December 2003 - cypherpunks-legacy

Associating Local Port Number to PID
by Karl A. Siil 17 Dec '03

17 Dec '03

Folks, I'm working on a program for UNIX (SVR4, Solaris 2.4) systems that needs to associate PID with local TCP/IP port number, so as to pass session keys accordingly to already running processes. This sounds like such an obviously needed association that someone must have done it already. Pointers to code would be best, but any references would be helpful (e.g., the appropriate /dev/kmem data structure(s), offset(s), etc.). If necessary, the program is allowed to be in any group (e.g., "sys" to get at /dev/kmem) and may even run as root, as a last resort. I see no reason for the latter, however. Running set-gid to "sys" is sufficient for netstat(1) and ps(1) and I think is the upper bound for process privilege that I would need. Thanks in advance. Karl

1 0

Re: [local] Report on Portland Cpunks meeting
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 24 Jan 1996 00:32:37 -0800, shamrock(a)netcom.com (Lucky Green) writes: > How do they verify that the person confirming the fingerprint is indeed > the person supposedly owning the key? It is pretty hard, that is one of the reasons the web-o-trust is broken. You can make it better by requiring the person to actually use the key, which proves that he/she has the passphrase. At the last key signing at the DC-area cypherpunks meeting, I told everyone my name was Boris Badanov. Even tho the key's userid said pfarrell(a)netcom.com. Carl Ellison suggests that the signature should have a much weaker meaning, roughly: "The person owning the secret key associated with this public key's tag has characteristic X." Obviously X could be "claims to be Pat" Thus if Lucky gives me a key, I don't know what his/her real name is, and don't care. All I have to do is see them actually sign something I give him/her with the key. Of course we need to rule out man-in-the-middle attacks. For me, I would buy off on watching the signing on a standalone laptop while I watch from accross the room. Interesting atack: Assume there is a chain of keys, with Lucky feeding keys to Klaus inside the laptop. I'd be signing what I thought was Lucky's key, but it was really Klaus'. Of course "Lucky" would have to have the secret passphrase for both Lucky's and Klaus' keys. It isn't clear to me if this is an important case. Equally questionable are tricks such as using an IR or wireless transmitter to send my test data to another computer so that the chain of MITM can be longer. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

"Concryption" Prior Art
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I haven't read the supposed Concryption patent so I don't know what the claim structure is. But if they truly claim the right to do encryption and compression simultaneously, then I've got some prior art that should knock out such a broad claim. The paper is "A Redundancy Reducing Cipher" (Cryptologia, May 88). It's not very secure, but it does do some manner of encryption at the same time as compressing a file with a Huffman-like system. The journal is found in many university libraries so it should be easy to produce a solid counterclaim. If anyone has the plaintext to the Concryption patent (5479512), I would like to read it. -Peter

1 0

Who would sign Lucky Green's key?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

The latest discussion about key signing parties and related questions asked in private email got me thinking about signing keys for nyms. What would one have to know to sign a key for a nym? Would you sign my key? Why? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

San Diego Cpunks Physical Meeting
by Chris Claborne 17 Dec '03

17 Dec '03

San Diego Area CPUNKS symposium .... will be in conjunction with USENIX "birds of feather" session titled "Remailers & Cypherpunk". Where: San Diego Mariott Hotel and Marina, 333 West Harbor Drive. Date : 1/25/96 Time : 6:30 - 8:30 SORRY for the late notice. I spaced the announcement. Hope you can join us. Thursday, January 25, 1996 Invitation to all Cypherpunks to join the San Diego crowd at this special session lead by our very own Lance Cottrell. Get the latest update of Lance Cottrell's anonymous e-mail server, "mixmaster", exchange keys, and discuss other topical subjects. If you are in to what's happening on the list, encryption, privacy, this is the place to be. The group may retire somewhere else after 8:30 to continue with other CP related issues, so join us. Don't forget to bring your public key fingerprint and two forms of identification. If you can figure out how to get it on the back of a business card, that would be cool. Drop me a note if you plan to attend. See you there! 2 -- C -- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Underground Radio
by John Young 17 Dec '03

17 Dec '03

For hams and other techno-libertines, The NY Times reports today on underground radio stations and bucking the FCC and global techno-tyrant-winner-takes-alls. http://www.nytimes.com/96/01/24/early/underground-radio.html

1 0

Guess what I found...
by Ian Goldberg 17 Dec '03

17 Dec '03

Guess what I found in my mailbox this morning: A cheque (that's check for those Americans out there) for $500 from Netscape Comm. Corp. It seems they decided to split a "Bugs Bounty" prize between Dave and me retroactively for the PRNG thing. :-) - Ian "This may turn out to be a good day..."

1 0

Rutgers symposium on Copyright and NII 14-15 Feb 96
by Steven C. Perkins 17 Dec '03

17 Dec '03

Please forward as appropriate. Conference Program will be at "http://www.rutgers.edu/RUSLN/copyconf.html" this weekend. Roundtable Conference: Copyright Issues and the National Information Infrastructure Rutgers School of Law - Newark February 14-15, 1996 Rutgers School of Law - Newark is hosting an important conference dealing with major issues presented by the White Paper and electronic distribution of information products. Three roundtable sessions will engage 40-50 leading scholars, lawyers, corporate counsel, and government officials in a day-long discussion and debate of critical law and policy issues. The scheduling of this conference anticipates further policy debates and congressional hearings on pending proposals. It will join leading actors in an in-depth exploration of core issues through an exchange that identifies and addresses a diversity of interests and searches for greater mutual understanding and expansion of areas of agreement. Registration fee: $125 Registration deadline: February 10, 1996 (Walk-in registration permitted beginning at 8:30 AM.) Rutgers School of Law - Newark 15 Washington Street Newark, NJ 07102-3192 Attn: Assistant Dean Margaret C. Bridge For further information, call Assistant Dean Margaret C. Bridge at (201) 648-5094, or send email to Professor David A. Rice at drice(a)world.std.com. ------------------------------------------------------------- **********||||||||||\\\\\\\\\\*//////////||||||||||********** Steven C. Perkins sperkins(a)andromeda.rutgers.edu User Services Coordinator Ackerson Law Library http://www.rutgers.edu/lawschool.html Rutgers, The State University of New Jersey, School of Law at Newark http://www.rutgers.edu/RUSLN/rulnindx.html VOX: 201-648-5965 FAX: 201-648-1356 |||||||||||||||\\\\\\\\\\\\\||*||///////////////|||||||||||||||

1 0

German home banking (fromn RISKS)
by stevenw＠best.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- Date: Tue, 23 Jan 1996 17:32:56 +0100 From: Klaus Brunnstein <brunnstein(a)rz.informatik.uni-hamburg.d400.de> Subject: Homebanking NonSecurity demo A German private TV channel (SAT 1) displayed, Monday Jan.22 night (10 pm), a demonstration of how easily homebanking may be attacked in Germany. In this demo, a person used T-Online (a navigation tool similar to CompuServe) to send his ID, PIN, the amount to be transferred (500 DM) and the account to which to transfer, plus a transaction number (TAN) via telephone line. All these data were intercepted on a portable connected to the user's phone line in the basement of the building (indeed, most telephone boxes are rarely locked). Actions of the customer and the "hacker" were shown in parallel, so one could see all data (including PIN which was not displayed on the Customers' screen) on the hackers' display. Before the customer could start the booking process on the bank computer by sending the requestor, the hacker interrupted the telephone connection. As he now possessed all relevant "secret" information of the user, he now started an order to transmit 5,000 DM from his victim's account to another one, successfully (as the customers' vouchers proved. After the demo (about 10 minutes), a short interview (with the author of this report) discussed evident risks; it was made clear that software solutions are available since some time, to replace the old PIN/TAN structure with digital signatures and to encrypt sensitive data using asymmetric encryption. Risks? Presently, there are several risks in telephone-based homebanking. First, ALL sensitive information is transmitted in cleartext. Secondly, interception of line-based communications of German Telekom is easily possible at several sites, from the basement of a customers' house where lines from different customers are collected in a unit, to units collecting lines from several blocks, streets etc. Thirdly, in contracts between banks and customers, the latter will often have difficulties to prove that an order carrying their personal ID, TAN etc was NOT issued from them, esp. when there is evidence that the order came from the customers' telephone line (though not from his telephone :-). Customer protection (both technically and legally) therefore requires immediate action, as Chaos Computer Club commented in press. Interestingly, German banks offer enterprises a secure solution based on RSA-licensed encryption software. So far, this is NOT offered to private customers as it canNOT interoperate with T-Online. Financial institutions are discussing presently a solution (either with a chipcard including sort of DES or a solution using an RSA-implementation with 784 bit key, which may be distributed via diskettes) but it is unclear when this solution will be available. As long as such solution is not available, "every day may become payment day even for the most lousy hackers" as one German newspaper (TAZ) wrote. Klaus Brunnstein (Jan.23,1996) ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

4 3

Re: Hack Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:47 1/24/96 +0100, Christian Wettergren wrote: >(In my darker moments, I feel that the whole field of computer security >is in a major crisis. Ever heard of the Emperor's New Clothes? ;-)) We reduce the problem of an infected Java Interpreter to the previously unsolved problem of virus protection in general. I think it is possible to build highly virus resistant systems, but the cost in user retraining will be huge. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0