December 2003 - cypherpunks-legacy

Re: Maybe the CypherPunks *do* have some heart
by Mark Neely 17 Dec '03

17 Dec '03

Just a quick note to say that Houghton-Mifflin has posted a request for people to _STOP_ emailing them! This wasn't a hoax, but they have reached their email target numbers > The Houghton-Mifflin Publishing Co.. is giving books to children's Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

1 0

The Complete, Unofficial TEMPEST Information Page
by Joel McNamara 17 Dec '03

17 Dec '03

Everything (well almost everything) you ever wanted to know about TEMPEST but were afraid to ask. Research papers, links to TEMPEST hardware manufacturers and consultants, military security manuals, monitoring devices, history, and more. http://www.eskimo.com/~joelm The page is devoted to presenting open-source information about TEMPEST and related topics. There is actually quite a large body of unclassified information available about this subject (much of it on the Net). My goal is to provide a useful reference for those interested in emanations security as it relates to intelligence, computer security, and privacy issues. Joel McNamara joelm(a)eskimo.com Disclaimer: I've never been involved with the TEMPEST community, had a security clearance for TEMPEST, or have access to classified material relating to TEMPEST. Like most good intelligence gathering, the information on the above-mentioned page is completely derived from publicly available, unclassified sources.

1 0

Re: Securing ActiveX.
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Bill Frantz <frantz(a)netcom.com> wrote in article <59721c$t8o(a)life.ai.mit.edu>... > At 7:19 AM -0800 12/17/96, Blake Coverett wrote: > >I would be happier running an ActiveX control with Peter Trei's signature > >on it > >than I would an unsigned control in a sandbox. (This kind of a trust decision > >is probably the normal case in the intranet world. ActiveX as it sits is > >quite > >sufficient for rolling out internal intranet applications.) > > While I might agree about Peter, I wouldn't agree if the signature was > Microsoft's (or any other large software vendor). There is just too much > room for bugs and or Trojan horses to enter via that route. I fail to see what the fuss is about. there are clearly advantages to having a good operating system architecture which provides protection for running applications and allows fine grained control over access to sensitive resources. The problem with the Java Sandbox model is that its all or nothing. In order to protect the user it allows the applet access to nothing that is important. As a result the applet can perform no function that is of importance. "Give us your corporate strategy and billing record and we will give you dancing beans on your screen" as one wag put it. I am still waiting to see a Java applet that does anything usefull. Most do no more than an animated gif would. The most elaborate are little more than carbon copies of the standard computer games. The download problem really is not that hard. The big problem is content. So far nobody appears to have the remotest idea how to use Java and I expect it to be about five years before the model emerges. From hypercard to the Web took ten so don't expect it to be overnight. The Microsoft bashing could be given a rest. Bill G. wins only because the rest of the market gave up. Stick a non computer litterate person in front of UNIX, Lotus 1-2-3 for MS Dos or Wordperfect for MS-Dos. If you don't realse then why Bill won you should try another career. MS-DOS and Windows are crappy O/S because they lack the type of memory protection that VMS and UNIX have. This was in part incompetence but mostly Intels disastrous design for the 80286. Meanwhile Apple managed to produce an inexcusably bad O/S without protection on a chip that had excelent provision for it. If you want your applet to do anything of use then the Java security model is inadequate. It is usefull for the software developer to have a rich security model since it makes it much easier to build secure software. Under VMS there are 32 different priviledges allowing fairly fine grained control. It is possible in some cases to access a wider range of resources by nafarious tricks but its hard to do something bad by accident. Phill

1 0

Ping of Death?
by james＠hotwired.com 17 Dec '03

17 Dec '03

Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of hostile code, disguised as a mere ping, that can lead to server rebooting. James Glave Technology Assignment Editor, Wired News, http://www.wired.com/ Producer, Packet, http://www.packet.com/ Phone: 1.415.276.8455 Fax: 1.415.276.8499

4 3

UNIX crypt
by Anne Carasik 17 Dec '03

17 Dec '03

I'm sure this has been discussed before, but this has come to mind recently. Has UNIX crypt been broken? If so, what was used to break the encryption? Are there any documented cases of it? Thanks for your help, AC --------------------------------------------------------------- /_ __ / Anne Carasik / Professional Services Organization / / /_/ / TN 919.460.2368 / Raleigh Sales Office / / Fax 919.460.2249 / stripes(a)m3142axc.ssr.hp.com All opinions expressed are mine, no one else would want them

1 0

Van Eck's TEMPEST Paper
by John Young 17 Dec '03

17 Dec '03

As a supplement to Joel McNamara's exemplary new TEMPEST page, and thanks to Steve Schear, we've put Van Eck's 1985 paper on TEMPEST at: http://jya.com/emr.pdf (702 kb) It's a finely detailed paper on EMR snooping with copious graphics. As Joel and Seline note, it may be purposely misleading on TEMPEST, (as appropriate to TEMPEST legends; Seline's may be bent as well, but who knows what the disinfoes know). Read Joel's page for the bright light facts.

1 0

Microsoft IE may not work without censorship files
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thought you'd find this amusing. Some names may have been changed to protect the innocent. - -rich - ---------- Forwarded message ---------- Date: Tue, 17 Dec 1996 15:24:36 -0800 From: Alice D'Anonymous <> To: win95netbugs-owner(a)lists.stanford.edu Subject: Inernet Eplorer I reqiure assistance in obtaining my internet explorer connection. I made an error while deleting cache, history and temp files which somehow prevents me from hooking up to Microsoft's Explorer. In the control panel I attempt to click on the Internet Icon and the following occurs: A Content Advisor box appears and states the following: Content advisor configuration information is missing. Someone may have tried to tamper with it. Check content Advisor Settings. End of quote. In the internet properties box, I tried to look for what they recommended but was not sure what to look for. I have the Windows 95 disk. Could you please advise accordingly. P.S. Netscape works fine. I previously had Internet Explorer woking before I cleaned house. Thanks... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMrcuKZNcNyVVy0jxAQF7dgH+JZt25esoFtkgsVx/p6iRJkvQVvkYpSDr OKoAL4PB01++okGIKOCGPdWC+Uxs9cQJTX+4ZW/8CTN5aHX/D2glmg== =qsrc -----END PGP SIGNATURE-----

1 0

Re: Ping of Death?
by ! Drive 17 Dec '03

17 Dec '03

read about it here http://www.sophist.demon.co.uk/ping/ At 02:39 PM 12/17/96 -0700, you wrote: >Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of >hostile code, disguised as a mere ping, that can lead to server rebooting. > >James Glave > >Technology Assignment Editor, Wired News, http://www.wired.com/ >Producer, Packet, http://www.packet.com/ >Phone: 1.415.276.8455 >Fax: 1.415.276.8499 ------------------------------------ pgp KeyID 3D932EA9 pub key available via mailto:pgp-public-keys@keys.pgp.net subject: get drink(a)aa.net

1 0

Computer crime prompts new parole restrictions
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, I saw this article in the nando.net paper today and was interested in your thoughts on it. It looks like people on probation will be limited in there use of encryption and access to the Internet. To me, it seems like this could be equated to preventing people on probabtion from using something like a phone. I am having problems with it because I feel these limitations are too severe. I mean, a good way someone on probabtion to make a living is to learn how to use the web and prehaps get a job as a html coder. There is a hacker I know of (Kevin Poulsen) who is prevented from using computers during his current probation and it really has limited his options alot. I curated and maintain a website for him at URL: http://www.catalog.com/kevin/ where this issue is dicussed. It also seems to me that preventing people on probation from using encryption would be difficult especially when encryption is used in webservers (ie Netscapes Secure Server). One could accidentally access one and not know that he was sending/receiving information via an encrypted channel. thanks, -lile http://www.nando.net/newsroom/ntn/info/121796/info1_7523.html ---------------------------------------------------------------------------- Computer crime prompts new parole restrictions ---------------------------------------------------------------------------- Copyright © 1996 Nando.net Copyright © 1996 The Associated Press WASHINGTON (Dec 17, 1996 07:42 a.m. EST) -- The U.S. Parole Commission has approved restrictions on the use of computers by certain high-risk parolees. The Justice Department announced Monday that the panel voted this month to authorize such restrictions as requiring certain parolees to get prior written approval from the commission before using an Internet service provider, computerized bulletin board system or any public or private computer network. Other restrictions would: prohibit particular parolees from possessing or using data encryption programs, require some parolees to agree to unannounced inspection of computers by probation officers, require some parolees to compile daily logs of computer use or to pay for equipment to monitor their computer use. "Unrestricted access to the Internet and other computer online services can provide sophisticated offenders with new opportunities for crime and criminal associations," said Edward F. Reilly Jr., commission chairman. "We cannot ignore the possibility that such offenders may be tempted to use computer services to repeat their crimes." The commission noted a surge in "how-to" information on child molestation, hate crime and the illegal use of explosives available on the Internet and on computer online services. Copyright © 1996 Nando.net Do you have some feedback for the Nando Times staff?

1 0

The virus I got...
by Vincent Padua 17 Dec '03

17 Dec '03

There was an e-mail sent to the list that had attached to it a virus. Well lucky me I got. It was a .com file that apparently turns your files into directories. I can't boot into Win95 since it turned my HIMEM.SYS into a directory. So, I seem to have fixed that, but now it says "access denied" and then prompts me with C:\>. Did anyone else get it? Has anyone heard or fixed this virus? Thanks //Vince

4 3