December 2003 - cypherpunks-legacy

Re: java security concerns
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:15 AM 10/10/95 -0400, Ray wrote: > There is a large class of Java apps that need no file i/o capability. >99% of all Java apps on the web right now don't save any persistent state While file I/O, especially file writes, are certainly a major concern, network capability is also critical - and I would guess that most of the interesting applets aren't just animated Christmas trees and image advertising - they'll be things to help you fill out a form correctly and send it in, or have buttons that say "order me". If they can issue outgoing messages of their own, they can spam, and they can send worms. > But it's still unclear whether those lack "i/o capabilities", >given that some postscript printers run operating systems and tcp/ip stacks Unlike network-equipped PS printers, which are a relatively small fraction of the market, and which usually don't get requests from the outside world sent to them through firewalls, we're talking about something that will be in Netscape, where anybody who clicks a button on anything on the web can download an executable page... It's a bit hard for network printers to find each other in most places; it's much easier for Netscape sessions to do so. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Crypto's Role in Evil?
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Jon Lasser (1) It is impossible to stop these technologies; someone on the list recently reminded us that a bright fourteen year old could reproduce the basic functionality of PGP in a brief period of time. The mathematics of, say, RSA, are fairly basic. I think it's unreasonable to outlaw multiplication of prime numbers, don't you? .......................................... Uh-huh, yes, I think it's dumb to think of outlawing the right of mental creatures to engage their faculties to their full potential, especially in a country which defined encroachments upon it as a crime. "Unreasonable" people will always try to get something for nothing, with nothing, while in conflict with those who could & would develop the means to deliver it. .. Blanc

1 0

Fully Qualified Domain Name
by Mike_Spreitzer.PARC＠xerox.com 17 Dec '03

17 Dec '03

Was there a recent discussion here about how to write a piece of UNIX code that discovers a Fully Qualified Domain Name of the machine running the code? If so, I'd appreciate pointers to or copies of the good parts (I scanned http://www.hks.net/cpunks/cpunks-19/subject.html and didn't find what I'm seeking). If not, sorry for wasting your time. Thanks, Mike

1 0

Re: PC disk wipe software
by James A. Donald 17 Dec '03

17 Dec '03

>>PC Tools has a wipe program that will either wipe individual files, or >>wipe all unallocated diskspace. It also allows you to choose the level >>of wipe (single overwrite, multiple, etc). At 12:24 PM 10/9/95 -0400, Robert Hettinga wrote: >There has been considerable discussion on the MCIP list about how most >*Mac* programs that purport to do this, like Burn, for example, leave stuff >over in disk blocks. My understanding is that this is not a trivial >problem, and it occurs in MUSH-DOS as well.... I wrote the disk wipe program in PC Tools. It really no kidding wipes stuff. The only way they can recover the data is if they take a scanning tunneling microscope the disk platter, and even then they could only recover small random fragments. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: java security & the cypherpunk agenda
by Rich Salz 17 Dec '03

17 Dec '03

>From what I have seen of the CV's of the Java team (at least those who have/had home pages on the various Sun java servers), none of them were particularly security-aware. /r$

1 0

PC disk wipe software - SUPERWIPE 1.04R
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

PC disk wipe software - SUPERWIPE 1.04R Note: SUPERWIPE is also a SUPER ERASER with powerful erase features. As a matter of fact, I have written a shareware program that is a PC wipe program: SUPERWIPE 1.04R . I just sent a copy to Perry Metzger. If anyone else wants a copy, let me know. Its free to Cypherpunks. There are two big problems with writing a PC disk wipe program. 1. Compressed disks. With compressed disks you don't know how long to make the write. You try putting all 1's or all 0's and the disk compressor will compress it next to nothing. In fact, it may write the wipe data to different clusters than the original file. 2. Software disk caches and even worse - hardware disk caches. - Those 256k disk caches. With caches, if you do multi-wipes of a file, in actuallity, you only do one real wipe & several virtual (to RAM) wipes. It might be possible to get around the first problem by using direct sector writes (INT 13 SERVICE 3) instead of well behaved (INT 21 SERVICE 40) writes. But this is a rather dangerous practice as if you make a mistake you might wreck the hard disk partition. Concerning the second, I see no practical way around the problem of hardware disk caches keeping the user from making multiple wipes of a file. As for making multiple wipes of CURRENTLY unused disk space, my SUPER- WIPE will do that with the options: /oldx /n . Where oldx points at the diskette drive or hard disk partition to be wiped & /n tells how many wipes to do (1-9). As for the problem of getting rid of old buffer data writes to the end of last file cluster writes, my program doesn't handle that. However, if there is no disk compressor, I don't think it would be that hard to write a function to handle it. In reality, I don't think that this problem is much of a problem anyway. It would only occur at the end of small files. I suspect that the wipe problems that we have with the DOS operating system are shared with most other operating systems. I uploaded SUPERWIPE to an anon ftp site. I believe it was Alex De Joode (or spelled something like that) who gave approval for the upload. It seems like it was a Utopia site. I lost my file on it and have now for- gotten. If anyone needs SUPERWIPE, send me a request. Some documentation follows for SUPERWIPE 1.04R: -------------Start of readme.spr file--------------------------------- SUPERWIPE current version: 1.04r SUPERWIPE is a utility that will substantially increase the security of your computer. What does SUPERWIPE do? In order to explain what it does, I first need to explain some security holes in the DOS operating system as it works with disks. The delete & erase DOS instructions are convenient utilities that allow you to get rid of old files. They don't actually destroy the files. They merely mark these files so that they will be ignored by the DOS operating system. Most of the time this is good enough. But what if you have sensi- tive files that must not be recovered? A snoop could use the popular DOS undelete command or another utility program to entirely recover these files. To solve this problem, wipe programs were invented. A wipe program will write a character, usually a 0 or a 1, over your entire file & then delete it. In this way, your sensitive files are made non-recoverable. NOTE: SUPERWIPE currently only works with non-compressed disks. SUPERWIPE also does this but with some improvements! SUPERWIPE (unregistered) will enable you to : 1. allow multiple files to be wiped instead of just one! 2. use wildcards! 3. mix your regular files with wildcards in any order you choose! Multiple wildcards may be interspersed with multiple regular files! 4. reduce your file to zero bytes, so that a snoop cannot determine with certainty what the original size was! 5. rename your file to a single letter, so that a snoop cannot determine what the original name was! 6. access several disk partitions (c: d: e: etc..) & diskette drives in one run! 7. starting with version 1.03, SUPERWIPE now has SUPER ERASE capabilities as well. All of the above capabilities are contained in this program. ADVANTAGES OF REGISTRATION FOLLOW: When you register, you will receive a registered version, that in addition to the above capabilities, will allow you to: 1: Wipe out all previously erased or deleted files! (The /OLD option.) The registered version will also have a nicer execution message that will lack the plea for money. You are probably wondering why you would want the capability to wipe out all previously deleted files. There are two reasons: one fairly ob- vious; one not. Firstly, those old deleted files may be sensitive & you forgot to wipe them properly. Or maybe, you were busy at an earlier time & did not take the time to properly wipe all the sensitive files. Or, you may not remem- ber wheather you wiped or erased a sensitive file. With the /OLD option, you can be sure that they are all wiped! Secondly, many programs, including some word processors, make temporary files that are used to assist that program in its work. When the program is done, those programs are deleted. Ordinarily, this is fine, but it does leave a security hole. The /OLD option will wipe out all of them! Note: Since the /OLD option must go through the entire "unused" disk par- tition or diskette, it may take several minutes to complete. 2. Registered users, will also be notified of improved versions of SUPERWIPE. 3. Upgrades, at least for the next upgrade, will only be $10. 4. Registered users will also receive telephone support. 5. Also, the registered user will have a clear conscience & will use SUPERWIPE with a feeling of sublime legitimacy! Site licenses are also available. -------------End of readme.spr file--------------------------------- -------------Start of .com help file------------------------------------ Gary's super file wipe/erase program. ver. 1.04r Copyright 1995 Gary Jeffers This ver. does not work with compressed disks. Nothing to do. Invocation syntax w filename1 filename2 ... wildcard1 wildcard2 ... /(no. of wipes for disk) /n(one alpha letter name of alternate file) /old{partition or drive letter} - (wipe all old deletes.-reg. only) /e for regular ERASE mode only - NO wipes. no parenthesis or braces in actual command line. The order of the tokens does not matter. examples: w my.fil new.fil /olda *.exe next????.com /5 /na w this.fil /e wild????.exe /nc anot????.com second.fil w that????.* /nk last.fil /oldc -------------End of .com help file------------------------------------ THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY. The United States "Federal" Government - We'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

1 0

Java idea
by Mike Fletcher 17 Dec '03

17 Dec '03

Well, security bugs aside (and I've got the sun4.1.3_u1 and Win32 ns2b distributions :) has anyone given any thought to using Java to do some sort of Chinese Lottery attack. I was re-reading App. Crypto. last night and it could be feasable. If you could get your key cruncher thread loaded into a good many browsers to run when idle . . . . How many estimated copies of NS are there? Anyone want to do the math? :) --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

2 1

LOG_rea
by John Young 17 Dec '03

17 Dec '03

10-10-95. NYPaper: "Deleted, but Not Gone or Forgotten." Files produced by Microsoft Office Windows applications, including Word, Excel, Powerpoint and Access, often incorporate chunks of data previously deleted from the disk on which the files were saved. Microsoft said the problem was solved in earlier versions of Microsoft Word but that it has recurred in the new version for Windows 95. Third-party programmers report another security lapse. Word offers optional password protection by encryption. The encryption, however, does not extend to "objects" within the file. "Chip Maker Introduces a Chip for Super Use and for Modems." One of the most closely watched Silicon Valley start-up companies plans on Tuesday to disclose details of an ambitious computer chip that it hopes will one day be used in everything from cable modems to supercomputers. Microunity Systems Engineering Inc. said its chips would be able to process information 10 times faster than today's personal computer microprocessors. The chip will consist of 10.5 million transistors and will process data at a gigahertz, or a billion operations a second. It is designed so that it can process information in parallel and will be capable of issuing up to four 128-bit-wide instructions simultaneously. 2: LOG_rea (10 kb)

1 0

NOD_out
by John Young 17 Dec '03

17 Dec '03

10-10-95. W$Japer: A long front page lead nodder on the burgeoning "space race" to build global satellite telecommuncations systems, for video, phone, data and other transactional bile. A related gagger on "media processors," a new generation of chips -- for video, graphics, on-line services, wireless data, telephone and audio -- being developed by MicroUnity, Chromatic Research, IBM and TriMedia. This is a more comprehensive pack-o-lies of the NYPaper spitter today on MicroUnity. NOD_out (28 kb in 2 parts)

1 0

truth in advertising: Netscape 1.1 on security
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Tue Oct 10 11:34:39 1995 This may be old news, but I don't recall seeing it on the list... In version netscape -version Netscape 1.1N/export, 20-Apr-95; (c) 1995 Netscape Communications Corp. I ran 'strings' on the binary, and only got one "about.*security" reference. entering it as an URL about:security yields the ironically humorous (when you consider all of the security bugs): Whatchew talkin' 'bout, Willis? - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/ Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about gnuslive.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMHqSl4JYfGX+MQb5AQFLKwP/RDsLzLxZkB18uSlV9lxp9nJ6uRilYYAE m1gv4KKmtNnWLowlrr605iv1L7DUvQTRpGKANcLZDEsKZFYnjT/VBSN+/Jnoe6GX VFNiSALrvX/IZjxf8FQ2xfyBYWF7J/DxTWP3QHjW9hc06Sx2fzCHdn4HItAteDwr aWO8dM3XYzY= =8udJ -----END PGP SIGNATURE-----

2 1