December 2003 - cypherpunks-legacy

Tricky Netscape Security Hole
by drozone＠winternet.com 17 Dec '03

17 Dec '03

Yes it's full of headers, but it's the complete, unexpurgated version. If this theory is correct, this IS FAR WORSE THAN A 40 bit key. I saw the livescript on the source code. I use 1.22 for image stability right now, though. Yes it's a came from, a came from, a came from kinda deal, but in the interest of security brevity it "seems real enough" to me. Love Always, Carol Anne >Posted-Date: Mon, 4 Dec 1995 12:57:21 -0600 >X-Sender: jeff(a)cyborganic.com >Mime-Version: 1.0 >Date: Mon, 4 Dec 1995 10:51:56 -0700 >To: cybernauts-l(a)netcom.com >From: foodie(a)netcom.com (We're a Comglomerate) (by way of jeff(a)cyborganic.com > (Jeffrey Logsdon)) >Subject: Tricky Netscape Security Hole > >Anybody else see this happening? > >Eternal Vigilance, and all that. > >- ------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, > >First off - I've posted this before (however not to this group) and only >got a response from the Netscape Corp. They were glad I found the >problem and said that they would fix it, however I feel that people >should know about it. Also I would like people to help me spread this >document around, i.e. if you know of a newsgroup (or people) that would >find this interesting then please re-postit. > >On with the problem... > >I've recently got hold of the latest netscape, and was (at first) very >excited about the new "LiveScripts" that it supports. If people don't >yet know - these "LiveScripts" allow you to put small programs into your >web page that is then executed by the Netscape client. There is no >DIRECT way for these programs to send information back to the owner of >the web page, however I was able to do it in a not-so-direct way. > >The "LiveScript" that I wrote extracts ALL the history of the current >netscape window. By history I mean ALL the pages that you have visited >to get to my page, it then generates a string of these and forces the >Netscape client to load a URL that is a CGI script with the QUERY_STRING >set to the users History. The CGI script then adds this information >to a log file. Now if this hasn't quite CLICKED yet lets do a little >example. > >Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 >to start his daily "surf" session. First he decides to check his CD-NOW >purchase and uses the handy Auto-Login URL. Then he decides to go to >Lycos and do a search. In his search he find my page, which he decides >to visit. Suddenly he is transported, not to my main page but to one >of my CGI scripts, which in turn happens to have ALL the URL's he just >been to in it. This means that in my log will be: > > - the URL to use to get into CD-NOW as Johnny Mnemonic, including > username and password. > - The exact search params he used on Lycos (i.e. exactly what he > searched for) > - plus any other places he happened to visit. > >I do this in a way that the user will KNOW that it has happened and >will _hopefully_ email Netscape and tell them they are NOT impressed. >But it would be EASY for me to change the CGI script so that the user >is unaware that it has actually happened, unless they closely examine >their URL history (in fact they'll probably just think its a netscape >bug). > > >If you're skeptical about this then do the test yourself. Get netscape >2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: > > scotts car boot sale > >which should return the URL - http://www.tripleg.com.au/staff/scott > >Click on the URL and sit back an watch. First my main page will show up >but a little while later you should be transported to a CGI bin script >that will show you your URL history. > >I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions >and both have done the same thing. I would be interested in knowing if >it happens for ALL versions of Netscape2.0b2. The log file does log >the User Agent (i.e. the name of the platform you are using) so by simply >going to the page I will know that your version of Netscape is also >open to this form of attack. > >Currently I can find no way to configure Netscape2.0b2 to NOT run >LiveScripts - and at the very least this option should be quickly >added to the next version of netscape to be released. But a far >better solution (IMHO) would be for netscape to pop up a window before >running the LiveScript and let you know what the LiveScript wants access >to, e.g. if it only wants to print out the current time then that's >OK, but if it wants to read my history list and then transport me to >a CGI script and add me to a logfile then maybe I would say NO. > >I think I've said enough.... > >If you've got any further questions, or want some more information just >email me : scott(a)tripleg.com.au > >- -- >Scott. > >Quote from a car accident insurance claim: "I told the police that I was >not injured, but on removing my hat, I found that I had a skull fracture." >- ------- End of forwarded message ------- > > >------------------------------ ------------------------------------------------------------ Thaddeus "Doc" Ozone <http://www.winternet.com/~drozone/> "Specialization is for insects." -RAH "I yam what I yam and that's all what I yam!" -Popeye

2 1

The "Future" Fallacy
by Duncan Frissell 17 Dec '03

17 Dec '03

Bill Gates (like Mister Newt before him) committed what I call the Future Fallacy in "The Road Ahead." Page 106. "Soon any child old enough to use a computer will be able to transmit coded messages that no government on earth will find easy to decipher." DCF "Term limits aren't enough. We need jail." -- PJ

1 0

Some info on file/memory erasing on NT
by Andy Brown 17 Dec '03

17 Dec '03

The subject of protecting memory and files from other users in a multi-user environment always seems to come up here every few weeks, so the following short article culled from the MS Win32 SDK might be of interest. - Andy [...] SUMMARY File systems under Windows NT currently have virtual secure erasure (when a file is deleted, the data is no longer accessible through the operating system). Although the bits could still be on disk, Windows NT will not allow access to them. MORE INFORMATION The NTFS file system does this by keeping a high-water mark, for each file, of bytes written to the file. Everything below the line is real data, anything above the line is (on disk) random garbage that used to be free space, but any attempt to read past this high-water mark returns all zeros. Other reusable objects are also protected. For example, all the memory pages in a process's address space are zeroed when they are touched (unlike the file system, a process may directly access its pages, and thus the pages must be actually zeroed rather than virtually zeroed). Note that file system security assumes physical security; in other words, if a person has physical access to a machine and can boot an alternative operating system and/or add custom device drivers and programs, he/she can always get direct access to the bits on disk. [...]

1 0

another fbi prosecution
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Chronicle of Higher Education (Dec 8, 1995) page A21 reports that Monmouth University (West Long Branch, New Jersey; http://www.monmouth.edu) sophomore Dominick LaScala was charged last week in federal court with two counts of computer fraud. Dominick had his campus account taken away after other users complained that he had been "advertising business proposals inappropriately on line." The FBI alleges that he then sent 24,000 email messages in one day from a commercial account (unamed) to Monmouth's system.. This denial of service attack was successful for about 5 hours. He is facing six(6) years in prison and a up to $350,000 in fines (1.20 years/hr and and $70,000/hr). His lawyer (Kenneth Weiner) claims that "even if his client sent the mail bomb" since no damage was done to the system, he could not be convicted under the computer fraud statute. He also claims that prosecutors are trying to make an example of his client. The university is still trying to figure out whether he can be punished under the university code of conduct.

1 0

Re: Netscape gives in to key escrow
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

SMTP%"unicorn(a)schloss.li" 4-DEC-1995 23:35:15.06 writes >On Mon, 4 Dec 1995 JR(a)ns.cnb.uam.es wrote: > >> Black Unicorn <unicorn(a)polaris.mindport.net> wrote >> >On Fri, 1 Dec 1995 JR(a)ns.cnb.uam.es wrote: ... many cuts all along to save bandwidth ... > >I'm afraid you have missed the point too. > >I don't care as much what the personal positions are, or what the ethical >center from which person x or person y works. > >I am most distressed because of what I see as a snowjob. > >"We are anti-GAK" > >Great, tell me what you have done to prevent GAK from proliferating. > >In the absence of an answer to that challenge, I have to question the >first statement as fluff or PR. > >This has nothing to do with Netscape sharing my opinion, or not sharing >my view on the evil of GAK. It has to do with putting up or shutting >up. I have been told that Netscape agrees with me, or will agree with >me, I just don't know that I believe it yet. For the last time: I have nothing to do with Netscape. So, please, stop making silly associations. What I do to defend my opinions it to try and get more people involved in the subject, explain the problems in terms they can understand, discuss with them about possible solutions (sometimes they have better ideas than me) and try to promote an effective course of action. And in any case that's *my* business. Being in a different country and even continent, what I do may not be of any direct consequence to you. And since I have nothing to do with any commercial company -hey I don't even use Netscape- it has no relationship whatsoever with Netscape or any other company. If you think that people likes to hear complains, go along. In my experience people is more cooperative when they see better solutions than just making a boicott and renouncing to use things they like. So, I'll keep on explaining what crypto can do for them and how easy it is to be taken advantage of. And how easy it is for them to press and get what they deserve. WRT legal courses of actions, just remember there's a whole world our your privy. It's sad you don't know better, but if you look around carefully you'll discover that many of the proposed actions are not feasible in many places. Just go out of your shell. I haven't either. I wouldn't be here if I did. jr

1 0

Joining The Mailing List
by Dave Turner 17 Dec '03

17 Dec '03

Cypherpunks, Would it be possible to include me on your current mailin list. Thanks Dave.

2 1

Re: WARNING: sting via remailer!
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

[ I see that the original has been forwarded to cypherpunks, so I'll also send my response there. -russ ] Boffo writes: > I was in the federal building coffee shop in Reston, Va. yesterday > when I overheard a conversation between what appeared to be two FBI agents > discussing a sting operation involving Mixmaster. Hearing the word > "mixmaster" naturally caused my ears to perk up and I listened further. > > It appears that the FBI has coerced a mixmaster remailer operator > into cooperating with them in a sting operation to catch remailers when > they forward email pertaining to pornography, pedophilia, and copy-written > software. Uh-oh! I'd better shut down my remailer, but fast, based on an unsubstantiated rumor. Especially one that makes little sense. Why do you need a sting? All you have to do is use a single remailer, and send the mail from yourself, to yourself. You know the source, destination, and who handled it. IF a court can be convinced that forwarding email containing illegal materials is the same as asking to receive email containing illegal materials, then ALL of our butts are toast. > My questions are a) is it possible to perform this type of > monitoring on a mixmaster remailer and, b) what is the identity of the > cooperating remailer operator? > > This concerns me greatly as I use remailers to privatize my > important email regularly and I don't want my identity or my email > compromised because of a "spook in cypherpunks clothing". You fool. If you use remailers regularly, then YOU ARE KNOWN TO THE SPOOKS. Face facts. We know that the FBI spends a minimum of $10,000,000 each year (count the wiretaps, multiply by agents and do the math) just for telephone wiretaps. Computer wiretaps are a LOT CHEAPER. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | Flushing, NY. Not just a suburb, Potsdam, NY 13676 | +1 315 268 9201 FAX | it's a good idea in general.

1 0

gondolin.org remailer announcement
by Gondolin Mixmaster Remailer 17 Dec '03

17 Dec '03

Gondolin Technologies is proud to announce our resumption of remailer services to the online community. Some of you may remember the remailer services based at <mixmaster(a)gondolin.org> that was on-line for most of this year. We are now back and better than ever with highly improved hardware and net connections. We are hosting a Type I "Cypherpunks" remailer, as well as a Type II "Mixmaster" remailer at <mix(a)remail.gondolin.org>. The PGP public key for the type I remailer is below: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzC7/HwAAAEEAKFLOSwJ6FdRb/Z0Yj+RV3inx9aRtrJI+5kXpZTWtcQNo50K qKzRB9joL68jxeQTa4FTOFsWlbsn7dCcOpkOCJqoo4Uby+bIDRP8E5MYGgALVoNh xO6Hucj2Hh1v+koOTvtv4lDWaDdhxN7rPPb8KlTC2FPFIK9/2n7xTkxYcqfxAAUR tDJHb25kb2xpbiBUeXBlIEkgUmVtYWlsZXIgPG1peEByZW1haWwuZ29uZG9saW4u b3JnPokAlQMFEDC+kr2Oh92U+GrHWQEB3s8EAI6+3t59tYB+EWUQDWvSaPNqihab 8lRkctA0gPtOWD3f6nOBcPjIrAoeZ3mB5ASJwPkXGbe6rTGrBo6HuC2t45bscviV O46wKKX6aIJnsCM6vx/vm1aWdm/a5DsBv1BYnnNEedrwFlvzzAhBFtolK1a7i6+N PDnfGlrs9q6U+9LBiQCVAwUQMLv8rPvQGgQ7UJMZAQECYgP9E2riZwFPvNFpKuX9 9JbG4PJGzOm7TAQO1/hIb9BAk7KrLs7yQuTzfQs6hAXB88o1ofIPYp5uz/GvAleg wCGIA3ZnhYh5yiS4UArZbCfr8hDvXsUqQBxR5tfLHj5qOkOejFckIHCRC/8wb23g 3Xu7Zh00PpJAD1EZVfDdhseMXGE= =AJYL -----END PGP PUBLIC KEY BLOCK----- The Type II remailer supports posting via mail2news gateways. We are using Mixmaster 2.0.3 from Lance Cottrell. The Type I remailer supports PGP encryption, latent time, hash marks, cutmarks, and so on. Our type I software is John Fleming's Freedom Remailer v1.6beta. Our remailers also utilize a reordering pool. Address any comments, complaints, or concerns to <remailer-admin(a)gondolin.org>. - Bryan Strawser, System/Network Administrator, Gondolin Technologies

1 0

No Privacy Right on "My" Desktop ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, A 12 04 95 The Electronic Telegraph newsstory headlined 'Spoilsport' software bars games reports that An American company called DVD has developed a utility called UnGame that can delete up to 3,100 games from a computer network. Even if the game is hidden on the com- puter user's own hard disk, it will find it. The user's own hard disk? Although the machines at work usually belong to the com- pany, most employees regard them as an electronic equi- valent of their desk, and are similarly territorial. John Davison, PC Zone editor, says: If anyone stole something from your desk you'd be fed up. If anybody stole something from my computer, I'd be equal- ly disgusted. What kind of software is UnGame? The newsstory suggests the answer: ...industry experts have complained that companies may be releasing "tailored viruses".... I believe my first post to the list was about McAfee's Virus Blocker. Perhaps that can be...adapted. If so, those who then declared the information had nothing to do with privacy may continue playing their games. Of course companies may try another tack: Oracle's "internet terminal." As dlv(a)bwalk.dm.com pointed out in his 11 18 95 post, [I guess, they mean no permanent storage or software other than the browser in ROM. No remembered state, no viruses ... -DV] In "my" terminal. Cordially, Jim NOTE. The Electronic Telegraph's website URL is: http://www.telegraph.co.uk The newsstory's online filename is: ngame02.htm It was written by: ROBERT UHLIG, TECHNOLOGY CORRESPON- DENT It first appeared in 12 03 95 The Daily Telegraph. The McAfee website URL is: http;//www.mcafee.com

3 2

ZD Net Update v.1 #2
by wwwziff＠internet.com 17 Dec '03

17 Dec '03

__________________________________ZD Net Update_______________________________ v. 1 #3 11-27-95 Welcome to ZD Net Update, the free E-mail newsletter created especially for registered users of Ziff-Davis Interactive's ZD Net/World Wide Web edition. ZD Net Update is a bi-weekly bulletin that alerts you to new and exciting developments on ZD Net. In this issue: > COMPUTER LIFE ONLINE PRESENTS THE HOT SITE OF THE DAY > INTRODUCING Q&A WITH PC MAGAZINE'S MICHAEL MILLER > ZD INTERNET LIFE INVITES YOU TO BECOME A WEB REVIEWER > MACUSER ANNOUNCES 11TH ANNUAL EDITORS' CHOICE FINALISTS * * * * * * * * * * COMPUTER LIFE ONLINE PRESENTS THE HOT SITE OF THE DAY The editors at Computer Life Online surf the Net like a bad habit. When they find sites that are hot, fresh, interesting--or just relevant to a healthy computer life--they share the news with everyone here on the Web. Then, before the Site of the Day gets warm, they put it on the "Previously Featured Hot Sites" page and serve up another one. Check these out, and you may be on your way to developing a few bad Net habits of your own: http://www.zdnet.com/~complife/filters/site.html * * * * * * * * * * INTRODUCING Q&A WITH PC MAGAZINE'S MICHAEL MILLER PC Magazine Online (http://www.zdnet.com/~pcmag/) is now giving their readers the opportunity to ask PC Magazine's editor-in-chief, Michael Miller, frank questions regarding the ever-changing state of the computer industry. Every week, this new column will feature questions from readers about a given topic. You can send questions as well as suggestions for topics you'd like to see Miller address in future columns. As Miller puts it: "My print column is really an essay on a particular topic. I try to focus on a broad variety of things, although most my print columns have been Internet-related lately. That's not too much of a surprise, as I've been spending a lot of time working with new tools and content for the Internet. This column will be more conversational. It will give me an opportunity to answer reader questions and address their concerns. In addition, this Q&A will be more timely than my magazine column because it doesn't have to be printed, bound, and mailed." Among Miller's first topics: PC Magazine's 1995 Technical Excellence Awards and reflections on the recent Comdex show. * * * * * * * * * * ZD INTERNET LIFE INVITES YOU TO BECOME A WEB REVIEWER ZD Internet Life (http:/www.zdnet.com/zdil/), the first interactive magazine designed from the ground up around a Web site, wants you to become part of their Web review team. Now you can tell the world what you really think of a Web site. Check out the new "Rate-o-Matic" review tool http://www.zdnet.com/zdil/cgi-bin/review.cgi and see for yourself. Every review enters you in a monthly drawing, and the most astute comments may be included in ZDIL's database. Need some help finding the sites you'd like to review? ZDIL's great new Search capability will give you a lift: http://www.zdnet.com/zdil/cgi-bin/index.pl * * * * * * * * * * MACUSER ANNOUNCES 11TH ANNUAL EDITORS' CHOICE FINALISTS What were the hottest Mac products this year? Find out by perusing MacUser, which has announced the finalists for this year's Editors' Choice Awards: http://www.zdnet.com/~macuser/eddy95/ But that's just the beginning of the story. You are also invited to join the staff on Monday, December 4, when MacUser's Eddy Web Site celebrates its grand opening.This state-of-the-art Web site will feature downloadable product demos, downloadable QuickTime video, RealAudio commentary from editors, links to product reviews published in MacUser, and the 1995 Eddy Awards Sweepstakes. Winners will be announced on Sunday, December 17 in a live ceremony on America Online (Keyword: Eddy95). Information about all the winners will appear on the Eddy Web Site the following day. * * * * * * * * * * ZD Net Update is the official newsletter of ZD Net/World Wide Web Edition. It is compiled by Tom Schmidt (tom_schmidt(a)zd.com) Feel free to respond with any news, notes, comments, or suggestions. To unsubscribe to ZD Net Update, point your browser to: http://www.zdnet.com/cgi-bin/ziffmail.pl/update and select "Unsubscribe to ZD Net Update."

1 0