December 2003 - cypherpunks-legacy

CERT Advisory CA-96.13 - Alien/OS Vulnerability
by stevenw＠best.com 17 Dec '03

17 Dec '03

Subject: CERT Advisory CA-96.13 - Alien/OS Vulnerability From: CERT Bulletin <cert-advisory(a)cert.org> Newsgroups: comp.security.announce, rec.humor ============================================================================= CERT(sm) Advisory CA-96.13 July 4, 1996 Topic: ID4 virus, Alien/OS Vulnerability - ----------------------------------------------------------------------------- The CERT Coordination Center has received reports of weaknesses in Alien/OS that can allow species with primitive information sciences technology to initiate denial-of-service attacks against MotherShip(tm) hosts. One report of exploitation of this bug has been received. When attempting takeover of planets inhabited by such races, a trojan horse attack is possible that permits local access to the MotherShip host, enabling the implantation of executable code with full root access to mission-critical security features of the operating system. The vulnerability exists in versions of EvilAliens' Alien/OS 34762.12.1 or later, and all versions of Microsoft's Windows/95. CERT advises against initiating further planet takeover actions until patches are available from these vendors. If planet takeover is absolutely necessary, CERT advises that affected sites apply the workarounds as specified below. As we receive additional information relating to this advisory, we will place it in ftp://info.cert.org/pub/cert_advisories/CA-96.13.README We encourage you to check our README files regularly for updates on advisories that relate to your site. - ----------------------------------------------------------------------------- I. Description Alien/OS contains a security vulnerability, which strangely enough can be exploited by a primitive race running Windows/95. Although Alien/OS has been extensively field tested over millions of years by EvilAliens, Inc., the bug was only recently discovered during a routine invasion of a backwater planet. EvilAliens notes that the operating system had never before been tested against a race with "such a kick-ass president." The vulnerability allows the insertion of executable code with root access to key security features of the operating system. In particular, such code can disable the NiftyGreenShield (tm) subsystem, allowing child processes to be terminated by unauthorized users. Additionally, Alien/OS networking protocols can provide a low-bandwidth covert timing channel to a determined attacker. II. Impact Non-privileged primitive users can cause the total destruction of your entire invasion fleet and gain unauthorized access to files. III. Solution EvilAliens has supplied a workaround and a patch, as follows: A. Workaround To prevent unauthorized insertion of executables, install a firewall to selectively vaporize incoming packets that do not contain valid aliens. Also, disable the "Java" option in Netscape. To eliminate the covert timing channel, remove untrusted hosts from routing tables. As tempting as it is, do not use target species' own satellites against them. B. Patch As root, install the "evil" package from the distribution tape. (Optionally) save a copy of the existing /usr/bin/sendmail and modify its permission to prevent misuse. - --------------------------------------------------------------------------- The CERT Coordination Center thanks Jeff Goldblum and Fjkxdtssss for providing information for this advisory. - --------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information. Location of CERT PGP key ftp://info.cert.org/pub/CERT_PGP.key CERT Contact Information - ------------------------ Email cert(a)cert.org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST (GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA CERT publications, information about FIRST representatives, and other security-related information are available for anonymous FTP from http://www.cert.org/ ftp://info.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for CERT advisories and bulletins, send your email address to cert-advisory-request(a)cert.org Copyright 1996 Carnegie Mellon University This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included. CERT is a service mark of Carnegie Mellon University. -- Moderators accept or reject articles based solely on the criteria posted in the Frequently Asked Questions. Article content is the responsibility of the submittor. Submit articles to ahbou-sub(a)acpub.duke.edu. To write to the moderators, send mail to ahbou-mod(a)acpub.duke.edu. ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Rick Smith 17 Dec '03

17 Dec '03

erehwon(a)c2.org (William Knowles) writes: >Ritalin has been a godsend, I am able to dialin when I have to. >Ritalin is not the only drug for treating ADD, Prozac works for >some. I use coffee, or else I just managed to grow out of the worst effects. In any case, I drink more coffee than just about anyone I know, and it doesn't "wire" me at all. Rick.

1 0

Re: stupid national security excuse again ...
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:10 AM 7/9/96 -0700, Ernest Hua wrote: >Ok. Not that I really care, at this point, who really killed Kennedy >or whether there was this or that conspiracy, but I am really sick of >this bull shit "national security" excuse. > >What kind of "national security" excuse could there be for the CIA to >say whether they confirm or deny the employment of some guy (whom they >could easily discredit by saying that they have nothing to do with >him)? It has always seemed to me that when they say "National Security" what they mean is "Job Security". Usually this involves some sort of behaviour that the government (or in-duh-viduals in it) do not want revealed, lest the scandal might drive them from their job or get them demoted. (Or their boss might demand "a peice of the action".) Sometimes it is just a relex action to a request for information. I remember such excuses being given during the Iran Contra hearings. They kept refering to "Country 1" and "Country 2", while the Pacifica commentator was in the background telling you what each country was and who most of the "unnamed players" were. The information was not unknown. It had been reported in the foriegn press already. It was known to other governments. The only people it was being kept from was the American people. Makes you wonder just who they are trying to remain secure from... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>One can only wonder how much more great some of the people on this list would >be today if they knew ADD back then. > That a fallacy. First, there's no way to know what they suffered if anything at all. Second, there's no way to know what would have happened. Third, there's what they themselves said. I know of many people who has your same signs. Hey you should see *my* office. And you should have seen it when I could devote myself to interesting things instead of XXXX(whateverI don't like) crap. Someone said about a kid not concentrating on grammar. Hell, I couldn't stand half of my professors in class, though I would perfectly listen to the same subject with other people. I don't know about you and don't pretend to tell you anything. But there are lots of cases in which the problem is *on the other side* (society, teachers, work, parents, priests, erroneous expectatives). I wonder how can we know from the external manifestations that those people were ADD and not just brilliant guys with dull teachers. As for those people you mentioned. Maybe if they had prozac they would have been perfect, quiet and compliant citizens, concentrated on what the power-that-be asked them to do. Think of Einstein happily working for Hitler, not worried about other themes (like ethical implications for instance). Thing is, it's very easy to keep everybody uniform. Easier than giving equal opportunities to less-good workers or allowing one to attempt many projects lest one succeeds and changes the stablishment! Let's make everyone into a uniform clone, and those who can't be made -say Down syndrome people- be exterminated. Let's enterprising people be forced into non-creative jobs, and if they don't like, be given drugs. Yeah! Let's monitor what everybody says, detect those guys who spend too much time at work reading cypherpunks or worrying about politics (which is not their job) and control them. Let's tap all their conversa- tions and force them to fit our idea of a uniform world of mediocre wits who just work perfectly in what we tell them and never question anything. I also wonder how those people you mentioned would have been allowed to do such great discoveries and destroy the grounds of their societies under the society we are heading to. "The World turning around the Sun? C'mon! Everybody knows it is flat and the Center of the Universe. That Galileo guy is obviously sick. Let's calm him down with some drugs so he can concentrate on Theology as it should well be"... Sorry, I think we need unfitted people, feeling unhappy about the society to make it evolve. jr

2 1

Active Attacks on DC-nets
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

I haven't read the paper on active attacks yet, but here is an easy example that I thought of, that others might find illuminating: When there is a round with no messages the server sends garbage to all but one of the participants so they think collisions occured. The other participant is sent zero so that he or she thinks the channel is open. The participants who think colllisions occured are then likely to back off for a number of rounds, so that if a message is sent it is most likely from the participant who wasn't lied to. What do people think of the idea of clients signing all input to the dcnet and the server signing all output and keeping logs so that it could be verified afterward (after the damage was done! :) ) whether or not everything was carried out properly or not. With Schnorr signatures and precomputation the clients could still be reasonably quick. The server will have to do alot of work, but the signature verifications could be done in parallel on a multiprocessor computer. Verification of the proceedings would also be long, but it could be done off-line. -- Leonard Janke (pgp key id 0xF4118611)

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Perry E. Metzger 17 Dec '03

17 Dec '03

blanc writes: > > I suppose you don't understand what it might be like for someone to be > > unable to do their work no matter how heavy the threat against them if > > they don't, and no matter how easy it is. There are people out there > > who can't get themselves to pay a phone bill or throw out the > > newspapers for months on end -- they just can't get themselves to > > dance around into the task no matter how hard they try, no matter how > > great the threat (job loss, etc) to them is. [...] > There are times when people have been totally unmotivated to take care > of themselves or the mundane matters in life because they were not > involved in the pursuits which were of true value to them, and life > "lost its meaning". Blanc, you really aren't listening. There are people out there who are desperately unhappy. They can't concentrate at all. They love what they do for a living, if only they could actually manage to do it four days out of five. They are not in the least scared of cleaning their homes, except for the fact that they are frightened of the fact that they can't manage to do it no matter what they try. They'd like to pay the light bill -- really -- but every time they start they get distracted, or they get distracted before they start. Sometimes they get bursts of hyperconcentration and they can work for two days straight on some project, and they end it and realize that the phone's been cut off because they completely spaced dealing with it or anything else. Sometimes they feel very pissed off because people tell them to just "apply themselves" more or "manage their time" better or "get a more motivating job". Such people aren't upset that life has lost its meaning. They are often perfectly intelligent, capable of being happy in their pursuits, and not bad individuals. They suffer, however, from an inability to keep from twitching. They ritualistically play with common objects -- rubber bands, paperclips, etc, folding and unfolding them, winding and unwinding them, etc. You can spot them -- they're the people who even as adults can be placed in a nearly empty room and will find a small object to play with. Their workspaces are littered with small fidget toys they have purloined or created. These people aren't unhappy with their jobs except for the fact that they wish they could get their work done, they sit in front of their work for hours on end, and can't get anywhere. They don't need new pursuits. Even with newere and "better" jobs, most people on earth have to occassionally maintain their attention long enough to pay their landlord or what have you. > Putting one's priorities into perspective can do a lot towards feeling > motivated to attend to life's minor contingencies, while elevating the > lesser items to the top of the hierarchy can totally dissipitate one's > energies and interest. Look, quit trying to tell people who have ADD that they are in the wrong jobs, that they are unmotivated, that they are "lazy", or whatever. Calling them "nuts" is actually far better. It at least acknowledges that there is something wrong that isn't readily fixed by the nostrums of people who have no idea whatsoever what they are going through. Perhaps, of course, we can just get all the suicidal people on earth to quit wanting to kill themselves by intoning to them "don't be sad" over and over again. I doubt it, though. > Maybe Ritalin could make them forgot their true interest which was lying > dormant, pushed away by who-knows-what kind of arguments against it, and > help them to start paying attention again to those mundane, irrelevant > aspects of existence. Or maybe, when they take it, the noise in their heads stops, the world focuses and clears up, and suddenly it doesn't seem like its so hard to finish that two paragraph status summary after all. Maybe they take it and suddenly they can function long enough to finish their resume and get another job. Maybe you should quit telling other people how to get through life when you haven't lived inside their heads. > You're right, Perry, that no one should be making that decision for > others. I do think, though, that achieving self-command by a conscious > knowledge of what is right for one's nature is actually the most > beneficial (and less controversial). Its always better to not need to use chemicals to help yourself out. However, we acknowledge in our society that when someone has an infected leg we decide that they aren't being "bad" by taking drugs to stop the infection. Perry

1 0

Put Uncle Sam in your Calling Circle
by Ray Arachelian 17 Dec '03

17 Dec '03

Hey guys, I just got a really cool poster from RSA. It's a big circle split off into several sections showing people talking to each other, the upper right hand corner shows two NSA dweebs looking like Bevis & Butthead in suits, one smoking, the other seated infront of an old 60's reel to reel audio tape recorder, a sign on the wall behind them says "Key Escrow" There are several logos for various government agencies including our friends at No Such Agency and the FBI, a small quote next to the Copyright (C) RSA notice says "One of a series of public relations posters that never made it out of Fort Mede." Very very funny! Many many thanks to the cool person(s) at RSA who sent it my way. ========================================================================== + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= <--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== + v + | Janet Reno & GAK|AK| do you not understand? |======= ===================http://www.dorsai.org/~sunder/========================= Key Escrow Laws are the mating calls of those who'd abuse your privacy!

2 1

Re: [RANT] Giving Mind Control Drugs to Children
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:39 AM 7/9/96 -0500, Rick Smith wrote: >erehwon(a)c2.org (William Knowles) writes: > >>Ritalin has been a godsend, I am able to dialin when I have to. >>Ritalin is not the only drug for treating ADD, Prozac works for >>some. Prozac works on a different set of brain chemestry. (Prozac messes with the seretonin level of the brain and how it is reabsorbed.) There is a whole series of chemicals similar to Prozac that are prescribed. It takes a bit to determine just which one is best for the person involved. (I have far too many friends on variations of those drugs.) The reactions when they come off them is quite "interesting". Prozac is not a stimulant however. (Not in the usual concept of a stimulant.) >I use coffee, or else I just managed to grow out of the worst effects. >In any case, I drink more coffee than just about anyone I know, and it >doesn't "wire" me at all. "It is by caffiene alone I set my mind in motion. It is by the beans of Java that the thoughts acquire speed, the hands acquire shakes, the shakes become a warning. It is by caffiene alone I set my mind in motion." You can build a resistance to caffiene. (As well as one hell of an addiction.) So far I am up to a gram a day of the stuff. Mix that with the Seldane-Ds I take every morning (for hay fever) and you get more than a small amount of stimulants. (I have found that the Seldane-Ds have a positive psychoactive effect as well. They seem to allow me to focus better. Probibly because I am not sneezing.) The long term effects of any stimulant is problbiy not very good. What needs to be looked at is what the long term benifits and risks are, for the individual, not just for the society. What these sorts of chemicals do to small children 10-30 years down the road is pretty unknown at this point. (If any of the things i have seen so far are any indication, they are not good.) But then, I suspect the government of drugging our kids with school lunches laced with lead paint, not with mind control drugs. (Lead paint is cheaper.) ]:> Alan Olsen Minister of Forced Caffinization - DNRC --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Style gettting in the way of clear reporting
by Ecgwulf 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: tcmay(a)got.net, cypherpunks(a)toad.com Date: Tue Jul 09 10:37:11 1996 In a reply to James A. Donald, Tim May wrote: > . . . You are probably right that journalism is becoming more florid as > "amateurs" flood the market. However, I don't quite buy the > concentration argument, as things were pretty concentrated in the > Hearst era, and the explosion of magazines in the past few decades has > not been as concentrated. I wonder what golden age of journalism these guys have in mind. Journalism is garbage and it always has been. After all, it is what connects you with your culture. It's a dirty job. > I still think of "The Wall Street Journal" and "The Economist," two of > my favorites, as being _careful_ in their reporting (careful is > different from unbiased). But my main focus in this thread was on the > _styles_, and this I think is more explained by faddishness. A couple of more fully fascist rags would be hard to find. Misinformation, disinformation and total lack of substance -- it's all style. The L.A. Times is a close runner-up with its one hundred year history of self interest, red-baiting of organized labor and political "enemies" broken only by a few periods of acting as a propaganda mill and inspiring a few race riots. Take a look at the masthead of, say, a 1943 edition. > Yes, and many of the newsletters we're seeing--as many are cc:ed or > forwarded to our list--are the kissing cousins of "zines." Same faux > style, same emphasis on "flash" over substance. Does 'faux style' mean 'fucked style'? If so, then kissing is appropriate. There are multiple issues of relevance: 1. The coding and decoding of messages in apparent plaintext. 2. Assumptions about the authenticity of sources and motives in message creation. 3. The separation of form and content in written language which I suggest cannot be separated. 4. The apparent political center of gravity of message subscribers. Let's say, this mailing list for instance. -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 iQB1AwUBMeKYyj/g5HTtoLA5AQFBNQMA3F/njYiTvcRCkqrLqnD0Tqa3RIQoozYl LtNc82V+8Wkl1b2dgXFas4SjuNoSeB/hq1UwdgJz97GIOH3VvEMeYayFVHnD1IKi /W+7lVIJ+62bypryoTP+eQH7hVARztLB =Gnrt -----END PGP SIGNATURE-----

1 0

Offshore Information Services is Back after Bertha
by Vincent Cate 17 Dec '03

17 Dec '03

Hurricane Bertha hit Anguilla just perfectly to do the most damage. Just north of the storm the counterclockwise spin and westward movements add for maximum destructive power, and we were just north of it. Don't know of any people or houses that were hurt, but a bunch of power and phone lines have been damaged. We lost power, ran for about 10 hours on battery, and then shut down. But about 24 hours later we are back online to stay. We are temporarily located in the Cable and Wireless building in town. Thanks Cable and Wireless! And thanks to everyone for your patience, Vince Cate Offshore Information Services Ltd Anguilla, Eastern Caribbean http://online.offshore.com.ai/

1 0