December 2003 - cypherpunks-legacy

re: alleged RC2
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

Not like I have the time or anything, but is there any value in attempting something like "bruterc2"? (IANARC (I am not a real cryptographer), but it looks like one trick to that would be to somehow short-circuit the key setup stage. I suppose you could just start after it's mapped the user key into the "xkey" array, but I might be missing something.) ______c_____________________________________________________________________ Mike M Nally * Tivoli Systems * Austin TX * I want more, I want more, m5(a)tivoli.com * m101(a)io.com * I want more, I want more ... <URL:http://www.io.com/~m101> *_______________________________

1 0

RE: [NOISE] Re: FYR_wal
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

perhaps it should, given that it will do about as well for its intended purpose... Kurt ---------- From: Marshall Clow[SMTP:mclow@owl.csusm.edu] Sent: Wednesday, January 31, 1996 14:58 To: Corey Minter Cc: cypherpunks(a)toad.com Subject: [NOISE] Re: FYR_wal >ok, who wants to help me market my new tunneling router software >called "Chinese Firedrill". I believe it would sell well in China's >black market. > Shouldn't it be called: "The Great Firewall of China"? ;-) -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:05 AM 1/31/96, sameer wrote: > I agree with your points that the press should write real >articles, and not just swallow press releases. The fact of the matter >though, is that that's what they do, swallow press releases. It's a >said state of affairs, but that is the state of affairs. > I wouldn't say *all* news is PR controlled, but most of it >is. It's much less work for the reporter when an article just shows up >on their desk and all they have to do is call one or two people for >some fresh quotes. And I agree with your points, too, Sameer. Like I said, I mean no disrespect to you that you issue press releases in which you interview yourself...it's the form that press releases take, and it's the form that "slides down easily" into a newspaper story. (The form makes it look as though the journalist has conducted the interview and gotten the quotes.) And at least most of Community Connexion's press releases have been about new services being offered, or rewards, etc. And not given vastly more attention than they deserve (as was the case with the FV "discovery"). I really hope this media frenzy with all things related to the Internet will burn itself out. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Flaw in FV process (was FV and Netscape slagging each other off :-)
by John Pettitt 17 Dec '03

17 Dec '03

At 05:56 PM 1/31/96 -0500, Nathaniel Borenstein wrote about Jeffs attack: >Your attack would be caught by us relatively quickly because our model >is based not on a single fail-safe piece of security software, but on >*process* security. The overall process is multifaceted, with many >checks and balances. Yes this is all fine and good - but your process does not allow for real time delivery of goods. For example: Somebody wants to buy say micrsoft office from me for electronic delivery (yes they have a lot of bandwidth :-). I can authorize a credit card, fun it by my fraud screen and start shipping in less than 30 seconds. At this point the transaction is done. In the FV model as I understand it I'd have to ship the software and wait for an approve/deny/fraud from the user. If it's anything but approved I'm SOL, I still have to pay Microsoft for the product but I didn't get paid. Solve that process flaw and I'll add FV support to software.net. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

[NOISE][CONTEST][FACTS] don't help much, do they?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Ontogeny recapitulates phylogeny, as the saying goes. I notice a recent surge in posts that have one or more of the bracketed labels above, presumably in an effort to make the filtering job easier for others. However, this rarely works. For one thing, many of the most noisome posts, in my estimation, lack the [NOISE] label. And many of the posts labelled [NOISE] are actually pretty interesting, to me. Some people go overboard in labelling their own stuff as [NOISE], out of some kind of false modesty. And needless to say, the labels usually propagate into later followups. (And, shockingly, some people even prepend the followups they make with the [NOISE] label, thus screwing up threading. I saw this fad for labelling over on the Extropians list. It failed then, and will fail now. For one thing, the labels take up valuable "namespace." It is far better that the 30 to 50 characters of namespace be taken up with good, descriptive thread titles. Use labels if you must, but give some thought to how they just become more roadside clutter, conveying no meaning. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

At 07:25 PM 1/30/96 -0800, Lucky Green wrote: >>I take it its completely legal to set up a Virus ftp site then? > >AFIK, in the US it is legal to set up a virus ftp site. I don't know if >someone has actually done it. Don't count on it lasting. Some European >countries have already outlawed virus (read knowledge) distribution. Anyone interested in visiting a good virus site should point their browsers to: http://www.xcitement.com/virus/ Quite a good site, really. It hasn't been "Netscape Enhanced" yet, so there are no frames and tables and inline A/V, but it gets the job done. They offer a *lot* of virus source code (almost all of it in x86 assembler) and many related resources. Some highlights of the home page are included below. I would recommend the use of something like WebWhacker, which automagically downloads the contents of a web site to your local system and edits the html files to work correctly from your local web browser. It will allow you to replicate the site quickly and easily, instead of clicking on each of the more than 2500 links one at a time. Hope this helps. If you're interested, better get there quickly. (Of course, it's been up for six months now, so it's likely already withstood a substantial amount of negative response. It may be there to stay.) ---- 8< ---- Welcome to the VIRUS Source Homepage! This page contains several virus code generators, a few mutation engines, over 500 virus source files and over 2,100 executable virus files. This material is being submitted for educational purposes only. Play at you own risk. But have fun! The purpose of this page is not to inflame, but to educate, stimulate and confront you with alternative information on the sensitive issue of virus creation and propagation. The only way in which to know the whole of a subject, is by gaining knowledge from every variety of opinion on the subject, and studying all modes in which it can be looked at. Inform yourself by analyzing and studying the source code of actual viruses, read the virus writing & assembly language tutorials. Then consider and examine every variety of opinion on the subject; the anti-virus folks, mainstream society, and most importantly ideas and opinions that are considered radical, reactionary, minority or stigmatized by some other uncomplimentary label. No wise person ever acquired wisdom in any other way... A special note to those of you who would like to see an end to this page: If all humankind minus one were of one opinion, and only one person were of the contrary opinion, humankind would be no more justified in silencing that one person than it, if it had the power, would be justified in silencing humankind... What's New? Last updated on 12/26/95. Message Board Code Generators The 2nd Generation in Virus Creation (46k) Virus Creation Lab (164k) Password: Chiba City Mass-Produced Code Generator (45k) Instant Virus Production Kit (39k) Trojan Horse Construction Kit (18k) German Virus Construction Kit (12k) Mutation Engines Mutation Engine (13k) Mutation Engine Tests (18k) Polymorphic Engine (8k) Visible Mutation Engine (20k) Source Code [A-Z] Executable Files [A-Z] Debug Scripts Over 33 debug script files (184k) Miscellanous Debug.com based interrupt stripper (3k) V-86 based interrupt stripper (13k) VSUMX507.ZIP (96k) - database of viruses. Assembly Language (resources) Virus Writing Tutorials ---- 8< ----

2 1

gondolin.org services are back!
by Bryan Strawser 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After a bout with InterNIC and multiple DNS problems, I am happy to announce that the remailer/nymserver services located at gondolin.org are back on-line and functioning. Type I/II Remailer: mix(a)remail.gondolin.org Nymserver: alias(a)nym.gondolin.org Keys are available via the correct commands and the keyservers. Please contact me with any questions you may have. Bryan - -- Bryan Strawser, System/Network Administrator & Postmaster feanor(a)gondolin.org Gondolin Technologies, Bloomington, Indiana USA -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRAR1fvQGgQ7UJMZAQHChwQAqdWdLsEN5++NwiR9dya6bBa6K4pISi5N y/8QQSCqFC21Rz1pq9hpvCiuhCHbuLOga1XM/SeGBCIn54nVfu/HYZP4VaFxUxI2 Fy0DAAKQhMlXT3wSMZdQJkkBX+My76sJP5k4PDouA6R/B1BQiOWa60oVfRM3Dbo9 upi27fcc4PU= =MDZQ -----END PGP SIGNATURE-----

1 0

Re:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ+x2ioZzwIn1bdtAQFLvgGArC5EiVmF0J6VZSZnboc9yoTW3eiJXN1M 4L9v0f1tkuoJlC10gX6fRo3SW19vILT4 =LmRK -----END PGP SIGNATURE-----

1 0

RE: More FUD
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>"real professionals?" You mean the kind that take meetings to avoid work and >leave the office by 5:00? No, those are managers. (Have better equipment at home anyway 8*). >As far as "virus writers" there are relatively few that I would lump >into that category, but the ones who do get there are worthy >of at least a little respect. The ones I know who could, don't. Is considerably harder to write an antivirus program that can account for Zenith ZDOS 3.21 or the original PC-AT BIOS than a virus that blows up if you run it under NW-DOS. >>True, in early '92 when [Mich] came out things were more difficult - not >>everyone had 640k in their machine so the user acurally had to have a clue >>how much memory was supposed to be there. Today is there anyone with 512k ? >If my memory serves me correctly, by '92 386's were rolling off the assembly >lines. You missed my point (and my canary trap). When a Pentium starts up it is in 8086 "real" mode and is limited to the same 1 Mb basic address space (know about the 64k - 16 bytes, is different from 8086/8). What I was referring to was the "640k limit" imposed by 1-2-3 waaaay back when - is stored in Bios data area (0:400) and CMOS. >Maybe you should use WordPerfect instead. Actually I prefer WordStar 7.0. Magazines and the gov like WordPerfect. >Solution: Get rid of Windows. Upgrade to '95, NT, or go to Linux, even OS/2. Have been warped. Have Liniux & FreeBSD. As for Win95, why would I want to degrade my system ? >>And you tell me that someone is going to spread a virus on the net that will >>capture keystrokes on any machine it hits without anyone noticing ? It is >>to laugh (and if they can, they are wasting their time with credit card >>numbers). > This sounds like a challange. Is it worth a T-Shirt? Wasn't a challenge (though getting something to work on a "strange" NCR notebook like mine might be 8*), never saw a BIOS leave dangling interrupts following POST before...) >Not if it is written properly. A lot of viruses become known only when they >drop their payload. Others are just poorly written, no different from a bad >software product. It is not that they are written badly, just that most virus writers lack experience and their worldview is narrow - the [Mich] we mentioned - is obvious not that the writer did not know how to handle floppies, rather that all he/she/it/other knew of were either 360k or 1.2 Mb. "Nightfall" writer had apparently bever seen a Zenith 248 kit 5 BIOS. Ludwig's LBB boot sector virus will only work under Dos 3.3 because DOS 4-up leaves different values in the registers. >>Fact is that the greatest protection the net has is that no two machines are >>alike, may even start that way but after six months, no way. >Ahhhhh.. but your wrong. Granted, the underlying strata may be radically >different, but I can run an MS-DOS program on an 300 Mhz DEC Alpha (under NT) >without any problems (except I couldn't get DOOM to run). No, you can get *some* programs to run and on your machine you may get *all* your programs to run. But they will not run on *any* machine. > There is already a >read-only Filesystem driver for Linux that will read NT. Like TCP/IP, the >operating systems are going towards interoperability. Type 7 ? Nothing magic, just different. >The big computer companies recognize that they have to compete to survive. No >longer can IBM design a machine and lock in their customers to IBM parts, IBM >service, and an IBM operating system. Strength from diversity 8*). Meanwhile, back at FV, if someone wants to break it badly enough, they'll buy one (or one of the FV employees) and take it apart at home. No "professional" would attack anything that she/he did not already know how to break. A *real* professional would buy two or three just to see if they were all the same. Is the same problem with the "Sidewinder Challenge" though it did get a lot of print. Warmly, Padgett

1 0

Call for Papers
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

January 31, 1996 Attention: Information Warriors: ***** CALL FOR PAPERS ***** Please feel free to distribute this widely. I first want to thank the thousands of people who have been so incredibly supportive of my work over the last several years, and who have helped the public debate on Information Warfare gain and sustain the momentum we have all created. As a result of the continued interest in the subject, my publisher has asked if I would create a 2nd. Edition with substantial updates to the original "Information Warfare" which was published in 1994. I told them that the new revised edition should include much of the thinking that has evolved on the topic in the last couple of years. Believe it or not, they agreed! So, I am asking (begging? :-) for a couple of things. 1. We want to include a comprehensive Appendix "D" to include references and bibliographic information for those already in and for those entering the field. We would greatly appreciate any and all types of references that you feel will be useful for students of Infowar today and in the future. The kinds of material we hope to include are: - Web sites, mailing lists, usenet, etc. - Monographs and their source - Published papers and their source - Books with publisher, author, date, ISDN (oops, ISBN) price and a one sentence commentary. - Global resources on the subject. - Courses (civilian, military, etc.) - Organizations, private and gov't. We will also add a credit/acknowledgments page for all of the Information Warriors who have assisted in this effort. Please supply name, title (or rank) contact info, and affiliation as you want it to appear in the book. (If you don't want your name or affiliation to appear, please so indicate and we will honor your request. (Honest . . . .) Ideally, we will need to have a hard copy of the materials that we reference. PLEASE RESPOND TO BETTY(a)INFOWAR.COM 2. In order to portray the current thinking of Infowar from its many facets, I am also looking for short commentaries on your particular take on Infowar - and heavens knows there are so many . . . perhaps googols! I would like to include a large number of 500-800 word overviews, or executive summaries of topics of interest to you, comments on my work, or perhaps on the efforts that you or your org are putting into the field. I am hoping to find a balance between the civilian viewpoints and military and international ones so that students and readers can see just how much work in occurring in the field. Organizations like AFIWC and DISA (and so on) are invited to submit a similar overview of their efforts in addition to individual submissions. It is not necessary to agree with me (that would be heresy in some cases :-)) but let's be civil about it, OK? The purpose is to get the neurons vibrating and moving the field forward. If you take issue with, or relate to specific items/topics/comments in "Information Warfare" please note page number so we can tie it all together thematically. There will be suffixes to each chapter, and I am hoping that many of the responses will comment on or add to each of the chapters. As for credit, we will list your name, contact info, affiliation etc., along with your particular contribution. With each submission, please just say something like, "I hereby give Winn Schwartau, Interpact, Inc., and Thunders Mouth Press non-exclusive permission to use this work." That keeps the publisher happy and still lets you own your own words. If it's a personal opinion, and not an official one of your organization, a simple disclaimer like, "these are the opinions of the author, and not necessarily those of my organization." We will provide a general suffix disclaimer to that effect anyway. If it is the official view of your org, then please indicate so clearly, so we may make an accurate distinction. If we decide to edit your piece substantively, we will run it back to you for approval before printing. All we will ask is a timely return. To get your brain thinking on the kinds of topics I am looking for: - Civilian Defense - "This is an act of War" - "This is not an act of War" - Infowar as an alternative to conventional conflict. - Non-lethal conventional warfare - Enhancing military efficiency with Infowar - PsyOps as Infowar - Hackers: A National Resource Please consider all three Classes of Infowar when deciding what you want to say. Since you only have 500-800 words to say it, I suggest that it be clear, concise and to the point. Controversy is good. But just as good is if your comments are thought provoking and stimulate additional discussion about your subject. For each contribution we accept, (and there will be a lot we will!) we will provide a free copy of the new revised "Information Warfare: Revised Edition" (or whatever they decide to call it.) PLEASE RESPOND TO: BETTY(a)INFOWAR.COM 3. We have already received a large number of short "pull quotes" of one or two sentences for the cover and inside covers where we give full attribution. If anyone is so inclined, we are looking for a few more that comment on the existing works. PLEASE RESPOND TO BETTY(a)INFOWAR.COM 4. Robert Steele at ceo(a)oss.net has agreed to help me pull together a "Who's Who" of Information Warfare. Please supply names, contact information and brief biographies to him at CEO(a)OSS.NET. Again, I want to thank everyone out there for their support, and I look forward to seeing what everyone has to say. Please send your input to BETTY(a)INFOWAR.COM no later than February 29, 1996. Feel free to distribute this widely and/or post as you see fit. Winn Schwartau Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0