December 2003 - cypherpunks-legacy

SpokesPunking...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:03 AM 9/26/95, Craig Hubley wrote: >"Consensus on cypherpunks seems to be that 40 bit encryption is not viable > for commercial applications, and that Netscape seems to have taken less > than due care to choose an appropriate random seed for its session keys." No offense offered Craig, 'cause I like reading your stuff here, but the concensus opinion on cypherpunks is "We don' need no steeenking spokespunk!". It seems to me that you can say that without any title, and the mouthier amongst us will be tapped for quotes as individuals anyway... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: WSJ on Netscape Hole 3
by sameer 17 Dec '03

17 Dec '03

He's -asking- for an exploit. Tshirts to Ray and the person who does the exploit, if it gets written. Maybe I should just ring up 8lgm and have them do one. > > On Mon, 25 Sep 1995, John Young wrote: > > > The Wall Street Journal, September 25, 1995, p. B12. > > > Marc Andreessen, vice president of technology at Netscape, > > said the company will issue fixes for the recent glitches > > later this week. He added that it's unclear whether > > anything other than temporarily crashing a user's computer > > could result trom the recent flaw. > > Oh Marc, you didn't really want to say that, did you? > > -Thomas > -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

3 2

"Notes" to be Eclipsed by "Netscape"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:52 PM 9/25/95, Jon Lasser wrote: >Perhaps the Notes pricing scheme is sooo outrageous (by the standards of >a student like myself, and probably most others, if it's still anything >like it was at the 1.0 release) that mostpeople have had zero opportunity >to examine the program, let alone really have time to play with it? I've never even _seen_ a copy of Notes running on any machine, nor do I know directly of _any_ of my colleagues who has. (Not saying nobody has, of course, just that I can't find anyone I know well who has.) I've been following the news on Notes for at least several years, even to the point of buying some Lotus stock several years ago on the strength of what I had read about Notes. (Alas, I sold it soon thereafter, before a run-up in price.) My point? Notes is nearly invisible in the non-corporate community I now hang out in. Who knows what weaknesses or bugs it has in it. Folks on our list probably don't have much familiarity with it. My hunch is that, as the "Wall Street Journal" reported yesterday, that IBM overpaid for Lotus, that the notion of Notes becoming the universal collaboration/communication option is flawed. (I've been saying for a while that the Web serves that purpose better, and that Web browsers will likely edge out Notes. Apparently I was hardly prescient, as Netscape recently bought Collabra, which is pushing that point exactly.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

[NOISE] Re: Easter Eggs
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 9/26/95 -0400, you wrote: >I also think that in Netscape their existance is an >indication that the managment at Netscape is a bit less uptight than >management at some other places. Depends on the department. They have at least one manager at Netscape with a permenent case of high blood preasure. (He happens to be in charge of the support department.) >I didn't know about the FishCam Easter Egg, but I know that Netscape >has a couple of Easter Eggs related to the activity indicator in the >top right of the display. Typically this is the Big N logo with >animated meteors, etc. flying by when the window is active. One >Easter Egg temporarily turns this into a compass which spins to >indicate activity. Another causes the animation to show a dragon >(Mozilla) breathing fire for the remainder of the session. I won't >spoil your fun by telling how to find them. If he is not running X Windows, he is going to be searching along time for the Compass easter egg. You also need X windows to find the Mozilla animated icon hack on Jammie Zawinski's page. Which easter eggs that are available is dependant on which client you are running. obNetscapeHack: There is a feature called a "cookie file" in Netscape that is ripe for exploitation as a security leak. If you are using a Netscape server (and you may not even need that), you can feed all sorts of information into it without the user's knowlege. I have heard of one page that overloads the cookie file until the machine runs out of drive space. I am sure that there are other exploitable holes there... Any takers? | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

3 2

Netscape for OS/2, when? (Re: Another Netscape Bug)
by sentiono＠cycor.ca 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 05:58:19 -0400 (EDT) you wrote: >> It's not an exploit script, but you can find an auto crash "animation" >> for Ray's discovered bug on >> http://hplyot.obspm.fr/~dl/netscapesec/c1.html >> (or click from the updated http://hplyot.obspm.fr/~dl/netscapesec/) >Crashes the 16-bit Windows version 1.1N. >DCF Same here. For more information (not Netscape related), Web Explorer 1.02 for OS/2 also crashes for the long URL. I wish Netscape will port it to OS/2 (already ask them, but no comment from Netscape). I don't try it on Netscape 1.1N as it doesn't run reliably under Win-OS/2 (10 min -> crash! ;) ------------------------------------------------------ Sentiono Leowinata, Charlottetown, Prince Edward Island, Canada System Engineer/Programmer Analyst - Cycor Communications Inc. sentiono(a)cycor.ca, 902-629-2488, http://www.cycor.ca/

3 2

Insecurity in WWW oriented security
by Tim Scanlon 17 Dec '03

17 Dec '03

I wanted to share an experience with folks on the list that points to the relavince of what c'punks have been doing looking at the Web encryption & security issues like we have. I was approached by a headhunter yesterday who wanted me to do the security for a hospital connected to the net. Straightforward stuff one would think. My inital reaction was fairly positive, and I responded that I didn't think I would have much trouble with the task as long as they had a resonable setup internaly etc. etc. (I'm not a big beliver in hard & crunchy -> soft & chewey when your accounting or other critical data is part of what can be chewed up...) Well at that point it got interesting. He told me that said client was asking as a part of their requirments that they be able to do "Secure transactions using HTML & Netscape". My reaction was somwehere allong the lines of "What do they mean by `secure transactions'!! Are they aware that the state of encryption for WWW is really poor at best right now? I told him that I thought this might not be such a hot idea, and that my interest in this whole thing would hinge totaly upon exactly what sorts of transactions they wanted to do using web servers and the like. And that depending on the answer to that, I would or would not be intrested in the whole thing. The reason for my hesitation? I don't want blood on my hands over a setup that is by definition currently in a state of very poor security. And right now I have no idea if they want to transfer MasterCard's or MRI's. But I do know that depending on what it is they're planning, it might not be a place *I* want to be. Besides being damned frightening, this points to a trend in network evolution. Organizations are planning these sorts of moves and utilizations of the technology with little thought to the possible consequences of it. And if the FBI ends up busting some psyco in the future for tampering with the transactions of MRI data, x-rays, or any of a million other possibilities, I seriously doubt that Loius Freeh will be stepping forward to remind us all of the need for robust security. Instead, it is far more likely that he would argue that it was another example of the need for increased monitoring of the internet and controls on cryptographic solutions. I found aspects of the whole conversation, juxtaposed with what has been going on lately with the list chilling to say the least. Tim Scanlon ________________________________________________________________ tfs(a)vampire.science.gmu.edu (NeXTmail, MIME) Tim Scanlon George Mason University (PGP key avail.) Public Affairs I speak for myself, but often claim demonic possession

2 1

Re: Security Update news release
by Bill Stewart 17 Dec '03

17 Dec '03

>>Do the new versions use PGP's randseed.bin? If Netscape even only looks at >>data used to keep PGP secure, Netscape will be banned from my computer >>and every computer I am responsible for. -- For good. > >This is the second person who has expressed this sentiment. I don't >understand it. If you believe that the possibility of randseed.bin >getting out is dangerous, then why do you leave it online? Do you >really trust every piece of software you run, every piece of software >that can possibly access your machine over the net, to not look at >that file? It makes a little bit of sense - I'm not aware of any software, other than PGP and now Netscape, that _explicitly_ goes after randseed.bin, though of course just about anything can try. Assuming the code is inspectable (which it currently is), if I can see that all it's going to do with the file is crunch it into MD5 along with a bunch of other stuff, I'm not too worried, even though it is stealing slack(entropy) from PGP. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Golden Coy Freeh
by John Young 17 Dec '03

17 Dec '03

The New York Times, January 25, 1995, p. D5. The F.B.I. Sting Operation on Child Pornography Raises Questions About Cryptography By Peter H. Lewis Federal agents swooped down on more than 125 homes and offices across the United States on Sept. 13, seizing computers and diskettes from people suspected of trafficking in child pornography over the America Online network. But to date, the number of arrests in the sting operation remains at 15. More arrests are expected, but why haven't more occurred? Last week, Louis J. Freeh, the director of the F.B.I., offered an oblique explanation for the seemingly low initial success rate. At least some of the suspected child pornographers had used data encryption software, Mr. Freeh said Thursday in remarks at an International Cryptography Institute conference in Washington. In other words, they had scrambled their computer files so that only someone with the password -- or with proper code-breaking skills -- could view the contents. Mr. Freeh wisely did not say whether the F.B.I. agents were able to decipher the encrypted files seized in the investigation. It would be foolhardy, from a law-enforcement perspective, to tip one's hand. If the head of the F.B.I. acknowledged that his agency was powerless to crack a cryptography program like Pretty Good Privacy, the stampede for that software on the Internet would make the run on Windows 95 look puny. From a political perspective, Mr. Freeh's coyness is shrewd as well. By making even a subtle suggestion that some child pornographers may walk free because of unbreakable cryptography, he gains more leverage in seeking Government-mandated controls over the use of encryption technology. Mr. Freeh said that encryption was a "public safety" issue, and he said law-enforcement agencies around the world "will not tolerate" the use of private data encryption to impede investigations. He said encryption had also been encountered in the Philippines in a plot to blow up an American jet and to assassinate Pope John Paul lI (in that case, at least, one can presume the code was cracked.) It seems worthwhile to point out that even if the suspects in the child pornography sting, called Operation Innocent Images, used cryptography, that did not provide evidence that they were doing something illegal. Our legal system is predicated on the belief that one is innocent unless proved guilty, and there is no exception clause for technology. "Fortunately we are not yet at the point where the mere use of encryption overcomes the presumption of innocence," said David Sobel, staff counsel for the Electronic Privacy Information Center in Washington. Another point to remember is that the F.B.I. identified more than 100 suspects, and gathered sufficient information to warrant raids, using existing laws and enforcement techniques. On the other hand, there is no denying that child pornographers use data encryption to keep co-workers, family members and police from discovering their secrets. "We are involved in a couple of jobs every week resolving some kind of a child pornography investigation," said Eric K. Thompson, president of Access Data Inc. of Orem, Utah, a private company that specializes in cracking encrypted files for corporations and Government agencies. The Government's elite codebreakers at the National Security Administration are prohibited by law from using their talents against American citizens. The F.B.I. has its own code-breaking experts, but it routinely calls on independent experts like Access Data to help on some cases. After eight years of breaking into encrypted files, ranging from situations involving secretaries who simply forgot their passwords for important memos to cases involving corporate computer systems that were encrypted by disgruntled employees, Mr. Thompson has concluded: "Basically, the criminal element is becoming more computer literate, and they are discovering encryption. Files are becoming more difficult to break." Dorothy Denning, an expert in cryptography and a professor of computer science at Georgetown University in Washington, said she recognized the importance of encryption for businesses seeking to protect information. At the same time, she said, she also recognized the problems that law-enforcement agencies face because of cryptography. "So many people had been saying people in law enforcement weren't having this problem, and I didn't believe that," Dr. Denning said. So in May, she said, she spent two days calling sources at law-enforcement organizations. "I came up with over 20 cases -- child pornography, terrorism, murder, embezzlement fraud, tax protesters, export violations -- and, in some cases, they were able to crack it, and others they couldn't," she said. What can be done? The Administration's plan is to seek voluntary compliance with a "key escrow" plan, which would enable citizens to use strong, private cryptography as long as a copy of the software "key" were made available to law enforcement officials. Last week, Mr. Freeh stressed that he preferred a voluntary approach. But "if consensus is impossible" on the encryption issue, he said, the F.B.I. might consider other approaches. The debate is certain to heat up as more information about Operation Innocent Images becomes known. There are no comforting answers, only an echo of advice from a time predating the Internet: There is no solution. Seek it wisely. [End]

4 3

Hack Microsoft?
by Ray Cromwell 17 Dec '03

17 Dec '03

Microsoft recently got C2-security status approved for Windows NT by the National Computer Security Center, a division of the NSA. They are supposed to put systems through "laborious testing and review" before they approve C2. So, if one can find bugs in NT's security, one can toss a little more egg on the NSA's face and the sham that part of their activies to *help* to secure american computers. A simple violation of NT's C2 status would be to demostrate a flaw in it's memory protection implementation. Personally, I think NT is *riddled* with bugs waiting to be discovered. Hell, even the NT "service pack" is included in the C2 status, which I bet has plenty of holes. If Cypherpunks can find flaws that the NSA can't, or won't divulge, what does that say about their so-called COMSEC ability. -Ray

4 3

IBM enters WWW security market
by Jeff Simmons 17 Dec '03

17 Dec '03

> > -------- Forwarded message -------- > Newsgroups: comp.os.os2.announce > Date: Fri, 29 Sep 1995 14:49:59 GMT > From: tsipple(a)vnet.IBM.COM > Subject: OS/2 NEWS: New, secure version of WebExplorer > > Submitted by: Timothy F. Sipples (tsipple(a)vnet.ibm.com) > Source: Timothy F. Sipples (tsipple(a)vnet.ibm.com) > Date received: 1995 September 26 > Date posted: 1995 September 29 > ------------------------------------------------------------------------------ > New, secure version of WebExplorer for OS/2 Warp > > ATLANTA, Sept. 27, 1995--The latest additions to IBM's Internet > Connection software family will enable companies to encrypt > Internet transactions and better protect internal networks with > firewall software as they explore new business opportunities on > the Information Superhighway. > > Today's announcements include: > > * A new secure version of the Web Explorer for OS/2 Warp > > * The IBM Internet Connection Secure Server for OS/2 Warp > > * The Internet Connection Secure Server for AIX > > * An enhanced version of the Internet Connection Secured > Network Gateway > > * an enhanced version of the Internet Connection for OS/2 > Warp > > * an enhanced version of the Internet Connection for Windows > > "Businesses of all kinds are considering the immense opportunity > the Internet offers but are reluctant to take the plunge until > they feel they can do so in a planned, secure manner. The > Internet Connection family provides our customers with that > reassurance, freeing them to explore a whole new world of > possibilities," said Lois Dimpfel, vice president, Networking > Software Products, IBM Networking Software Division. > > The Internet is evolving as a means for conducting electronic > commerce, and the new IBM secure servers and OS/2 Warp client are > superbly positioned to meet customer security needs. The IBM > Internet Connection servers and client support both of the > emerging security technologies -- Secure Hypertext Transfer > Protocol (S-HTTP) and Secure Sockets Layer (SSL) -- to provide > customers with maximum flexibility. > > New OS/2 Warp client and secure servers > > The new version of the Internet Connection for OS/2 Warp, the > first Internet client to be included at no charge in an operating > system, adds security support to an Internet application suite > that has won generous praise in its first year of availability. > OS/2 Magazine recently chose the Internet Connection for OS/2 > Warp as a winner in its editors' choice awards. > > The Internet Connection family of client software was also > enhanced last week. The Internet Connection for OS/2 Warp, > provided at no charge as part of the Warp bonus pack, now > includes table support, streaming graphics, an integrated news > function and other enhancements through HyperText Markup Language > (HTML) 3.0 extensions. These enhancements will also be available > in the secure version being announced today. > > The InternetConnection for Windows was enhanced with improved > performance, additional graphic viewers, audio players and other > features. > > IBM's new web server software provides unmatched scalability for > customers. The OS/2 Warp version can run on cost-effective > desktop systems sold in retail outlets, while the AIX version > runs on highly-scalable RISC System/6000 platforms. > > Both the IBM Internet Connection Secure Server for OS/2 Warp and > the Internet Connection Secure Server for AIX were designed to be > quickly and easily configured using any industry-standard > browser. The installation and configuration is menu-based and > includes online help designed to assist an administrator with > making the correct choice. > > The new Internet Connection secure servers and clients allow > businesses and their customers to conduct transactions over the > 'Net knowing that the data is protected. For example, an auto > parts supplier might create a secure web server containing its > catalog, including high-quality images of the items, on the web > along with the ability to place an order. A customer would use > the Internet Connection secure client -- or an S-HTTP- or > SSL-compliant client from another vendor -- to browse the > online catalog, order a part and pay for it with an encrypted > credit card number. > > Enhanced secured network gateway > > A new version of IBM's Secured Network Gateway, a software > product generally known as an Internet "firewall," today joins > the Internet Connection product family. Formerly part of the > NetSP product family, the Secured Network Gateway operates on an > AIX platform to protect a corporation's internal enterprise > network resources from Internet intruders, while allowing > legitimate traffic to flow through the firewall. > > The Internet Connection Secured Network Gateway offers a number of > advanced features, including: proxy server, SOCKS servers, filters and > domain name service. > > Among several features added to the new version is support for > AIX version 4.13, in addition to AIX version 3.25. The new > operating system support offers customers the option to run the > Secured Network Gateway on PowerPC hardware. > > Another key feature of the new version is data encryption. Data > can safely flow between two firewalls across a public network. > The firewall encrypts IP data packets, creating a private "IP > tunnel" from one secure internal network to another. > > The new secure IP tunnels could be used for a company with the > Secured Network Gateway installed at its various sites to safely > and confidently transmit sensitive financial data from a branch > office over the Internet to corporate headquarters. Customers > could also use the new feature to securely administer a firewall > from a remote location. > > Internet Connection directions > > Just as the Internet itself continues to expand phenomenally, the > Internet Connection family, now consisting of seven generally > available products, will also grow. Current product plans call > for additional web clients on a number of platforms, and web > server software for OS/400, MVS and selected non-IBM systems. > > "We don't intend to just keep pace with the market; we intend to > be the pacesetter," said IBM's Dimpfel. "IBM has worldwide reach > and strengths like no other company. The IBM Global Network, > robust software products, IBM services and gateway software to > link with existing business systems using DB2 and CICS--all this > means customers don't have to deal with patching together > solutions from a collection of vendors." > > The Internet Connection product family is a component of IBM's > imperative to provide people and organizations with > network-centric computing, a new model that combines networking > software, network services and computing devices to facilitate > computing anywhere, anytime. > > IBM, the world's largest software provider, creates, develops and > manufactures the industry's most advanced information technologies, > including networking systems, software, computing systems, storage > devices and microelectronics. > > Pricing and availability > > The secure server software for OS/2 Warp is $2,999 for the first > license with additional licenses available for $2,699 each. The > AIX secure server software is $4,999 for the first license and > $4,499 for an additional license. The Internet Connection Secured > Network Gateway is priced at $9,999 for the first license, with > additional licenses available for $8,999. > > The new secure WebExplorer for OS/2 Warp is $35 per copy and > pricing on the enhanced IBM Internet Connection for Windows has > been reduced to $59. > > Both secure servers and the secure Web Explorer for OS/2 Warp > will be generally available in December of this year. The new > version of the Secured Network Gateway will be available in > October. > > > IBM, OS/2, AIX, CICS, DB2 and RISC System/6000 are trademarks of IBM. > > Windows is a trademark of Microsoft Corp. > -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0