December 2003 - cypherpunks-legacy

Re: Recent Web site cracks
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

yes, i heard that about 50 microseconds after i posted. another thing that i have been thinking is that both of these cracks were inside jobs, which would explain any number of things. -paul > From stewarts(a)ix.netcom.com Tue Oct 8 12:36:57 1996 > From: stewarts(a)ix.netcom.com > X-Sender: stewarts(a)popd.ix.netcom.com (Unverified) > X-Mailer: Windows Eudora Light Version 1.5.2 > Mime-Version: 1.0 > Content-Type> : > text/plain> ; > charset="us-ascii"> > Date: Tue, 08 Oct 1996 09:37:23 -0700 > To: pjb(a)ny.ubs.com > Original-From: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: Recent Web site cracks > Cc: cypherpunks(a)toad.com > Content-Length: 1263 > > At 09:46 AM 10/8/96 -0400, pjb(a)ny.ubs.com wrote: > >The recent cracks of the DOJ, CIA and Dole web sites have caused me to think > >about just what is going on here. > > > >Do you suppose that these entries were made via the httpd route, maybe via > >cgi-bin, or just a straight telnet-type entry to the server? I don't know > >what operating systems were involved with these three systems, or even if > > The DOJ and CIA sites were actually cracked; don't know the mechanisms. > The dole-kemp96.com and dole-kemp96.org domains were spoofs - they > have similar names to the real site, and people reach them by accident > or by hearing about them. According to today's San Jose Mercury News, > the web designer who registered them did so just before Dole announced > Kemp as his VP, and tried to sell his design services to the campaign. > They didn't buy it, and the names were sitting around with nothing > better to do anyway, so he decided to have a good time with them. > Supposedly he's gotten about 40,000 hits and the "real" site got 1,000,000. > > > # Thanks; Bill > # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com > # You can get PGP outside the US at ftp.ox.ac.uk > Imagine if three million people voted for somebody they _knew_, > and the politicians had to count them all. > >

1 0

RE: Recent Web site cracks
by Mullen Patrick 17 Dec '03

17 Dec '03

Which firewalls did they use, what are the holes, and how can you plug and/or exploit them? PM _______________________________________________________________________________ From: Dr.Dimitri Vulis KOTM on Wed, Oct 9, 1996 3:20 Subject: Re: Recent Web site cracks To: cypherpunks(a)toad.com stewarts(a)ix.netcom.com writes: > The DOJ and CIA sites were actually cracked; don't know the mechanisms. They used firewalls that are known to be easily crackable. ^^^^^^^^^^ ^^^^^^^^^^^^^^^^ --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;9 Oct 1996 03:20:19 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Wed, 9 Oct 1996 7:17:16 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id QAA26393 for cypherpunks-outgoing; Tue, 8 Oct 1996 16:51:04 -0700 (PDT) Received: from uu.psi.com (uu.psi.com [136.161.128.3]) by toad.com (8.7.5/8.7.3) with SMTP id QAA26380 for <cypherpunks(a)toad.com>; Tue, 8 Oct 1996 16:50:40 -0700 (PDT) Received: by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via UUCP; id AA00949 for ; Tue, 8 Oct 96 19:43:02 -0400 Received: by bwalk.dm.com (1.65/waf) via UUCP; Tue, 08 Oct 96 16:54:14 EDT for cypherpunks(a)toad.com To: cypherpunks(a)toad.com Subject: Re: Recent Web site cracks From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Comments: Dole/Kemp '96! Message-Id: <9VZHVD1w165w(a)bwalk.dm.com> Date: Tue, 08 Oct 96 16:53:43 EDT In-Reply-To: <199610081636.MAA10912(a)attrh1.attrh.att.com> Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

Re: ElGamal
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

> Tim May sits at his terminal dressed in five-inch stiletto heels, fishnet > stockings, a gold-lame mini-skirt, a purple halter with girdle underneath to > keep in his flabby gut, A Fredericks of Hollywood padded bra also underneath > the halter, a cheap Naomi Sims pink afro wig, waiting to yank his crank > whenever a black man responds to one of his posts. No, you must be confused, I believe you are talking about Dmitri Vulis or whatever his fucked up name is.

1 0

Re: pgp, edi, s/mime
by ratak 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jubois(a)netcom.com, cypherpunks(a)toad.com Date: Wed Oct 09 10:19:39 1996 t: > > - S/MIME and PGP are the two leading candidates for encrypting EDI > messages, > S/MIME inside the US, and PGP outside the US where S/MIME is unavailable. > How far along has S/Mime come now, can they offer the same key sizes as PGP...? ___________________________________________________________________ GarGoyle Securities - -Intrusion Assessment Systems - -Security Consultation/Education/Curriculum Development - -Project Management/Research/Analysis World Wide... - -Member of CITDC (Canadian International Trade Development Council) - -Email: ratak(a)GargSec.mb.ca (Jason E.J. Manaigre) - -Web: www.GargSec.mb.ca - -Email for PGP key with phrase 'Get Public Key' as Subject - -2048 PGPKey iD E2 FA 30 E5 F5 AD EC F3 00 9A 9D 33 59 FC DF AD ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMlvCj/qtmO8M92GRAQFNBAf8CVzTxtle7jvTQFq6UM9MpEGjvrnoSHoO NMidciwyht0AqyGNPqNxczU/arpCAQwluwkhtTRor8lYsUWLLLyZB8d2DGs1i/En 3dE4WIXnNSR/G4YjHf8ln/DwE+YbHHFwEve5zSJAf4Gnvt7+LRo+VJPq34MaJgyc 5888BrSMHKTo5pyISAz+LQhDJptWMZwPsldrZctWI0QW/xgFMCmZr8qt2VYWdlZw XO+Px+QadwvNJlL8pR2ZT3l458rzU5B7kS3CKVJDl0iUlVWK2/xHiuRUHfo1Yu1Z VB6jFEw6IsQI8ukrANu90qgDcab3YQpe99BQCd/imZfKWSzO3vsieQ== =Ew/I -----END PGP SIGNATURE-----

5 5

Microsoft CAPI
by Ravi Pandya 17 Dec '03

17 Dec '03

>From today's HotWired Packet http://www.packet.com: "Today Microsoft is using similar technology as part of its Cryptography API: You can't load an encryption engine into Windows 95 or Windows NT unless that engine has been specially signed by Microsoft's corporate key. The reason for this restriction, says the company, is the Clinton administration: Microsoft couldn't have gotten export permission for its operating systems if users could easily plug in crypto engines that hadn't been approved. " This is disturbing, if true, though I suspect there is also a less ominous reason: you certainly want your cryptography provider to be trusted, and you want to be sure the code has not been altered. The implications really depend on Microsoft's policy on signing cryptography engines, and whether they allow a way to delegate signature authority. Ravi

5 4

RE: crypto cd once more
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:23 PM 10/8/96 +0100, JR(a)ROCK.CNB.UAM.ES wrote: >>1) is there a system that can handle unix, windows and mac filenames >> > Yes. Use Rock Ridge extensions. That will allow for long UNIX >names. If you couple it with ISO9660 youget both worlds. Windows 95 will read rockridge discs, but will not display the long filenames. (Why they have not added those extensions to MSCDEX on Win95 is a mystery. Maybe Bill Gates had a bad experience at a showing of "Blazing Saddles".) --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

pgp, edi, s/mime
by Jeff Ubois 17 Dec '03

17 Dec '03

Interesting comments from a member of the IETF EDI-INT group, which is developing standards for secure EDI over the net, and managing a Commercenet pilot project: - S/MIME and PGP are the two leading candidates for encrypting EDI messages, S/MIME inside the US, and PGP outside the US where S/MIME is unavailable. - If PGP 3.0 comes out on time with promised features, it could gain adoption by large companies as a standard means of encrypting EDI messages; that would pull smaller companies along, but it has a narrow window of opportunity and could lose to S/MIME products like those from Deming. - The G7 governments will impose key escrow on large companies trading over the net, and while non-escrowed systems will continue to be available, they are likely to be illegal, and certainly will be marginalized.

1 0

Government Denial of Service Attacks
by Duncan Frissell 17 Dec '03

17 Dec '03

Those who read this list or watch the news of the "Wired Curtain" that is attempting to be drawn across the Net know that there is a theory out there that government Denial of Service Attacks (GDOS) are a real threat. The GDOS theory holds that if government legislates or even threatens litigation against the provision of a particular service, the providers of the service will fold and the public will be unable to obtain the banned service. In the case of the net this is the "Do Not <--'Enter" theory. The governments claim that by threat, deception, or nuclear weapons, they can keep millions of us from hitting the <--'Enter key and thus transmitting banned material. That is a very fine control regime indeed. (Original meaning of 'fine' of course.) If the governments had this GDOS power; this Do Not <--'Enter power, then the article on the front page of today's New York Times could not have been written. "Behind a Suburban Facade in Queens, A Teeming, Angry Urban Arithmetic" is the annual NYT article on the spread of illegal apartments throughout the Region. From the humblest urban ghetto to the swankiest suburbs, denizens of the TriState area are converting one- and two-family dwellings into two- three- or four-family (and denser) dwellings. These illegal apartments are commonplace and illegal. This has been true (and written about) for years. Here we have a physical service (apartment rental), difficult to hide, and illegal which is offered by hundreds of thousands of property owners in this area. The GDOS theory holds that this can't happen. "All they have to do is pass a law." Note that the GDOS theories that involve our activities say that once the government passes a law, no one (or hardly anyone) will offer an anonymous Net account, or an uncensored ISP connection, or an un IDed financial account, or an uncensored news server, etc. That all government has to do is pass a law and all transactions will be carried out in rigid conformity to its dictates. I say nonsense. If the government can't keep thousands of property owners (with their physical property at risk) from offering it for rent illegally, in an "open, notorious, and continuous" manner; then they aren't going to be able to keep very many of us from hitting <--'Enter. DCF "During Fiscal 1996, the Government of the United States collected more taxes from the American people than any government had ever collected before in the history of mankind. During Fiscal 1997, the Government of the United States plans to collect more taxes from the American people than any government has ever collected before in the history of mankind. And still it's not enough."

3 2

Re: Seeking help on WordPerfect 6.1 cracks [Done, thanks]
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Got it, thanks for the offers of help. FYI, none of the currently available freeware will decrypt WP 6.1 files; the WPCRAK mentioned in the sci.crypt FAQ stops at 5.2. But AccessData was kind enough to decrypt one for free, and the others had the same password. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMlqzB5NcNyVVy0jxAQE6WAH/Wg2NIeaZxdfbRi2tTgdeynMdqXfSm0E6 zhq9aBRdpQEtZSRY5jABH24pLlSd3OfugyhyNqD+qULy4XzIygm5Fw== =lMjI -----END PGP SIGNATURE-----

1 0

Be careful where you put up
by Donald Weightman 17 Dec '03

17 Dec '03

Apropos the thread about asset allocation and relocation to hedge political risk, today's FINANCIAL TIMES reports: >Offshore banking centres agree to greater scrutiny > > Tuesday October 8 1996 > > By George Graham, Banking Correspondent > > Banking supervisors from large offshore financial centres have agreed to > co-operate more with their counterparts in industrialised nations in > investigating irregular behaviour at banks under their control. <SNIP> > The drafting involved hard negotiations on issues such as when a > supervisor could ask for the identity of an individual depositor or investor. > A supervisor in Europe may, for example, want to know that a bank is not > dependent for all its deposits on one source, but the offshore centre does > not want that to serve as an excuse for trawling for tax evaders. > > In all 140 countries have endorsed the deal, which sets out procedures for > exchanging information between supervisors and also establishes a > checklist to ensure that banking operations in a particular country are > subject to effective supervision. > > The agreement says home supervisors should be able to inspect the books > of shell branches wherever they are kept. "In no case should access to > these books be protected by secrecy requirements in the country that > licenses the shell branch," it says. Don Weightman dweightman(a)radix.net

1 0