December 2003 - cypherpunks-legacy

New version of SSL 3.0
by Phil Karlton 17 Dec '03

17 Dec '03

SSL 3.0 protocol has been substantially changed from earlier drafts to fix a number of performance and cyrptographic issues. The latest version can be found as PostScript in a compressed tar file on ftp://ftp<N>.netscape.com/pub/review/ssl-spec.tar.Z where <N> is a digit in the range [2-8]. An HTML version should be available in a day or two. I will post the URL when that happens. Netscape is also in the process of submitting this draft to IETF. Questions and comments about this specification should all be directed to ssl-talk(a)netscape.com. Answers and replies will be posted there. We are quite interested in your feedback. As new eyes see the spec for the first time, I suspect that we will be notified about typos and areas that are not as clear as they should be. As a result, there will probably be an update in 2 weeks or so. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications

1 0

Crypto stuff
by Bob Johnson 17 Dec '03

17 Dec '03

Could you send me some info on crypto stuff. I need to secure some files and as yet havent figured out how to do it. If you can help I would appreciate it.

1 0

Re: Do the Right Thing
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 4 Dec 1995, Ed Carp wrote: > > > Netscape, being the dominant browser company, and Microsoft, > > > being the dominant OS company, are in special positions to > > > "build in Big Brother." I'm not claiming they are, just that > > > they are clearly in a position to make it technologically more > > > feasible to make non-GAK illegal. They both need to carefully > > > think about the role that's been "given" to them (whether by > > > fortune, hard work, or being in the right place at the right > > > time) and do what's right. > > > > That's always a tough position to be in. If Netscape or Microsoft > > knew what was the "right" thing to do, I don't doubt that they'd be > > doing it. > > That's one of the most politically and socially naive statements I've > ever heard. Corporations *never* do the "right thing" unless it will > increase their profits. Sure, I realize this. I'm very aware of it in fact. The art of persuasion is the science of selfish self-interest. Once a company realizes that their "profits" are in jeopardy, or that individual corporate officers are liable to face prison time, then they generally do the "right" thing, what's in their interest. It's just like asking questions. You never ask a question to which you don't already have the answer. > Remember, corporations are in business to > make money by providing a product or service that people will pay > money for. Whatever gets in the way of that will fall by the > wayside. That's an economic fact of life. Sure. This is true. Facts of Life. Stiff upper-lip and such. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: GAK_hit
by Mark Neely 17 Dec '03

17 Dec '03

> I've heard that when a machine that already has Internet In A >Box, Netscape Navigator personal edition, or some other internet >software with a stack and dialer is upgraded to Win95, the win95 >installation may somehow disrupt the functioning of the winsock >or dialer. I've also heard that re-installing the application >will solve the problem. I've never seen the problem myself, >and don't know anything about any subpoena... > > --Jeff > >-- >Jeff Weinstein - Electronic Munitions Specialist My understanding is that Win '95 installs its winsock.dll in /windows/system, which is where a number of other Internet packages also install their winsock.dll. As their .dll is replaced by MS's, they cease to function (either correctly or at all). The problem is resolved by re-installing the original winsock.dll or configuring the Internet software to look elsewhere for it. Regards, Mark Neely ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

1 0

Tricky Netscape Security Hole
by drozone＠winternet.com 17 Dec '03

17 Dec '03

Yes it's full of headers, but it's the complete, unexpurgated version. If this theory is correct, this IS FAR WORSE THAN A 40 bit key. I saw the livescript on the source code. I use 1.22 for image stability right now, though. Yes it's a came from, a came from, a came from kinda deal, but in the interest of security brevity it "seems real enough" to me. Love Always, Carol Anne >Posted-Date: Mon, 4 Dec 1995 12:57:21 -0600 >X-Sender: jeff(a)cyborganic.com >Mime-Version: 1.0 >Date: Mon, 4 Dec 1995 10:51:56 -0700 >To: cybernauts-l(a)netcom.com >From: foodie(a)netcom.com (We're a Comglomerate) (by way of jeff(a)cyborganic.com > (Jeffrey Logsdon)) >Subject: Tricky Netscape Security Hole > >Anybody else see this happening? > >Eternal Vigilance, and all that. > >- ------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, > >First off - I've posted this before (however not to this group) and only >got a response from the Netscape Corp. They were glad I found the >problem and said that they would fix it, however I feel that people >should know about it. Also I would like people to help me spread this >document around, i.e. if you know of a newsgroup (or people) that would >find this interesting then please re-postit. > >On with the problem... > >I've recently got hold of the latest netscape, and was (at first) very >excited about the new "LiveScripts" that it supports. If people don't >yet know - these "LiveScripts" allow you to put small programs into your >web page that is then executed by the Netscape client. There is no >DIRECT way for these programs to send information back to the owner of >the web page, however I was able to do it in a not-so-direct way. > >The "LiveScript" that I wrote extracts ALL the history of the current >netscape window. By history I mean ALL the pages that you have visited >to get to my page, it then generates a string of these and forces the >Netscape client to load a URL that is a CGI script with the QUERY_STRING >set to the users History. The CGI script then adds this information >to a log file. Now if this hasn't quite CLICKED yet lets do a little >example. > >Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 >to start his daily "surf" session. First he decides to check his CD-NOW >purchase and uses the handy Auto-Login URL. Then he decides to go to >Lycos and do a search. In his search he find my page, which he decides >to visit. Suddenly he is transported, not to my main page but to one >of my CGI scripts, which in turn happens to have ALL the URL's he just >been to in it. This means that in my log will be: > > - the URL to use to get into CD-NOW as Johnny Mnemonic, including > username and password. > - The exact search params he used on Lycos (i.e. exactly what he > searched for) > - plus any other places he happened to visit. > >I do this in a way that the user will KNOW that it has happened and >will _hopefully_ email Netscape and tell them they are NOT impressed. >But it would be EASY for me to change the CGI script so that the user >is unaware that it has actually happened, unless they closely examine >their URL history (in fact they'll probably just think its a netscape >bug). > > >If you're skeptical about this then do the test yourself. Get netscape >2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: > > scotts car boot sale > >which should return the URL - http://www.tripleg.com.au/staff/scott > >Click on the URL and sit back an watch. First my main page will show up >but a little while later you should be transported to a CGI bin script >that will show you your URL history. > >I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions >and both have done the same thing. I would be interested in knowing if >it happens for ALL versions of Netscape2.0b2. The log file does log >the User Agent (i.e. the name of the platform you are using) so by simply >going to the page I will know that your version of Netscape is also >open to this form of attack. > >Currently I can find no way to configure Netscape2.0b2 to NOT run >LiveScripts - and at the very least this option should be quickly >added to the next version of netscape to be released. But a far >better solution (IMHO) would be for netscape to pop up a window before >running the LiveScript and let you know what the LiveScript wants access >to, e.g. if it only wants to print out the current time then that's >OK, but if it wants to read my history list and then transport me to >a CGI script and add me to a logfile then maybe I would say NO. > >I think I've said enough.... > >If you've got any further questions, or want some more information just >email me : scott(a)tripleg.com.au > >- -- >Scott. > >Quote from a car accident insurance claim: "I told the police that I was >not injured, but on removing my hat, I found that I had a skull fracture." >- ------- End of forwarded message ------- > > >------------------------------ ------------------------------------------------------------ Thaddeus "Doc" Ozone <http://www.winternet.com/~drozone/> "Specialization is for insects." -RAH "I yam what I yam and that's all what I yam!" -Popeye

2 1

No Privacy Right on "My" Desktop ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, A 12 04 95 The Electronic Telegraph newsstory headlined 'Spoilsport' software bars games reports that An American company called DVD has developed a utility called UnGame that can delete up to 3,100 games from a computer network. Even if the game is hidden on the com- puter user's own hard disk, it will find it. The user's own hard disk? Although the machines at work usually belong to the com- pany, most employees regard them as an electronic equi- valent of their desk, and are similarly territorial. John Davison, PC Zone editor, says: If anyone stole something from your desk you'd be fed up. If anybody stole something from my computer, I'd be equal- ly disgusted. What kind of software is UnGame? The newsstory suggests the answer: ...industry experts have complained that companies may be releasing "tailored viruses".... I believe my first post to the list was about McAfee's Virus Blocker. Perhaps that can be...adapted. If so, those who then declared the information had nothing to do with privacy may continue playing their games. Of course companies may try another tack: Oracle's "internet terminal." As dlv(a)bwalk.dm.com pointed out in his 11 18 95 post, [I guess, they mean no permanent storage or software other than the browser in ROM. No remembered state, no viruses ... -DV] In "my" terminal. Cordially, Jim NOTE. The Electronic Telegraph's website URL is: http://www.telegraph.co.uk The newsstory's online filename is: ngame02.htm It was written by: ROBERT UHLIG, TECHNOLOGY CORRESPON- DENT It first appeared in 12 03 95 The Daily Telegraph. The McAfee website URL is: http;//www.mcafee.com

3 2

The "Future" Fallacy
by Duncan Frissell 17 Dec '03

17 Dec '03

Bill Gates (like Mister Newt before him) committed what I call the Future Fallacy in "The Road Ahead." Page 106. "Soon any child old enough to use a computer will be able to transmit coded messages that no government on earth will find easy to decipher." DCF "Term limits aren't enough. We need jail." -- PJ

1 0

Some info on file/memory erasing on NT
by Andy Brown 17 Dec '03

17 Dec '03

The subject of protecting memory and files from other users in a multi-user environment always seems to come up here every few weeks, so the following short article culled from the MS Win32 SDK might be of interest. - Andy [...] SUMMARY File systems under Windows NT currently have virtual secure erasure (when a file is deleted, the data is no longer accessible through the operating system). Although the bits could still be on disk, Windows NT will not allow access to them. MORE INFORMATION The NTFS file system does this by keeping a high-water mark, for each file, of bytes written to the file. Everything below the line is real data, anything above the line is (on disk) random garbage that used to be free space, but any attempt to read past this high-water mark returns all zeros. Other reusable objects are also protected. For example, all the memory pages in a process's address space are zeroed when they are touched (unlike the file system, a process may directly access its pages, and thus the pages must be actually zeroed rather than virtually zeroed). Note that file system security assumes physical security; in other words, if a person has physical access to a machine and can boot an alternative operating system and/or add custom device drivers and programs, he/she can always get direct access to the bits on disk. [...]

1 0

another fbi prosecution
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Chronicle of Higher Education (Dec 8, 1995) page A21 reports that Monmouth University (West Long Branch, New Jersey; http://www.monmouth.edu) sophomore Dominick LaScala was charged last week in federal court with two counts of computer fraud. Dominick had his campus account taken away after other users complained that he had been "advertising business proposals inappropriately on line." The FBI alleges that he then sent 24,000 email messages in one day from a commercial account (unamed) to Monmouth's system.. This denial of service attack was successful for about 5 hours. He is facing six(6) years in prison and a up to $350,000 in fines (1.20 years/hr and and $70,000/hr). His lawyer (Kenneth Weiner) claims that "even if his client sent the mail bomb" since no damage was done to the system, he could not be convicted under the computer fraud statute. He also claims that prosecutors are trying to make an example of his client. The university is still trying to figure out whether he can be punished under the university code of conduct.

1 0

Joining The Mailing List
by Dave Turner 17 Dec '03

17 Dec '03

Cypherpunks, Would it be possible to include me on your current mailin list. Thanks Dave.

2 1