December 2003 - cypherpunks-legacy

Re: Serious Windows TCP/IP Security Hole (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 30 Sep 1995 02:03:58 -0700 (PDT) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Ken Simler <krs2(a)cornell.edu> Subject: Re: Serious Windows TCP/IP Security Hole (fwd) This doesn't work for you? Please get back to me if you figure it out. I'd like to document the problem accurately. -rich ---------- Forwarded message ---------- Date: Thu, 28 Sep 95 23:45:49 -0400 From: Mark Thornton <markt(a)eng.umd.edu> To: llurch(a)networking.stanford.edu Newgroups: comp.os.ms-windows.win95.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.networking.tcp-ip Subject: Re: Serious Windows TCP/IP Security Hole I can confirm that the complete(floppy) version of Windows 95 STILL has the ../ bug ;-( The ... bug has been fixed correctly returning the following message chkpath: ERRDOS - ERRbadpath (Directory invalid.) But cd ../ WILL put you in the root directory of the share with the rights you had in the intial directory. Very bad... I've had to share all my drives read-only until the problem gets fixed.

1 0

McNeil Lehrer on Net Insecurity
by John Young 17 Dec '03

17 Dec '03

McNeil Lehrer has a segment on net boogers this evening, reported by Time's anxious Elmer-Dewitt. Diffie, Farmer and Shimomura, all beautifully coiffed, offer sagacious views. It includes a clip of Kevin, unbeautifully cuffed and mutely eloquent. Says most of the charges against him have been plea-bargained away.

1 0

SAIC Bags Tier 1 Job
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

SAIC Awarded Multimillion Dollar Communications Security Contract San Diego, Oct. 3 /PRNewswire/ -- Science Applications International Corp. (SAIC) said it has been awarded a three year, $28 million contract to support the Space and Naval Warfare Systems Command (SPAWAR). The Common Tier 1 System will integrate computers and software to implement and field the Tier 1 element of the Department of Defense's Electronic Key Management System. This program will provide automated communications security and key management system support for the Navy, Army, Air Force, Marines, Coast Guard and other government agencies. Common Tier 1 will help implement the Electronic Key Management System and support its integration with COMSEC material management in the Navy, Army, Air Force and joint key management systems. The work performed on this contract will be split between San Diego (66%) and Camden, New Jersey (34%), and is expected to be completed in October 1998. "We expect to hire an additional 65 employees in San Diego during this contract to primarily work on software development," said SAIC Program Manager Tom Trebelhorn. "This is a very significant win that allows SAIC to continue its involvement in this key information security program and extend the company's commitment to the communication security field," Trebelhorn added. SAIC provides high-technology services and products for government and private industry in the areas of space, transportation, national security, environment, health care, energy and systems integration. With nearly $2 billion in annual revenues, the employee-owned, San Diego based company has 20,000 employees in more than 350 locations worldwide. Contact: Tom Trebelhorn, Operations Manager of SAIC, 619-552-5319, or fax, 619-452-3540, or e-mail, tom_trebelhorn(a)cpqm.saic.com/

1 0

GSS sample/demo?
by David K. Merriman 17 Dec '03

17 Dec '03

Sorry for the 'broadcast', but I'm looking for some source code that shows how GSS 'works' in real-world applications, as well as opinions on how good it is. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

Digestable
by Man In Black 17 Dec '03

17 Dec '03

Would whoever posted information on a free cypherpunks digest please repost? Thanks. =]=

1 0

Macneil-Lehrer tonight.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Whitfield Diffie, Dan Farmer, and another Sun Microsystem guy whose name I can not spell but who tracked down Kevin Mitnik are on the Newshour right now. JMR No PGP .sig Regards, Jim Ray "Every act of visibility is an act of resistance." Suzanne Pharr - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> - ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHOTMCoZzwIn1bdtAQHsDQF/ZUbX7FTGpQRuuS/vyPIBqlPO9ovW26un Q5CalRK8OSwX1IuNG0H9Nqj14QhsAfnd =qUCL -----END PGP SIGNATURE-----

1 0

Simple hardware RNGs
by John A. Thomas 17 Dec '03

17 Dec '03

Having built devices for generating random data, I can tell you the problem is more difficult than it appears. The problem is removing biases and correlations from the process. A good place to start is Murry, Herschell, "A General Approach for Generating natural Random Variables", IEEE Transactions on Computers, December 1970, p. 1210-1213. --------------------------------------------------------------------- John A. Thomas | (214) 263-4351 | jathomas(a)netcom.com Bowles & Thomas, L.L.P. | Voice | CompuServe 75236,3536 410 N.W Eleventh St. | (214) 262-6520 | Grand Prairie, Tx 75050 | Fax | PGP public key available ---------------------------------------------------------------------

1 0

$BN_air
by John Young 17 Dec '03

17 Dec '03

10-5-95. FTPeach: "A David and Goliath fight, the battle between Netscape and Microsoft over software for the Internet." For all of his success in outwitting the likes of IBM to become the leader of the world's biggest software company, Bill Gates has long said that the competition he most feared would come from a software start-up with breakthrough, innovative technology. Netscape Communications may be such a company. But a war over technology standards, which could delay the progress of electronic commerce and potentially impede Netscape's growth, now seems inevitable. Netscape's hand has been weakened by recent incidents in which flaws in the security features of its browser software were discovered by two "cyberpunks" [sic]. $BN_air (8 kb)

1 0

xus_ORN
by John Young 17 Dec '03

17 Dec '03

10-5-95. Wash Rag: "Congress Debates Adding Smaller Spy Satellites to NRO's Menu." Top members of the House and Senate intelligence committees are carrying on a behind-the scenes debate over the nation's spy satellite system, with one group arguing that the governmeat could save hundreds of millions of dollars by building a new generation of small satellites to be launched in place of some of the big ones already planned. The Combest group wants to start production now of 2,000-pound space vehicles, each costing about $100 million and nicknamed "small-sats." "$1.6 Billion in NRO Kitty Helped Appropriators Fund Pet Projects." On the morning of Sept. 21, security men bustled around Room H-140 on the first floor of the Capitol, sweeping it to ensure that the space was free of electronic eavesdropping devices. This year's session turned out to be different from any in recent memory. The conferees took more than $1 billion from the once-sacrosanct spy satellite program of the National Reconnaissance Office (NRO) to help make room in the budget to speed up purchases of hundreds of millions of dollars worth of big-ticket defense items, including the B-2 "stealth" bomber. xus_ORN (17 kb)

1 0

Re: Oct 14 meeting Agenda? (DC Cypherpunks)
by Tom Rollins 17 Dec '03

17 Dec '03

>>I figure that as long as we are going to receive... >> ? a commercial message from Digex ? >> >>We might be able to tap their knowledge base in assesing >>the various risks and rewards available by using a Commercial >>ISP. >> >>After all, with the FBI and Scientologists waging war on >>the Internet ( capturing keystroaks, siezing computers, >>and rummaging through everyones E-mail ), There may be a >>way to make life a little more interesting for them. >I will be glad to send in my two cents worth - I am not sure that >I understand the question though. While, I believe in strong crypto for everyone (what cypherpunks doesn't), I also believe that much can be done to prevent the wholesale snooping of Commercial ISP customers data. I believe that this data is snooped because the ISP's and large number of customers (ignorant of security) make this data too easy a target (cost effective). While the NSA may follow it's motto (In GOD we trust, the rest we monitor). Others may take hostile actions agenst someone whose password or personal information has been obtained. (ex. drain bank account, or just send spam) Some questions that I would like to ask... 1 - Assuming that someone from an agengy or someone pretending to be from an agency wanted to capture one or all the ISP customers key presses. What method would they use ? Would they capture the data at the phone company? Would they tap the raw data stream at the initial ISP router ? Would they route IP packets from the initial ISP router through their own equipment before arriving at the ISP maching running the shell account ? Would they use a Trojin Shell (or telnetd) on a shell account ? Would they inform the ISP and get his help or root access ? 2 - What methods could be put into place by the ISP or it's customers to help prevent this snooping activity ? Perhaps an alternative login method (like deslogin or idealogin) trying to protect data through the phone company and IP route to the target machine. Perhaps having a crypto checksum on the shell (telnetd) to detect trojin software. Perhaps sendmail could public key encrypt mail on it's way to the customers directory. Perhaps just raising the customer awareness of security issues and methods at the ISP. This could affect the mainstream user (joe sixpack) as well as the PGP user. Perhaps ISPs could offer a data archive service/site (foreign site) where data in the form of PGP encrypted E-mail can be saved and retrieved via a robot (something like majordomo). That way, if your home computer breaks, burns, is stolen, or siezed. You can still retrieve your data at a later time. Granted these methods do not prevent a determined attacker from squashing an ISP cutomer. However, it does raise the cost of the effort to single out a user and attack him rather that grab cleartext from everyone. -tom

1 0