December 2003 - cypherpunks-legacy

Re: "Re: NSA says strong crypto to china??
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:47 AM 1/7/96 -0800, Raph Levien <raph(a)c2.org> wrote: > My best guess is that we're seeing a distortion of this >interchange. If I were a Chinese dissident, I wouldn't want to use >GAK, for three reasons: using US-lackey encryption is certainly not >going to get you into any _less_ trouble than using independent >encryption, if you used GAK you'd be working as a US spy whether you >wanted to be or not, and finally, who says the Chinese can't decrypt >it, especially with the rapid growth of television. And, four, there's no guarantee the US keymasters won't burn you to the Chinese government, if it seems useful in preserving "stability"... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Re: phone calls from hell
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

8 Jan 1996 Jerusalem, (Reuter) - The head of Israel's Shin Bet resigned Monday just three days after the killing of a wanted Palestinian bombmaker recovered some of the damage the secret service suffered from the assassination of Yitzhak Rabin. The man, identified by his initial "kaf," remains in office until a successor is appointed, Israel Radio said. His predecessor, Yaacov Peri, is now president of one of Israel's two cellular telephone networks. -- 8 Jan 1996 Jerusalem (AP) -- The booby-trapped cellular phone that killed an Islamic militant was delivered by a longtime informer for Israel who was paid $1 million for helping, media reports said Monday. A fugitive for three years, Ayyash was hiding in the home of Osama Hamad, his friend from college days. Hamad said he warned Ayyash in the summer that his uncle, Kamal Hamad, may be an informer for Israel. Hamad said his uncle gave him a cellular phone so he could be found easily. A day before Ayyash was killed, his uncle asked for the cellular phone, took it and returned it later, requesting that it be kept on at all times, Hamad said. Israel's security services apparently deceived Kamal Hamad, telling him they had planted a bug in the phone, rather than explosives, the radio said. Media reports said that the explosion was set off by remote control when Ayyash answered a call to him. It is not known how the identity of Ayyash was ascertained. --

1 0

Re: phone calls from hell
by jim bell 17 Dec '03

17 Dec '03

At 01:03 PM 1/8/96 -0600, you wrote: >jim bell <jimbell(a)pacifier.com> said: > > >jb> Sorta gives new meaning to the term "_Terminate_ and Stay Resident" >jb> program, doesn't it?!? > > Wouldn't that be "Stay Resident and Terminate" or "Stay and >Terminate Resident"? > >jb> (Or "end of file.") "end of life"?

1 0

Re: NWLibs Re: Hammill 1987 speech
by jim bell 17 Dec '03

17 Dec '03

At 10:01 PM 1/7/96 -0800, you wrote: >Mr. Bell: > >if I were to summarize my arguments, they would be that governments >are the way that they are not so much because they attract certain >dysfunctional individuals, but rather because they are microcosms >and macrocosms of human psychology. the problems with government >that libertarians rant about are problems with human behavior. >the solution is not to get rid of governments-- this is confusing >cause and effect, symptom and cause. the solution is to work on >human behavior. when humans begin to think in a different, >positive way, their governing systems will automatically reflect the change. Gobbledygook. Blaming the problems of the system on the people involved. It is obvious that you are unwilling to admit that THE SYSTEM could, indeed, BE the problem. >my essay was designed to show the negative aspects of governments >that rabid libertarians are always endlessly ranting about are actually >embodied in the psychologies of those libertarians themselves. More gobbledygook. Blaming the problem on the observers of the problem. >therefore, >while I agree with the libertarian that there are many problems with >governments, I see no reason to believe that libertarians are proposing >a workable alternative, based on their own stark biases and prejudices. Still more gobbledygook. You don't mention WHICH "stark biases and prejudices," for instance. >in fact it seems quite obvious to me that their own "alternatives" are >either "vaporware" "Vaporware" is generally thought of as programs that have not yet been implemented. While it is true that much of what libertarians have proposed has not yet been implemented, blame for this lies strongly (and primarily) with NON-libertarians. >or would be far worse in practice than even the >dysfunctional systems we have in place today. You haven't established this, and haven't even attempted to. Your argumentation is weak and practically meaningless. >rabid libertarianism reminds me of Marxism: sounds great in theory, Lots of things "sound great in theory". That does not mean that everything that "sounds great in theory" will NOT be good in practice, if allowed to operate. This is ESPECIALLY true that much of libertarianism which "sounds great in theory" actually sounds PERFECTLY AWFUL to the statists who currently control things. > and >you might even convince large parts of the population or key people in >power to follow it. but does it truly present an implementable and workable >alternative? First, you tell us: What are your standards for this? Are you never going to admit that it's "workable" until it's actually working? In other words, when those opposing it have finally FAILED? where are the specifics? "Specific" what? >identifying problems with government is quite trivial. If you admit this is the case, this puts even more blame on those defending government's flaws (or failure to fix them.) >this is destructive >criticism, Please document this silly claim. You're saying identify problems with government is "destructive"? "Destructive" of what, pray tell?!? If it's "destructive" of a bad and corrcupt government, I'm HAPPY to hear it. This kind of "destructive" we need PLENTY more of! ?analogous to the guerilla warfare of words that rabid libertarians >love. but criticism is easy compared to construction of something that works. Oddly, the non-libertarians don't usually want to give libertarians the opportunity to take enough control to show that what they can do "works." Gee, I wonder why! Maybe they're afraid of incipient success. Privatization of previously publicly-provided services is strongly resisted. >when you focus your attempts on creating a system that embodies your >ideals instead of ranting at those that do not (and complaining that >you cannot because governments prevent you), you will make far more >progress in developing your ideas and convincing the world to follow you >than any number of essays can accomplish. More gobbledygook. >if libertarianism is truly workable, shouldn't it be workable on >small scales? It is, and does, work on small scales, WHEN ALLOWED. >what prevents individuals from actually starting it going >at a small scale and growing it? It's called, "government regulation," "taxes," and such. If you've been following the news recently, perhaps you've noticed that there are "peanut quotas" (to cite just one example) which legally prevent me from deciding to grow peanuts and sell them freely on the American market. ___THIS___ is just one of those things which "prevents individuals from actually starting it going at a small scale and growing it." Feeling a bit more foolish, Mr. Nuri?!? >that is the path that every government >and nation has taken since the beginning of time, why do you think you >should be exmempt? That's EXACTLY why libertarianism ISN'T being allowed to flourish. It eliminates control that others worked hard to achieve. >I don't see that any of your response to my essay detract from this >basic message so I'm going to pass on a detailed reply. Typical Nuri wimp-out.

1 0

Re: Horowitz "thread"
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 08, 1996 17:41:10, 'Alan Horowitz <alanh(a)infi.net>' wrote: > >I almost hate to start a thread about something that will inevitably >implode into a middle-east-politics flamefest... > Then don't. --tallpaul

1 0

NSA Rigs Win NT to B
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Global Internet Wins NSA Contract for Windows NT Security Enhancement Feasibility Study to Analyze B-Level Security Requirements Palo Alto, Calif., Jan. 8 -- Global Internet today announced that the National Security Agency has awarded them a contract to conduct a feasibility study on raising the security level of Windows NT 3.51 to B-level. Global Internet will analyze Windows NT's ability to meet B-level security requirements, as well as develop a software prototype that demonstrates a Fortezza-based cryptocard access control mechanism. The contract was granted by the NSA under the Multilevel Information System Security Initiative (MISSI), which has the charter to provide security services for information ranging from Unclassified but Sensitive up to and including Top Secret. Windows NT was originally designed with security in mind. A NSA evaluation team has determined that Windows NT 3.5 with Service Pack 3 satisfies all class C-2 security requirements. B-level of security strengthens the C2 level security features while providing stricter system assurances. Global Internet has a proven expertise with Windows NT. Centri TNT is the only network security solution that is fully integrated into Windows NT TCP/IP networks by complementing and extending Windows NT's inherent strengths, while maintaining 100% compatibility with existing applications. Global Internet also has extensive experience architecting, designing and developing high level secure operating systems. "This project addresses anticipated security requirements for DOD, as well as commercial customers using Windows NT," said Michelle Ruppel, a director of the Global Internet Software Group. "Our analysis will address compatibility issues with B-level security requirements and identify the changes necessary to provide this level of support." According to Outlink, Inc., a New York-based research and publishing firm focusing on the information security market, about 80% of the PC hardware market supports Microsoft's DOS and Windows 3.1. This combination, though popular, does not provide inherent security features such as secure login, access control, auditing and self-protection. Strong access control is a highly desirable function of the MISSI architecture. Trusted Operating Systems will play a role in the MISSI success. Windows NT is a modular OS and combined with its current security features that are based on the Trusted Products Evaluation Program (TPEP) C2 level of security and it's ability to operate on the majority of customer platforms while supporting DOS and Windows applications, the architecture lends itself to support B-level requirements. An operating system with few security features allows anyone to use the machine without validating their identity, while allowing access to all files, objects and resources. C2 level security includes: auditing to allow security-relevant events to be recorded and monitored, discretionary (need-to-know) access controls to mediate who can access (read or write) files and other objects and identification and authentication (login) to require users to identify themselves to the system before they are allowed to use the system. B-level security additionally includes: labeling of users, files and other objects with a sensitivity label, mandatory access controls to enforce a security policy based on the labels of the users and objects and trusted path that ensures users they are using the actual programs provided with the system. The Global Internet Software Group specializes in security software for Windows NT networks and other operating environments. The Software Group is a division of Global Internet, a full-service internetworking solutions company focusing on secure, reliable internetworking software and services. Located in Palo Alto, California, Global Internet is privately held and was founded in 1993. Global Internet Home Page: http://www.gi.net.

2 1

No Subject
by kephart＠interserv.com 17 Dec '03

17 Dec '03

please send anon remailer faq. many thanks.

1 0

Re: Microsoft continues to mislead public about Windows security
by frankw＠in.net 17 Dec '03

17 Dec '03

>From the desk of Lucky Green: > >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? I'm not a psychologist, but I have worked in the Information Security field for a while now. When a system is breached or a CERT Advisory is issued, this is a major embarassment for the company. The breach (or publicized security flaw) shakes the confidence of people in the vendor's products. People are rather unwilling to risk putting their business-critical data on a system which has just recently breached. This lack of confidence translates into a loss in sales. If unchecked or the case if severe enough, this could also translate into a loss of jobs. If the consumers (or some key major players) put pressure on the vendors to secure their systems, then it will happen. Until then, the vendors will continue provide us in the Information Security field with unparalleled job security. 8^) You would be surprised how bad the situation really is and how many companies are vulnerable and to what extent (then again, you may not). We now return you to your discussion on crypto. 8^) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

1 0

Microsoft continues to mislead public about Windows security bugs (a bit long, with references)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Please do not dismiss this as mere "Microsoft Bashing." c2.org has similar promotions running for Netscape, DigiCash, and Java. The following is a quote from Microsoft's "Knowledge Base" technical support and marketing database, which is online in CompuServe and at: http://www.microsoft.com/kb/peropsys/windows/q90271.htm Security of the Windows for Workgroups Password Cache _____________________________________________________ The password list file is encrypted with an algorithm that meets the U.S. government Data Encryption Standard (DES). This encryption technology is the highest security allowed in software exported from the United States. The odds of breaking the encryption algorithm are less than those for random guesses of what the password might be. Even if your logon password is blank, Windows for Workgroups generates seemingly random data in your PWL file, so you cannot discover the passwords if you look at the PWL file using a file viewer. Currently, no user interface exists that allows you to unencrypt passwords in the PWL file, so password caching in Windows for Workgroups is as secure as the choice of the password used to encrypt your PWL file. As Microsoft well knows, this is completely untrue. The rest of the world has known that this is untrue since November 29th. Microsoft quietly acknowledged on December 7th (after a day of much "Internet Strategy" hype, and after the deadline for the morning papers) that the exact same implementation was insecure in Windows 95, and claims to have released a patch that fixes the problem (the efficacy of the Win95 patch does not appear to have been verified by anyone outside Microsoft, however). Microsoft has not even admitted that this bug in both Windows 95 and Windows for Workgroups affects Windows for Workgroups, apparently because they have decided not to fix it. Information on the .PWL implementation bugs was first broached on the sci.crypt newsgroup in late November 1995, then discussed on the cypherpunks list and refined for Community ConneXion's "Hack Microsoft" promotion, http://www.c2.org/hackmsoft/. We have since been given a sample trojan horse that will very efficiently exploit this bug in Windows for Workgroups. Distributed as a Word Basic virus, MIME attachment, or downloadable archive (note that Exchange and Internet Explorer unwisely execute downloaded binaries without even a virus check, a problem that Sun's Java has long acknowledged and addressed), this trojan horse could collect passwords and other sensitive information from .PWL files and other sources and send them out via email, possibly through an untraceable chain of remailers or to a throwaway trial account on, for example, America "Online." We believe that it would be highly irresponsible to release the full version of this hack, but we will soon release a crippled demonstration-only version if Microsoft does not at the very least admit that this problem has always affected Windows for Workgroups, correct their online documentation, publish the specifications of the Win95 security patch for review by outside security experts, and issue a public retraction. See also: http://www.microsoft.com/kb/peropsys/windows/90210.htm http://www.microsoft.com/windows/pr/clarifications.htm http://www.c2.org/hackmsoft/ http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html {mirror of above} http://www.mari.su/guide/win95/ {mirror of above} ftp://ftp.demon.co.uk/pub/mirrors/win95net/ {more mirrors are under construction in Australia and elsewhere} In other news, I assume everyone knows by now that NT's claimed C2 security rating was granted *for use a standalone workstation only*. It has been widely reported that its NetWare Services implementation does not ask for passwords for nonexistent usernames, making a potential cracker's job that much easier. The correct response, which is given by real NetWare servers and other servers that are certified C2-secure on networks, is to silently ask for a password in all cases. I started getting copies of hackmsoft(a)c2.org mail on December 20th. It's really depressing. We've also seen problems with Microsoft Access 95's security. Basically, there is none. Anyone can access the network-enabled Access as any user without knowing the password. We don't think it would be responsible to publicly release this hack, either, until Microsoft has had another chance to patch the hole (they've known about it for some time). These are far, far worse than the widely publicized bugs in Netscape's SSL implementation, which have been fixed. Yet the only place I've seen them mentioned is the lapdog Seattle Times, which only reports bug *fixes* in glowing terms. Is anybody listening? - -rich owner-win95netbugs(a)lists.stanford.edu ftp://ftp.stanford.edu/pub/mailing-lists/win95netbugs/ gopher://quixote.stanford.edu/1m/win95netbugs http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPHZrI3DXUbM57SdAQFojwP/T0CIjfyEz5NHD81wPdkAuUf1YCB8OE3/ 4NakffTxzmPxJXRT/MoRpOMn4qJa6mzC6WAgAdwtKWG/3K9WS1LNgM/w/PYMHj45 pEQroJBzoXU/Sctjnyz87FBl2/m6dwAdvPQqGOzGqsLVDaFsmqbWtalkvP2y0707 ntdb2fkqpNI= =q491 -----END PGP SIGNATURE-----

1 0

Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references)
by Gordon Campbell 17 Dec '03

17 Dec '03

At 12:37 AM 1/9/96 -0800, you wrote: >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? I'm not a psychologist, but I'd guess that by the time a crack is released, knowledge of a problem is so widespread, that the company responsible can't ignore it. Kind of an ostrich thing. ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

1 0