December 2003 - cypherpunks-legacy

Crypto *import* ban?
by Brad Dolan 17 Dec '03

17 Dec '03

What exactly does a ban on import of "defense articles and services" which are not in "furtherance of world peace" mean? Could you ban crypto imports? Imports of chopped liver? ---------- Forwarded message ---------- Here is a final rule issued by ATF regarding the import of "defense articles" into the United States. It appears in the Federal Register at 60 FR 47866 (9/15/950). This becomes a regulation in the Code of Federal Regulations, Title 27 CFR, part 47, Importation of Arms. Sec. 47.52 Import restricitons applicable to certain countries. (a) It is the policy of the United States to deny licenses and other approvals with respect to defense articles and defense services originating in certain countries or areas. This policy applies to Cuba, Iran, Iraq, Libya, Mongolia, North Korea, Sudan, Syria, Vietnam, and the States that comprise the former Soviet Union [list of countries omitted]. This policy applies to countries or areas with respect to which the United States maintains an arms embargo [list of countries omitted]. It also applies when an import would not be in furtherance of world peace and the security and foreign policy of the United States. [end excerpt]

1 0

Deadly Argyles [was Miami Vice]
by jordan＠macandco.com 17 Dec '03

17 Dec '03

>>>> Here's one: http://cnn.com/US/9709/09/briefs.pm/crime.sock.reut/index.html - Jordan <<<< He should have kept them rolled in his pants where they belong! For the browser impaired: [Begin quotation] Police think sock is gun, shoot man September 9, 1997 Web posted at: 7:43 p.m. EDT (2343 GMT) MIAMI (Reuter) -- A Florida man who covered his hand with a sock to work on his car was recovering in the hospital Tuesday after being shot by police who were told he had a gun. Bobby Whipple, 27, had wrapped his hand in a dark sock while working on his car Saturday, prompting at least two people to alert police to a man wielding a gun. After receiving the reports, 14 officers surrounded Whipple and five of them, including one using a shotgun that shoots pellets, opened fire when he did not respond to calls to put his "weapon" down. A spokeswoman at Jackson Memorial Hospital said Whipple was in good condition. "Witnesses said that he had a gun and the officers assumed they were correct ... He took the position of an aggressive stance," said Pat Brickman, a spokesman for the Metro-Dade Police Department. "At this point, we don't have any indication that they acted inappropriately when faced with deadly force." The Miami Herald reported that Whipple's attorney was preparing a civil rights lawsuit against the police department over the shooting. Copyright 1997 Reuters Limited. All rights reserved.

1 0

medical records next. does it ever end?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ref: http://www.nytimes.com/yr/mo/day/news/washpol/medical-files.html and, of course, we all know that our friendLY, loyal, trustworthy, and obedient police departments can keep a secret and protect the innocent. NYT lead article today indicates Clinton bowing to LEOs to: ...gain broad access to patients' medical records, with hardly any restrictions on use or redisclosure of the data. "We recommend that providers and payers be permitted to rely on the statement of law-enforcement officials that an inquiry meets these standards," the administration says.... and we all know the police never lie when theY're fishing! The administration proposal would not require law-enforcement agencies to get court orders or to notify patients when they seek medical records. Patients would not be assured of an opportunity to challenge the disclosure of their files, though the records could later be used against them in investigations or prosecutions. fourth amendment mean _anything_ to these petty dictators? has the US become just another bananna republic at the interest of the power brokers? are we stretching the idea of a republic a bit thin? "Our recommendations accommodate the interests of law enforcement rather well," said an administration official who helped draft the proposal. "The Justice Department got almost everything it wanted." THIS is what is wrong with the US! the courts have become adversarial playgrounds for the prosecutors for the benefit of the "state" the old rule used to be if you were _charged_ by the Feds, start plea bargaining --if you go to court, the sentence will triple. just "fuck" the concept of innocent until proven guilty, or 'hey, man, you were arrested, weren't you?' Andrew Fois, an assistant attorney general, said, "There has been no documented history suggesting that law-enforcement agencies have abused their current access to medical records, or that existing federal and state law is inadequate to guard against such a danger." LIAR! I'll bet this man would lie to his own mother if it meant his courtroom body count ratio increased. What state or federal law? there is no restriction to LEO access currently; Congress is considering bills on protecting access, and the LEOs want total exemption from the rules. TIME FOR THE INTERMOUNTAIN EMPIRE TO SECEDE FROM THE UNCONSTITUTIONAL GOVERNMENT IN WASHINGTON. -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNBbEvb04kQrCC2kFAQHysAQAuRJTdS96yudsRASI2x3xVHey1N/hYYfN NCl/9FAr+TJsF+yWtSUhDLnE/1MODaIPjWomsDOla282kmrMZUQQa8CuYyw3e/xu uAwuw3bbqUfvJ13afwc7ddgusyAxbtDDxICv/ys/rFvHJCK9Ri8tKYKA6/7OZXqj L+6tueo6dI8= =ykmY -----END PGP SIGNATURE-----

3 2

netscape bug
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DF8qC9.4Cw(a)sgi.sgi.com>, "Vladimir Z. Nuri" <vznuri(a)netcom.com> writes: > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? I question the accuracy of this. The fingerd bug was that a string in the static data area was read in with gets which could be overflowed. At some point in memory after this input buffer was the string constant that stored the name of the finger command. What the Morris work did was to overflow the input buffer and replace the string constant "finger" with "csh". When fingerd then exec'ed the command, that gave you a shell running on the machine. While it is certainly true that you can stomp on memory in static buffers, it's not clear that you can execute whatever code you insert there. If the buffer happens to be allocated off the stack (and the stack grows down) then you can modify the return address. Of course, you have to know the address of whatever code you want to execute. And that code has to do something useful. Presumably, if there are two bugs, one which lets you write over a static buffer and one for a buffer allocated from the stack, then you could execute code of your choosing. Of course, that also assumes that you can execute from the data area which is not always true. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

4 5

DH in IE and NT
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Microsoft will use Diffie-Hellman in Internet Explorer 4.0 and Windows NT. See: http://www.cylink.com/html/microsoft.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNBbQejltEBIEF0MBAQFqowf+MnienInvTNqib8YfVxKXLQMpw17yymA2 YRlXalaClmwMnE2LzMwBKqwC9wFm+FPNWIAz8q5O36+k9IEDepCVazZpyar64/En HhUZ+7F8ZGnuxvNScDBhexxUFkSAU/fuPRcqETZIMwE1kHIBGkVO/28KBF+MJ8Aj engwErZi6lFHMqiS8378/iyJ01wxRmMqI2sMTeF7Ub8kWMh7bEq24y9xF8mRVwsg DAguXZsagGapgB/pIqT/L4xP2uBIxYCKrqCJw6KtB9tsffraw9NHBzvkaZn1d7bo c2V7GF4adk6BE4oFmdjRa03o6j0nr8sKpHPlHlxo1hmslZ8fjPxTWQ== =LXf8 -----END PGP SIGNATURE-----

1 0

Anyone for testing MOSS?
by Raph Levien 17 Dec '03

17 Dec '03

I've just gotten TISMOSS 7.1 running (whew!) and wondered if there was anyone else out there who could exchange encrypted email with me. Here is my public key: alias:raph@cs.berkeley.edu public-key:MFkwCgYEVQgBAQICAgADSwAwSAJBAKQ2qG5eZDa58HpVxM9fpru2hDVVkw0iK GC3BMhagHpio7XlGydpkbY3iSV08U92VVbkyTeB2aWhSe2xUUaONPsCAwEAAQ== I guess I'll probably wait until next week to test S/MIME. Raph

1 0

XDM has the same problem as netscape ?!
by iagoldbe＠csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

In article <9509210631.AA18308(a)sfi.santafe.edu>, Nelson Minar <nelson(a)santafe.edu> wrote: >Last time I looked, the MIT-MAGIC-COOKIE-1 scheme used in X11R4 had >the same problem: the random seed was based on the current time to the >microsecond, modulo the granularity of the system clock. I think I >figured that on my hardware, if I could figure out which minute the X >server started (easy with finger), I'd only have to try a few >thousand keys or so. Caveat: I never actually proved the idea. Wow. I just checked, and Nelson's right. The seed is this: #ifdef ITIMER_REAL { struct timeval now; X_GETTIMEOFDAY (&now); ldata[0] = now.tv_sec; ldata[1] = now.tv_usec; } #else { long time (); ldata[0] = time ((long *) 0); ldata[1] = getpid (); } #endif and if you don't have XDMAUTH defined, the auth value is this: seed = (ldata[0]) + (ldata[1] << 16); srand (seed); for (i = 0; i < len; i++) { value = rand (); auth[i] = value & 0xff; } Oh, well. We knew X didn't have much in the way of security, anyway... - Ian

2 1

Is Your Web Site A Secret?
by owl＠owlsnest.com 17 Dec '03

17 Dec '03

Is your web site the best kept secret on the Internet? We'll promote it to 50 search engines and indexes for $85 and complete the job in 2 business days. Satisfaction is guaranteed! If you have a great product, but are not getting many inquiries from your Web site, you may not be adequately listed on the Web's search engines and indexes. Millions of viewers daily use these facilities to find the products and services they are looking for. But if your site is not listed, no one will see it. Listings on most of these services are free. However, locating and filling out the forms required to get a listing can take several days, and most people just don't have the time to do it. That is why we offer a web site promotion service. WHAT'S THE DEAL? We will submit your site to 50 indexes and search engines for $85. We will accept the return of this E-mail, with the form below filled out, as an order. We will bill you upon completion of the promotion. Our terms are net 15 days from date of invoice. Satisfaction guaranteed! HOW LONG WILL IT TAKE? Generally, we complete the submissions within 48 hours of receiving your order. It can take any individual search engine or index up to three weeks to process your submission, although most are much faster. WHAT SEARCH ENGINES AND INDEXES ARE INCLUDED IN THE PROMOTION? The list changes from time to time. This is our current list: Abaweb!, Alta Vista, Been There, BizWeb, Central Source Yellow Pages, Enterpreneurs on the Web, Excite, Four11, Galaxy, I-Network I-Systems Spiral Business Directory, I-World Web Pointer, Infoseek, Inktomi, Innovator's Network Yellow Pages, Internet Mall, Jayde Online Directory, Jumpcity, Jumper Hot Links, Linkmaster, Lycos, Magellan, Mega Mall, Net-Happenings, Net Navigator, Net Mall, NTG's List, NYNEX Big Yellow, One World Plaza, OnLine's WWWeb Index, Rex, Starting Point, Truenorth, URL Tree, Virtual Lynx, Web Point, WebCentral, Web Venture Hotlist, Webcrawler, Websurf, Win Mag/NetGuide Hotspots, WhatUSeek, Worldwide Announce Archive, WWW Business Yellow Pages, World Wide Yellow Pages, WWW Worm, YelloWWWeb. HOW WILL I KNOW THAT YOU HAVE PROMOTED MY SITE? When we have completed the promotion, we will send you an HTML file as an attachment to your E-mail bill. Save this file to your disk, and view it through your Web browser. It provides links to the search engine we submitted your site to, plus any comments we received from them when we did it. ARE THERE ANY GUARANTEES? We do not require prepayment. Your satisfaction is guaranteed or you don't pay the bill. WHO IS OWL'S EYE PRODUCTIONS? We are a web site promotion company located at: Owl's Eye Productions, Inc. 260 E. Main Street Brewster, NY 10509 Phone: (914) 278-4933 Fax: (914) 278-4507 Email: owl(a)owlsnest.com HOW DO I ORDER? The easiest way to order is by e-mail. Just hit the REPLY button on your e-mail program and fill out the following information. (This information will be posted to the search engines/indexes): Your name: Company Name: Address: City: State/Prov: Zip/Postal Code: Telephone: Fax: Email address: URL: http:// Site Title: Description (about 25 words): Key words (maximum of 25, in descending order of importance): Proofs (Where shall we e-mail proofs): If billing a different address, please complete the following: Addressee: Company Name: Address: City: State/Prov: Zip/Postal Code: Telephone: Fax: Email address: We will bill via Email. (7519) Terms: By returning this document via Email, you agree as follows: You have the authority to purchase this service on behalf of your company. Terms are net 15 days. Accounts sent to collections will be liable for collection costs. You agree to protect and indemnify Owl's Eye Productions, Inc. in any claim for libel, copyright violations, plagiarism, or privacy and other suits or claims based on the content or subject matter of your site. WHAT HAPPENS NEXT? When we receive your order, we will input the information into our system, and send you a proof. After we process any corrections, we will run your promotion, capturing any comments from search engines as we go. We will incorporate these into an HTML-formatted report to you, which we will attach to your bill. ===Web Promotions=====Press Releases=====Link Exchanges========= Owl's Eye Productions, Inc. 260 E. Main Street Brewster, NY 10509 Ph: 914-278-4933 Fx: 914-278-4507 E-mail: owlseye(a)owlsnest.com

1 0

Re: economic espionage (@#$%^&*)
by tcmay＠got.net 17 Dec '03

17 Dec '03

Vlad writes: >I would *die* to see an op-ed in the NYT with the subject: >"economic espionage: the new bogeyman decoy after the cold war" You might want to prepare your memorial service, then, as I recall reading editorials along these lines back around 1990, when "should the NSA be used for economic espionage?" was in the news. Not the exact title of their editorial, but the gist was that turning the NSA into a spy agency at the beck and call of Ford and Motorola is a bad idea. But if you die, Vlad, "the vznuri," at least you have seven other functioning tentacles. --Tim May Notice: Don't expect me to reply to trivial questions and complaints. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Pitfall in producing random numbers
by norm＠netcom.com 17 Dec '03

17 Dec '03

I think that it was on the cypherpunks list that I learned of how PGP for the IBM PC, running under emulation on the Mac failed to produce good random numbers. The virtual PC clock proceeded forward by very predictable manner. Perhaps the details were different but the nature of the pitfall is clear. I did not notice that pitfall mentioned in RFC 1750. (Its the only hazard that I know of that they missed.) The only thing I can think of protecting against this is to do some simple checks against more obvious ways that virtual clocks might produce times. Low order bits should not always be zero. The differences between successive readings should not be constant. Two clock readings separated by a computation of known length should be within a factor of a few of the expected value. If not try again once or twice. Such tests are imperfect but I think that they would have noticed the virtual clock on the virtual PC. If they fail the program can require the user to enter the seed, with all that that entails.

1 0