December 2003 - cypherpunks-legacy

Re: Tales from the UK: Basel Part IV
by Peter Trei 17 Dec '03

17 Dec '03

> Received: from toad.com [140.174.2.1] by alcor.process.com > with SMTP-OpenVMS via TCP/IP; Tue, 25 Jun 1996 11:11 -0400 > Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id HAA10621 for cypherpunks-outgoing; Tue, 25 Jun 1996 07:04:53 -0700 (PDT) > Received: from mailhost.IntNet.net (mercury.IntNet.net [198.252.32.180]) by toad.com (8.7.5/8.7.3) with SMTP id HAA10616 for <cypherpunks(a)toad.com>; Tue, 25 Jun 1996 07:04:46 -0700 (PDT) > From: winn(a)Infowar.Com > Received: from 198.252.40.157 by mailhost.IntNet.net (SMI-8.6/SMI-SVR4) > id KAA24757; Tue, 25 Jun 1996 10:06:02 -0400 > Date: Tue, 25 Jun 1996 10:06:02 -0400 > Message-Id: <199606251406.KAA24757(a)mailhost.IntNet.net> > MIME-Version: 1.0 > Content-Type: text/plain > Content-Transfer-Encoding: 7bit > Subject: Tales from the UK: Basel Part IV > To: Nmunro(a)access.digex.net > X-Mailer: SPRY Mail Version: 04.00.06.17 > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > June, 1996: Basel, Switzerland > More on the London Attacks: Part IV winn writes: [...] > The perpetrator(s) would first place a call to the upper management of the > intended victim announcing his/her intention. "We will take down your bank (or > financial organization) unless you pay us a lot of money not to." > > The intended victims each sluffed off the threats. Shortly thereafter (within a > day or two) their financial systems would seemingly collapse for no reason at > the prescribed time and as promised by the caller. Banking services and/or > trading would come to a halt, for about an hour or so, and then the affected > systems would come back on line. Backups were ineffective; typical disaster > recovery methods, I was told, just didn't work. [...] > I was told unequivocally that all of the four attacks used the same methodology: > malicious software was somehow injected into the systems but neither was either > forthcoming or knowledgeable about the specifics. They specifically denied that > HERF techniques were used. But many questions remained, and I was unsuccessful > at getting what I would call good answers to these and more queries: > > - Which systems were affected exactly? > - How were the backup/redundancies disconnected? > - Exactly what do you mean by remote control? > - Did you ever find the offending software? > - Was it an insider job? > - Was it pure hacking? > - Was is mission critical application software gone awry? > - And so on . . . . [...] > Winn Schwartau - Interpact, Inc. > Information Warfare and InfoSec > V: 813.393.6600 / F: 813.393.6361 > Winn(a)InfoWar.Com I used to work in a major money center bank (late, lamented Irving Trust). I find this account highly improbable, considering the precautions I've seen used in these situations. The only possibility seems to be an inside job, inserting a logic bomb into some crucial piece of software, and then setting it off either through an inside collaborator, or by sending an appropriate message through the system from outside: "if you see a transfer from acct 346769 to 56789 of $3,141,592.65, shut down for an hour". Inserting a bomb like this would have been extremely difficult, if not impossible, at IT. Code modifications were always checked by more than one programmer, and an extensive 'backout' mechanism existed which permitted us to go back to older versions of the software in a matter of minutes. Cracking the system from outside is also unlikely - the operational machines had no internet connection, dial in, or connection to our development or administrative lans, nor did they run any of the usual demons through which attacks are made. They were connected only to other parts of the operational system. Even the developers did not have direct access to them - putting on new software involved writing it to a removable HD which was then physically transfered to the operational systems. Only the operators were permitted to touch the consoles of the operational systems. Finally, we maintained a 'hot site' duplicating most of our capability, at a location about 100 miles away, in case of catastrophe. Switching to that would have taken a few hours, but was certainly doable. >Thereafter, a second call would be made to senior executives of the victim >firms, and the extortion demands for payment made again. In these cases, >electronic payments to Switzerland were made, and the monies were then >secreted from their temporary Swiss home within seconds - destined for >places unknown or unannounced. I also find the claim improbable - the Swiss authorities are quite cooperative when there is good reason to beleive a crime is being committed. If it's an inside job, then it's not much of a threat, since each financial institution would need to be penetrated separately. The only way in which this might NOT be an inside job would be if a logic bomb was inserted into some piece of commercial software used by all of the targets, such as a message database. If so, then there is no reason not to identify the package. Until names get named, I'm going to view this story with extreme skepticism. Finally, people may wish to look at the source of the posting. Mr Schwartau is a consultant who makes his living by advising institutions on how to protect themselves against attacks of the type claimed in this story. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Re: AT&T bans anonymous messages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:46 AM 6/25/96 -0700, Rich Graves wrote: >On Mon, 24 Jun 1996, WorldNet User wrote: >> (ii) Members may not post or transmit any message >> which is libelous, defamatory or which discloses >> private or personal matters concerning any person. >> Members may not post or transmit any message, >> data, image or program which is indecent, obscene >> or pornographic. >> >> http://www.worldnet.att.net/care/terms/#oppol > >"Discloses private or personal matters concerning any person"? I guess any >discussion of political figures is out. Hell! My email to my family is also ruled out. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

crypto '96 roommate
by Chris Hall 17 Dec '03

17 Dec '03

Hello, I plan to attend this years crypto '96, but I don't have a roommate for the dorms. It is much cheaper if you have a roommate so I was wondering if anyone needed a roommate who was going? Please respond to me directly as I don't subscribe to cypherpunks and I don't see any point in cluttering the list with this thread. BTW, the deadline for normal registration is July 12 and it would be nice to register asap. Thanks, Chris Hall

1 0

Re: domain name zapping threat by Internic
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:05 PM 6/24/96 -0700, Vlad wrote: >surprising not to see any discussion on this here.. It's not particularly relevant (:-), but SAIC's position has been discussed here.... >this is a very intersting development. all kinds of news reports >are talking about the internic zapping 25,000 DNS addresses. >I wonder how this will turn out. >I saw in an article a claim, I think, that the internic now charges >$100 "rent" per year for a domain. this is really amazing to me, >because this has totally changed from a one-time only fee, if correct. >is that correct? It's not correct. They charge $50/year (the $100 setup fee for new domain names gets you the first two years.) This gets you the use of the name plus support from the root-level domain name servers; it's how they're trying to fund the NIC instead of getting tax subsidies. Before the rent policy started, domain names weren't charged for (there's no such thing as a free name server...) They did a 90-day grandfathering, but now they're trying to de-grandfather the older names, and you can tell when you've got to pay from whois. The legal issues are really unclear, especially since they don't run all the US-based root name servers, but they'll probably get away with it. It seems appropriate that organizations calling themselves COMmercial should pay money for the privilege :-) They also control the .org and .net hierarchies. If you don't like it, you can always get a statist address in the .us domain or some other .xx government domain, or find someone who's got a second-level domain that will register you (e.g. someone may decide to rent out space in .a.com ... .z.com cheaper than NSI, or .hardware.com, .software.com, .services.com....) The NSF is still subsidizing .edu and .gov, and .mil runs its own nameservers. NSI's contract runs til 1998, which is about enough time to evaluate alternatives. .in-addr.arpa is also still "free". >I wonder if people are going to try to find a way to "route around" >this action by the internic... There are very interesting discussions of the issues in RFC1591 and RFC1480. You _could_ hang off odd places in the .US domain, like calling yourself a technical school, distributed nationwide institute, or a generic .GEN.st.US which is used for things like domain name parks or statewide garden clubs. But use of top-level domain names and creation of new ones isn't precluded; it might be interesting if someone wanted to form a .ALT domain with some automated first-come-first-served registration. Or you _could_ just live in .in-addr.arpa space if you wanted.... About N years ago, Peter Honeyman started the .fun domain; don't know if he's still got a nameserver supporting it. >one wonders if this is just the first in a series of actions by the >new spook owners. (SAIC) essentially, >if someone wanted to implement a tax or a way to control the internet, >the NIC would be an excellent place to start. They may have contracts with spooky people, but it doesn't really give them a lot of control, especially since you can always get yourself a domain name from some friendly country like Anguilla or Lichtenstein (a high-tech equivalent of fancy postage stamps? :-) It's more interesting to speculate on what they can do with .in-addr.arpa. However, because the DNS root-level servers only hand out addresses, rather than carrying your mail, it doesn't provide much opportunity for wiretaps or other Un-American Activity. They could do a bit of traffic analysis (seeing which IP addresses request info for which domain names), but it's really sparse traffic information - they're mainly getting requests that have filtered through other nameservers (especially if you point your systems at some caching nameserver like netcom's or aol's which tells them that one of 5 million users wanted to know the address for .suspicious.com), and caching nameservers mean that multiple requests for the same information generally won't hit the root servers. The take is further reduced if suspicious machines are third-level addresses under either privacy-protecting second-levels (suspicious.alias.net) or large ones (suspicious.big-isp.net) which will get the queries instead of the root servers. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

3 2

Re: AT&T bans anonymous messages
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:48 AM 6/25/96 -0700, Timothy C. May wrote: >I suspect other major ISPs will adopt similar language, absent a vocal >lobbying group for anonymous messaging capabilities. So all you have to do is copy the whole statement, delete the offending passages, and mail it to your ISP as a counter offer to their proposed contract. You can explicitly disclaim the language you don't like. This sets up a long and interesting negotiation process during which you can try to get them to define what they mean by the terms. Since they haven't defined any of this stuff (indecency?) it's all kind of meaningless. Businesses usually won't cut you off over a mere refusal on your part to accept a contract. They wait for an overt act. Might even work in the case of someone like me who pays AT&T $2K/month or more. Then you can get a real ISP. I have found that if you are well-behaved in a social sense, you can get away with all sorts of controversial stuff. I kept firearms in my college dorm just because I argued my RA into ignoring same (he had bows and hunting arrows). He knew I wasn't a psycho. I expect that AT&T will ignore what you do unless it kicks back to them so use them for net access but don't use them for mail. Run your own mail server or keep a shell account somewhere else. DCF

2 1

[Announce] New version of Systemics crypto library for Perl
by Gary Howland 17 Dec '03

17 Dec '03

The Systemics Cryptix crypto library for Perl is now available for download at http://www.systemics.com/software/ Apart from much tidying up, there have been several signigicant additions to the library, include a Blowfish implementation, RSA encryption (including key generation routines), CFB and CBC block cipher mode modules, and a cryptographically secure random stream generator. This library is not currently on CPAN, since several modules are not in a suitable state for CPAN distribution. However, if anyone can rectify this, then we are happy to place them on CPAN. Enjoy! P.S. - PGP library on it's way soon (hopefully this weekend!) CRYPTIX LIBRARY FOR PERL (V1.1) _________________________________________________________________ Description This library contains a suite of cryptographic and mathematical modules for Perl. Many of the more CPU intensive algorithms have been implemented in C as Perl extensions. Features Perl extensions All of the following have been implemented as Perl extensions in C: * Crypt::Blowfish module (Blowfish implementation by A.M. Kuchling). * Crypt::DES module (DES implementation by Eric Young). * Crypt::IDEA module. * Crypt::MD5 module (based on an implementation by Neil Winton and Data Security, Inc.) * Crypt::SHA module (based on an implementation by Uwe Hollerbach and based on code from NIST and Peter C. Gutmann) * Math::BigInteger module (based on code from Eric Young). This module implements arbitrary length integers and some associated mathematical functions. * Math::PRSG - Pseudo random sequence generator This module implements a 160 bit LFSR for use in generating pseudo random sequences. * Math::TrulyRandom module, based on code from Don Mitchell and Matt Blaze (AT&T). This module generates "truly random" numbers, based on interrupt timing discrepancies. Perl modules All of the following have been implemented in Perl: * Crypt::CBC module This module implements CBC block cipher mode. * Crypt::CFB module This module implements CFB block cipher mode. * Crypt::CSRandomStream module This module implements a cryptographically secure random stream. It implements the Stream::DataInput interface. * Crypt::DES3EDE module This module implements triple DES (EDE mode). * Crypt::HashMD5 This module implements an MD5 hash, which derives from Crypt::MessageDigest. * Crypt::HashSHA This module implements an SHA hash, which derives from Crypt::MessageDigest. * Crypt::MessageDigest This module implements the Crypt::MessageDigest base class. * Crypt::RSAKey This module implements the RSA key base class. * Crypt::RSAKeyGen This module is used for the generation of RSA key pairs. * Crypt::RSAPublicKey This module implements an RSA public key, which derives from Crypt::RSAKey. * Crypt::RSASecretKeyPair This module implements an RSA public/secret key pair, which derives from Crypt::RSAKey. * Math::MPI module This module implements the reading and writing of Philip Zimmermans MPI format large integers. * Math::PseudoRandomStream module This module implements a pseudo random data stream. It implements the Stream::DataInput interface. * Math::Random module This module contains a collection of various random number routines. * Math::TestPrime module This module is used to test the primality of an instance of Math::BigInteger. * Stream::DataEncoding * Stream::DataInput * Stream::DataOutput * Stream::FileInput * Stream::FileOutput * Stream::Streamable * Stream::StringInput * Stream::StringOutput Copyright This library includes (or is derived from) software developed by (and owned by) the following: * Peter C. Gutmann * Uwe Hollerbach &ltuh(a)alumni.caltech.edu> * A.M. Kuchling * Don Mitchell and Matt Blaze (AT&T) * NIST * RSA Data Security, Inc. * Neil Winton &ltN.Winton(a)axion.bt.co.uk> * Eric Young &lteay(a)mincom.oz.au> Other parts of the library are covered by the following licence: Copyright (c) 1995, 1996 Systemics Ltd (http://www.systemics.com/) All rights reserved. This library and applications are FREE FOR COMMERCIAL AND NON-COMMERCIAL USE as long as the following conditions are adhered to. Copyright remains with Systemics Ltd, and as such any Copyright notices in the code are not to be removed. If this code is used in a product, Systemics should be given attribution as the author of the parts used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. All advertising materials mentioning features or use of this software must display the following acknowledgement: This product includes software developed by Systemics Ltd (http://www.systemics.com/) THIS SOFTWARE IS PROVIDED BY SYSTEMICS LTD ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The licence and distribution terms for any publically available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution licence [including the GNU Public Licence.] _________________________________________________________________

1 0

Re: Appology
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Jun 25, 1996 21:14:56, 'chris.liljenstolpe(a)SSDS.com (Christopher Liljenstolpe)' wrote: >... the meaning of r and R have been reversed Way it is, Chris, The motherfucking Best and Brightest did that to us all time in Nam, granting us a few days to stumble around fuck-you-GIs-it-ain't-our-war Aussieland, with a few stolen hours layover, hungover puking up poison, in Thailand, then back to eating their Ivy League shit sandwiches. There it is, live with it -- or frag their pasty asses back to the stoned age.

1 0

Re: Zimmermann's Senate testimony
by jim bell 17 Dec '03

17 Dec '03

At 09:39 AM 6/25/96 -0700, Philip Zimmermann wrote: >Testimony of Philip R. Zimmermann to >the Subcommittee on Science, Technology, and Space >of the US Senate Committee on Commerce, Science, and >Transportation 26 June 1996 >The government has a track record that does not inspire confidence >that they will never abuse our civil liberties. The FBI's >COINTELPRO program targeted groups that opposed government >policies. They spied on the anti-war movement and the civil >rights movement. They wiretapped Martin Luther King's phone. >Nixon had his enemies list. And then there was the Watergate >mess. The War on Drugs has given America the world's largest per- >capita incarceration rate in the world, a distinction formerly >held by South Africa, before we surpassed them during the eighties >even when apartheid was in full swing. Recently, we've seen the >images and sounds of the Rodney King beatings, Detective Mark >Fuhrman's tapes boasting of police abuses, and the disturbing >events of the Ruby Ridge case. And now Congress and the Clinton >administration seem intent on passing laws curtailing our civil >liberties on the Internet. At no time in the past century has >public distrust of the government been so broadly distributed >across the political spectrum, as it is today. > >The Clinton Administration seems to be attempting to deploy and >entrench a communications infrastructure that would deny the >citizenry the ability to protect its privacy. This is unsettling >because in a democracy, it is possible for bad people to >occasionally get elected-- sometimes very bad people. Normally, a >well-functioning democracy has ways to remove these people from >power. But the wrong technology infrastructure could allow such a >future government to watch every move anyone makes to oppose it. >It could very well be the last government we ever elect. Yes, the situation is bad, very bad. And yes, I agree that a political system has to have ways to remove bad people. The odd thing is, some of the people who say that are the same ones who get squeamish when a solution is suggested. <sigh> Jim Bell jimbell(a)pacifier.com

1 0

Re: AT&T bans anonymous messages
by jim bell 17 Dec '03

17 Dec '03

At 11:46 AM 6/25/96 -0700, Rich Graves wrote: >On Mon, 24 Jun 1996, WorldNet User wrote: > >> AT&T WorldNet service has banned the sending of anonymous email or >> posting anonymously. >> >> >From the "AT&T WorldNet Service Operating Policies": >> >> (i) Members may not post or transmit any message >> anonymously or under a false name. Members may >> not permit any other person (other than an agent >> acting on Member's behalf and subject to Member's >> supervision) to access the Service Member's >> account for any purpose. > >I don't have a problem with this, actually, and a brief visit to >news.admin.net-abuse.misc would show why. AT&T is selling you access under a >given username. If you send a message traceable to AT&T, they are held >accountable. Why should this be true? I can still walk to a pay telephone, put in a quarter, dial a random number and talk to somebody anonymously. The various Baby Bell companies aren't "held accountable" if it's an obscene phone call. I think that any attempt to hold the Internet to standards higher than existing services is a mistake. >I think it's reasonable for them to demand that you make >messages traceable to yourself so that you are held accountable. Isn't the whole purpose of anonymity (remailers and such) in order to ensure that the messages AREN'T traceable?!? >If AT&T bans or monitors access to anonymous remailers, then that's a >different kettle of fish entirely, but they're not doing that. Yet. Jim Bell jimbell(a)pacifier.com

1 0

Re: AT&T bans anonymous messages
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

How on earth can a service try to stop anonymous dealings. Well.. i can see HOW... because they say their just going to do it. Now.. I know theres such things as the internet task force....etc... Isnt there any groups out there whose _SOLE_ purpose is trying to protect rights in the online community?

1 0