December 2003 - cypherpunks-legacy

"Dr." Fred
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

The most charitable explanation for "Dr." Fred is that he's degenerated into the professional equivalent of those pathetic aging former chess masters who try to eek out a subsistence living by charging five bucks a game. People often play with them out of sympathy, or for the novelty of having lost to a past great. It's part of the chess culture, and it's basically harmless and sort of quaint. The difference, of course, is that its almost impossible to have sympathy for Dr. Fred. His hussle is for a hell of a lot more than subsistence. He was also never actually a master of his field, a fact that becomes increasingly obvious as our exposure to him goes on. Now he's reduced himself to trying to collect someone else's winnings.

1 0

Re: Brit conference asks for more cyberspace violations
by Anonymous 17 Dec '03

17 Dec '03

>Crimebusters must devise more ingenious ways of combating fraud and >will need new international policing powers to stem a rising tide of >high-tech economic crime, experts say. Delegates at an economic crime >conference in Cambridge, England, this week complained they lacked >the tools and power to take the fight to the organized criminals >whose only barrier was the speed of their modems. Perhaps encryption could be used as a means of fraud prevention.

1 0

OH?_bob
by John Young 17 Dec '03

17 Dec '03

11-1-95. NYPaper, Page One lead: "C.I.A. Tells Panel It Failed To Sift Spy Data. Disinformation May Have Led to Spending for Illusionary Perils." The C.I.A. admitted today that it knowingly gave the White House and the Pentagon inside information on the Soviet Union without warning that it came from foreign agents it knew or strongly suspected were controlled by Moscow. The information may have affected decisions to spend billions of dollars on military hardware. Even when the agency knew or suspected that its sources were double agents it never warned that its inside information was tainted. The agency thought it more important to protect its suspect Soviet sources than to tell the nation's leaders the truth. That disclosure threatens the C.I.A.'s foundation; its central mission is to speak the truth to those in power. "Something has gone terribly wrong," Senator Bob Kerrey said. OH?_bob (8 kb)

1 0

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

On Tue, 31 Oct 1995, Anonymous wrote: > Wall Street Journal, October 30, 1995, p. B3. > Brad Meinert, senior analyst at research firm Input, says the > tremendous growth of the World Wide Web, a graphics Internet > interface, "is putting increased capacity demands for greater > bandwidth on the Internet infrastructure." I see our media friends are just as clueful as ever .... graphics Internet interface ?? Thats almost as bad as saying "Come visit our Internet Site" when they mean Web site !!

1 0

[Fwd: Please Archive] Please Archive
by Six 17 Dec '03

17 Dec '03

1 0

US government department for crime enforcement!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

It's come to my attention that the US government has a group called the 'Department of the Treasury Financial Crimes Enforcement Network' in Vienna, Virginia. I know that burocrats like to keep themselves busy, but even I didn't think they would go so far as to enforce crimes to keep the law enforcement people busy. What a curious way to spend the taxpayers money. Garfield P.S. :-) for the humor impaired.

2 1

Re: Please send cash
by todd＠lgt.com 17 Dec '03

17 Dec '03

Yo Fred, nobody said you wer not right on the money, just that these issues clearly have fixes and are part and parcel to a pre-adolesencent product, not a mature one. Yes, you get two points for posting the bug report, but lose one for soap-boxing about the woes of the product in general... Keep up the good work, just drop the proslitizing and we all wouldn't mind hearing your rap. BTW - If your or your friends are up for a game of speed-chess... I'm willing, I used to be *rated* until I dropped off the circuit a few years ago... Winged Benoni, Classical Ruy, or maybe an Accellerated Dragon (for those who play the black)... I won't even charge you the nominal 5$ fee... >I just picked this up from the Risks forum: > >> Date: Mon, 30 Oct 1995 16:14:59 -0500 >> From: Drew Dean <ddean(a)CS.Princeton.EDU> >> Subject: HotJava 1.0 alpha 3 security issues >> >> We have found several security problems in the 1.0 alpha 3 release of >> HotJava from Sun Microsystems. The two most important problems are that >> HotJava does not enforce the stated limits on where an applet can connect to >> (an applet can talk to any place with which you have IP-level connectivity), >> and HotJava is vulnerable to a man-in-the-middle attack, where someone can >> watch your web-surfing, both seeing your requests, and the content that you >> receive. > >Two of the Java attacks I outlined in this forum and got abuse for. > >> While HotJava prevents applets from actively opening connections that >> violate the user-selected security policy, it allows an applet to accept >> connections from anywhere. At this point, an applet only has to use any one >> of a number of channels to communicate where it is, and have the remote end >> do the active open. >> >> HotJava also allows an applet to set the proxy servers that the browser >> uses. This opens up a huge hole for anyone concerned about the privacy of >> their web surfing. > >Attacks 31-49 work here. > >> Please note that these bugs are specific to the 1.0 alpha 3 release, and are >> _not_ bugs in the Java language itself, nor do they apply to Netscape 2.0 >> beta 1J, which doesn't permit network connections. We have notified Sun of >> these problems, and are presently writing a paper on these and other issues. >> We will make more information available on our Web page after we hear back >> from Sun. > >Drat - Sun doesn't offer awards. > >> >> http://www.cs.princeton.edu/~ddean/java/ >> >> Drew Dean Dan Wallach >> ddean(a)cs.princeton.edu dwallach(a)cs.princeton.edu > >Inquiring minds want to know. > >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

E-Cash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May has been a source of endless embarassments to his sympathizers on and off the net. <o o> Tim May /-+-- --+X /> <\

1 0

Re: Please send cash
by todd＠lgt.com 17 Dec '03

17 Dec '03

>> While HotJava prevents applets from actively opening connections that >> violate the user-selected security policy, it allows an applet to accept >> connections from anywhere. At this point, an applet only has to use any one >> of a number of channels to communicate where it is, and have the remote end >> do the active open. > >What if I start a Java applet then send it a faked TCP/IP packet from another >host? Can I hotwire an outgoing connection that appears to be from the victim >host? > >TCP/IP connections are not really all that directed. It is only the startup >phase that is trully directed - someone has to start a conversation. > >Planned sequence of events : > >Mallet: > Send out Java applet to Alice > Send Bob a connection request packet on port 22 > Alice's Java applet is accepting connections. > Send Alice a "request" packet claiming to come from port 22 > Should now have an outgoing connection. > >???? I'm not a TCP/IP hacker (much). I'll ask our guru tommorow after we >are done with the NSA. > > > Phill For the most part this scenario would work. The Java Applett that is doing secure or authenticated work clearly must employ some form of embedded authenticatation. A cute trick we are employing in one applet under development here at LGT is an embedded stream based bi-directional encryption engine. It provides a direct mechanism to encrypt the data stream within the TCP datagram rather than outside of it. Since the datagram itself is untouched the simple interface that Java employs is unfettered. However this proces adds some performance overhead but allows for a virtual private network to be constructed directly from the server to the applet context. This project/concept will be released sometime in January along with some underpinnings to plug into the FSTC EPayment Handler and its Architecture along with the applett itself... Yes we will share it with the CypherPunks... It's the best way I know to get a public testing/err bashing and beta cycle on a concept., We really are not trying to build a product in this effort, rather the intent is to prove that although the general "external transport" is/may be unsecured, that the internal or upper layers do not necessarily suffer from the same security leakage or process models, and that secure transactions can successfully be layered upon these "existing" underpinnings if they are adapted properly. This is especially true with both HiJacking and Spoofing attack modalities. But in our model with the upper layers events are synchronized and validated such that there is little chance for these attack modalities to succeed. Again for the world to hear - The Java concept is a Transport Harness, not the entire magilla. Clearly that is what is going on here... Without thewse upper layers it is no safer than normal netscape or any other browser transport. Sincereley, Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

Rivest on the Design of RC4
by baldwin 17 Dec '03

17 Dec '03

Professor Ron Rivest will be presenting a talk titled "The Design of RC4" at the RSA Data Security Conference in San Francisco (January 17 to 19). It should be interesting. --Bob

2 1