December 2003 - cypherpunks-legacy

Re: java security & the cypherpunk agenda
by Rich Salz 17 Dec '03

17 Dec '03

>From what I have seen of the CV's of the Java team (at least those who have/had home pages on the various Sun java servers), none of them were particularly security-aware. /r$

1 0

PC disk wipe software - SUPERWIPE 1.04R
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

PC disk wipe software - SUPERWIPE 1.04R Note: SUPERWIPE is also a SUPER ERASER with powerful erase features. As a matter of fact, I have written a shareware program that is a PC wipe program: SUPERWIPE 1.04R . I just sent a copy to Perry Metzger. If anyone else wants a copy, let me know. Its free to Cypherpunks. There are two big problems with writing a PC disk wipe program. 1. Compressed disks. With compressed disks you don't know how long to make the write. You try putting all 1's or all 0's and the disk compressor will compress it next to nothing. In fact, it may write the wipe data to different clusters than the original file. 2. Software disk caches and even worse - hardware disk caches. - Those 256k disk caches. With caches, if you do multi-wipes of a file, in actuallity, you only do one real wipe & several virtual (to RAM) wipes. It might be possible to get around the first problem by using direct sector writes (INT 13 SERVICE 3) instead of well behaved (INT 21 SERVICE 40) writes. But this is a rather dangerous practice as if you make a mistake you might wreck the hard disk partition. Concerning the second, I see no practical way around the problem of hardware disk caches keeping the user from making multiple wipes of a file. As for making multiple wipes of CURRENTLY unused disk space, my SUPER- WIPE will do that with the options: /oldx /n . Where oldx points at the diskette drive or hard disk partition to be wiped & /n tells how many wipes to do (1-9). As for the problem of getting rid of old buffer data writes to the end of last file cluster writes, my program doesn't handle that. However, if there is no disk compressor, I don't think it would be that hard to write a function to handle it. In reality, I don't think that this problem is much of a problem anyway. It would only occur at the end of small files. I suspect that the wipe problems that we have with the DOS operating system are shared with most other operating systems. I uploaded SUPERWIPE to an anon ftp site. I believe it was Alex De Joode (or spelled something like that) who gave approval for the upload. It seems like it was a Utopia site. I lost my file on it and have now for- gotten. If anyone needs SUPERWIPE, send me a request. Some documentation follows for SUPERWIPE 1.04R: -------------Start of readme.spr file--------------------------------- SUPERWIPE current version: 1.04r SUPERWIPE is a utility that will substantially increase the security of your computer. What does SUPERWIPE do? In order to explain what it does, I first need to explain some security holes in the DOS operating system as it works with disks. The delete & erase DOS instructions are convenient utilities that allow you to get rid of old files. They don't actually destroy the files. They merely mark these files so that they will be ignored by the DOS operating system. Most of the time this is good enough. But what if you have sensi- tive files that must not be recovered? A snoop could use the popular DOS undelete command or another utility program to entirely recover these files. To solve this problem, wipe programs were invented. A wipe program will write a character, usually a 0 or a 1, over your entire file & then delete it. In this way, your sensitive files are made non-recoverable. NOTE: SUPERWIPE currently only works with non-compressed disks. SUPERWIPE also does this but with some improvements! SUPERWIPE (unregistered) will enable you to : 1. allow multiple files to be wiped instead of just one! 2. use wildcards! 3. mix your regular files with wildcards in any order you choose! Multiple wildcards may be interspersed with multiple regular files! 4. reduce your file to zero bytes, so that a snoop cannot determine with certainty what the original size was! 5. rename your file to a single letter, so that a snoop cannot determine what the original name was! 6. access several disk partitions (c: d: e: etc..) & diskette drives in one run! 7. starting with version 1.03, SUPERWIPE now has SUPER ERASE capabilities as well. All of the above capabilities are contained in this program. ADVANTAGES OF REGISTRATION FOLLOW: When you register, you will receive a registered version, that in addition to the above capabilities, will allow you to: 1: Wipe out all previously erased or deleted files! (The /OLD option.) The registered version will also have a nicer execution message that will lack the plea for money. You are probably wondering why you would want the capability to wipe out all previously deleted files. There are two reasons: one fairly ob- vious; one not. Firstly, those old deleted files may be sensitive & you forgot to wipe them properly. Or maybe, you were busy at an earlier time & did not take the time to properly wipe all the sensitive files. Or, you may not remem- ber wheather you wiped or erased a sensitive file. With the /OLD option, you can be sure that they are all wiped! Secondly, many programs, including some word processors, make temporary files that are used to assist that program in its work. When the program is done, those programs are deleted. Ordinarily, this is fine, but it does leave a security hole. The /OLD option will wipe out all of them! Note: Since the /OLD option must go through the entire "unused" disk par- tition or diskette, it may take several minutes to complete. 2. Registered users, will also be notified of improved versions of SUPERWIPE. 3. Upgrades, at least for the next upgrade, will only be $10. 4. Registered users will also receive telephone support. 5. Also, the registered user will have a clear conscience & will use SUPERWIPE with a feeling of sublime legitimacy! Site licenses are also available. -------------End of readme.spr file--------------------------------- -------------Start of .com help file------------------------------------ Gary's super file wipe/erase program. ver. 1.04r Copyright 1995 Gary Jeffers This ver. does not work with compressed disks. Nothing to do. Invocation syntax w filename1 filename2 ... wildcard1 wildcard2 ... /(no. of wipes for disk) /n(one alpha letter name of alternate file) /old{partition or drive letter} - (wipe all old deletes.-reg. only) /e for regular ERASE mode only - NO wipes. no parenthesis or braces in actual command line. The order of the tokens does not matter. examples: w my.fil new.fil /olda *.exe next????.com /5 /na w this.fil /e wild????.exe /nc anot????.com second.fil w that????.* /nk last.fil /oldc -------------End of .com help file------------------------------------ THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY. The United States "Federal" Government - We'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

1 0

Java idea
by Mike Fletcher 17 Dec '03

17 Dec '03

Well, security bugs aside (and I've got the sun4.1.3_u1 and Win32 ns2b distributions :) has anyone given any thought to using Java to do some sort of Chinese Lottery attack. I was re-reading App. Crypto. last night and it could be feasable. If you could get your key cruncher thread loaded into a good many browsers to run when idle . . . . How many estimated copies of NS are there? Anyone want to do the math? :) --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

2 1

LOG_rea
by John Young 17 Dec '03

17 Dec '03

10-10-95. NYPaper: "Deleted, but Not Gone or Forgotten." Files produced by Microsoft Office Windows applications, including Word, Excel, Powerpoint and Access, often incorporate chunks of data previously deleted from the disk on which the files were saved. Microsoft said the problem was solved in earlier versions of Microsoft Word but that it has recurred in the new version for Windows 95. Third-party programmers report another security lapse. Word offers optional password protection by encryption. The encryption, however, does not extend to "objects" within the file. "Chip Maker Introduces a Chip for Super Use and for Modems." One of the most closely watched Silicon Valley start-up companies plans on Tuesday to disclose details of an ambitious computer chip that it hopes will one day be used in everything from cable modems to supercomputers. Microunity Systems Engineering Inc. said its chips would be able to process information 10 times faster than today's personal computer microprocessors. The chip will consist of 10.5 million transistors and will process data at a gigahertz, or a billion operations a second. It is designed so that it can process information in parallel and will be capable of issuing up to four 128-bit-wide instructions simultaneously. 2: LOG_rea (10 kb)

1 0

NOD_out
by John Young 17 Dec '03

17 Dec '03

10-10-95. W$Japer: A long front page lead nodder on the burgeoning "space race" to build global satellite telecommuncations systems, for video, phone, data and other transactional bile. A related gagger on "media processors," a new generation of chips -- for video, graphics, on-line services, wireless data, telephone and audio -- being developed by MicroUnity, Chromatic Research, IBM and TriMedia. This is a more comprehensive pack-o-lies of the NYPaper spitter today on MicroUnity. NOD_out (28 kb in 2 parts)

1 0

truth in advertising: Netscape 1.1 on security
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Tue Oct 10 11:34:39 1995 This may be old news, but I don't recall seeing it on the list... In version netscape -version Netscape 1.1N/export, 20-Apr-95; (c) 1995 Netscape Communications Corp. I ran 'strings' on the binary, and only got one "about.*security" reference. entering it as an URL about:security yields the ironically humorous (when you consider all of the security bugs): Whatchew talkin' 'bout, Willis? - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/ Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about gnuslive.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMHqSl4JYfGX+MQb5AQFLKwP/RDsLzLxZkB18uSlV9lxp9nJ6uRilYYAE m1gv4KKmtNnWLowlrr605iv1L7DUvQTRpGKANcLZDEsKZFYnjT/VBSN+/Jnoe6GX VFNiSALrvX/IZjxf8FQ2xfyBYWF7J/DxTWP3QHjW9hc06Sx2fzCHdn4HItAteDwr aWO8dM3XYzY= =8udJ -----END PGP SIGNATURE-----

2 1

Myth of the Powerless State
by Duncan Frissell 17 Dec '03

17 Dec '03

Gentlemen: Your leader entitled "The myth of the powerless state" (October 7th) made some valuable points about the continuing significance of state power in our lives but missed some very significant numbers. You state that public spending in the "big economies" has expanded from 36% to 40% of GDP since 1980. But, if you take the world's economy as a whole, can you doubt that the percentage of Gross World Product (GWP) controlled by the world's states has declined since 1980. Note the following significant changes. 1) In both developed and underdeveloped countries, the "informal sector" has continued to grow. You, yourself have reported that the poorest households in America spend twice their official income. 2) The Soviet Union has gone from an almost 100% government-controlled economy to one which has a much smaller state sector. Meanwhile informal and formal privatization in China, India, Britain, etc. have transferred vast assets to private control. 3) The continued accumulation of offshore funds are effectively outside of the game and under no flag. The amount of these funds is hard to estimate but has surely grown quite large. The convergence of all of these factors suggests that, at some point in the late '80s or early '90s, the percentage of the GWP controlled by governments peaked and began to decline. As technology makes it easier for the financial services industry to carve its niches in the corridors of cyberspace, stateless financial assets seem sure to grow. Since anyone can use powerful mathematics to create virtual spaces which even the largest government is powerless to enter, the percentage of GWP that the state even knows about much less controls will shrink. Duncan Frissell

1 0

Re: PC disk wipe software - SUPERWIPE 1.04R
by Herb Sutter 17 Dec '03

17 Dec '03

At 04:45 1995.10.10 -0500, Gary Jeffers wrote: > As for the problem of getting rid of old buffer data writes to the end >of last file cluster writes, my program doesn't handle that. However, if >there is no disk compressor, I don't think it would be that hard to write >a function to handle it. In reality, I don't think that this problem is >much of a problem anyway. It would only occur at the end of small files. Thanks for the post. Just a thought: there is dead space at the end of virtually all files, not just small ones. On average, half a cluster is wasted at the end of any given file. Only files that happen to be an exact multiple of the cluster size won't have wasted bytes (on my main drive, with a cluster size of 16K, on average about one file out of 16,000+ wouldn't have any wasted space). Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Re: Certificate proposal
by jbaber＠mi.leeds.ac.uk 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> writes: >The POV I am really arguing against is the one that defines identity to >be a key, that states that in communicating with a key you are by >definition communicating with the person you have in mind. The man in >the middle attack does not exist because from your point of view the >entity at the other end of the communication channel is just the MITM >plus the person you think you are talking to. This idea has been >expressed many times by other people in this discussion, and it is this >which I think is fundamentally flawed and even dangerous because it >encourages the use of untested keys. In fact it seems to define away >the question of whether a key is real or fake. It defines away the question of whether a key is real or fake because the key itself can not be fake. Assuming strong encryption anything that you send to the key can only be read by the key and anyone that he/she choses to pass it on to (something that can not be stopped). The only thing that can be fake about the key is the attributes associated with it - whether the attributes concerned are true names or the ability to use a bank account. Having a man in the middle when no attributes are concerned is simply the same as talking to someone who passes all of your messages on to a friend and then expresses the friends opinion rather than his/her own back to you... something that I can think of no possible way to stop. So although you are talking talking to A the opinions expressed are those of B, and there is no way of telling - in the same way as a man in the middle attack (B may not even know that his/her arguments are being used by A against you). This argument reduces the problem to 'how do you validate key attributes' as you can be sure that you are communicating securely with the key (key's owner) but nothing else. With PGP currently the only attribute that a key (X) may have is a name (true/pseudo) and this attribute can be signed as valid by another key (Z). If you accept the signature all you are doing is saying that you accept the signing key's certification - ie an attribute signed by this key (Z) is true. Eventually you have to just trust a key to have taken reasonable care to ensure that any attribute that it has signed is true - whether you are using a Web of Trust model or a more centralised model such as accepting VeriSign certificates (or your own - knowing exactly how much care you have taken to ensure that the attribute that you have certified (signed) is true). I believe that this is more removing a special case (treating the true name differently from any other attribute) than defining away the problem - even though the (MITM) problem does cease to exist. Jon jbaber(a)mi.leeds.ac.uk http://www.chem.surrey.ac.uk/~ch02jb/

1 0

Re: Conference Summary, Part the First
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:23 PM 10/8/95 -0800, Douglas Barnes wrote: > o Regulators are not amused by attempts to run unlicensed online > banks. They are aware such things are starting to pop up, and > they are very interested in shutting them down when they do. The jurisdictional problems are going to be very interesting. As with gambling. Nations are reluctant to extradite their nationals for acts that are not crimes at home. The US follows this practice just like everyone else. Witness the lack of success of the German government in extraditing neo-nazis from the US. They had to grab one in Europe. > o The same goes for NBFIs (Non-bank financial institutions) -- > these appear to be regulated primarily at the state level, with > some IRS and FinCEN involvement. These include everyone from > stock brokers to Casas de Cambio. This is the real problem for the Feds. When everyone is a non-bank financial institution... > o The attendees displayed an understanding of the situation wrt > electronic payment systems that ran from dim to non-existent. Hard to control what you don't know. > o Fewer formal, specific or deterministic rules for reporting > suspicious transactions. > > o More vague, subjective, and privacy-invading rules for > reporting suspicious transactions, coupled with more severe > penalties for banks and NBFIs. But unlicensed NBFIs don't have licenses to pull so regulation is tricky. An unlicensed NBFI includes any institution in another jurisdiction (no *US* license) and any person running Quicken version 9.0 that will no doubt support exotic electronic payment systems. > o Banks are now considered "deputies" of the federal government > in the War On Money Laundering. Generals are always fighting the last war. Banks are history particularly if they are unable to offer competitive services because of regulatory restrictions. > o Banks must implement strict "Know Your Customer" policies. Which are trivial to defeat particularly under an EPS system when the customer hands his keys over to his actual principal. Note: I've often wondered why the rulers place so much faith in their ability to identify people when those who have studied the Is A Person problem have thrown their hands up. "Homeless? Want to make a few bucks? You have a brilliant future in the identity sales business. Remember, you can sell your identity as many times as you like. It never wears out." DCF

1 0