December 2003 - cypherpunks-legacy

Want Your Biz To EXPLODE In 1997?
by peggyhn＠isp-inter.net 17 Dec '03

17 Dec '03

Fuck_You_Nerds, Hello and Happy Holidays! I thought you might be interested in some information to help you build your business to new heights!! It will sure help 1997 to be the VERY best yet!! I love to bulk email, and I was using Floodgate. I just loved it! Then I came across something brand new that has Floodgate put to shame! This software will almost eliminate "flames" by using personalization in the email address, (no more "suppressed" list), putting in their first and/or last name, reminding you when to follow up, extracts addresses from AOL without even having to belong to AOL, plus so much more! They are even having a HOLIDAY SALE! $100 off regular price until Jan. 5th. So this is a GREAT time to try out the free demo and see what you think! For further information, just reply back and ask for "NO FLAME" Info! I will let you know where you can download the demo and try it for FREE!! I don't sell this, I just think it's the most awesome online marketing tool I have ever seen! Also, FYI, the seller offers people who have purchased Net Contact a $165 referal fee, so if you are concerned about money, you can get a free auto-responder and use it to pay for Net Contact!! ( You will also receive FREE training and support!! This is found NO where else!!) For instant information, email: star-peggyhendricks-netcontact(a)nicers.com Happy Holidays!! Peggy Hendricks P.S. Remember the HOLIDAY SALE! It will be over January 5th!

1 0

The Fast to Encrypt Decrypt....
by Fyodor Yarochkin 17 Dec '03

17 Dec '03

Hey.. By the way anyone can advice me the Encryption/Decryption Algorythm, which would give chip. text with different size, related to solt value or something.. i mean some function like size_of_Encrypted_file=H(solt)? PS: better if it 'd be reversed algorythm..

1 0

Re: Forged addresses
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 27 Dec 1996 00:24:51 -0800 From: Chuq Von Rospach <chuqui(a)plaidworks.com> Subject: Re: Forged addresses To: listmom-talk(a)skyweyr.com Mime-Version: 1.0 Precedence: Bulk Reply-To: listmom-talk(a)skyweyr.com At 12:53 PM -0800 12/26/96, Kass Johns wrote: >I only joined this listserv a few days ago, and suddenly, I got (on >Christmas Eve), about 25 (assumed) bogus subscribers. I had never had any >bogus ones before. well, *that* sounds familiar. Same time, same size... do any of these sites sound familiar? isp-inter.net? softcell.net? superhot.com? mid-night.com? strutyourstuff.com? I'll bet they do... A lot of what got spammed onto my sites were various forms of internet commerce (superhot.com is net-porn-chat or some such, at least two of the others are unsolicited email houses. strutyourstuff is a pretty noxious one, from what little I saw of what they're doing. A pox on all their houses, so to speak, but don't do it with my server, dammit...) But that wasn't it. Someone got mad at the cypherpunks, and spammed their list. And for some godawful reason, the webcrawler admin lists. Someone -- possibly two someones -- were making some interesting political statements.... This christmas eve spam was pretty well planned. It seems to have been exceptionally widespread, aimed at some segments of the internet certain high-and-righteous types find unacceptable, and issued at a time when it was pretty much guaranteed nobody was watching the servers too closely. And it seems pretty widespread in the number of servers hooked into the spam. >My thought is, is there someone who >is lurking among this group who just lies in wait for new folks to >subscribe and add their list to their sick little spamming game? Well, if I were trying to build lists of places to send spam mail from, this is one place I'd watch. That's why, if you don't mind, I won't go into details about my anti-spamming traps in public here. Except in generalities. I've learned to just assume that they're watching. Of course, with any luck they'll figure out I have full logging of the information needed to catch spammers, too, and not take chances with me, because I don't take prisoners... Oh, heck. Gotta run. As I type, the cyberpromo folks are trying to log onto my lists again and setting off my alarms. Oh, before I go, a note on those folks. Make sure that under no circumstances you allow any addresses from: cyberpromo.com cybercastle.com onto your lists. These are folks that will happily sign onto your lists, suck the addresses of people posting to your lists, and add them to their cyberspam mass mailings. These are also the folks AOL's been fighting in court. No ethics, and don't even bother trying to talk to them. Just keep them out. They may be using a third domain these days, but I've caught them sneaking onto lists from various accounts in both domains. Just lock the entire puppy out. That way, they can't spam your lists, and can't suck your lists out and spam them away from your server. You *do* have subscriber lists kept private on your server, right? Nobody can get them, right? -- Chuq Von Rospach (chuq(a)solutions.apple.com) Software Gnome Apple Server Marketing Webmaster <http://www.solutions.apple.com/> Plaidworks Consulting (chuqui(a)plaidworks.com) <http://www.plaidworks.com/> (<http://www.plaidworks.com/hockey/> +-+ The home for Hockey on the net) I got no name or number/ I just hand out the lumber. But if I get a chance to play/ I'm going to show 'em. -- Stick Boy (The Hanson Brothers, SUDDEN DEATH) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

2 1

SSN_sii
by John Young 17 Dec '03

17 Dec '03

[Thanks to RF.] Federal Register: December 26, 1996 [Pages 68044-68045]: The Federal Reserve Board solicits comment concerning the public availability and use of social security numbers and other sensitive identifying information about consumers. The FRB, and the FTC, is to conduct a study to determine the availability to the public of sensitive identifying information about consumers, the possibility that such information could be used for financial fraud, and the potential for fraud or risk of loss, if any, to insured depository institutions. Testimony at a recent FTC hearing highlighted how easy it is to obtain identifying information about a consumer and to use that information to fraudulently receive credit in the consumer's name, a practice often referred to as "identity theft." ----- SSN_ssi (9 kb) Or, access the Federal Register at: http://www.access.gpo.gov/su_docs/aces/aces140.html

1 0

For your information
by rsampson＠microsyssolutions.com 17 Dec '03

17 Dec '03

Hi, After seeing some of your newsgroup postings, I may have something that will interest you. If you're not interested, just delete this message. This will be the only message you will receive. $$$ GET ATTENTION FOR YOUR PRODUCT OR MESSAGE $$$ It's an application called Ready-Aim-Fire for Windows 95. It will connect to your news server, download the Email addresses of all the people posting messages to that group (or groups), and Email your message to all those addresses. Ready-Aim-Fire will get your product or message out of the crowd and into your customers' hands. Ready-Aim-Fire will deliver your message right to their door, so to speak. If you post a message to a business oriented newsgroup it's stuck right in the middle of hundreds of others. A prospective customer may look in once in a while, or only once, and you'll miss him. With Ready-Aim-Fire you can focus on the persons in the group who are most interested in the subject. That is, the people who post the messages. The great part is the price! It's only $39.95. If you would like more information send an email to: info(a)microsyssolutions.com or visit our web site at: http://www.microsyssolutions.com/raf Thanks, Ron Sampson rsampson(a)microsyssolutions.com Ready Aim Fire! Marketing Director

1 0

CN Leads US
by John Young 17 Dec '03

17 Dec '03

12-27-96. WaPo snippet: China said it plans to strengthen its already strict controls over the Internet. The China Consumers Daily, an official newspaper, mentioned the planned tighter controls in a report on a recent conference in Beijing, but did not provide details. Earlier this year, China required Internet users to register with police and warned that laws against pronography, social disturbances and breaches of state security apply online. [Whole story.] ----- Sounds like US policy foretold, boiling the frog. The Administration's current CN policy must include a secret GAK-product sharing deal, to parallel those with OECD and the world's big-bit-fearful. Behold the burgeoning, slobbering, Key Recovery Alliance: billions of targets to be tracked, keys shared with authorities who give out the contracts, profits ka-chinged (low pun). Gerstner says he can't believe the money IBM's going to make off sweet deals to control the Internet -- just like the old days before the anarchistic start-ups got uppity and out-foxed the old-money-archists.

1 0

Re: UNIX talk and write source...
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:17 PM 12/26/96 -0500, Jesse Lucas wrote: > >Fellows, > > Anyone know if and where the source code for UNIX talk and write (or the >equivalent Linux) commands are to be found? Anyone have any terminal to >terminal communication code that they've written that they wouldn't mind >parting with? Check out http://www.gnu.org/ . They have source for all sorts of fun stuff. What you are looking for is in their "inetutils" package. (Or in BSD44. It is listed twice.) You also might check out some of the larger source mirrors for Linux, like ftp.cdrom.com. --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

Re: CypherRevenge
by Carl Johnson 17 Dec '03

17 Dec '03

Adam Breaux wrote: > Berating me does no > good. I simply went about this in the way that is most effective. I > asked the admin to correct this loophole in his system. Adam, I have no idea how you are connected to plaidworks.com, but the one previous post I have seen of yours indicates that you do not have your head up your butt. As for Chuq, however, I have little sympathy. I find it amazing that a web site of that magnitude has 'loopholes' that are a ten-year old hacker's dream. Then he has the audacity to email my Postmaster, claiming that 'returning' his mail is 'spamming'? Which Subject: heading bothered him the most, the one that said, "If you act like an idiot, we'll treat you like one?" (this is a quote from plaidworks.com's home-page). Chuq's 'loophole' resulting in his mailsite spamming people with Tourette Syndrome, like myself, are not his biggest problem. Whatever kindegarten child hacked his system to spam the CyberPunks conference, is not his biggest problem. In my estimation, the Evil One roaming his system freely (who is rumored to have originated the 'Ping of Death'), is probably his biggest problem. The fact that some of plaidworks.com's 'postmaster' and 'webmaster' mail is being routed directly to me, is probably a close second. If I receive further mail routed from plaidworks.com, I will continue to return it. However, if anyone wishes to inquire 'nicely' in regard to plaidworks.com's 'hidden' problems, I would be happy to reply. Sincerely, Toto > If you disagree with my methods, I suggest that you email me directly > instead of cluttering an already busy list with more junk-mail. > > Thanks > Adam Breaux > > > Adam Breaux wrote: > > > > > And frankly, if someone's starting to use mailbots to spam, lists are > > > in big trouble, because there are zillions of those out there. Most > > > systems, for instance, have "info@xxxxx" addresses, all of which would > > > do exactly what my mailbots are doing. > > > > Well, I certainly hope that nobody uses this information to subscribe > > others to a zillion lists. Especially not the authors of such classics > > as, "EASY MONEY!!!", "MAKE $$$ AT HOME", etc. > > I would hate for these people to be too busy to send me "IMPORTANT > > INFORMATION ABOUT HOW 'YOU' CAN MAKE $$$ AT HOME, LICKING YOUR OWN > > DICK!!!" > > > > Toto > > p.s. - for a limited time--offer open to CypherPunks only--anyone > > who sends me $20.00 will receive my special 'Secret Magic Chant', > > which effectively blocks unwanted eMail. > > (This offer includes a clear Title to a bridge in the New York > > City area--absolutely free!) > > > > > --- > Adam Breaux > admin(a)veracruz.net > http://www.veracruz.net {Corporate Page } > http://www.abyss.com {Extracurricular} > http://www.iso-america.com {In Search Of...} > > "Violence is a cruel world doing what it > does best...break the habit...BE NICE" --- me.

1 0

OECD resolution?
by Lucky Green 17 Dec '03

17 Dec '03

Now that the OECD meeting is over, does anybody have a final version of their resolution? As opposed to the draft versions available on the net? Thanks, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

Re: "Deeyenda" E-MAil virus alert!!!!!!
by Bob Antia 17 Dec '03

17 Dec '03

I will not go into a rant about the technical impossibilities of such a virus, I'll just forward this pice of information on, hoping that it will get read and filed, to be used as future reference. This is a hoax. These hoaxes are becoming so prevalent that the CIAC put out a bulletin about such hoaxes. Here is the bulletin: __________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Internet Hoaxes: PKZ300, Irina, Good Times, Deeyenda, Ghost November 20, 1996 15:00 GMT Number H-05 ______________________________________________________________________________ PROBLEM: This bulletin addresses the following hoaxes and erroneous warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and Ghost.exe PLATFORM: All, via e-mail DAMAGE: Time lost reading and responding to the messages SOLUTION: Pass unvalidated warnings only to your computer security department or incident response team. See below on how to recognize validated and unvalidated warnings and hoaxes. ______________________________________________________________________________ VULNERABILITY New hoaxes and warnings have appeared on the Internet and old ASSESSMENT: hoaxes are still being cirulated. ______________________________________________________________________________ Introduction ============ The Internet is constantly being flooded with information about computer viruses and Trojans. However, interspersed among real virus notices are computer virus hoaxes. While these hoaxes do not infect systems, they are still time consuming and costly to handle. At CIAC, we find that we are spending much more time de-bunking hoaxes than handling real virus incidents. This advisory addresses the most recent warnings that have appeared on the Internet and are being circulated throughout world today. We will also address the history behind virus hoaxes, how to identify a hoax, and what to do if you think a message is or is not a hoax. Users are requested to please not spread unconfirmed warnings about viruses and Trojans. If you receive an unvalidated warning, don't pass it to all your friends, pass it to your computer security manager to validate first. Validated warnings from the incident response teams and antivirus vendors have valid return addresses and are usually PGP signed with the organization's key. PKZ300 Warning ============== The PKZ300 Trojan is a real Trojan program, but the initial warning about it was released over a year ago. For information pertaining to PKZ300 Trojan reference CIAC Notes issue 95-10, that was released in June of 1995. http://ciac.llnl.gov/ciac/notes/Notes10.shtml The warning itself, on the other hand, is gaining urban legend status. There has been an extremely limited number of sightings of this Trojan and those appeared over a year ago. Even though the Trojan warning is real, the repeated circulation of the warning is a nuisance. Individuals who need the current release of PKZIP should visit the PKWARE web page at http://www.pkware.com. CIAC recommends that you DO NOT recirculate the warning about this particular Trojan. Irina Virus Hoax ================ The "Irina" virus warnings are a hoax. The former head of an electronic publishing company circulated the warning to create publicity for a new interactive book by the same name. The publishing company has apologized for the publicity stunt that backfired and panicked Internet users worldwide. The original warning claimed to be from a Professor Edward Pridedaux of the College of Slavic Studies in London; there is no such person or college. However, London's School of Slavonic and East European Studies has been inundated with calls. This poorly thought-out publicity stunt was highly irresponsible. For more information pertaining to this hoax, reference the UK Daily Telegraph at http://www.telegraph.co.uk. Good Times Virus Hoax ===================== The "Good Times" virus warnings are a hoax. There is no virus by that name in existence today. These warnings have been circulating the Internet for years. The user community must become aware that it is unlikely that a virus can be constructed to behave in the manner ascribed in the "Good Times" virus warning. For more information related to this urban legend, reference CIAC Notes 95-09. http://ciac.llnl.gov/ciac/notes/Notes09.shtml Deeyenda Virus Hoax =================== The "Deeyenda" virus warnings are a hoax. CIAC has received inqueries regarding the validity of the Deeyenda virus. The warnings are very similar to those for Good Times, stating that the FCC issued a warning about it, and that it is self activating and can destroy the contents of a machine just by being downloaded. Users should note that the FCC does not and will not issue virus or Trojan warnings. It is not their job to do so. As of this date, there are no known viruses with the name Deeyenda in existence. For a virus to spread, it must be executed. Reading a mail message does not execute the mail message. Trojans and viruses have been found as executable attachments to mail messages, but they must be extracted and executed to do any harm. CIAC still affirms that reading E-mail, using typical mail agents, can not activate malicious code delivered in or with the message. Ghost.exe Warning ================= The Ghost.exe program was originally distributed as a free screen saver containing some advertising information for the author's company (Access Softek). The program opens a window that shows a Halloween background with ghosts flying around the screen. On any Friday the 13th, the program window title changes and the ghosts fly off the window and around the screen. Someone apparently got worried and sent a message indicating that this might be a Trojan. The warning grew until the it said that Ghost.exe was a Trojan that would destroy your hard drive and the developers got a lot of nasty phone calls (their names and phone numbers were in the About box of the program.) A simple phone call to the number listed in the program would have stopped this warning from being sent out. The original ghost.exe program is just cute; it does not do anything damaging. Note that this does not mean that ghost could not be infected with a virus that does do damage, so the normal antivirus procedure of scanning it before running it should be followed. History of Virus Hoaxes ======================= Since 1988, computer virus hoaxes have been circulating the Internet. In October of that year, according to Ferbrache ("A pathology of Computer Viruses" Springer, London, 1992) one of the first virus hoaxes was the 2400 baud modem virus: SUBJ: Really Nasty Virus AREA: GENERAL (1) I've just discovered probably the world's worst computer virus yet. I had just finished a late night session of BBS'ing and file treading when I exited Telix 3 and attempted to run pkxarc to unarc the software I had downloaded. Next thing I knew my hard disk was seeking all over and it was apparently writing random sectors. Thank god for strong coffee and a recent backup. Everything was back to normal, so I called the BBS again and downloaded a file. When I went to use ddir to list the directory, my hard disk was getting trashed again. I tried Procomm Plus TD and also PC Talk 3. Same results every time. Something was up so I hooked up to my test equipment and different modems (I do research and development for a local computer telecommunications company and have an in-house lab at my disposal). After another hour of corrupted hard drives I found what I think is the world's worst computer virus yet. The virus distributes itself on the modem sub- carrier present in all 2400 baud and up modems. The sub-carrier is used for ROM and register debugging purposes only, and otherwise serves no othr (sp) purpose. The virus sets a bit pattern in one of the internal modem registers, but it seemed to screw up the other registers on my USR. A modem that has been "infected" with this virus will then transmit the virus to other modems that use a subcarrier (I suppose those who use 300 and 1200 baud modems should be immune). The virus then attaches itself to all binary incoming data and infects the host computer's hard disk. The only way to get rid of this virus is to completely reset all the modem registers by hand, but I haven't found a way to vaccinate a modem against the virus, but there is the possibility of building a subcarrier filter. I am calling on a 1200 baud modem to enter this message, and have advised the sysops of the two other boards (names withheld). I don't know how this virus originated, but I'm sure it is the work of someone in the computer telecommunications field such as myself. Probably the best thing to do now is to stick to 1200 baud until we figure this thing out. Mike RoChenle This bogus virus description spawned a humorous alert by Robert Morris III : Date: 11-31-88 (24:60) Number: 32769 To: ALL Refer#: NONE From: ROBERT MORRIS III Read: (N/A) Subj: VIRUS ALERT Status: PUBLIC MESSAGE Warning: There's a new virus on the loose that's worse than anything I've seen before! It gets in through the power line, riding on the powerline 60 Hz subcarrier. It works by changing the serial port pinouts, and by reversing the direction one's disks spin. Over 300,000 systems have been hit by it here in Murphy, West Dakota alone! And that's just in the last 12 minutes. It attacks DOS, Unix, TOPS-20, Apple-II, VMS, MVS, Multics, Mac, RSX-11, ITS, TRS-80, and VHS systems. To prevent the spresd of the worm: 1) Don't use the powerline. 2) Don't use batteries either, since there are rumors that this virus has invaded most major battery plants and is infecting the positive poles of the batteries. (You might try hooking up just the negative pole.) 3) Don't upload or download files. 4) Don't store files on floppy disks or hard disks. 5) Don't read messages. Not even this one! 6) Don't use serial ports, modems, or phone lines. 7) Don't use keyboards, screens, or printers. 8) Don't use switches, CPUs, memories, microprocessors, or mainframes. 9) Don't use electric lights, electric or gas heat or airconditioning, running water, writing, fire, clothing or the wheel. I'm sure if we are all careful to follow these 9 easy steps, this virus can be eradicated, and the precious electronic flui9ds of our computers can be kept pure. ---RTM III Since that time virus hoaxes have flooded the Internet.With thousands of viruses worldwide, virus paranoia in the community has risen to an extremely high level. It is this paranoia that fuels virus hoaxes. A good example of this behavior is the "Good Times" virus hoax which started in 1994 and is still circulating the Internet today. Instead of spreading from one computer to another by itself, Good Times relies on people to pass it along. How to Identify a Hoax ====================== There are several methods to identify virus hoaxes, but first consider what makes a successful hoax on the Internet. There are two known factors that make a successful virus hoax, they are: (1) technical sounding language, and (2) credibility by association. If the warning uses the proper technical jargon, most individuals, including technologically savy individuals, tend to believe the warning is real. For example, the Good Times hoax says that "...if the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop which can severely damage the processor...". The first time you read this, it sounds like it might be something real. With a little research, you find that there is no such thing as an nth-complexity infinite binary loop and that processors are designed to run loops for weeks at a time without damage. When we say credibility by association we are referring to whom sent the warning. If the janitor at a large technological organization sends a warning to someone outside of that organization, people on the outside tend to believe the warning because the company should know about those things. Even though the person sending the warning may not have a clue what he is talking about, the prestigue of the company backs the warning, making it appear real. If a manager at the company sends the warning, the message is doubly backed by the company's and the manager's reputations. Individuals should also be especially alert if the warning urges you to pass it on to your friends. This should raise a red flag that the warning may be a hoax. Another flag to watch for is when the warning indicates that it is a Federal Communication Commission (FCC) warning. According to the FCC, they have not and never will disseminate warnings on viruses. It is not part of their job. CIAC recommends that you DO NOT circulate virus warnings without first checking with an authoritative source. Authoritative sources are your computer system security administrator or a computer incident advisory team. Real warnings about viruses and other network problems are issued by different response teams (CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by the sending team using PGP. If you download a warning from a teams web site or validate the PGP signature, you can usually be assured that the warning is real. Warnings without the name of the person sending the original notice, or warnings with names, addresses and phone numbers that do not actually exist are probably hoaxes. What to Do When You Receive a Warning ===================================== Upon receiving a warning, you should examine its PGP signature to see that it is from a real response team or antivirus organization. To do so, you will need a copy of the PGP software and the public signature of the team that sent the message. The CIAC signature is available from the CIAC web server at: http://ciac.llnl.gov If there is no PGP signature, see if the warning includes the name of the person submitting the original warning. Contact that person to see if he/she really wrote the warning and if he/she really touched the virus. If he/she is passing on a rumor or if the address of the person does not exist or if there is any questions about theauthenticity or the warning, do not circulate it to others. Instead, send the warning to your computer security manager or incident response team and let them validate it. When in doubt, do not send it out to the world. Your computer security managers and the incident response teams teams have experts who try to stay current on viruses and their warnings. In addition, most anti-virus companies have a web page containing information about most known viruses and hoaxes. You can also call or check the web site of the company that produces the product that is supposed to contain the virus. Checking the PKWARE site for the current releases of PKZip would stop the circulation of the warning about PKZ300 since there is no released version 3 of PKZip. Another useful web site is the "Computer Virus Myths home page" (http://www.kumite.com/myths/) which contains descriptions of several known hoaxes. In most cases, common sense would eliminate Internet hoaxes. - ----------------------------------------------------------------------------- CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 510-422-8193 FAX: +1 510-423-8002 STU-III: +1 510-423-2604 E-mail: ciac(a)llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC duty person, and the secondary PIN number, 8550074 is for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://ciac.llnl.gov/ Anonymous FTP: ciac.llnl.gov (128.115.19.53) Modem access: +1 (510) 423-4753 (28.8K baud) +1 (510) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. CIAC-NOTES for Notes, a collection of computer security articles; 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 4. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called ListProcessor, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or SPI-NOTES for list-name and valid information for LastName FirstName and PhoneNumber when sending E-mail to ciac-listproc(a)llnl.gov: subscribe list-name LastName, FirstName PhoneNumber e.g., subscribe ciac-notes OHara, Scarlett W. 404-555-1212 x36 You will receive an acknowledgment containing address, initial PIN, and information on how to change either of them, cancel your subscription, or get help. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver(a)first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) G-43: Vulnerabilities in Sendmail G-44: SCO Unix Vulnerability G-45: Vulnerability in HP VUE G-46: Vulnerabilities in Transarc DCE and DFS G-47: Unix FLEXlm Vulnerabilities G-48: TCP SYN Flooding and IP Spoofing Attacks H-01: Vulnerabilities in bash H-02: SUN's TCP SYN Flooding Solutions H-03: HP-UX_suid_Vulnerabilities H-04: HP-UX Ping Vulnerability RECENT CIAC NOTES ISSUED (Previous Notes available from CIAC) Notes 07 - 3/29/95 A comprehensive review of SATAN Notes 08 - 4/4/95 A Courtney update Notes 09 - 4/24/95 More on the "Good Times" virus urban legend Notes 10 - 6/16/95 PKZ300B Trojan, Logdaemon/FreeBSD, vulnerability in S/Key, EBOLA Virus Hoax, and Caibua Virus Notes 11 - 7/31/95 Virus Update, Hats Off to Administrators, America On-Line Virus Scare, SPI 3.2.2 Released, The Die_Hard Virus Notes 12 - 9/12/95 Securely configuring Public Telnet Services, X Windows, beta release of Merlin, Microsoft Word Macro Viruses, Allegations of Inappropriate Data Collection in Win95 Notes 96-01 - 3/18/96 Java and JavaScript Vulnerabilities, FIRST Conference Announcement, Security and Web Search Engines, Microsoft Word Macro Virus Update -b Bob Antia antia(a)leftbank.com The Left Bank Operation, Inc. http://www.leftbank.com TCP/IP Internetworking LAN/WAN/NT/UNIX Admin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu

1 0