December 2003 - cypherpunks-legacy

Re: Please send cash
by todd＠lgt.com 17 Dec '03

17 Dec '03

Yo Fred, nobody said you wer not right on the money, just that these issues clearly have fixes and are part and parcel to a pre-adolesencent product, not a mature one. Yes, you get two points for posting the bug report, but lose one for soap-boxing about the woes of the product in general... Keep up the good work, just drop the proslitizing and we all wouldn't mind hearing your rap. BTW - If your or your friends are up for a game of speed-chess... I'm willing, I used to be *rated* until I dropped off the circuit a few years ago... Winged Benoni, Classical Ruy, or maybe an Accellerated Dragon (for those who play the black)... I won't even charge you the nominal 5$ fee... >I just picked this up from the Risks forum: > >> Date: Mon, 30 Oct 1995 16:14:59 -0500 >> From: Drew Dean <ddean(a)CS.Princeton.EDU> >> Subject: HotJava 1.0 alpha 3 security issues >> >> We have found several security problems in the 1.0 alpha 3 release of >> HotJava from Sun Microsystems. The two most important problems are that >> HotJava does not enforce the stated limits on where an applet can connect to >> (an applet can talk to any place with which you have IP-level connectivity), >> and HotJava is vulnerable to a man-in-the-middle attack, where someone can >> watch your web-surfing, both seeing your requests, and the content that you >> receive. > >Two of the Java attacks I outlined in this forum and got abuse for. > >> While HotJava prevents applets from actively opening connections that >> violate the user-selected security policy, it allows an applet to accept >> connections from anywhere. At this point, an applet only has to use any one >> of a number of channels to communicate where it is, and have the remote end >> do the active open. >> >> HotJava also allows an applet to set the proxy servers that the browser >> uses. This opens up a huge hole for anyone concerned about the privacy of >> their web surfing. > >Attacks 31-49 work here. > >> Please note that these bugs are specific to the 1.0 alpha 3 release, and are >> _not_ bugs in the Java language itself, nor do they apply to Netscape 2.0 >> beta 1J, which doesn't permit network connections. We have notified Sun of >> these problems, and are presently writing a paper on these and other issues. >> We will make more information available on our Web page after we hear back >> from Sun. > >Drat - Sun doesn't offer awards. > >> >> http://www.cs.princeton.edu/~ddean/java/ >> >> Drew Dean Dan Wallach >> ddean(a)cs.princeton.edu dwallach(a)cs.princeton.edu > >Inquiring minds want to know. > >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

E-Cash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May has been a source of endless embarassments to his sympathizers on and off the net. <o o> Tim May /-+-- --+X /> <\

1 0

Re: Please send cash
by todd＠lgt.com 17 Dec '03

17 Dec '03

>> While HotJava prevents applets from actively opening connections that >> violate the user-selected security policy, it allows an applet to accept >> connections from anywhere. At this point, an applet only has to use any one >> of a number of channels to communicate where it is, and have the remote end >> do the active open. > >What if I start a Java applet then send it a faked TCP/IP packet from another >host? Can I hotwire an outgoing connection that appears to be from the victim >host? > >TCP/IP connections are not really all that directed. It is only the startup >phase that is trully directed - someone has to start a conversation. > >Planned sequence of events : > >Mallet: > Send out Java applet to Alice > Send Bob a connection request packet on port 22 > Alice's Java applet is accepting connections. > Send Alice a "request" packet claiming to come from port 22 > Should now have an outgoing connection. > >???? I'm not a TCP/IP hacker (much). I'll ask our guru tommorow after we >are done with the NSA. > > > Phill For the most part this scenario would work. The Java Applett that is doing secure or authenticated work clearly must employ some form of embedded authenticatation. A cute trick we are employing in one applet under development here at LGT is an embedded stream based bi-directional encryption engine. It provides a direct mechanism to encrypt the data stream within the TCP datagram rather than outside of it. Since the datagram itself is untouched the simple interface that Java employs is unfettered. However this proces adds some performance overhead but allows for a virtual private network to be constructed directly from the server to the applet context. This project/concept will be released sometime in January along with some underpinnings to plug into the FSTC EPayment Handler and its Architecture along with the applett itself... Yes we will share it with the CypherPunks... It's the best way I know to get a public testing/err bashing and beta cycle on a concept., We really are not trying to build a product in this effort, rather the intent is to prove that although the general "external transport" is/may be unsecured, that the internal or upper layers do not necessarily suffer from the same security leakage or process models, and that secure transactions can successfully be layered upon these "existing" underpinnings if they are adapted properly. This is especially true with both HiJacking and Spoofing attack modalities. But in our model with the upper layers events are synchronized and validated such that there is little chance for these attack modalities to succeed. Again for the world to hear - The Java concept is a Transport Harness, not the entire magilla. Clearly that is what is going on here... Without thewse upper layers it is no safer than normal netscape or any other browser transport. Sincereley, Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

Rivest on the Design of RC4
by baldwin 17 Dec '03

17 Dec '03

Professor Ron Rivest will be presenting a talk titled "The Design of RC4" at the RSA Data Security Conference in San Francisco (January 17 to 19). It should be interesting. --Bob

2 1

Decrypted / Like mom used to say...
by Six 17 Dec '03

17 Dec '03

+OK 5688 octets Received: from toad.com (toad.com [140.174.2.1]) by orion.sk.sympatico.ca with ESMTP (8.7.6/8.7.3) id EAA29640 for <toto(a)sk.sympatico.ca>; Wed, 17 Sep 1997 04:39:52 -0600 (CST) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id DAA22534 for cypherpunks-unedited-outgoing; Wed, 17 Sep 1997 03:36:52 -0700 (PDT) Message-ID: <341FB2A9.61F5(a)cypherpunks.ca> Date: Wed, 17 Sep 1997 02:15:21-0400 From: Six <ualdv8(a)sk.sympatico.ca> Reply-To: ualdv8(a)sk.sympatico.ca X-Mailer: Mozilla 4.01 (Win95; X) MIME-Version: 4.0 To: cypherpunks(a)toad.com Subject: Decrypted [Fwd: Please Archive] Content-Type: message/decrypted Content-Transfer-Encoding: 7bit Content-Disposition: online Sender: owner-cypherpunks(a)toad.com Precedence: bulk X-UIDL: ea64d17a8b56e725d47ed8fa626cdcaf Message-ID: <341FB0A5.5E4C(a)cypherpunks.ca> Date: Wed, 17 Sep 1997 04:27:49 -0600 From: Canadian Jam Remailer <remailer(a)cypherpunks.ca> Reply-To: remailer(a)cypherpunks.ca X-Mailer: Mozilla 3.01A (Win95; U) MIME-Version: 1.0 To: cypherpunks(a)toad.com Subject: Like mom used to say... Content-Type: text/plain; charset=us-ascii; name="CanJam.asc" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="CanJam.asc" :: Anon-To: president(a)whitehouse.gov Dear Yankee Asshole, You ever hear of Noriega, Shit For Brains? In case it has slipped your mind, he is the fucker that the U.S. used as an example that it is legal and righteous to invade another country and capture the criminals in power, bringing them back to your own country to imprison and try for their crimes. This means YOU, asshole! Are you hard of fucking hearing, eh? Maybe you should have paid closer attention to Big Bad John Chretien when he informed the world as to who the biggest fucking criminals are in society. This means YOU, asshole! You think that YOU are going to tell CANADIANS what we can and can't do in our own fucking country? Guess again you piece of shit. Like mom used to say, "If I've got to come down there, son, you are in big, big trouble." So get back in your own bed and go to sleep, pal, if you know what's good for you. If we have to come down there and bring your ass back for trial, I don't think you can count on your citizens to back you up. (At least not the ones who are hanging on to their fucking guns, and the ones that aren't can kiss our big blubbery Canadian butts.) So why don't you keep your fucking nose out of our business and concentrate on disarming and imprisoning the only citizens you have left who are capable of defending you if the Canadian government decides that it is time to see some justice done to the criminals in D.C? And while you are at it, you might consider treating the Canadian you have taken hostage in Camp Pendleton the same as you would treat present Presidents who didn't go overseas to murder strangers for Big Oil. Tell Randy that if we come for you, we will stop by Camp Pendleton and pick him up, too. I don't think that the drug-addict rapists that currently comprise the majority of your armed services are going to put up much resistance. They know that they will go back to jail when they get out of the services, anyway. Your Canadian Pal, Canonymous

1 0

Re: Keyed-MD5, and HTTP-NG
by baldwin 17 Dec '03

17 Dec '03

Perry, I personally spoke to Bill Simpson about this problem. I should have given you a phone call or email in addition to speaking to Bill. In my opinion this problem does not at all reflect on your skills or reputation. What it signifies to me is the poor state of cryptographic engineering. If anything, it points out the wisdom of the IPsec designers in requiring that key material have a limited lifetime. A wise engineering choice like this protects the system against many different kinds of attacks. Of course, the protocol implementors often omit "details" like key lifetime limits. In fact, 17 years ago when I wrote a TCP/IP stack for the Xerox Alto I left out several "details", which of course caused lots of problems when I did interoperability testing with a mainframe (Multics). --Bob ______________________________ Reply Separator _________________________________ On 11/1/95 10:20 AM, perry(a)piermont.com worte: > There were two names on the MD5 document -- mine and Bill > Simpson's. Bill didn't tell me that he was called (I suspect he > would have), and I wasn't called, either. We were the only two > editors of that portion of the specification. > > Given that my name was on that document and that I made a large effort to > try to make sure that people examined the algorithms and thought they were > good, and that I have some of my reputation tied to that document, I am > rather unhappy at the fact that I only find out third hand about what people > in the field have determined about our selected algorithm.

4 3

Divx
by Michael Stutz 17 Dec '03

17 Dec '03

>From <http://www.wired.com/news/news/technology/story/6947.html>: Divx Protects Content, But Not Your Liberties The ability to create pristine copies of any digital work is seen as a threat by some Hollywood studios, which are experimenting with a new pay-to-play DVD format to protect their intellectual property. This format, Divx, could conceivably hobble the video rental business, but some see its real threat as an invasion of consumer privacy - and the freedom to view information anonymously.

1 0

Re: The cost of ITAR
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> Here's the problem: Because the US government has outlawed the export of > industrial-strength encryption, firms seeking to do business abroad find > themselves without trustworthy security options once they leave US > boundaries. How can companies in the information and networking > business, such as Sun Microsystems, possibly sell a system to Alcatel in > France, for example, if the encryption that accompanies it can be broken > by a 14-year-old with too much time on his or her hands? They can't. So > Sun came up with a novel solution: buy Russian. The Soviets may have > sucked at cars and strip malls, but they sure as hell knew their > cryptography. "The Russians can make any kind of encryption you want" > says Geoffrey Baehr chief network officer at Sun. And what can the US > government do about a product developed outside its borders? Nothing. Actually the US government and US industry generally does not follow any coherent industrial development policy of which ITAR is but one single part. There is almost a jingoistic belief in the "free market" with a concomitant commitment to a strong American individualism. While this may function domestically, it certainly does not function internationally. The US continues to cede entire industries through poor economic and trade policy. I guess, nothing was learned with Boeing and Airbus. ITAR regulations will simply lock-out US companies from foreign markets, and this combined with "competition" rather than "co-operation" will allow foreign firms to divide and conquer American firms. Foreigners generally don't trust "American" as it is. Historically, the US has deliberately sold inferior security products while making representations that they were in fact secure. While this *might* work on unsuspecting civilians, internationally it just doesn't pass the giggle test, and won't allow a US firm to even make the bid list outside their own borders in the not too distant future. US companies will loose the entire international market, unless they begin to think globally. Non-legislated trade lockouts based on Nationalism are extremely difficult to overcome. > In fact, Sun was so taken with Russia's computing talent that the company > recently hired the entire team once responsible for the next generation > of Soviet supercomputers (and the Russians brought along the plans for > the beasts). Ask Sun chief scientist John Gage if he'd rely on > US-approved encryption to send those plans between Moscow and California, > and he'll laugh out loud. "We can't rely on that stuff. We're talkling > trade secrets here!" - John Battelle While John Gage, may laugh out loud, it is actually a very serious matter. Trade secrets are not for laughter. As an example, what value is access to Pacific Gas's LAN?? Let's suppose that Pacific Gas could be compromised because of poor security or encryption -- a compromise which occurs as a result of some user installing a commercial web-browser which had a well-known "back door", a browser like the Netscape product. What would be the fallout from this?? Maybe (domestically), Pacific Gas customers might not be _happy_ that PGT's market book was given over to CAPP, and that foreign producers knew *exactly* what Californian's Natural Gas open interest was in advance on a real time basis. And that CAPP, hypothetically, has used and continues to use that information in trading on Natural Gas markets, which results in all Californians paying a 30% premium on their utility bills. Would this be a laughing matter?? Who would laugh if natural gas prices were up (as they in fact are) 25 - 30% at the trading hub AECO-C? And while PGT might ignore daisy chaining, and advance the argument that the hole was at NGX -- rather than at PGT, or maybe that the hole was because a client of NGX installed a copy of Navigator 1.1 somewhere, how far would the laughter carry?? Especially the laughter at the keystone cop finger pointing?? Around the world, maybe? The idea of a foreign group of producers positioning themselves through high-tech scouting by taking advantage of the shoddy design of a "Made in America" product so that they could indirectly tax the citizens of California is _truly_ a laughing matter. Trivial in fact. The uproar of a class action suit by all the customers of PGT would be but a small nuisance within the context of the international fallout. Laughter will not be on the lips of US executives when it becomes known that the security flaw in Navigator 1.1 was "well and widely known" within the US software, hardware and security industry, and that ALL members of kept quiet about and around it. There will be little laughter at the catastrophic trade fallout if it is demonstrable (as it was) that a US multi-billion dollar company knowingly distributed a program which functions as a virus delivery vehicle, and that all US industry members decided that their "industrial policy" dictated that they would not step forward and speak out. There will be very little laughter amongst shareholders and directors when they become aware that not only were entire markets sacrificed to "keep the secret" but that the entire US economy was put at risk. Good-bye international markets -- not just for the said billion dollar company -- but for all members of the industry who domicile in the US. > This looks like a striking example of regulatory arbitrage at work, and > if it can be confirmed in its details ought to be an extremely powerful > anecdote in the hands of those working against GAK and ITAR. > > The sucking sound is American jobs heading overseas, > the snorting sound is American trade-secrets being sniffed up > by foriegn competitiors, Yep, and it's not even a question of someone else causing this. This is US citizens, and US companies having a limited experience and view in international trade, and that very inexperience leading to their OWN creation of these problems. Has anyone considered GISA in all of this? Probably not. As an example, I contacted AT&T, regarding the Netscape flaw which was posted to the Internet on Friday the Thirteenth -- the flaw that Netscape had "no comment" on. I asked for AT&T commentary, since they were selling the Netscape product under their own brand. I also asked for referral to their Security Officer, rather than their Public Relations people. AT&T's response?? "...I am not sure that our security officers are up to it. Often AT&T just repackages an external product, without opening it or understanding it. My guess is that the corporation is likely to simply trust the netscape folks unless an actual hole can be demonstrated." And with that, there's 'nuff said ... > Maybe the FBI's responsibility for US counter-intelligence is meant as a > double-entendre? I guess getting shot by friendly fire does sound better than saying that you're shooting yourself in the foot. Don't it?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Your Credit Report
by mailhost＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ *AS SEEN ON TV * AS SEEN ON TV * AS SEEN ON TV* AS SEEN ON TV* ////////////////////////////////////////////////////////////////////// If you received this electronic mailing by mistake, please pardon our intrusion. Dear Friend, Are you or somebody that you know experiencing credit problems? If your answer is yes, I think you will be very interested in our special offer. No longer will you have to live like a second class citizen due to a bad credit report. Bad credit is caused by a variety of reasons: Health, divorce, termination of employment, loss of income and dozens of other reasons. The bottom line is that bad credit can happen to anybody. There is no specific profile of a person with credit problems. It can happen to doctors, lawyers, accountants, the mail man, truck drivers, housekeepers and salesmen. As a matter of fact, one in three Americans live with some form of bad credit. Fortunately, the United States Government has passed many laws under the Fair Credit Reporting Act, all of which protect your rights as a consumer. Our manuals will show you how to use these Federal laws to your advantage and repair or obtain a new credit report. ***** THE FRESH START PROGRAM (TM) ***** Have you seen your credit bureau report lately? Have you recently been denied credit because of a bad cedit report? If you have answered yes, then you need to take advantage of THE FRESH START PROGRAM (TM). THE FRESH START PROGRAM (TM) will guide you through the process of obtaining a BRAND NEW credit bureau report. Our easy-to-follow manual will put you on the fast track to obtaining your new credit bureau report and can be accomplished within 24 hours! Regardless of your credit rating, you can NOW obtain a brand new, fresh credit bureau report free of: * ANY bad credit * Bankruptcies * Judgements * Foreclosures * Charge-Off's * Tax Lien's * Repossessions * Late pays * Garnishments * Inquiries NOW, you can have a 'Clean Slate' and a 'FRESH START' with a brand new, credit bureau report. ////////////////////////////////////////////////////////////////////// ***** THE COMPLETE CREDIT REPAIR KIT (TM) ***** Good credit empowers you to qualify for personal loans, business loans, auto loans, credit cards, home loans and other types of credit you may apply for, at the best possible interest rate. As you know, if you don't have excellent credit, lenders will NEVER extend credit to you! The Fair Credit Reporting Act will allow you to legally and permanently ERASE the negative information on your credit bureau file. Anything that is damaging to your credit rating, may be removed: Inquiries, Foreclosures, Repossessions, Charge-Off's, Late Payments Student Loans, Bankruptcies and Judgements The 'Credit Repair' companies located in every city will charge from $500.00 and up to do what our easy-to-follow manual will teach you. Now, in the privacy of your own home, you can repair your own credit at your own pace. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ***** PROOF ***** "Having bad credit was the one thing holding me back from starting my own business. After working your program, I qualified for a $45,000 Small Business Loan. My business is making me more money than I've ever made. Your program is truly priceless!" George S. - Fresno, CA. "Thank you, thank you, thank you! Before, my credit was totally trashed. After using your Fresh Start Program and using The Complete Credit Repair Kit, my wife and I qualified to purchase our first home with no down payment. These programs are worth thousands of dollars!" Kenneth T. - Ithica, NY "After being laid off, my creditors were not very understanding when I couldn't pay my bills and as a result, my credit was very badly damaged. Once I started working again, I couldn't qualify for any type of credit. After using the manuals, I qualified to buy a new car, with no down payment." Mr. Fred C. - Tampa, FL "After my divorce, I was forced to file bankruptcy. I was told my credit would be ruined for 10 years. After using the your manuals, I have great credit again. I even receive pre-approved credit cards in the mail. Thank you so much for your amazing program. I don't know what I could have done without it. I highly recommend your program to anyone who has credit problems." Ms. Anna S. - Tacoma, WA \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ YOU MAY BE ABLE TO EARN $1,500.00 FOR YOUR TESTIMONIAL ON OUR UPCOMING TV INFOMERCIAL. DETAILS INCLUDED WITH YOUR ORDER. ////////////////////////////////////////////////////////////////////// Don't let ANYONE tell you that you can not make the transition from a bad credit risk to that of preferred credit customer. Over 175,000 satisfied customers can't be wrong! each manual, THE FRESH START PROGRAM (TM) and THE COMPLETE CREDIT REPAIR KIT (TM) is normally $89.95 + $3.95 S&H. However, if you take advantage of this special offer within the NEXT 24 HOURS, you will pay only $34.95 + $3.95 S+H for one program or you can take both programs for $54.95 +$3.95 S&H (U.S. Funds Only). To place your order, simply mail the form below, along with your certified check, money order, personal check or cash to: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ I.M.S. 5201 Kingston Pike, Suite 6-216 Knoxville, Tennessee 37919 Yes, please send the manual(s) checked below: $34.95 THE FRESH START PROGRAM (TM) $34.95 THE COMPLETE CREDIT REPAIR KIT (TM) $54.95 Both Programs $_____ Sub Total $ 4.95 Shipping and handling $(15.00) RUSH Delivery (Optional) $_____ Total Enclosed I have enclosed (Check One): _____Cashiers Check _____Money Order _____Personal Check _____Cash SHIPPING INFORMATION: Name:_________________________________________ Phone:_______--__________--___________________ Physical Street Address (NO P.O. BOXES):_______________________________________ City:______________________ State:____ Zip/Postal Code:_________________ Your E-Mail Address (Needed for order confirmation):________________________________ /////////////////////////////////////////////////// SAVE AN ADDITIONAL $5.00!!! FAX YOUR ORDER NOW!!! Please tape your completed check in the space below and fax it along with your order to IMS. That facsimile number is 1-423-681-6520 ************************************************* FAX: 1-423-681-6520 Please Tape Your Check Here Please Sign Your check ************************************************* Thank You For Your Order-All orders shipped same day. 654657809028556 </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: S. 1284 To Amend (C) Act
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> S. 1284, s1201: "No person shall import, manufacture or distribute > any device, product, or component incorporated into a device or > product, or offer or perform any service, the primary purpose or > effect of which is to avoid, bypass, remove, deactivate, or otherwise > circumvent, without the authority of the copyright owner or the > law, any process, treatement, mechanism or system which prevents > or inhibits the violation of any of the exclusive rights of the > copyright owner under section 106." IANAL, but I thought these types of laws were already tested and deemed unconstitutional in cases involving video-tape copying boxes, dual video cassette dubbing decks, SCMS 'scrubbers', etc... andrew

1 0