December 2003 - cypherpunks-legacy

Re: CYPHERPUNK considered harmful.
by Ironwolf＠Minotaur.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently Peter Trei <trei(a)process.com> called for new names and slogans to replace the negatively loaded name "Cypherpunks." Here is one effort (partially based on his suggestion, but with refinements.) Note that I intend the term "strong privacy" to include both cryptography-based tools, and other tools such as remailers. I hereby place the following into the public domain. * * * I lock my car. I secure my house. I send my letters in envelopes. I store my valuables in safe places. I don't let strangers hold my wallet. I don't wear a name tag everywhere I go. I carry my cash and credit cards out of sight. I don't show off my key number when visiting the ATM. I protect my e-mail and files with strong privacy tools. Don't you? A message from SPAN: the Strong Privacy Advocates Network -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGvwfwsQtf7CdTI1AQFSGwP9HWusresWaRsQig2fSNW/nXt+oKVv6Np7 5EuziM3v1ihP4Clr4dqUtEE+Yujf7o71I7nb1UrVvwpIOt5yWXtiZc2/5VPZFBUY bTUHlQ/NkgKum9RMnntb8BprtpiTSrb+o2s9iYDJLfFnCeT8n2zEn97GgandKA2o rbXWVIEKSpc= =mBAk -----END PGP SIGNATURE----- ------------------------------------------------------------------------- NOTE: Currently travelling on sabbatical. Expect responses within 7 days. ------------------------------------------------------------------------- ROBERT McNALLY - MINOTAUR CONSULTING Ironwolf(a)Minotaur.com * 714/648-2248 Specializing in Computer Games and Digital Entertainment Software Over 15 Years of Industry Experience: Creative * Technical * Managerial -------------------------------------------------------------------------

2 1

Re: NetScape's dependence upon RSA down for the count!
by Don.Stephenson＠Eng.Sun.COM 17 Dec '03

17 Dec '03

> From cmcmanis@scndprsn Mon Oct 2 09:07:33 1995 > Why forge it? Why not simply buy a netsite server with a valid certificate. > Let's say you paid full list for it $5000. It is the classic MITM attack > but the protection against that attack was generally that the parties > communicating "knew" each other. Of course, the attacker would be leaving a very strong pointer back to themselves as evidence. > This is a fundamental weakness of putting the security at the SSL level as > opposed to a possibly higher level. With the netscape attack since your > client never cares "how" (or to whom) the SSL connection is made, it never > shows you the information about where the source key came from. Only that > it is valid. I'm not sure this is really an issue of where the security is layered, but rather a flaw in the use of it, in not requiring the unambiguous specification of the "service name" (what's in the certificate) beforehand, or confirming it after the connection is established. You must have a binding between the target URL and the desired "service name", regardless of whether you have the security protocol in the session layer (SSL) or the application/http layer (Secure-HTTP). - Don

1 0

Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape'sdependence upon RSA down for the count!)
by cman＠communities.com 17 Dec '03

17 Dec '03

The idea here is to use multiple alternative channels for distributing the checksums (newsgroups, mailing lists, telephone support lines, fax-back service, e-mail, etc.), in addition to the ftp sites. Also, since you guys use (relatively untrusted) mirror sites, you can distribute the checksums on your official sites, so that people can verify them from you directly, even if it's more practical for their main download to be from a "local" mirror. > > I've been thinking about this recently for obvious reasons. My concern >is that if someone can attack your download of netscape, they could also >attack your download of the program that validates netscape. Is there >really any way out of this one? > > --Jeff

1 0

Re: Crypto APIs
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt writes: <snip> >Yes. (ICE, by the way, is funded by ARPA and run by TIS. Strange notion >of "experiment", given that the result of the "experiment" will be to see >whether the government will allow it. So one part of DoD is funding TIS >to find out how another part of DoD behaves...) Your tax dollars at work. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHC9lW1lp8bpvW01AQHg4gQAge0AzJBK7zlQux8Mc6evJZm/Z87noNYM qtS9cc6OPtcBP7kvrwf/sAa1X+vsHQkKec/WsJ3xH944P8m8WuDgTa2/gMoro50E rymwS6ZtIftrmCis4vpTg6xSPhMXDSHg9NcffLNrKXDQh4xW1aRzIgiixRbBCg1s gXyQ5GoGPqk= =TVrb -----END PGP SIGNATURE----- Regards, Jim Ray "One of the penalties for refusing to participate in politics is that you end up being governed by your inferiors." -- Plato ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

New Netscape bug (in version 1.12)
by Ray Cromwell 17 Dec '03

17 Dec '03

C'punks, I just got back from a vacation in Raleigh, and downloaded the new "fixed" Netscape 1.12. It took me about an hour, but I've discovered another bug and potential security hole. This one relates to mailto:. The bug is as follows. Create a HTML file with a hyperlink containing the following URL foo This bug doesn't seem to crash Netscape, instead, it crashes my XServer as soon as the mail window pops op. I'm too tired right now to try to analyze it, but it might be another stack bug, this time, in the X libraries because Netscape isn't doing any sanity checking. I need help testing this bug on other platforms. I have created a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html to test. I have also found 2 other bugs that cause stack trashing in v1.1 however, they are random and I haven't been able to isolate them completely yet. (I have created a page on my system, such that if you visit it, after you visit about 3 more pages, it crashes) What's my point in pursuing this? Netscape's browser is a piece of software that runs on millions of computers and in effect, allows outside agents to input arbitrary data into that software. As such, it is unlike most applications made. Sure, Microsoft Word may have bugs, but how many people are downloading hundreds of MS Word documents everyday and viewing them? Users of Web browsers are exposing themselves like this everyday, and so I think, that web browsers must have higher standards of robustness. I think Netscape represents an enormous risk to computer security, and while I think they are heading in the right direction, there are some very basic implementation issues they need to clear up which are orthogonal to SSL and credit card transactions. All the cryptography in the world won't help you if someone can subvert your cryptobox. Netscape needs to do some serious quality assurance work. I've never been a QA person in my life, but within a few minutes, I have been able to find serious bugs in the software. And while I'm sure Netscape's coders are fine people, proof reading your own code, code that you look at everyday, becomes rather hard because you tend to "see through it". (just like proof reading essays, or messages) I think Netscape should hire some outside firm/group to review their code under non-disclosure for potential implementation holes. -Ray Cromwell <rjc(a)clark.net> P.S. I am running Netscape v1.12 under BSDI2.0 and the XAccel/2.0 server

6 7

CISS TSP MISSI
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.disa.mil/ciss/tsp.html INFOSEC TRAINING AND SECURITY PRODUCTS (TSP) DEPARTMENT The INFOSEC Training and Security Products Department is responsible for developing, coordinating and executing a DoD-wide INFOWAR education, training and awareness program; creating an INFOWAR Career Management Program for DoD; and developing, coordinating, documenting and executing DoD-wide procedures to identify and disseminate INFOSEC products to meet DoD-wide INFOWAR requirements. This department of CISS is also responsible for the update and distribution of the Multilevel Information Systems Security Initiative (MISSI) Implementation Guide. The MISSI Guide is a planning tool, enabling DoD and other agencies to determine resource requirements to implement various MISSI services into their infrastructure. [Insert Multilevel Security (MLS) excerpt] The MLS Program is partnered with NSA's Multilevel Information Systems Security Initiative (MISSI). The MISSI Program is intended to provide a set of MLS technologies that comply with the DoD Goal Security Architecture. These technologies, when developed over the next five years, will be implemented in operational environments by the MLS Program. In the meantime, the MLS Program will continue to identify, assess, and implement commercially available MLS technologies to satisfy immediate MLS requirements throughout DoD. [End insert] The DISSPATCH newsletter, an INFOSEC publication is published 4 times per year by TSP. Electronic copies will be loaded here soon. The Security Products Database is a stand-alone database containing information on over 400 security products, to include their technical characteristics and points of contact. TSP is also building an INFOSEC Training Facility (ITF) at our Falls Church, Virginia location. The ITF will provide state of the art information systems security training to include the suite MISSI educational offerings. Commercial telephone: (703) 681-1325, DSN: 761-1325 Back to the CISS Page yorkw(a)cc.ims.disa.mil Last Revision - 31 August 1995

1 0

Re: New Netscape bug (in version 1.12)
by Arve Kjoelen 17 Dec '03

17 Dec '03

It doesn't crash Solaris 2.4 running X11R5 (Netscape 1.1N) > I need help testing this bug on other platforms. I have created > a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html > to test. -Arve

2 1

Telco Blob
by John Young 17 Dec '03

17 Dec '03

Financial Times of October 3 has a humongous 40-page insert on international telecommunications -- markets, business, technology, and, to be sure, the tele-players lying, cheating, fearing the "computer hacking industry," whimpering with delirious greed at the bountiful, multicultured consumer's mindless credulity of tekkie- gadgets. For the mil-beguiled Colin Powells there's even a colored global map of Big Blob telco strategic rapacity. A tiny cheering blip of machine-wash-n-readable T-stupidity on p. 34: Sutton dismisses worries out security -- despite a recent successful attempt to break the security on Internet financial transactions. An incident in August, when a researcher at the French National Institute of Computer Science and Control (INRIA) broke into the Internet security system, raised concerns about security. "A lot of security is about perception -- after all, every code can be broken. The INRIA incident only involved breaking a single code and needed massive computer resources to do it," says Mr Sutton.

1 0

ZIT_pus
by John Young 17 Dec '03

17 Dec '03

10-3-95. Wash Rag: "Employment Database Proposal Raises Cries of 'Big Brother'." Critics say that in its zeal to combat illegal immigration, Congress is steering the nation toward an "Orwellian nightmare," an era of all-knowing federal oversight whereby officials will be able to verify citizenship by using high-tech national identification cards. So far, no member of Congress has openly called for a national ID card, at least by that name. Rep. Bill McCollurn (R-Fla.) said he intends to offer an amendment on the House floor to create a "more secure" Social Security card with a photo, a hologram and "perhaps a biometric identifier." Microchip technology can make ID cards especially intrusive. According to an analysis by the Cato Institute, one newly patented ID card can hold a photo and 1,600 pages of text. Another identification system developed by a major defense contractor consists of a microchip the size of a grain of rice that can be implanted under the skin with a syringe and read with a scanner. ZIT_pus (7 kb)

1 0

Re: New Netscape bug (in version 1.12)
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From owner-cypherpunks(a)toad.com Tue Oct 3 04:39:23 1995 | Subject: New Netscape bug (in version 1.12) | X-Mailer: ELM [version 2.4 PL24alpha3] | Content-Transfer-Encoding: 8bit | Sender: owner-cypherpunks(a)toad.com | X-Status: | | | C'punks, | I just got back from a vacation in Raleigh, and downloaded the | new "fixed" Netscape 1.12. It took me about an hour, but I've | discovered another bug and potential security hole. This one relates | to mailto:. Well, I'm still in Raleigh :-) but this doesn't do much of anything to my Macintosh, Netscape 1.1N, under System 7.5. Looks like a bug in your X server. However, Netscape 1.1N for Solaris, running under X11R6 X server, dumps core fairly quickly. I haven't had a chance to try out the 1.12 version on UNIX or Mac, but the 1.22 32-bit Windoze version handles it fine under NT 3.5.1. Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

2 1