December 2003 - cypherpunks-legacy

Re: NYT on Internet Flaws
by cman＠communities.com 17 Dec '03

17 Dec '03

As I pointed out to Ian on Sunday, this is a very old, very well-known bug. As I also pointed out, it is a well- understood fact about Internet security as it stands today that if you can't trust the people on your subnet, you're screwed. I also mentioned the facts that have been mentioned by others on this list (firewalls, most home users don't use NFS, etc.) It is profoundly irritating to find this splashed on the front page of the NYT, contributing to the FUD that largely benefits luddites like First Virtual and those, like MS$, pushing for a return to proprietary networks. (One quote from FV marketing director Pierre Wolfe at the ML conference I recently attended, "The Internet may end up as a ghetto, where people are afraid to engage in commercial activity.") Furthermore, neither the original post or the NYT article place any blame on the role of government regulation or greedy patent-holders in disrupting the formation of protocols based on strong cryptography, which are two of the major culprits in this matter.

7 6

Re: anonymous web pages?
by rkw＠dataplex.net 17 Dec '03

17 Dec '03

At 7:18 PM 10/11/95, Nelson Minar wrote: >The hard part would be finding a site that would be willing to serve >anonymous pages. I don't understand the politics at various sites that >allow anonymous remailers: maybe this isn't much harder? Yes, it is "much harder". Unless the site had a cache of all the pages that it was willing to source (the usual case), traffic analysis could easily be applied to determine the sources for pages because, unlike mail which is "store and forward", web pages are provided on a realtime connection. ---- Richard Wackerbarth rkw(a)dataplex.net

2 1

Re: NYT on Internet Flaws
by David Berger 17 Dec '03

17 Dec '03

[stuff deleted] >People seem to miss that the NFS hack was only an _example_ of a powerful >way to silently destroy the integrity of an executable. Spoofing the >insecure FTP session they used to retrieve it works. Sending them a random >trojan horse works. The point was not that NFS is insecure. It was that >unless you can authenticate your executables as being trustworthy NOTHING >ELSE MATTERS. No I don't think the community missed the point. While both NFS and FTP are equally weak in the way you point out, I think you should have used FTP as your main example because if we presume that the file server where the binary lives is reasonably trustworthy (like the guys at Netscape haven't inserted a trojan horse into their own binary and placed it up for FTP) then the way the file will propogate throughout the net is FTP and not NFS. Nonwithstanding, the NY Times writer took an otherwise reasonable point and blew it up into a "War of the Worlds" style article. I'd make sure he writes a decent article before quoting me in it. David (wondering whose stock fell because of this page one-er) =========================================================================== David A. Berger Software Engineer/Internet Product Development Enterprise Integration Technologies|800 El Camino Real|Menlo Park, CA 94025 dvberger(a)eit.com http://www.eit.com/~dvberger/ (415) 617-8792 ===========================================================================

4 3

Check by phone (revisited)
by cman＠communities.com 17 Dec '03

17 Dec '03

There are a variety of these new "check by phone" operations advertising on the Internet; I decided to check some of them out this afternoon. Most of them seem to use the same breathless prose immortalized in "Make Money Fast", along with generous use of the Netscape "blink" attribute, which immediately sent alarm bells ringing, especially when coupled with referral programs that border on a pyramid scheme. Furthermore, it's clear that these operations are highly vulnerable to fraud and abuse, as was mentioned in a thread on the list a few weeks back. Quoting from http://www.pixi.com/morgan_group/checks/by_phone.html: --------- TELEPHONE CHECKS (PAPER DRAFTS) ARE COMPLETELY LEGAL! Paper drafts are established as a legal method of payment as provided in the Uniform Commercial Code, Title 1, Section 1-201 [39] and Title 3, Sections 3-104, 3-401, and 3-403; Code of Federal Regulations, Title 12 Chapter II, Part 210; and Regulation J, Federal Reserve Bank, Part 2, Sections 4A-201 to 4A-212. Only verbal agreement is required for authorization. Also see Romani v Harris, 255 Md 389. --------- Any lawyers feel like checking this stuff out? (I've got the UCC at home, but not the rest of the materials.) When I called the phone number given at: http://www.Village.com/business/enterprise, I got a guy who was obviously at home, "watching the ball game"; he was quite pushy and focused on the system of "referrals" for people who sign up. Among other things, he had never heard of an ACH debit and was therefore unable to compare the conflict resolution processes for the two methods. (ACH debits are what your health club uses to deduct fees from your checking account each month -- the transactions are reversible solely on the customer's say-so.) The folks at http://www.redichek.com/redichek/redifaq.htm seem a bit more professional. They admit in e-mail that there is a security problem here (no kidding), especially wrt sending routing and account information over the Internet. I enclose our correspondence at the end of this posting, for your reading enjoyment. It seems plain from the nature of the folks who are offering these check printing services that they are not regulated or licensed. Also, it seems that these services are really just preparing the drafts, any liability for submitting bogus drafts rests on the merchant into whose account the drafts are deposited. Question: has anyone seen more legitimate folks offering this type of service? Also, it seems that for the fees that these folks are charging, it would be worth it for a merchant to do this in-house. When this topic came up before, I recall people mentioning sources of magnetic ink and check paper; is this stuff really widely available? Another puzzling factor is that all the services seem to base the fees on the amount of the transaction, when, as near as I can tell, the check printer has no exposure, and costs are in no way proportional to transaction size (basically they're collecting data and running a laser printer.) Proably due to their positioning themselves wrt credit card companies. Joe-Bob sez: Check it out. ========================================================================= Date: Wed, 11 Oct 95 18:13:57 -0600 X-Sender: msumsion(a)mail.redi-check.com Mime-Version: 1.0 To: cman(a)communities.com (Douglas Barnes) From: msumsion(a)optical.fiber.net (Michael Sumsion) Subject: Re: Legal basis Douglas, Thanks for the inquiry. Before I answer your questions, I would like to make you aware that we are in the process of building a completely new, completely secure system using this same check-draft service. It will be arriving within the next couple of weeks. This new system will allow online customers to make purchases, using their checking account, without the need to transmit their account information over the Internet. On to your questions: > >Hi, our company may be a potential customer of your service, >but I have questions about the legalities involved in printing >drafts on people's accounts. In particular, this system seems >especially vulnerable to fraud. I just spoke with our banker, >who had not heard of these services, and was quite concerned. Many bankers have not heard of the system, although it has been in use now for over 3 years. We get calls from bankers on a regular basis who are curious about the service. After explaining it to them, they are generally very supportive. As far as the legalities, it is perfectly legal to print a draft, drawn on a customer's account, with the authorization of the customer. In fact, the legal basis for this is printed on the bottom of each of our drafts. >For instance, wouldn't it be possible for any recipient of a >check from someone to copy down the routing information and >account number, and then use that to defraud the account holder >and the merchant? Yes, this is possible. We have never run into this situation, however. We are not stating that this system is any more secure (with the current system) than credit cards. What we WILL say is that this system is as safe as walking into any store and handing the clerk one of your checks. (The new system will eliminate the need to transmit this information.) >Also, I'm curious where the liability rests in the event that >a charge is disputed -- that is, the customer claims that they >didn't authorize the transaction. How readily are the charges >reversed? I'm familiar with ACH debits, which are extremely >easy for customers to reverse; how does this system compare with >ACH debits? Since there is no standard or regulation regarding this in the banking industry, this differs from bank to bank. Some banks will allow you to go back as far as two years to dispute a check. Others will only go back 30-60 days from the date of receipt. I hope that I've been able to answer completely. If you would like to speak with someone about specific processes, please give Allen a call at 801.298.1212. Thanks, Michael Sumsion _/_/_/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ TM _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/ _/_/ _/ _/ _/ _/_/ _/ _/_/_/ _/_/ _/ _/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ Internet Commerce Solutions - (800) 607-2001 Fax (801) 298-9789 email: msumsion(a)redi-check.com http://www.redi-check.com/redi-check Referral Program: http://www.redi-check.com/redi-check/referral.htm ======================================================================

1 0

Final Roster/Reminder -- Bionomics Conference (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here's a sign of the times> S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 11 Oct 95 14:38:02 . . . Subject: Final Roster/Reminder -- Bionomics Conference Dear Friends, With a record number of 35 speakers and panelists (whew!), the program for the 3rd Annual Bionomics Conference has been finalized. Since our brochures were printed, we've added a number of interesting and thought-provoking individuals, including o Lew Perelman, author of "Hyperlearning" o Andrew Basile, author of "The SPA's Guide to Online Law" o Morley Winograd, author of "Taking Control: Politics in the Information Age" o Frank Gregorsky, former chief of staff to Cong. Newt Gingrich o Jim Griffin, Director of Technology at Geffen Records o Don Lavoie, Director, Program on Social & Organizational Learning, George Mason University o Irwin Glenn, Senior Systems Engineer, Netscape Communications o Pat McKim, Managing Partner, Practical Strategies o Cindy Cooke, Director, Democratic Leadership Council of CA o Dennis Miller, Associate Professor, Baldwin-Wallace College . . . What's more, for the truly tech-savvy, you can now pay for your conference attendance with Cybercash. Just check our web site (www.bionomics.org) . . . ^^^^^^^^^

1 0

netscape rewards bug finders
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Netscape Offers Rewards To "Bug Catchers" MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1995 OCT 11 (NB) -- Netscape Communications Corporation (NASDAQ: NSCP) has announced the "Netscape Bugs Bounty" program that rewards users who help the company find and report "bugs" in the beta versions of its recently released Netscape Navigator 2.0 World Wide Web browser software. Users who are the first to report a particular bug will be rewarded with various prizes depending on its importance. The contest begins with the beta versions of Netscape Navigator 2.0 that are already on the Internet. Full rules for the contest will be available on Netscape's home page at http://home.netscape.com . Speaking to Newsbytes, Roseanne Siino a spokesperson for Netscape, said, "As far as we can determine, this is the first contest of its kind. Netscape's whole approach to broad-based beta testing on the Internet was new, and we hope the contest will enliven the beta testing process." Users who are the first to report a particular bug will be rewarded with prizes depending on the "bug class." Users reporting "significant security bugs," as determined by Netscape, will collect cash prizes, while users finding any security bugs will win Netscape "merchandise." Users finding other "serious" bugs will be eligible to win "a choice of items" from the Netscape General Store. Siino pointed out that there are no caps on winners. Top prize will be $1,000 for any and all bugs in the top category: Severe Security Bugs. To win, the finder has to be the first, and, according to the company, it is important to be constantly using the current versions. The beta versions are available now for downloading on the Internet for free evaluation. Netscape's beta testing of 2.0 is already underway. Users who downloaded previous beta versions of the 2.0 software should download today's versions, which fix major and minor bugs identified since its initial release, including security bugs in the pre-release version of the Java language support integrated in 2.0. Netscape has released special beta versions of 2.0 that include Java for users wanting to test it. Because bugs will be reported and fixed on an ongoing basis, Netscape asks users to stay current on the beta version they are using, so that the latest software is constantly being refined. "We are continuing to encourage users to provide feedback on new versions of our software, and the Netscape Bugs Bounty is a natural extension of that process," said Mike Homer, vice president of marketing at Netscape. "By rewarding users for quickly identifying and reporting bugs back to us, this program will encourage an extensive, open review of Netscape Navigator 2.0 and will help us to continue to create products of the highest quality." Netscape has created two versions of its Netscape Navigator 2.0 beta, available for downloading from Netscape's home page at http://home.netscape.com . Version b1J for Windows 95, Solaris, and Irix platforms includes Java and is for users who want to participate in the bounty program. For general users or those on other Unix environments, Windows 3.1, and Macintosh, Netscape has posted beta versions without Java. After initial testing is complete, future beta versions for all supported platforms will contain Java. (Richard Bowers/19951000/Press Contact: Roseanne Siino, Netscape, 415-254- 1900) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

variations on an attack
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Jiri Baum wrote: > To start a new sub-thread: what if the man in the middle is actually > a behaviour-modifying parasite? At that stage even a physical meeting > won't do you much good (the parasite may be otherwise asymptomatic). That wouldn't quite work since the host would notice the parasite in the middle and could then work out countermeasures. An important part of a MITM attack is escaping notice. What if one night the man in the middle drugged you, kidnapped you, placed you inside a virtual reality machine, replaced your body with a clone, and established a link between the VR machine and the clone so that you experience everything the clone experiences and the clone does everything you intend to do? Can you prove this has not already happened? - the Mad Scientist in the Middle - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHyIA9IjPOsOWLIJAQE3AgP/bNcA0BmDMvto9SocpIcYImoXJ72k9k+Z gYH6dnCo5UCY0KbKwgCbBfQI0bxpaP7EWmZPS/i1HdzWvKOw9JExY2i0gvKMr/BS KGtlG0+RAVSU9DiVRuAr6d7x6IQKYOeRgcNz0Dm2JpaA1eo/DbJ3tsRBYCeaQQ26 gS5XzNzL00M= =lc/J - -----END PGP SIGNATURE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzB8hz8AAAEEAKuHA58RXNk5o0nlDTOsoAs3YTKubscQYoW3kLSjmn7gmskD NtPKxYvXveGN3D/eBgsMzdGVtrl46j1r6VjYsTMcDGUL9wGQnflgHGrbReFYGzkI yW7GhyeUoRqCdmACDpmzUxEqp2J5hK2obL8bcvoiVSBMFogabdIjPOsOWLIJAAUT tEJJIHdvdWxkIGxpa2UgdG8gYmUgcmVmZXJlZCB0byBhcyAidGhlIE1hZCBTY2ll bnRpc3QgaW4gdGhlIE1pZGRsZSI= =Lzd5 - -----END PGP PUBLIC KEY BLOCK----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHyK9SoZzwIn1bdtAQHNsgF/WqMLd/EuNEG3QEXZobZKDQDl0hjMmhBn 56pUQxkNYi0ckMx+YIij9X7XoExm3MsK =D+xl -----END PGP SIGNATURE-----

1 0

Re: NYT on Internet Flaws
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Adam Shostack sez: > > Dr. Frederick B. Cohen wrote: > > | There are alse several papers there on "Internet Holes" under Network > | Security in the same on-line journal. Every month, another 5-10 holes > | are added to those published in this forum. > > And how many of those holes are published by bugtraq/CERT/8lgm > first? Just curious to see if this is another list I should be on... > Well since I see far less than 5-10 announcements from bugtraq, CERT and 8lgm put together most months, they must have others. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: NYT on Internet Flaws
by Rich Salz 17 Dec '03

17 Dec '03

> I understand though, that we can't control what the reporters >say and how they interpret what we say. It is very important to word >your posts carefully such that when you post a bug a reporter won't >think that they should write an article on it until it is verified. NO! Something like Perry's "Do not redistribute without permission" should be the only modification needed. /r$

4 3

Aquaria wars ?
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

I need some historical information for a discussion about which security features are to be used in usenet. Perhaps someone can help: Some (many) years ago there was a very large and long flamewar at the usenet. As far as I know it was called "The Aquaria Wars" because it began with a debate about the question whether the newsgroup should be named "alt.aquaria" or "alt.aquarium". I am looking for historical informations about this flamewar. Can anyone remember it or is there anything available about? Thanks a lot Hadmut

2 1