December 2003 - cypherpunks-legacy

CERT Advisory CA-96.13 - Alien/OS Vulnerability
by stevenw＠best.com 17 Dec '03

17 Dec '03

Subject: CERT Advisory CA-96.13 - Alien/OS Vulnerability From: CERT Bulletin <cert-advisory(a)cert.org> Newsgroups: comp.security.announce, rec.humor ============================================================================= CERT(sm) Advisory CA-96.13 July 4, 1996 Topic: ID4 virus, Alien/OS Vulnerability - ----------------------------------------------------------------------------- The CERT Coordination Center has received reports of weaknesses in Alien/OS that can allow species with primitive information sciences technology to initiate denial-of-service attacks against MotherShip(tm) hosts. One report of exploitation of this bug has been received. When attempting takeover of planets inhabited by such races, a trojan horse attack is possible that permits local access to the MotherShip host, enabling the implantation of executable code with full root access to mission-critical security features of the operating system. The vulnerability exists in versions of EvilAliens' Alien/OS 34762.12.1 or later, and all versions of Microsoft's Windows/95. CERT advises against initiating further planet takeover actions until patches are available from these vendors. If planet takeover is absolutely necessary, CERT advises that affected sites apply the workarounds as specified below. As we receive additional information relating to this advisory, we will place it in ftp://info.cert.org/pub/cert_advisories/CA-96.13.README We encourage you to check our README files regularly for updates on advisories that relate to your site. - ----------------------------------------------------------------------------- I. Description Alien/OS contains a security vulnerability, which strangely enough can be exploited by a primitive race running Windows/95. Although Alien/OS has been extensively field tested over millions of years by EvilAliens, Inc., the bug was only recently discovered during a routine invasion of a backwater planet. EvilAliens notes that the operating system had never before been tested against a race with "such a kick-ass president." The vulnerability allows the insertion of executable code with root access to key security features of the operating system. In particular, such code can disable the NiftyGreenShield (tm) subsystem, allowing child processes to be terminated by unauthorized users. Additionally, Alien/OS networking protocols can provide a low-bandwidth covert timing channel to a determined attacker. II. Impact Non-privileged primitive users can cause the total destruction of your entire invasion fleet and gain unauthorized access to files. III. Solution EvilAliens has supplied a workaround and a patch, as follows: A. Workaround To prevent unauthorized insertion of executables, install a firewall to selectively vaporize incoming packets that do not contain valid aliens. Also, disable the "Java" option in Netscape. To eliminate the covert timing channel, remove untrusted hosts from routing tables. As tempting as it is, do not use target species' own satellites against them. B. Patch As root, install the "evil" package from the distribution tape. (Optionally) save a copy of the existing /usr/bin/sendmail and modify its permission to prevent misuse. - --------------------------------------------------------------------------- The CERT Coordination Center thanks Jeff Goldblum and Fjkxdtssss for providing information for this advisory. - --------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information. Location of CERT PGP key ftp://info.cert.org/pub/CERT_PGP.key CERT Contact Information - ------------------------ Email cert(a)cert.org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST (GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA CERT publications, information about FIRST representatives, and other security-related information are available for anonymous FTP from http://www.cert.org/ ftp://info.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for CERT advisories and bulletins, send your email address to cert-advisory-request(a)cert.org Copyright 1996 Carnegie Mellon University This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included. CERT is a service mark of Carnegie Mellon University. -- Moderators accept or reject articles based solely on the criteria posted in the Frequently Asked Questions. Article content is the responsibility of the submittor. Submit articles to ahbou-sub(a)acpub.duke.edu. To write to the moderators, send mail to ahbou-mod(a)acpub.duke.edu. ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Rick Smith 17 Dec '03

17 Dec '03

Tim writes more about Ritalin: >From what I've read--and I'm no expert, having long had essentially the >_opposite_ of "attention deficit disorder," assuming it really even >exists!--most children getting Ritalin are just being sedated. Behavior >control in its purest form. While the kids stop their wandering attention >and constant physical motions, it's because they're in a mental fog, just >one step away from drooling. (The 8-year-old friend of my friend's son is >so zoned out he can't play video games well at all...until the drugs wear >off.) That's very interesting, especially the part about video games. It sounds like overdosing to me. My wife says that a Ritalin overdose can also affect your heart rate and ability to sleep. Regarding video games, we went through some elaborate assessment process before Alex ended up on Ritalin. The school people did an assessment declaring he wasn't "learning disabled" but may have ADHD. Then he saw a behavioral psychologist for a few hours of observation, yielding the diagnosis. Lastly a different psychologist measured his behavior using some computer based game/test. The actual dosage was calibrated according to his effectiveness on the game/test, which involved memory, coordination, and ability to concentrate on something fundamentally boring. The test was performed 3 times to compare his performance before and after dosage. The point of all this is that there are other ways of using Ritalin. I don't think I'd tolerate its use on Alex if I didn't trust my wife. She has a much better background in such things than I, as well as a family doctor's experience with seeing the results of drug abuse. >>BarelyObCrypto: ADD is more about lack of attention *control* than lack of >>attention itself. Hyperfocus is also a trait of ADHD, and computers tend to >>cause hyperfocus for a lot of ADDers. >BTW, I saw a comment that Bill Gates is almost certainly an ADD person...or >maybe the comment was that he is borderline autistic? This matches my own experiences with ADHD. That's the thing about the raw phenomenon and its overall lifestyle effect: you either find your niche and do OK, or you get sidelined. Rick.

3 4

Put Uncle Sam in your Calling Circle
by Ray Arachelian 17 Dec '03

17 Dec '03

Hey guys, I just got a really cool poster from RSA. It's a big circle split off into several sections showing people talking to each other, the upper right hand corner shows two NSA dweebs looking like Bevis & Butthead in suits, one smoking, the other seated infront of an old 60's reel to reel audio tape recorder, a sign on the wall behind them says "Key Escrow" There are several logos for various government agencies including our friends at No Such Agency and the FBI, a small quote next to the Copyright (C) RSA notice says "One of a series of public relations posters that never made it out of Fort Mede." Very very funny! Many many thanks to the cool person(s) at RSA who sent it my way. ========================================================================== + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= <--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== + v + | Janet Reno & GAK|AK| do you not understand? |======= ===================http://www.dorsai.org/~sunder/========================= Key Escrow Laws are the mating calls of those who'd abuse your privacy!

2 1

Re: [RANT] Giving Mind Control Drugs to Children
by Rick Smith 17 Dec '03

17 Dec '03

erehwon(a)c2.org (William Knowles) writes: >Ritalin has been a godsend, I am able to dialin when I have to. >Ritalin is not the only drug for treating ADD, Prozac works for >some. I use coffee, or else I just managed to grow out of the worst effects. In any case, I drink more coffee than just about anyone I know, and it doesn't "wire" me at all. Rick.

1 0

Re: stupid national security excuse again ...
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:10 AM 7/9/96 -0700, Ernest Hua wrote: >Ok. Not that I really care, at this point, who really killed Kennedy >or whether there was this or that conspiracy, but I am really sick of >this bull shit "national security" excuse. > >What kind of "national security" excuse could there be for the CIA to >say whether they confirm or deny the employment of some guy (whom they >could easily discredit by saying that they have nothing to do with >him)? It has always seemed to me that when they say "National Security" what they mean is "Job Security". Usually this involves some sort of behaviour that the government (or in-duh-viduals in it) do not want revealed, lest the scandal might drive them from their job or get them demoted. (Or their boss might demand "a peice of the action".) Sometimes it is just a relex action to a request for information. I remember such excuses being given during the Iran Contra hearings. They kept refering to "Country 1" and "Country 2", while the Pacifica commentator was in the background telling you what each country was and who most of the "unnamed players" were. The information was not unknown. It had been reported in the foriegn press already. It was known to other governments. The only people it was being kept from was the American people. Makes you wonder just who they are trying to remain secure from... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Active Attacks on DC-nets
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

I haven't read the paper on active attacks yet, but here is an easy example that I thought of, that others might find illuminating: When there is a round with no messages the server sends garbage to all but one of the participants so they think collisions occured. The other participant is sent zero so that he or she thinks the channel is open. The participants who think colllisions occured are then likely to back off for a number of rounds, so that if a message is sent it is most likely from the participant who wasn't lied to. What do people think of the idea of clients signing all input to the dcnet and the server signing all output and keeping logs so that it could be verified afterward (after the damage was done! :) ) whether or not everything was carried out properly or not. With Schnorr signatures and precomputation the clients could still be reasonably quick. The server will have to do alot of work, but the signature verifications could be done in parallel on a multiprocessor computer. Verification of the proceedings would also be long, but it could be done off-line. -- Leonard Janke (pgp key id 0xF4118611)

1 0

Re: Put Uncle Sam in your Calling Circle
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:15 AM 7/9/96 -0400, you wrote: >Hey guys, > >I just got a really cool poster from RSA. It's a big circle split off >into several sections showing people talking to each other, the upper >right hand corner shows two NSA dweebs looking like Bevis & Butthead in >suits, one smoking, the other seated infront of an old 60's reel to reel >audio tape recorder, a sign on the wall behind them says "Key Escrow" > >There are several logos for various government agencies including our >friends at No Such Agency and the FBI, a small quote next to the >Copyright (C) RSA notice says "One of a series of public relations >posters that never made it out of Fort Mede." Very very funny! > >Many many thanks to the cool person(s) at RSA who sent it my way. You got one too... I recieved one in the mail with no return address. There is another poster in that series which says "A good marketing organization listens to its customers... WE HEAR YOU!". The woman is being tapped by the same two government agents. The posters are done by Tom Tommorow, who also does a cartoon called "This Modern World" which appears far too infrequently in a number of papers and _Processed World_. Incredible political cynicysm... Thanks again to RSA for a couple of cool posters! --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Re: [RANT] Giving Mind Control Drugs to Children
by Perry E. Metzger 17 Dec '03

17 Dec '03

blanc writes: > > I suppose you don't understand what it might be like for someone to be > > unable to do their work no matter how heavy the threat against them if > > they don't, and no matter how easy it is. There are people out there > > who can't get themselves to pay a phone bill or throw out the > > newspapers for months on end -- they just can't get themselves to > > dance around into the task no matter how hard they try, no matter how > > great the threat (job loss, etc) to them is. [...] > There are times when people have been totally unmotivated to take care > of themselves or the mundane matters in life because they were not > involved in the pursuits which were of true value to them, and life > "lost its meaning". Blanc, you really aren't listening. There are people out there who are desperately unhappy. They can't concentrate at all. They love what they do for a living, if only they could actually manage to do it four days out of five. They are not in the least scared of cleaning their homes, except for the fact that they are frightened of the fact that they can't manage to do it no matter what they try. They'd like to pay the light bill -- really -- but every time they start they get distracted, or they get distracted before they start. Sometimes they get bursts of hyperconcentration and they can work for two days straight on some project, and they end it and realize that the phone's been cut off because they completely spaced dealing with it or anything else. Sometimes they feel very pissed off because people tell them to just "apply themselves" more or "manage their time" better or "get a more motivating job". Such people aren't upset that life has lost its meaning. They are often perfectly intelligent, capable of being happy in their pursuits, and not bad individuals. They suffer, however, from an inability to keep from twitching. They ritualistically play with common objects -- rubber bands, paperclips, etc, folding and unfolding them, winding and unwinding them, etc. You can spot them -- they're the people who even as adults can be placed in a nearly empty room and will find a small object to play with. Their workspaces are littered with small fidget toys they have purloined or created. These people aren't unhappy with their jobs except for the fact that they wish they could get their work done, they sit in front of their work for hours on end, and can't get anywhere. They don't need new pursuits. Even with newere and "better" jobs, most people on earth have to occassionally maintain their attention long enough to pay their landlord or what have you. > Putting one's priorities into perspective can do a lot towards feeling > motivated to attend to life's minor contingencies, while elevating the > lesser items to the top of the hierarchy can totally dissipitate one's > energies and interest. Look, quit trying to tell people who have ADD that they are in the wrong jobs, that they are unmotivated, that they are "lazy", or whatever. Calling them "nuts" is actually far better. It at least acknowledges that there is something wrong that isn't readily fixed by the nostrums of people who have no idea whatsoever what they are going through. Perhaps, of course, we can just get all the suicidal people on earth to quit wanting to kill themselves by intoning to them "don't be sad" over and over again. I doubt it, though. > Maybe Ritalin could make them forgot their true interest which was lying > dormant, pushed away by who-knows-what kind of arguments against it, and > help them to start paying attention again to those mundane, irrelevant > aspects of existence. Or maybe, when they take it, the noise in their heads stops, the world focuses and clears up, and suddenly it doesn't seem like its so hard to finish that two paragraph status summary after all. Maybe they take it and suddenly they can function long enough to finish their resume and get another job. Maybe you should quit telling other people how to get through life when you haven't lived inside their heads. > You're right, Perry, that no one should be making that decision for > others. I do think, though, that achieving self-command by a conscious > knowledge of what is right for one's nature is actually the most > beneficial (and less controversial). Its always better to not need to use chemicals to help yourself out. However, we acknowledge in our society that when someone has an infected leg we decide that they aren't being "bad" by taking drugs to stop the infection. Perry

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:39 AM 7/9/96 -0500, Rick Smith wrote: >erehwon(a)c2.org (William Knowles) writes: > >>Ritalin has been a godsend, I am able to dialin when I have to. >>Ritalin is not the only drug for treating ADD, Prozac works for >>some. Prozac works on a different set of brain chemestry. (Prozac messes with the seretonin level of the brain and how it is reabsorbed.) There is a whole series of chemicals similar to Prozac that are prescribed. It takes a bit to determine just which one is best for the person involved. (I have far too many friends on variations of those drugs.) The reactions when they come off them is quite "interesting". Prozac is not a stimulant however. (Not in the usual concept of a stimulant.) >I use coffee, or else I just managed to grow out of the worst effects. >In any case, I drink more coffee than just about anyone I know, and it >doesn't "wire" me at all. "It is by caffiene alone I set my mind in motion. It is by the beans of Java that the thoughts acquire speed, the hands acquire shakes, the shakes become a warning. It is by caffiene alone I set my mind in motion." You can build a resistance to caffiene. (As well as one hell of an addiction.) So far I am up to a gram a day of the stuff. Mix that with the Seldane-Ds I take every morning (for hay fever) and you get more than a small amount of stimulants. (I have found that the Seldane-Ds have a positive psychoactive effect as well. They seem to allow me to focus better. Probibly because I am not sneezing.) The long term effects of any stimulant is problbiy not very good. What needs to be looked at is what the long term benifits and risks are, for the individual, not just for the society. What these sorts of chemicals do to small children 10-30 years down the road is pretty unknown at this point. (If any of the things i have seen so far are any indication, they are not good.) But then, I suspect the government of drugging our kids with school lunches laced with lead paint, not with mind control drugs. (Lead paint is cheaper.) ]:> Alan Olsen Minister of Forced Caffinization - DNRC --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Word lists for passphrases
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 07:20 PM 7/8/96 -0400, you wrote: :Human stupidity is never a surprise. : :Perry Perry is a significant factor I include when I decide every day whether or not to check my cypherpunk's mail. I'm glad I did today. What a hoot! Alec

2 1