphrase, getting the RSA parameters without the passphrase itself. Obviously, having your secret key ring file leak is not good, but the fun parts _are_ IDEA-encrypted using your passphrases, so it's not too much of a risk. Having the passphrase or the raw keys stolen would obviously be worse. DOS/Windows is _not_ a secure operating system, if you believe that there's more than one person in the universe. (DOS doesn't believe that, so in some sense it's perfectly secure. :-) Nathaniel Borenstein's recent postings are a good reminder that keystrokes can be stolen, easily, in that environment. >The freeware was, according > to Mr.Lyman, developed "Project Manager, Forward Air Missile Defense, > United States Army Missile Command". That gvt. affiliation gives me > considerable pause as regards back doors and other ways my secret ring > and pass phrase could be compromised. > >Does anyone have any familiarity with this freeware? I do not think > I am being paranoid.. just careful. Lastly, if I am not a programmer, > what sort of inspection can I perform on the software to make sure it is not "bugged"? Without source code, if you're not a programmer, the things to look for are circumstantial evidence - is the copy of the program you got off the server PGP-signed by the purported author? Or by any programmers you trust? That doesn't tell you the program is trustable, but it does tell you if it's a fake replacing the real thing. Is the real thing trustable? (Well, probably...) There's also the problem of leaking your key back to the Bad Guys, but that's easy - the program could leak it out in your PGP messages (either obviously, as a second recipient, or in subtle nasty ways like playing with the system clock on timestamps.) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: Opinion piece in NYT; responses needed
by andreas＠horten.artcom.de 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "Rich" == Rich Graves <llurch(a)networking.stanford.edu> writes: Rich> Is DT going to block TCP port 80 and UDP ports 7000-7029 Rich> from every machine in the world? We'll see. I told the Admin of dfn.de nicely that his routing seems to be broken. If he responds with pointing to the Zuendel site, I'll send him the other URLs and ask him to stop routing to these sites as well. Andreas P.S.: I need some fodder. Anyone else mirroring the site? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAgUBMQ3XXUyjTSyISdw9AQEvgQP+MyHBlF7JmcIBHEceFCxECnyMbuPHBnPa MvoHGdLZwIxWmEpa8YwTHb06mQ5J3oO2AiWNWLgw480krWGV10R8bhMIOBP51Htz 7Odl6S1S1NLtxE/yyzkSH4D4AukFT4BrMviPWVDGnArGwS8XioTyyxhYC4JKyjfu ahrCdu9nha8= =SWyn -----END PGP SIGNATURE-----

1 0

Re: The Politics of Mistrust
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 13:31 1/28/96, John Young wrote: > > While not directly related to technical crypto, a number > of findings parallel discussions here about the diminution > of personal and economic security. Samples: My personal reason for mistrusting the Government is that it uses Coercive Power to steal money from me (via "taxes" such as FICA) claiming that I am buying Benefits for myself such as SS and Medicare yet it does not meet the obligation to supply these services under the promised terms when I need/want them. If SS and Medicare were run by a private company and operated the way the Government changes the rules, all of Top Management would be in Prison for Fraud (and a number of other charges). Any Benefits program that the Government uses its coercive power to force me to join and pay for should be REQUIRED to maintain the terms in place when the payments were collected (ie: There should be no unilateral alteration of the terms by the Government). The ONLY program that I can think of where this has even partly occurred is with IRAs (all payments prior to year X are treated under the original tax rules while payments into an IRA after that date have a new tax status). All other programs are subject to rules modification (ie: reductions of promised/paid-for Benefits) or Congress defunding at a moments notice.

1 0

Handy WWW anonymizer proxy *and* translator!
by Rich Graves 17 Dec '03

17 Dec '03

Not only does it prevent the nasties from logging where you're coming from, but it also translates to Canadian on the fly, eh? -rich ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 00:32:36 -0500 From: John R. Covert <covert(a)covert.enet.dec.com> Newgroups: alt.revisionism, alt.politics.white-power, alt.internet.media-coverage, alt.censorship, comp.org.eff.talk, soc.culture.german Subject: Re: Simon Wiesenthal Center Did Not Attempt to Censor Internet In article <declanmDLzvJ8.8MK(a)netcom.com>, declanm(a)netcom.com (D B McCullagh) wrote: >If the German government forces Deutsche Telekom to block access to web >servers at Carnegie Mellon University, MIT, and Stanford University, it >will be slicing off communications with three of the most respected >universities in the United States. It will be interesting to see if they do. At first, I refused to believe that they would do it to WebCom. I just thought I'd mention another technique for dealing with this problem. It doesn't require dedicating disk space to specific sites; instead, it relays through to any site you specify. For an example, see "The Great Web Canadianizer" at http://www.io.org/~themaxx/canada/can.html To thwart censorship of specific sites, people who have a bit of bandwidth to spare could set up cgi scripts like this one (without the text modification the Canadianizer does -- that's its hack). (Zundel's stuff is no less offensive after the Canadianizer adds a bunch of "eh?"s and "hosers" and changes all the "-ing"s to "-in'".) /john

2 1

Re: CONTEST: Name That Program!
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:45 AM 1/30/96 -0500, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: > In fact, I'd settle for getting onto 10% of the machines, although I > suspect I could get onto more like 80% without raising a sweat. You've alleged that Macs and Unixen should be about as easy as Windows machines to crack with your CardShark. I disagree - most Mac users I know have been using virus protectors more consistently and reliably than DOS/Windows users. However, if their virus software only stops known viruses, rather than anything modifying critical resources, you might get away with it for long enough to surf some numbers. Unix is a much tougher case - while there have been a couple of viruses, they don't spread very well, even when everyone uses the same binary formats. B2 helps, of course; B1 configured reasonably should also work. ... >Case closed. Your argument would hold a lot more weight if you could >convince me that the average Internet consumer was going to rebuild his >UNIX kernel every few weeks. I suspect a machine that gets rebuilt every week may be _more_ at risk :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

2 1

Domain hijacking, InterNIC loopholes
by rishab＠dxm.org 17 Dec '03

17 Dec '03

While filling in details for modification of my domain (dxm.org) I realised that I haven't seen much written on domain hijacking. We all know about mail spoofing, which let's you pretend you're someone else. Mail spoofing is one-way - you can send, but not receive. This is the same with IP spoofing, where you pretend to be a trusted machine, but again you can send but not receive. Unlike IP spoofing, which can lead to major security breaks (you can become root on someone else's machine), domain hijacking is not so much a security issue as a commercial one. Domain hijacking uses loopholes in InterNIC domain registration procedures to completely take over a domain, allowing you to send and receive e-mail, and other traffic such as ftp/www. As I haven't seen this explained, and have seen no warnings for sysadmins, here goes: To do 'IP hijacking' (receive packets as well as send) you will need to modify routing tables all over the place, where you're not likely to have access. To do domain hijacking, you would need to modify DNS entries in several nameservers, to which again you're not likely to have privileged access. On the other hand, if you could associate an existing domain with a nameserver you _do_ control (root access on any machine connected to the Net is enough for this), your lack of access to the present nameservers would become irrelevant. So, 1. set up a nameserver on your machine, with address, cname or MX records as required for the victim domain address - victim.com. You can do fancy things with nslookup on victim.com's existing nameservers to find out what's required. Make sure the MX, address and cname records in your machine point to machines under your control. 2. send a modify domain mail to hostmaster(a)internic.net, with your machine as nameserver replacing any existing ones. The InterNIC has no authentication procedures for normal hostmaster requests, so your modification will get processed. 3. Ta DA! Wait for InterNIC to update its records and broadcast changes to other nameservers. From then on, a lookup for victim.com will go to ns.internic.net, find that ns.evil.org is the nameserver, and send all mail to @victim.com to victim.evil.org, route traffic to www.victim.com to www.evil.org, whatever you want. This is not a security risk? No. But, to quote a delightfully low-key document from InterNIC, "[such] an unauthorized update could lead a commercial organization to lose its presence on the Internet until that update is reversed." Ah. But that update will be reversed only when victim.com's sysadmins realise what's happened. If evil.org is clever enough, it will not halt the mail flow, but forward everything on to victim.com (after keeping a copy, of course). It could act as a proxy server to www.victim.com, accessing all URLs (using victim.com's real IP address) on demand and relaying them to browsers who are actually looking at www.evil.org. And so on. Unless victim.com's admins are particularly observant, they may not notice a thing. How many sysadmins out there do what victim.com could have done? I.e. run nslookup on victim.com regularly to check that the nameservers listed are as they should be, and if they're not, to immediately send a new update to InterNIC? Not many, I believe. On the other hand I know no case of domain hijacking actually taking place. But I don't know specific instances of WWW credit card fraud either. That delightful InterNIC document I mentioned is the draft paper on the InterNIC Guardian Object, first out in November 1995, latest version out earlier this month. It's an internal InterNIC proposal for a "Guardian Object" which would guard any other object (such as a domain name, or individual, or hostname, or even another guardian). It would allow a range of authentication methods, from none (very clever) and MAIL-FROM (easy to spoof) to CRYPT (1-way hash, like Unix passwd) and PGP (using public keys stored at InterNIC). All domain and other templates will be changed to work with guardians. The procedures in the original draft looked easy enough; the latest ones are formidable. Incidentally, this draft appeared two months after the InterNIC started charging. The wonders of the profit motive. Rishab ps. I'm not quite back on the Cypherpunks list yet, so please Cc responses you feel are important to me at rishab(a)dxm.org. pps. I quite forgot. The URL for the latest Guardian Object draft: ftp://rs.internic.net/policy/internic/internic-gen-1.txt

5 4

Re: [FACTS] Germany, or "Oh no not again"
by Bill Stewart 17 Dec '03

17 Dec '03

A message claiming to be from > SANDY SANDFORT allegedly wrote: >> Isn't there something in U.S. Code about crossing state lines >> for immoral purposes? >No relevance here. Originally enacted to combat the "white >slavery" trade, it was probably used more to prosecute unmarried >lovers for sexual activity outside of marriage. I don't even >know if it's still on the books, but as I said, no relevance in >the current debate. There's a lot of US law about transporting various materials across state lines or using interstate carrier services or in ways that _might_ affect interstate commerce. Politically incorrect language or imagery (obscenity for adults; indecency for children), politically incorrect vegetable products, politically correct but economically incorrect vegetable and animal products, geographically incorrect humans, mathematically correct but politically incorrect image-manipulation bitstreams all are affected. While the German censorship is evil, immoral, and impractical, I have to agree with Dr. Vulis that many American laws are similarly wrong, and the Germans are at least trying, in their inadequate and immoral way, to fight genuine evils that are far worse than the stuff the US government is attempting to censor. BTW, today's "Recorder" (Bay Area legal newspaper) reports that the US 6th Circuit Court of Appeals upheld the Thomases' conviction. 96 C.D.O.S 609. ABTW, they didn't need those laws to fight "white slavery"; kidnapping and rape were already illegal, but any opportunity to make a law.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

2 1