December 2003 - cypherpunks-legacy

cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf vulnerability? cheers, -paul

3 2

Re: Counterproductive Dorothy Denning Flames
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, they feel compelled to harrass anyone who's smarter / more > knowledgeable than they are (sometimes using the anonymous remailers) in > an effort to drive all intelligent discussion off their "private mailing > list", so ignoramuses like Bradley can sound like "local experts". I think you might be missing the very succinct and subtle point that all you ever contributed to this list (despite your knowledge of cryptography) was rants about sovok jews and Tim Mays sexual orientation. I happen to be knowledgable about cryptography but even if I`m not an expert I do tend to post things that are of value and interest as opposed to worthless flames. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

First Contact
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Is there anything in First Contact to do with Crypto at all? Just that it opened out here today, and I'm going to see it. Yours Sincerely, Benjamin Grosman ------------------------------------------------------------- bgrosman(a)healey.com.au -- http://www.healey.com.au/~bgrosman/ PGP Encrypted Mail Preferred -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzKNX9oAAAEEAOIx4HkRU4vckgguzERhVCxgy5psmngHUoW10Xl8kBkjnuc/ ACysH1K98UXlGfet9zjn/XN4RMnGq64EHXvJu56H7OHhwhoerTpVIW5MUYt+QExk KKnRNrdq8WVGoaMywSM4qKbaJr8aNMBWkldUKR4NElvAjIEEO9z0msNPp33RAAUR tClCZW5qYW1pbiBHcm9zbWFuIDxiZ3Jvc21hbkBoZWFsZXkuY29tLmF1PokAlQMF EDKNX9vc9JrDT6d90QEBxVYEAL5nw1NiyaPpG8R2x7lNcqOcavj/cCmDYT8swT02 Z0AO0C7PGpgp9V38Yyki0FB3yaiJhIQ3Kw6xCtuI8f1F4Vfql/nZebzQERl8kTa4 sI/4xSKRT/Riw/wSGupagU1F1wYIPlXOCdUilIfLzVf4IOsxKjJMdm7aKladSxkV N7Yg =Yapx -----END PGP PUBLIC KEY BLOCK-----

3 2

The House Rules At The Permanent Virtual Cypherpunks Party
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is a document I just hacked. I am breaking several of the Rules by posting it, since I am not actually subscribed to cypherpunks right now. Enjoy. Bryce - ------- 0. Hello Welcome to the cypherpunks mailing list! Starting now, you will receive hundreds of email letters every week on the subject of privacy and social change in an age of cryptographic networks. PLEASE, for everyone's sake, SAVE THIS MESSAGE! If you ever want to remove yourself from this mailing list, you can send mail to <majordomo(a)toad.com> (NOT <cypherpunks(a)toad.com>) with the following command (correctly spelled) in the body of your e-mail message: unsubscribe cypherpunks Their Name <them(a)theiraddress.xxx> Here's the general information for the list you've subscribed to, in case you don't already have it: I. Etiquette -- The House Rules At The Virtual Cypherpunks Party The Meta-Rule: It's John Gilmore's virtual house. He is the sole owner of the computer (toad.com) that hosts cypherpunks and the sole authority over what the users of that computer (you) can do with it. Rule 1: Do not _ever_ send email to the list <cypherpunks(a)toad.com> asking how to accomplish some administrative task like unsubscribing yourself. If you do, you will be roundly flamed, and nobody will answer your question. Instead, send email to <majordomo(a)toad.com>, or read the "Administrivia" section below. Rule 2: Don't forward articles from other forums to cypherpunks. We can find it ourselves the same place you did if we want to read it. If you have something useful to say about the article, then consider writing a review of the article or a response to it and posting _your_ article along with a pointer to the original article. Rule 3: Don't cross-post articles to cypherpunks as well as to other lists. Rule 4: Read before you post. If you are new, don't post at _all_ until you have read a few weeks of discussion. Rule 5: When replying to a message, ask yourself if more than a thousand other subscribers really need to see your response, or if is more appropriate to reply privately. Rule 6: Don't ask questions which are already answered in the resources described below. How can you know whether your question is already answered in those resources? Simple: read them. Rule 7: Don't publically reply to someone just to flame him/her because it makes you feel better. We are not here to make you feel better; we are here to read quality discussion about certain issues. Some people actually _specialize_ in tempting their adversaries into publically flaming them. Don't be a stooge by falling for it. Advice: The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQs referenced below. These documents are a good introduction. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. We've noticed that people who post a lot usually have less to say. Refrain from contributing too much. Re-read your article before your send it. Then re-read it again. I'm serious-- go back over it _twice_. Really. It helps. Assume any message from you to the list, no matter how insignificant or casual, is archived somewhere for eternity for future employers and acquaintances to read (it probably is). You may even wish to unsubscribe right now and then re-subscribe under a "nym," rather than using your true name, if your views are especially controversial or your job prospects are sensitive. II. Administrivia -- How To Unsubscribe And Stuff If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net (Is Eric still doing this?) This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The majordomo address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. [There is no digest version available.] (We should put in info here about subscribing to Alan's digest at gateway.com and the 2(?) filtered versions of the list here. Does someone have all that?) There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. III. About Other Forums There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as it says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. If you are beginning to use PGP and have questions, you can also subscribe to the PGPusers list by sending mail to pgp-users-request(a)rivertown.net with a subject of subscribe, or as an alternative way to subscribe use their Web Mailing List Gateway at http://pgp.rivertown.net/#Subscribe IV. About Net.Loons On cypherpunks The cypherpunks list has attracted a fair number of net.loons in its day. If you see an inflammatory article that seems too crazy to be serious, then it probably is. The hallmark of these loons is rudeness, and the preferred policy in just to ignore their postings (tempting as it is to respond). Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. V. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. D. For a more technical, lower volume, and much less policy-politics oriented list, you might try to subscribe to the coderpunks list, which branched off of cypherpunks some time ago, due to frustration with loons. It also runs at toad, and you can be considered for subscription by sending mail to Majordomo(a)toad.com with these words in the body of the message: subscribe coderpunks Their Name <them(a)theiraddress.xxx> E. The Snake Oil FAQ, by Matt Curtin & others, located at: http://www.research.megasoft.com/people/cmcurtin/snake-oil-faq.html Has some useful warning signs to keep in mind. "Snake Oil," here, means "weak cryptography," which brings us to... F. An incomplete cypherpunks translation list: PGP -- Pretty Good Privacy software. PRZ -- Philip R. Zimmermann, PGP's author. GAK -- Government Access to Keys (for crypto, but it might as well be for your front door). KRAP -- Key Recovery Access Program (a brand new flavor of GAK). TLAs -- Three Letter Agencies (the alphabet soup of the US government -- FBI, DEA, IRS, CIA, DIA, NRO, ATF, NSA -- all your favorites). NSA -- the US National Security Agency in Fort Meade, Maryland, responsible for encryption codes and computer security for the entire US government. LEAs -- Law Enforcement Agencies (see above, at least when they're not busy breaking the law themselves...). ITAR -- International Traffic in Arms Regulations. A silly US government regulation outlawing the "export" of strong cryptography software which is all over the planet anyway. [Please suggest other resources and acronyms.] IV. Famous last words My preferred e-mail address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric [From here on I changed/added nothing (it's gospel, after all:). -- JMR] - ---------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated 11/28/95] -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMp2nikjbHy8sKZitAQGoiQMAgAfvKA0751PAW6ivMQ0+KQfa19cuueFY VqPWxJSMXBE+8v37+sx6nn7FN/qFYkoccaBkOJdOZb7zu2kX+ptV/T153F6cFFFT 6RULRhMKQOiWB7JV+fdr2QV136hR8U/1 =AKDO -----END PGP SIGNATURE-----

9 23

Counterproductive Dorothy Denning Flames
by mpd＠netcom.com 17 Dec '03

17 Dec '03

William H. Geiger III writes: > Dorthy Denning is a boot-licking fasicist!!! > William Reinsch is a lying bastard. Fucking politions!! > Fucking goverment!! They all deserve a long rope!! It is perhaps a point in Dr. Denning's favor that her most vitriolic detractors can spell neither "Dorothy" nor "fascist". I must admit that I am at a loss to understand the heat which Dorothy Denning generates on the Cypherpunks list, which seems to be second only to the heat generated by posting recipes for roast feline in rec.pets.cats. All of the people I know who have met her find her to be a pleasant person, and the occasional Email messages we have exchanged have certainly been positive and friendly. While she tends to view the Four Horsemen of the Infocolypse as a bit more threatening than the typical Cypherpunk, I don't think her views are so extreme as to justify the continuous screams of "crypto toady", "government suckup", and "wicked witch" which seem to pop up in response to her every utterance. I would even go so far as to say that this list would be a lot more entertaining if she were contributing to it, and sci.crypt is certainly a less interesting place now than it was in bygone days when she was posting there. Perhaps Tim can add his own thoughts to this thread. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 10

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 06:08 AM 11/26/96 -0800, Paul Pomes wrote: >There are some commercial products worth studying. See ><http://rainbow.rmi.net/~comscire/> for one. Thanks for the reference. However, I was very unimpressed with their price of $295 dollars. I don't doubt that there are certain organizations (banks?) which would have no problem affording them, but that's well out of the range of ordinary consumer items. I just bought a 10x CDROM drive for $100; somehow I think that a hardware RNG should cost less than that. Volume is a big issue, I suppose. Jim Bell jimbell(a)pacifier.com

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

I would say that depends on -where- &/or -how- you store the premaster/master, and is dependent on platform threat models rather than attacks on the wire. These are different problem spaces with different solutions, which some contemplated changes to SSL may help address: some tweaks may be useful to support more secure secret management on the platforms. But I would not go so far as to say that these issues make SSL or an implementation insecure per-se, until I did the complete job. If my platform is compromised such that the master or premaster secret can be subverted, then I have problems that go way deeper than SSL or a particular implementation of it. Would you like to propose some fixes? We would be very interested. Ben Laurie wrote .... >SSL requires the keying material to be available at all times. This is rather >different from many applications of cryptography, where one can keep keying >material safely locked away except when it is needed. > >This is the inherent vulnerability. > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

Well, then, tanslation: "I say SSLEAY is not secure - but to actually do the homework to back my assertion then someone has to pay me." Hmmmph. Not very useful. Nor credible. >I think I would discuss this with the author before going public, to give >him the usual opportunity to clean up before all hell breaks loose. However, >that is what I'd call "work" rather than "fun", so I'd want paying for it. > >No doubt I'll take it up with Eric at some point, when neither of us has >anything better to do. > >My impression is that Eric is more interested in speed and functionality than >strict security (and considering the incredible vulnerability that is more or >less inherent in an SSL implementation, I feel the same). I could be wrong, of >course. > >I will say that I'm not aware of any problems that a good firewall and physical >security don't take care of. That isn't to say there aren't any - I haven't >looked that hard. > >Cheers, > >Ben. > >> >> >I've never seen a security review of SSLeay, and if anyone gave it a clean >> bill >> >of health, they didn't have their eye on the ball. Note, I'm not knocking >> >SSLeay here, it is a wonderful lump of code, but it hasn't been written with >> >security in mind (IMHO). >> > >> >Cheers, >> > >> >Ben. >> > >> >-- >> >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >> >Freelance Consultant and Fax: +44 (181) 994 6472 >> >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >> >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >> >London, England. Apache-SSL author >> > >> > > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

News Release (USCIB): Tuesday, November 26, 1996 Banks Making Sweeping Changes in Operations to Meet Challenges of International Markets Study finds international banks applying mix of reengineering and new technology to improve operations. In an effort to reduce costs and boost productivity, international banks are reengineering their operations departments and updating technology at increased rates, according to a two-year study of top international banking operations officers conducted by the U.S. Council on International Banking (USCIB) and the USCIB Foundation. Operations departments, which generally maintain activity other than retail banking or customer service, are becoming increasingly critical in international banking, due to the explosive growth of transnational business and the convergence of commercial and investment bank activities. Such industry developments have left many corporate clients looking for "one-stop shopping" for their banking matters as an easier way to meet their financing needs. At the USCIB Annual Conference in mid-November, it was noted that banks are going to have to employ more agility in order to satisfy their corporate clients' escalating demands for simplicity. The increasing cost of running an operations department is also forcing executives to take a sharper look at where they can trim their budgets. According to the USCIB study the annual operations department budget is now $ 15 million, compared with $ 9 million in 1995, an increase of more than sixty-six (66%) percent. In more than half (52%) of the operations departments surveyed, labor costs accounted for fifty (50%) percent or more of their budgets. To reduce costs, executives have turned to reengineering and downsizing. Thirty six (36%) percent have reengineered their departments, and of those, sixty-three (63%) percent reported the action had reduced costs and improved productivity. Nearly one-half (49%) of operations executives have either downsized their departments in the past year or plan to in the one to come. In addition, all of the executives surveyed plan to invest in technology over the next 12 months in order to speed up operations and handle the increase in international transaction banking. Ninety-six (96%) percent of respondents say they will invest in technology, up from eighty-nine (89%) percent in 1995. Just under half of surveyed operations departments use a technology system that is over three years old, and sixty-three (63%) percent of prospective buyers expect to spend more than $100,000 to replace or upgrade aging equipment in the next year. The U.S. Council on International Banking (USCIB) is a national association representing more than 320 U.S. and foreign-based financial institutions with operations or subsidiaries in the United States. One of the oldest U.S. banking associations, the USCIB works to standardize international banking rules and practices, serves as advocate to U.S. and international regulatory bodies on policy issues that affect its membership, and provides training and information to bankers throughout the United States. This study included 55 of its members and other executives and was conducted in late July and August, 1996.

1 0

Re: cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i think that i understand what you are trying to say, however, my purpose in asking for this information has nothing to do with what i know. i am pulling together a series of tests for our firewall, and am not satisfied that the entries/cracks that i know are the only ones that exist, therefore, i ask others for their input. seems reasonable, doesn't it? thanks for you response. cheers, -paul > From deviant(a)pooh-corner.com Fri Nov 29 12:55:52 1996 > Date: Fri, 29 Nov 1996 17:54:10 +0000 (GMT) > From: The Deviant <deviant(a)pooh-corner.com> > X-Sender: deviant(a)random.sp.org > To: pjb(a)ny.ubs.com > cc: cypherpunks(a)toad.com > Subject: Re: cgi-bin vulnerability > Organization: The Silicon Pirates > MIME-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Content-Length: 1025 > > -----BEGIN PGP SIGNED MESSAGE----- > > On Fri, 29 Nov 1996 pjb(a)ny.ubs.com wrote: > > > does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf > > vulnerability? > > > > cheers, > > -paul > > > > If you can't figure out how, you probably don't need to know. (actually, > its so simple the average high school student could probablyfigure it out, > if they knew what %0A meant... oops.. wasn't supposed to tell you that... > ;) > > --Deviant > PGP KeyID = E820F015 Fingerprint = 3D6AAB628E3DFAA9 F7D35736ABC56D39 > > "All in all is all we are." > -- Kurt Cobain > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQEVAwUBMp8jSjCdEh3oIPAVAQFkoAf+Nu62ObHyWHgDvkWAqqH7QTw4svfkELTB > d5E8S1ghkyxL1219LwGljelQ+uHaZt4EGB/nnDfQo7H2J9fMDR1CLJRC+h95xxKM > mKuAVbVT1W3nPm4+WP5DIplMvF/xVmextdbGLmAfYQksXQ4uGNRuaawS9G2ffYLP > erBEN9XuxvVY0AnTYCErnpDdOhh4BNTi2+os86Ea+mXt2FG3D8y0pdfRSnOJm2YU > yvQ7pUrMfhl9DGauc+lvb42B8OXWElnjYIFloxWr+rxACzS6NCbGF3izjfTv+2HX > tRZUuwYNee3j+p7kDY9ebANJqWUcMtR9To5za1/vlA4QAtPl5HsaVw== > =3/ok > -----END PGP SIGNATURE----- > >

1 0