December 2003 - cypherpunks-legacy

anon.penet.fi compromise?
by joelm＠eskimo.com 17 Dec '03

17 Dec '03

This was in alt.2600. Comments or verification? --------------------------------- From: will(a)rmii.com (Will Spencer) Newsgroups: alt.2600 Subject: Re: remailer security? Date: 24 Jan 1995 15:48:57 -0700 Steve: The penet database was stolen and posted on Unphamaliar Territories. Will

1 0

Okay, okay!!!!
by sorr＠roch0.eznet.net 17 Dec '03

17 Dec '03

To all list subscribers: I get the picture. I apologize for lurching into your space, but I had good reason. I was trying to track down a bit of information. I tracked it down. The information was right. Now I'm done. Thanks to all of you who took a moment to explain to me what toad.com is. As for those who took a moment for abuse, hey, I don't care. I'm a journalist. Taking random abuse is part of my job description. As I mentioned above, I have verified to my satisfaction that someone "borrowed" the machine that runs toad.com and used it to commence burrowing into the computer space of Tsutomu Shimomura, the San Diego computer-security expert who got cracked in late December. Is this a big deal? No, not really. It's a line or two in the story I'm writing, which seeks to detail the scope of the intrusions. The story's not intended to scare people. Nor is it intended to hype anything. It's just a story. So that's that. Again, sorry for intruding and thanks for the help. You can return now to your regularly scheduled programming. Steve Orr, at the f****** Gannett Rochester Newpapers

1 0

Re: Unix, Linux, NeXTStep, etc.
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199501260513.VAA11989(a)netcom7.netcom.com>, Timothy C. May <tcmay(a)netcom.com> wrote: >I was about to say the same thing! Not to push NeXTStep per se, as it >is apparently doomed for a variety of reasons, but to say that >popular applications can be--and have been--ported to Unix. Actually, while NeXTStep per se may be doomed, its spirit might very well end up surviving. The move towards integrating it with Solaris 2 and other vendor unices is a heartening one, to say the least. I still want a WYSIWYG editor that spews TeX. - - -- Todd Masco | "Let me get this straight. You're making a crypto toolkit, cactus(a)hks.net | and you're worried about it being _obscure_?" - Eric Hughes Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyeTTBNhgovrPB7dAQHqzgP/UGxrIMKUMHVneOLPHu7yRkjm7CztPIzu E46PIPt2ZXdnMDIvHAGekx3SZ8tH1EY6Fl/MBHpYrUxh6XRY+MsaPw8JlAi8cs3t cEfsyS1GbZ50z3731CQcjS7HDX7PGCYqjxm8fMqvEx8Z0BrrhGnWfBdq8Caonpyt MRFG2uoyIBo= =F4SP - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLyfMISoZzwIn1bdtAQFOYQF9FtrdZCf390uGkHjwfK+BWCpYcGv3uj0w eV5X0B36qrocwT9Sma3agHRx5AWsS4RV =tOUY -----END PGP SIGNATURE-----

1 0

Electronic Security
by jallen＠pen.k12.va.us 17 Dec '03

17 Dec '03

I have been lurking for a while, trying to learn. Someone asked about electromagnetic shielding. I remembered an article in Popular Science. It was July 1989 on p. 87. It described a _fabric_ which provided 100 dB of shielding. I have not used it, but thought I would pass on the reference. It is called Saf'n'Shielded and is produced by International Paper. Hope this helps. -- {---------------------------------------------------------} J. C. Allen Ass't. Technology Coordinator Episcopal High School Alexandria, VA 22303 jallen(a)pen.k12.va.us {---------------------------------------------------------}

1 0

Re: Reordering, not Latency (Was: Re: Remailer)
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Michael Handler <grendel(a)netaxs.com> > On Wed, 25 Jan 1995 Louis Cypher wrote: > > > In recent discussions, the consensus > > was that message reordering was superior to (and the actual intent of) > > latency. Reordering is not sufficient, a form of latency is required > > to make it effective. > > I have literally hundreds of messages archived from the CP list of > several months back where Eric Hughes repeatedly states that reordering, > not latency, is the key. Reordering of a sufficient magnitude will > introduce latency inherently. Otherwise you are still vulnerable to > traffic analysis (which is an art, not a science, remember). I think there is a small terminology problem here. In Eric's writings, latency refers to delaying message remailing; reordering refers to sending messages in a different order than they arrive. I think it is obvious that reordering is necessary in order to have any mixing; latency may provide reordering, but it is not guaranteed to do so. Latency without reordering is not of much use. More recently the discussion has been contrasting simple batch reordering versus a form of reordering where some messages are "carried over" from one batch to the next. In the recent context this carry-over process is being referred to as adding latency. I think the recent comments about the advantages of latency refer to the additional statistical confusion which this carry-over process may add. So these comments don't contradict Eric's earlier statements, but rather the terminology has shifted slightly. Reordering is still the primary necessity; now it appears that reordering with some latency (carry-over) is superior to simple batch-based reordering. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLyfSgBnMLJtOy9MBAQH2CwH/WbGPjJmI8yDmlfOblU+fbC9+tlqILluQ UpAxSFUg00u2QpHdA2a52Yvzb7Oi+oe6WvwdZ7SBFfbLTksa8Q8FVg== =hWiJ -----END PGP SIGNATURE-----

1 0

RE: Identity
by M00012＠kanga.stcloud.msus.edu 17 Dec '03

17 Dec '03

Gannett sucks. Kare 11 sucks. USA Today sucks. St. Cloud Times sucks. Gannett==sucks.

2 1

NYT on MOD
by John Young 17 Dec '03

17 Dec '03

The New York Times January 26, 1995, p. C17 Books of the Times Kids or Conspirators: How Hackers Got Caught MASTERS OF DECEPTION The Gang That Ruled Cyberspace By Michelle Slatalla and Joshua Quittner 225 pages. HarperCollins Publishers. $23. By Chirstopher Lehmann-Haupt It's difficult to feel much besides amused admiration for the computer hackers spotlighted in "Masters of Deception: The Gang That Ruled Cyberspace," by Michelle Slatalla and Joshua Quittner, a married couple who are reporters for Newsday. After all, what mainly characterizes the gang of adolescents they write about is high intelligence, infinite resourcefulness and boundless curiosity. Among the Masters of Deception, as the gang is called, there is Paul Stira, nicknamed Scorpion, who as a child learned to program a computer even before he had his hands on one and went on to master the art of cracking computer-game copy-protection codes. Mark Abene, a k a Phiber Optik, was so driven to understand how machines work that he explored and mastered the most sophisticated of the telephone company's computers. Eli Landopoulos, or Acid Phreak, after helping lure Phiber Optik away from a rival cyberspace gang, Legion of Doom, was moved to write "The History of MOD" for other hackers to envy. And John Lee, or Corrupt, found computer hacking a better way to survive than running with a street gang. It is difficult for the reader of this book to look upon these and other members of the gang as criminals. Yet they were eventually charged by a New York grand jury with conspiring to "gain access to and control of computer systems in order to enhance their image and prestige among computer hackers," among other counts. And they ended up pleading guilty and serving jail terms, which they have completed. In telling their stories, Ms. Slatalla and Mr. Quittner have almost as hard a time finding a continuous thread as the Government did building a coherent case against the hackers. The authors begin by describing a crash of the AT&T long-distance system that occurred on Jan. 15 1990. The authors write of the gang's reaction to this crisis: "No self-re-specting computer hacker would ever destroy anything. No hacker would ever purposely hurt the phone system. Paul just wanted to look around. He just wanted to learn more. He'd know it if he'd done something bad. Wouldn't he?" The lively narrative then backtracks to tell how the hackers formed their gang the previous year. This sequence creates the impression that the gang will turn out to have caused the crash, an expectation that is buttressed by other evidence that Ms. Slatalla and Mr. Quittner describe. The boys crashed smaller systems they invaded, like the Learning Link, a collection of electronic bulletin boards for educators and librarians that is owned by Channel 13/WNET, New York City's public broadcasting television station. The gang left the message "Happy Thanksgiving you turkeys, from all of us at MOD," which prevented access to the bulletin board's files. As the authors write, "the Learning Link crash would become the pivotal event in the case that the Federal Government was slowly building against the boys in MOD." The process was slow because the investigators had to weigh the need for evidence against the risk of damage. As the authors write: "It was kind of like having a tarantula crawl up your leg. If you shook it off too fast, it would escape into the wall. But if you waited too long, you got bitten." But when, about half way through the book, the narrative arrives back at the AT&T crash of 1990, we learn that the failure was traced not to anything the hackers did but to what the author's describe as "a routine update of the AT&T software." True the gang did much that was wrong like creating and using unbillable telephone accounts, trespassing in cyberspace to make long-distance calls, looking up private information and using it to harass other hackers and stealing and selling other people's credit card numbers. In short, certain members crossed the line between hacking and cracking and thereby violated the hacker ethic, which holds, in the authors' words: "Thou shalt not destroy. It's O.K. to look around, but don't hurt anything. It's good enough just to be here." Yet the fact remains that the gang did not cause the AT&T crash. And the worst that was done appears to have happened at a remove from what Mr. Abene was responsible for and after Mr. Stira had more or less withdrawn from hacking. Yet these two received the stiffest sentences. Mr. Abene, the last to complete his sentence, was released in the fall of last year. So one has the impression that what mattered to the Government was less the mischief done than the potential for mischief. What the slightly jumbled narrative does capture effectively is the contrast between the manic glee of the hackers at the prospect of a vast new unexplored world to conquer, and the Government's nervous disapproval and understandable need to set limits on a mysterious new frontier. The authors try to present both points of view. They don't reveal where their sympathies lie until the last line of their book. Here, after describing the meeting of a hackers' club as "the milling clumps of boys" who "are the picture of entropy, of disorganization, of isolated growing pains and undeveloped social skill," they write with tongue in cheek as their concluding paragraph: "This is the conspiracy." End

1 0

An article on Windows (in)security
by Rich Salz 17 Dec '03

17 Dec '03

---------- Begin Forwarded Message ---------- >From: first(a)individual.com (An Information Service of INDIVIDUAL Inc.) (by >way of [Some initial stuff seems missing, sorry.] > ``No.'' > > And so it went. Once the security configuration is established and the >security profiles are put in a database-like protected file system, >accessing that data to get a full view of the security policy implementation >is near impossible. An administrator must retrieve individually each piece >of data stored in the security database, then manually collate and compile >it into a usable form. > > In a large operation, the security administrator will build a security >database by virtue of the number of objects and characteristics assigned to >each object during configuration. But Windows NT offers little way to access >and manipulate that database for analysis, rapid reconfiguration or global >views. It appears, and Microsoft engineers agree, someone will have to build >a utility program to take advantage of the security database via the maze of >APIs available to third-party developers. > > Kevin Phaup, program manager lead of Microsoft's Business Systems >Division, put the best spin he could on this first major Windows NT >shortcoming. ``Pull the data into a database and then massage it,'' he said. >``We have a new product - System Management Server from the Back Office >Suite - that could help.'' > > I agree, but why would I want to buy a brand-new operating system that >needs help out of the box? > > What's more, the third-party database solution for security administration >is a hopeless short-term patch. To be truly effective, it needs a much >tighter integration with Windows NT's APIs to permit not only systemic >analysis, but also systemic security changes based on selected criteria. > > If administrators want to change the access rights of every user so they >can log on at 7 a.m. instead of 8 a.m., they cannot do it with Windows NT >3.5. They might be able to do it with a third-party product or with Windows >NT 4.0. > > ``If someone builds an administration product like that, they'll make a >lot of money,'' Phaup says. > > A WEEKEND'S WORK Windows NT has other security problems, as well. For >example, it does not have data cryptography, which is essential to make sure >a network is reasonably secure from eavesdropping and integrity breaches. >Microsoft, which knows encryption technology, easily could have included the >appropriate algorithms in software to make Windows NT more secure. > > Microsoft's Phaup agrees it would have been simple to add encryption to >Windows NT. ``The hooks are all there,'' he said. > > But Windows NT does not need cryptography for C2 certification. And >perhaps even more telling, Microsoft cannot export cryptography outside the >U.S. due to export control laws that prohibit it from doing so without >licensing. Of course, the company could have made two versions of Windows >NT: one with crytography for domestic use and one without cryptography for >export. > > According to Phaup, Microsoft was reluctant to do so for two reasons. >``Security is way down on the list of corporate concerns and desires and >wants in an OS. It's in the top 20, but not the top 3,'' he says. ``And the >testing cycle would have been a double killer.'' > > Windows NT's last major shortcoming lays in the omission of a feature that >most security experts consider virtually indispensable: boot control. > > In the DOS/Windows world, third-party PC security is reasonably attempted >by forcing users to boot from the C drive and making them log on with IDs >and passwords. However, if a bootable DOS diskette is inserted in the A >drive, the PC will boot without a logon, and the A:> will appear. > > But if the user attempts to log over to the C drive, the system will come >back with a message such as: Invalid drive specification. Security experts >recognize this as an inexpensive technique that will keep out casual >intruders and nontechnical types. > > One way to mandate boot control is with a hardware or firmware addition to >the PC in the form of an add-on card. The hardware boot process is >interrupted, and then even access to the A drive can be restricted until the >actual logon process through the legal boot drive has been successfully >completed. > > In Windows NT, boot control does not even exist as an option. Again, this >suggests that Microsoft's security effort was driven by C2 certification, >not by security itself. > > In its defense, there is a lot to like about Windows NT and the plethora >of functionality it offers from the application standpoint. But Windows NT >sorely lacks in security, so much so that it almost would be safer not to >use any security. > > Windows NT must evolve quickly to garner a spot in the secure operating >system arsenal or somehow steal market share from the likes of Novell. It >just is not there yet. But Microsoft's Phaup left me with one closing >thought. ``Have you talked to the Cairo [Windows 95.5] guys yet?'' > > 2Schwartau is an independent consultant, writer and lecturer on network >security topics. He can be reached at Interpact, Inc. at (813) 393-6600, or >via electronic mail at P00506(a)psilink.com. > >[01-23-95 at 15:10 EST, Copyright 1995, Network World, File: x0123303.8dn]

2 1

MixMaster remailer source
by kevin＠elvis.wicat.com 17 Dec '03

17 Dec '03

A little while back when the "remailer crisis" discussion was in full swing, L. McCarthy recommended the Mixmaster remailer as being the most modern. After several days of hunting, I have utterly failed to turn up the source to this remailer. Can anyone provide me a pointer? On a slightly related note, is there a validation suite for PGP? The MIT distribution does not include OS/2 binaries, unfortunately, but I have managed to get a clean build. It seems to work, but I simply don't know enough about PGP to be sure that it really is a fully working verson. Kevin At Intel, quality is job 0.999731.

3 2

Privacy of Voice Mail?
by jmueller＠gac.edu 17 Dec '03

17 Dec '03

>From 1/24/95 Edupage Forwarded message: > > HOW PRIVATE IS VOICE MAIL? > A lawsuit filed by a former McDonald's employee whose private voice mail > messages to his paramour were recorded and played for his wife may > determine the question of whether voice mail boxes are granted the same > confidentiality protections as live telephone calls or postal mail. The > ACLU argues that electronic eavesdropping should be avoided, but the U.S. > Chamber of Commerce takes the stance that businesses have the right to > ensure their electronic equipment is used for legitimate purposes. > (Times-Picayune 1/23/95 A3) > Comments? -- Joel Mueller - "Here lies one whose name is writ in water." -Keats Check my .plan for my PGP Public Key. PGP encrypted mail is very welcome! This must be Thursday. I never could get the hang of Thursdays. -Dent

1 0