December 2003 - cypherpunks-legacy

article for cypherpunks (fwd)
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Irony of ironies! Keith Henson, who I was just minutes ago writing about, just asked me to forward an article to the CP list. --Tim Forwarded message:

1 0

Attempted Compromise of anon.penet.fi Server?
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A number of postings to the alt.test Usenet newsgroup from pseudonymous accounts at anon.penet.fi have recently been reported. Correspondingly, a number of people have received email from that server indicating that an unsolicited pseudonymous account and ID and have been established for them at that server. Assuming no actual compromise of the anon.penet.fi database itself, this attack could serve a number of purposes. Let's assume that an attacker had obtained the Cypherpunks mailing list, perhaps merged with a listing of all posters to sci.crypt, alt.security.pgp, alt.politics.org.nsa, etc. and, forging a message from each member, attempted to create a new pseudonymous account at the anon.penet.fi server for each one. Likely motives for, and outcomes from this attack are: SCENARIO #1: Attempting to assign a new anon account to a person by posting to alt.test. Each failure would indicate that the address owner already possessed a password-protected anon ID there. This information could prove potentially "useful", I suppose. For example, a list of names of anon forwarder users could be collected for "special treatment" later, possibly a "sting" operation of some sort, it would also net a few people whose only use of anon.penet.fi was merely REPLYING to another's pseudonymous address, which also results in the allocation of a new ID. See Scenario #4 for further speculation. SCENARIO #2: Attempting to create such an account and SUCCEEDING would now match up the user ID with the new account number. Any future posts via this account could then be easily cross-referenced back to the source. Any account thus created, as evidenced by a "welcome" message from anon.penet.fi, should probably NOT be used, at least where anonymity was needed. SCENARIO #3: If the new accounts were password-protected by the forger, and the passwords NOT revealed to the putative "owners", the result would be a "denial of service". Has anyone received a message that an unsolicited new account has also been password "protected"? (Scenarios #2 and #3 are mutually exclusive, BTW.) SCENARIO #4: The most serious of all is the possibility of a "barium attack". A special "coded", but seemingly innocuous, message could be sent to each email address identified in Scenario #1. If the person replies, he/she has just blown his/her anonymous cover, and any previous (or future) postings/correspondence using that ID are then traceable back to the source. Needless to say, anyone who has a pseudonymous ID at anon.penet.fi that he/she would like to keep secret should be EXTREMELY careful in responding to any messages coming through that server. The most likely means of accomplishing this attack is through the Subject: header, since many people reply to messages and keep the original subject, prefixing it with "RE: ". If I send messages to Alice, Bob, and Charlie via anon.penet.fi, using a slightly different Subject: line for each, then a reply containing that Subject: line will link the pseudonymous return address on the reply with the recipient of the original message. The source of this attack could be either a TLA (three-letter agency, such as NSA, FBI, CIA, etc.), some hacker, or even the infamous Larry Detweiler. I cite the "TLA" option since a number of messages have been posted to various newsgroups via anon.penet.fi that seemingly violate Federal law. At first glance the attack would seem to have been executed in a somewhat clumsy fashion, particularly the posting of public messages with the text "I am John Doe", or whatever. OTOH, given the inevitable "welcome" message from anon.penet.fi to the "holders" of the newly assigned IDs, such "clumsiness" could also be designed to make a sophisticated attack look amateurish to disguise the motives and capabilities of the attacker(s). Or, this whole thing could be an attempt to achieve "Death to Blacknet" by undermining user confidence in the anon servers by spreading "fear, uncertainty, and doubt". QUESTION: Has anyone with a previously existing, password-protected identity at anon.penet.fi received an "invalid password" message recently, even though no attempts to send mail through the server had been made? If not, then that's a bad sign because it might indicate that password protection has somehow been curcumvented by the attacker. -- Diogenes - a registered pseudonym. PGP key (ID# D1150D49) available through PGP Public Key Servers -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLjmja+Rsd2rRFQ1JAQExTAP6A4kTUwufW05Bx5Mznz3AkjDKuP18K5/P FhZT3LEed2j8x1fxFbwmNdkUnHVsxf+pvA0cfmQQV68CY9R0BIkPEUmf59wMAlZ4 vr6kei5nNw6WFb8W3ihk7GhqynTuIZjGCHdPXP/IaZKcxGx0tdTB2A1A74eVYBB3 yRWrSTbSEbc= =7yi1 -----END PGP SIGNATURE-----

1 0

Re: "Just say 'No' to key escrow."
by Blanc Weber 17 Dec '03

17 Dec '03

From: Graham Toal . . . . . Bill Gates is attempting to create a worldwide network of about a hundred satellites. You don't get to do that without political assistance, and no way is the USG going to let Bill put those birds up unless they control the technology to snoop on the entire net. ............................................................... Could Bill even think about setting up a satellite network without confronting the Governmental Presence? Anyone who plans to do anything in communications must come to terms with the Divine Intervention Department; maybe not today, maybe not tomorrow, but for sure by payday. Can anyone in the United States get away with introducing a product or service which is not going to require that "government interests" be represented in some way (if only at tax-time)? They must, at the very least, have meetings, conferences, discussions to ensure that 1) no one in the world is going to be damaged by the new service, and 2) that the MotherShip will get its revenue % . Is there any legally-sanctioned enterprise/company which can avoid this? This is a real predicament not limited to Billg and his interest in the internet. I think quite broadly about all of the areas in which the government steps in to maintain a controlling influence; any time a new idea is introduced, They Will Be There to make sure that they can protect us from the new-fangled object in case anyone tries to use it against us, the Precious Ones, the Most Valuable Citizens of the World. Scanaphobia, anyone? Blanc [Obligatory Reminder: The company won't leFrom owner-cypherpunks Fri Jul 29 21:18:02 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA15874; Fri, 29 Jul 94 21:18:02 PDT Received: from selene.wright.edu by toad.com id AA15859; Fri, 29 Jul 94 21:17:23 PDT Received: from discover.wright.edu (discgate.wright.edu) by selene.wright.edu (PMDF V4.3-7 #2485) id <01HFAQ3YAUXS0001IY(a)selene.wright.edu>; Sat, 30 Jul 1994 00:14:36 EDT Received: by discover.wright.edu (4.1/SMI-4.1) id AA13118; Sat, 30 Jul 94 00:16:39 EDT Date: Sat, 30 Jul 1994 00:16:38 -0400 (EDT) From: Aron Freed <s009amf(a)discover.wright.edu> Subject: Re: No SKE in Daytona and other goodies In-Reply-To: <9407292014.AA07120(a)sosfc.avtc.sel.sony.com> To: Eric Weaver <Eric_Weaver(a)avtc.sel.sony.com> Cc: blancw(a)microsoft.com, tcmay(a)localhost.netcom.com, cypherpunks(a)toad.com Message-Id: <Pine.3.89.9407300035.A12869-0100000@discover> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Transfer-Encoding: 7BIT Sender: owner-cypherpunks(a)toad.com Precedence: bulk On Fri, 29 Jul 1994, Eric Weaver wrote: > The government should NOT be viewed similarly to an employer in its > relationship with citizens. Employees are free to quit and make their > income some other way. Yeah and since when has this country been so easy to quit and find a new job with the same relative pay???? Do you think it's that easy??? Uh I don't think so.. duh huh... I can't even get a summer job working at a computer store and I'm very computer literate for my age. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -=- YABBS - telnet phred.pc.cc.cmu.edu 8888 -=- -=- -=- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

1 0

Graham Toal and His 'Fucking Religion'
by Anonymous User 17 Dec '03

17 Dec '03

gtoal(a)an-teallach.com (Graham Toal) wrote: > Keep your fucking religion out of my face, Zook. If you want > censored-kiddynet, create your own one privately out of funds > donated by Good Christians, but take your state control and stuff > it where ypu stuff your crucifix. Ironic what you say, Graham. Given the fact that the subject matter is PORNOGRAPHY, often involving explicit depiction of sexual intercourse, which is somewhat of a "religion to some", maybe that's exactly what Nathan was asking -- for pornographers to keep their "fucking religion" off the net... Just as adults can avoid reading what the consider "offensive" material, so can you, too, avoid lashing out in a blind fury at posts like this that YOU disagree with. If one didn't know better, it'd seem that YOU are almost advocating censorship of ideas that you deem offensive. <g>

1 0

Re: A new flavor of spam
by roy＠sendai.cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yeah, I know it's a forward. But it's short, and raises a very good point about tuna... In alt.current-events.net-abuse, nreadwin(a)london.micrognosis.com writes: > levin(a)bbn.com (Joel B Levin) writes: >>If you'll note that bottom of these messages, the (forged) user's real >>ID is included in the text. > > Do you have evidence to back this up? The forger can map the forged > from line to the anon id using the subject line. The id in the body may > be unrelated. The forger might even deliberately try to mislead anyone > reading alt.test into thinking that infamous-anon-id-X corresponds to > some-email-address using this. Neil. - -- Roy M. Silvernail -- roy(a)sendai.cybrspc.mn.org perl -e '$x = 1/20; print "Just my \$$x! (adjusted for inflation)\n"' "What do you mean, you've never been to Alpha Centauri?" -- Prostetnic Vogon Jeltz -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLjmivxvikii9febJAQGthwQAuvscCVExgQ4mtuL3Ju+BdO1/+vZxtazb zWy48A6hZC5qrp6n3F/nUGrITC6CD5ZvJ3OOwyU1jCsieuKFjFwwkMJQumm98iF+ ibd+WVcurBqEr+oWGVXl7Oyfcs474w1/533HJwUZDK/MC/QCfdFcPJdVrC36146E Q+r1Ck8CzPE= =FLAh -----END PGP SIGNATURE-----

1 0

Re: NYET to censors, REPOST
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

>C'punks, > >On Fri, 29 Jul 1994, Lucky Green wrote: > >> ... >> The christian right is attempting to keep their children in ignorance... > >No need to alienate folks, Lucky. LOTS of folks, of all political and >religious persuasions are attempting to keep their children ignorant of >one thing or another. Anyone who thinks it's only the so-call "Christian >Right," is living in denial. I agree. The environmental fascists on the 'left' and the "don't you deviate from the mainstream" masses in the 'middle' are no better. I believe that children are best exposed to everything out there at an early age, because exposed they will be, rest assured. >> "Daddy, do you know how to perform a genuine French duck fuck?" >> "Gasp!" >> "Well, we do. Would you like to know?" > >Hell, Lucky, *I* haven't got a clue. How does it go? > I am not sure if explaining this under my own name would be wise at this point in time. Perhaps someone else would like to elaborate through a remailer? -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

3 2

penet.fi attack
by L. Todd Masco 17 Dec '03

17 Dec '03

roy(a)sendai.cybrspc.mn.org (Roy M. Silvernail): > In list.cypherpunks, Alan Westrope: > > > Me too, but I suspect the asshole just sent a 'who cypherpunks' request > > to majordomo(a)toad.com. > > Maybe not. My personal address was used, but my list subscription > address wasn't. (cypherpunks gets gated to a local newsgroup here, so I > can read it with news tools) Ditto. El creepo was definitely using the real list for the attack (and oddly, I got two total: one last night and one this evening). -- L. Todd Masco | Bibliobytes books on computer, on any UNIX host with e-mail cactus(a)bb.com | "Information wants to be free, but authors want to be paid."

1 0

Re: Larry Detweiler and his 'Fucking Hypocrisy'
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Anonymous User <nobody(a)c2.org> : Ironic what you say, Graham. Given the fact that the subject : matter is PORNOGRAPHY, often involving explicit depiction of : sexual intercourse, which is somewhat of a "religion to some", : maybe that's exactly what Nathan was asking -- for pornographers : to keep their "fucking religion" off the net... Classic, a lesson in hypocrisy from Detweiler! Larry, the day I call for government regulation to stop decent atheist kids from being allowed to access evil underground Christian fsp sites is the day you can start bleating hypocrisy. Another deliberate flame-bait from Detweiler. Excuse me if I don't waste my time refuting anything else he said. G

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Muchas apologies for the forwarded post, but I thought you folks might find this of interest... From: Perillo(a)dockmaster.ncsc.mil Newsgroups: comp.security.misc Subject: Fwd: SHA, Proposed Modification. Date: 29 Jul 1994 10:03:21 -0400 Organization: Yale CS Mail/News Gateway Lines: 611 Sender: daemon(a)cs.yale.edu Message-ID: <940729135927.373949(a)DOCKMASTER.NCSC.MIL> NNTP-Posting-Host: babyblue.cs.yale.edu The following is the Request for Comments citation summary, on the revision or fix of the Secure Hash Algorithm (SHA) released by NIST on July 11th. Enclosed is the "technical details sheet" of the proposed modification that has been floating around NIST for the last two months. - Robert ---------------------------- Federal Register 07/11/94 Citation="59 FR 35317" [Docket No. 940675-4175] RIN 0693-AB33 Proposed Revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard AGENCY: National Institute of Standards and Technology (NIST), Commerce. ACTION: Notice; Request for comments. SUMMARY: A revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard (SHS), is being proposed. This proposed revision corrects a technical flaw that made the standard less secure than had been thought. The algorithm is still reliable as a security mechanism, but the correction returns the SHS to the original level of security. The SHS produces a 160-bit output called a message digest for a message of any size. This message digest can be used with FIPS 186, Digital Signature Standard (DSS), to compute a signature for the message. The same message digest should be obtained by the verifier of the signature when the received version of the message is used as input to the Secure Hash Algorithm (SHA). -------------- Proposed Modification of the Secure Hash Algorithm In Section 7 of [1](page 9), the line which reads b) For t=16 to 79 let W(t) = W(t-3) XOR W(t-8) XOR W(t-14) XOR W(t-16). is to be replaced by b) For t=16 to 79 let W(t) = S1( W(t-3) XOR W(t-8) XOR W(t-14) XOR W(t-16) ). where S1 is a left circular shift by one bit as defined in Section 3 of [1](page 6), namely S1(X) = (X<<1) V (X>>31). ASCII translator's note : S1 is actually, S superscript 1. W(t-n) is actually, W subscript, t or t-n. References: [1] FIPS PUB 180; Secure Hash Standard Computer Systems Laboratory National Institute of Standards and Technology 1993 May 11 ___________________________________________________________________ Robert J. Perillo, CCP Computer Scientist Cerberus Systems Washington, DC ___________________________________________________________________

1 0

Re: "Just say 'No' to key escrow."
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: solman(a)mit.edu : This is a relatively inane conspiracy theory. Gates hardly requires any : assistance since the feds were already committed to setting up licenses : in bands that are good for these types of networks. Both the FCC and Hughes : have sped up their efforts towards these systems in recent days. That's just the terrestrial side. What about actually getting the birds up? : And the satellite system is not Bill Gates. He is an investor, and a fairly : small one. Gates and McCaw (sp?) gave that venture much more by attaching : their names to it than they did by giving a few of their millions. I seem : to recall Gates' share being 7 megabucks. All the more reason to look at the investors more closely and see what other quid pro quo's have been arranged. : will be too late and that B) software based escrows are a good thing because : they take the wind out of hardware based encryption efforts and they are : difficult to make mandatory. This sort of talk is dangerous. If cypherpunks don't have a united front against SKE, I can't see the less radical front organisations like EFF and CPSR (well, maybe just EFF) going balls to the wall against it either. Compromises should be resisted in order to force USG to show their true colors when they finally demand to outlaw all non-escrowed crypto. Otherwise it'll sneak up on us in the night like the Christian Coalition's goal of taking over the Republican party. G

1 0