December 2003 - cypherpunks-legacy

http:--cnnfn.com-digitaljam-wires-9702-11-hackers_wg-
by Jim Choate 17 Dec '03

17 Dec '03

Click here to download the shareware YOU want at ZDNet [INLINE] Digital Jam hackers graphic Hackers victimize firms Experts tell House panel breaking into networks is too simple February 11, 1997: 6:17 p.m. ET [INLINE] Hackers and Feds in Vegas - July 31, 1996 Internet firms make hacking pay - April 12, 1996 WASHINGTON (Reuter) -- Hackers are finding it easier to break into computer networks and steal money, partly because companies are reluctant to admit that they are vulnerable, security experts said Tuesday. [INLINE] "If I want to steal money a computer is a much better tool than a handgun," Daniel Geer, engineering director for Open Market, Inc., told a House of Representatives technology subcommittee hearing on computer security. "They start out stealing $1,000 a day and figure they can get away with $2,000 a day and then they get greedy and hit some figure which sets off alarm bells." [INLINE] A panel of experts assembled by the subcommittee said many companies refuse to report breaches in their security because they want to avoid negative publicity and embarrassment. [INLINE] "Most computer crimes are not reported," Eugene Spafford of Purdue University told the panel. He estimated losses run into "hundreds of millions of dollars" but said no one really knows since so much goes unreported. [INLINE] Daniel Farmer, a security consultant, said penetrating a computer system is relatively easy. "Just using simple tests, I could break into two-thirds of the systems I tried," he said, adding that he could easily raise that figure to three-quarters if he wanted. [INLINE] Farmer said that during his tests he even discovered a problem with the White House World Wide Web site and told the system manager about it. He said he never received a reply. [INLINE] "Defensive programs have been overtaken by offensive programs" developed by hackers, he said. [INLINE] Spafford said law enforcement has kept pace with advances made by hackers who are able essentially to take over entire networks and run them by remote control. [INLINE] In addition to banks and corporations, the experts said, government secrets can be stolen and used to threaten national security. They cited recent computer network tampering at the Justice Department and the CIA. [INLINE] A General Accounting Office study recently found that there were 250,000 "hits" aimed at the Defense Department's computer networks last year and 65 percent were successful. Link to top home | digitaljam | contents | search | stock quotes | help Copyright 1997 Reuters. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. Copyright © 1997 Cable News Network, Inc. ALL RIGHTS RESERVED.

1 0

Computer break-ins
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable To: cypherpunks(a)toad.com Date: Tue Feb 11 22:14:30 1997 U.S. Experts: Computer Break-Ins Go Unreported U.S. Experts: Computer Break-Ins Go Unreported February 11, 1997, 4:19 PM EST WASHINGTON (Reuter) - Security experts said on Tuesday hackers are finding it easier to break into computer networks and steal money, partly because companies are reluctant to admit that they are vulnerable. ``If I want to steal money a computer is a much better tool than a handgun,'' Daniel Geer, Director of Engineering for Open Market, Inc., told a House of Representatives technology subcommittee hearing on computer security. ``The only way they get caught is if they cross some threshold,'' he said. ``They start out stealing $1,000 a day and figure they can get away with $2,000 a day and then they get greedy and hit some figure which sets off alarm bells.'' A panel of experts assembled by the subcommittee said many companies refuse to report breaches in their security because of they want to avoid negative publicity and embarassment. ``Most computer crimes are not reported,'' Eugene Spafford of Purdue University told the panel. He estimated losses run into ``hundreds of millions of dollars'' but said no one really knows since so much goes unreported. Daniel Farmer, a security consultant, said penetrating a computer system was relatively easy. ``Just using simple tests, I could break into two-thirds of the systems I tried,'' he said, adding that he could easily raise that figure to three-quarters if he wanted. Farmer said that during his tests he even discovered a problem with the White House World Wide Web site and told the system manager about it, but never received a reply. ``Defensive programs have been overtaken by offensive programs'' developed by hackers, he said. Spafford said law enforcement had not been able to keep up with advances made by hackers who are able essentially to take over entire networks and run them by remote control. In addition to banks and corporations, the experts said, government secrets can be stolen and threaten national security. They cited recent computer network tampering at the Justice Department and the CIA. A General Accounting Office study found that there were 250,000 ``hits'' aimed at the Defense Department's computer networks last year and 65 percent were successful. =A9 Reuters Ltd. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMwE1lz5A4+Z4Wnt9AQHlrAQAi4X7MTb8CbWTaQZfdLIfwzkMkzT1g/gi QPcdaPedbgG6tU8SBS5trqyXu5JvwaVomEUpW+qrKT0JzD8a1Lyf23dgK5qLM+/+ fDWz08KaxsW3uymTRNBZo2gl/ZwpdU7DeQoReOkAqQyBXPWeoBRwYbyGu1pDlHBB yK3hRY2MrEk= =Ht0R -----END PGP SIGNATURE-----

1 0

Re: whois cypherpunks.org ?
by John Young 17 Dec '03

17 Dec '03

cypherpunks (REMAILER-DOM) 1819 Woolsey St. Berkeley, CA 94703 Domain Name: REMAILER.NET Administrative Contact: Hughes, Eric (EH9) eric(a)SAC.NET (415) 392-0526 Technical Contact, Zone Contact: Levy, Elias M. (EML2) aleph1(a)DFW.NET 619-794-8383 (FAX) (619) 794-8373 Billing Contact: Hughes, Eric (EH9) eric(a)SAC.NET (415) 392-0526 Record last updated on 17-Oct-96. Record created on 09-Nov-94. Domain servers in listed order: FLYING.FISH.COM 140.174.97.13 NS1.SAC.NET 208.146.161.2 ---------- CypherPunks (CYPHERPUNKS-DOM) 9705 Standford Road Ft. Meade, MD 20755 Domain Name: CYPHERPUNKS.COM Administrative Contact, Technical Contact, Zone Contact: Levy, Elias M. (EML2) aleph1(a)DFW.NET 619-794-8383 (FAX) (619) 794-8373 Record last updated on 14-Sep-95. Record created on 14-Sep-95. Domain servers in listed order: NS1.CYBERWORKS.NET 206.170.116.21 NS2.PARANOIA.COM 207.239.130.25 WKP.COM 205.199.64.11 ---------- CypherPunks Group (CYPHERPUNKS3-DOM) 9705 Standford Road Ft. Meade, MD 20755 Domain Name: CYPHERPUNKS.ORG Administrative Contact, Technical Contact, Zone Contact: Levy, Elias M. (EML2) aleph1(a)DFW.NET 619-794-8383 (FAX) (619) 794-8373 Record last updated on 03-Oct-95. Record created on 03-Oct-95. Domain servers in listed order: NS1.CYBERWORKS.NET 206.170.116.21 NS2.PARANOIA.COM 207.239.130.25 WKP.COM 205.199.64.11 ---------- Cypherpunks (ANONYMOUS-DOM) PO Box 170608 San Francisco, CA 94117-0608 Domain Name: ANONYMOUS.NET Administrative Contact, Technical Contact, Zone Contact: Gilmore, John (JG150) gnu(a)TOAD.COM +1 415 221 6524 (FAX) +1 415 221 7251 Record last updated on 24-Jun-93. Record created on 24-Jun-93. Domain servers in listed order: CYGNUS.COM 205.180.230.20 RTL.CYGNUS.COM 205.180.230.21 ----------

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Sean Roach 17 Dec '03

17 Dec '03

At 10:45 AM 2/11/97 -0600, Firebeard wrote: >>>>>> John Gilmore writes: > >JG> Sandy has agreed to continue moderation through the end of the >JG> original 1-month experiment (through Feb 19). And it's a good >JG> thing, too, because the "cypherpunks community" had better get off >JG> its whining butt in the next ten days, or it will no longer exist. > >[...] > >JG> This is a "put up or shut up" to the cypherpunks community. > > This appears to be as good a time as any to announce that I'm >"putting up". I've already taken steps, along with Jim Choate, to >start a network of majordomos hosting a Cypherpunks mailing list. I >didn't intend to announce this until Jim and I had gotten the first >pair of 'domos working properly, but this means that we'll need to >speed things up. Our intention is to have a set of majordomos which >are intersubscribed to a cypherpunks list on each one, with measures >taken to ensure that mail loops don't develop. As the resulting >mailing list from each 'domo will be identical, periodically >(initially weekly), the subscriber lists of all of the participating >majordomos will be compared, with any duplicate subscribers being >removed from the 'domo(s) with the longest subscriber list.... You might want to set up a temporary majordomo on the same machine as one of the permanent daemons for debugging purposes. It is conceivable to me that a message might be sent to one sub-list, be forewarded to two lists, and then each of those foreward the same message to each other, causing duplication. You might get around this if the daemons keep track of each others, unique, message ID numbers. In other words, if each unit were to apend the message ID with a personal ID number when the message came from someone other than a majordomo, then they could collate them by number, eliminate duplications, and send them on down the line. To do this, the majordomo daemons will probably have to have a guaranteed seat in the front of the cue. This is probably a stupid point to bring up as you have probably already cured this problem, but I decided to post it anyway.

1 0

Re: Recommendation: Creation of "alt.cypherpunks"
by snow 17 Dec '03

17 Dec '03

> (Please leave my name in any replies to ensure I see your comments.) > I talked to Hugh Daniel at the Saturday meeting about the creation of an > "alt.cypherpunks" unmoderated (of course) newsgroup as a possible > alternative (or supplement) to cypherpunks(a)toad.com. Greg Broiles and John > Gilmore were there for part of the discussion, too. Might "we" get wider propigation with something like "talk.issues.crypto" or "talk.cypherpunks"? > Charter for alt.cypherpunks: (suggested) > "Alt.cypherpunks is for the unmoderated discussion of cryptography and the > political, social, and economic implications of unrestricted, strong > readers are strongly advised to learn how to use filters and other tools > for making virtual anarchies manageable for their own tastes." Maybe a pointer to these tools? > * Disadvantages -Mailing lists easily penetrate firewalls, while many places don't provide Usenet access. Another possibility would be to create a "private Usenet" setting up NNTP servers that _only_ talk to each other. This would eventually allow for the same sort of redundancy that the "regular" usenet offers, provide some of the same efficient use of resources, and ease of use (almost) but provide some protection against spammers & etc. For those who don't understand, this is how it would work (and correct me if I am wrong): Usenet works by servers exchanging messages with one or more other servers it is decentralized and has no central authority (execpt the cabal --there is no cabal) inherent in the process. These servers are told _who_ they get their feed from/to, so it should be possible to set up another network of Usenet servers just to serve our purposes. As part of setting up the servers, they can be configured as to who they From owner-cypherpunks Wed Feb 12 08:00:24 1997 Return-Path: owner-cypherpunks Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id IAA22396; Wed, 12 Feb 1997 08:00:24 -0800 (PST) Message-Id: <199702121600.IAA22396(a)toad.com> Date: Wed, 12 Feb 1997 06:56:59 -0800 From: Lucky Green <shamrock(a)netcom.com> To: John Young <jya(a)pipeline.com> Cc: cypherpunks(a)toad.com Subject: Re: whois cypherpunks.org ? Sender: owner-cypherpunks(a)toad.com Precedence: bulk At 08:04 PM 2/11/97 -0500, John Young wrote: [Trying whois] Eric Hughes and John Gilmore are fouders of this list. Aleph1 is the moderator of the famous bugtraq mailing list. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: Recommendation: Creation of "alt.cypherpunks"
by Jeremiah A Blatz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- das(a)razor.engr.sgi.com (Anil Das) writes: > On Feb 11, 2:42pm, Alan Bostick wrote: > > new alt.* newsgroups are better > > received if they don't have top-level names. Using existing top-level > > hierarchies is better (e.g. alt.security.cypherpunks or > > alt.privacy.cypherpunks). > > I agree that alt.privacy.cypherpunks is the best bet, if alt.group > is the route we go. This has a number of frige benifits, too. It's lower down in the alphabetical list, so luser AOL-type people and auto-spam bots are less likely to reach alt.p* or alt.s* than alt.c*. Also, it seperates it from alt.cyberpunk and associated groups, thus maybe minimizing innappropriate x-posts. The hybrid mailing list/newsgroup system seems to me to be an excellent setup. It is resilliant to the moderation woes that a mailing list is vulernable to, and is also resistant to ISPs who don't carry alt groups. It also provides a set of mail-news gateways for people who wish to post anonymously to the newsgroup, whaile at the same time being resistant to commercial spam abuse (why use a mail-news to spam if it just goes to 1 newsgroup?). Finally, a newsgroup makes it easy to spread the gospel to the unwashed masses. Tim May's rants/essays would probably make excellent usenet memes, and having more usenet people crypto-aware can only help advance the causes of liberty and privacy. I hereby volunteer to do my best to handle all the newbie questions. Jer "standing on top of the world/ never knew how you never could/ never knew why you never could live/ innocent life that everyone did" -Wormhole -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMwEULskz/YzIV3P5AQGgNQMAgPaMmS7Wcb4kT6Mc9ak3dLZ9GjdvZmtU ZDdkLhnnJ+3IFD1RWzo7gahEXDrJtFQ3QfWhcjC/0V9EMYWBr/ITa2esNXPiuCWW KyWYblVSCeYGdrzd0MK8MJXIjX5hWZ/A =emtl -----END PGP SIGNATURE-----

1 0

Re: Moderation experiment almost over; "put up or shut up"
by John Gilmore 17 Dec '03

17 Dec '03

> - Is a pentium up to the task of running a list of this size and > volume? A pentium is definitely up to this task. I've been running it the whole time on a slower 40MB SPARCstation-2 (that also runs netnews and general computing). Give it a big /var/spool partition (mine is 60MB) because every message will sit in the queue for days (*somebody* on the list will have an unreachable name server or MX server until the msg times out). Give it lots of RAM and paging space, since each sendmail process takes about 2MB virtual, 1.4MB physical, and you will have dozens running at the same time. The new version of majordomo (that allows confirmation of subscriptions) will help a lot. It needs a small patch though, to do exponential backoff on the lock file, or when you get a flood of messages, thirty majordomo processes will burn up the whole machine trying and failing to get the lock file. You'll need a BIG mailbox for the bounce messages, and someone (or some unwritten software) to scan it every day or two and delete the lusers whose mailboxes are full or who dumped their account without unsubscribing. The bounce mailbox on toad gets between 1 and 4MB of email a day; more when the list is under attack. You'll want to run the latest version of BIND on the machine, too, since doing DNS name-lookups on a thousand email addresses is expensive. You want them all in the in-memory cache on the same machine. The name daemon burns about 7MB virtual, 5MB real RAM once its cache gets loaded. Make sure that every message sent to the list gets into at least two logfiles -- on separate partitions, in case one fills up. At least if you want to have an archive of what's been sent. > I can provide a pentium box running Linux with a T1 connection to > MAE-West to host the list, if there is still interest. Make sure you are getting "transit" service to the Internet, instead of trying to cheap out with "peering" to a few major networks. Without transit service ("we'll carry your packets to anywhere even if the destination is not on our network") you won't be able to route packets to some places on the net. This will cause mail to those subscribers to sit in the queue for days and then bounce. The real issue is how willing you are to put your own time into dealing with problems. Not only do things go wrong by themselves, but there are malicious assholes in the world who will deliberately make trouble for you just because they like to. Spending a day or two cleaning up the mess is just part of the job. Check your level of committment two or three times before taking on the task -- so you won't end up getting disgusted after a month or two and putting the list's existence into crisis again. It's not a "set it up and forget it" kind of operation. John

1 0

Cypherpunks Distributed Remailer
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 11 Feb 1997 19:18:46 -0600 (CST) > From: ichudov(a)algebra.com > Subject: Re: Moderation experiment almost over; "put up or shut up" > John Gilmore wrote: > > A pentium is definitely up to this task. I've been running it the > > whole time on a slower 40MB SPARCstation-2 (that also runs netnews and > > general computing). Give it a big /var/spool partition (mine is 60MB) > > because every message will sit in the queue for days (*somebody* on > > the list will have an unreachable name server or MX server until the > > msg times out). Give it lots of RAM and paging space, since each > > sendmail process takes about 2MB virtual, 1.4MB physical, and you will > > have dozens running at the same time. My approach to this problem has been to use a 1G drive and mount the entire file system on it. Swap and MS-Dos each get their own partitions. This allows the use of the entire drive as a buffer. I am in the process of adding another 1G in approx. two weeks with the intent of moving /home off the main drive. This not only gives the system more space but the users as well. I set swap to 4x main ram. I use Linux and have it as one giant partition even though suggested is blocks of 16M, works for me (YMMV). Would be minor to monitor df and alarm when it gets to 200M or something. I must admit however that I am looking at a faster mbrd. and a bigger hard drive in the immediate future to make up for the extra load I expect. Had not really planned on the remailer project however... > > You'll need a BIG mailbox for the bounce messages, and someone (or > > some unwritten software) to scan it every day or two and delete the > > lusers whose mailboxes are full or who dumped their account without > > unsubscribing. The bounce mailbox on toad gets between 1 and 4MB of > > email a day; more when the list is under attack. How about dumping the bounces to /dev/null? I shure don't care if some bozo's (other than mine that is) mailbox goes away. > > Make sure that every message sent to the list gets into at least > > two logfiles -- on separate partitions, in case one fills up. At > > least if you want to have an archive of what's been sent. I have no intention of acting as an archive. I personaly see that as a 'subscriber' issue. Potentialy even a business if the archive were suitably databased. Of course with the distributed model any member is potentialy capable of this. > > > I can provide a pentium box running Linux with a T1 connection to > > > MAE-West to host the list, if there is still interest. I would certainly be interested in your involvment with the Distributed Remailer. > > The real issue is how willing you are to put your own time into > > dealing with problems. Not only do things go wrong by themselves, but > > there are malicious assholes in the world who will deliberately make > > trouble for you just because they like to. Spending a day or two > > cleaning up the mess is just part of the job. Check your level of > > committment two or three times before taking on the task -- so you > > won't end up getting disgusted after a month or two and putting the > > list's existence into crisis again. It's not a "set it up and forget > > it" kind of operation. I can verify this. If I was not already having to deal with these problem as a current mailing list operator I certainly would not take on the job. It is one of the reasons I STRONGLY suggest anyone serious about this should use the resources to make money as well. Anyone capable of setting up and operating such a remailer system is at least capable of basic skills. > Another suggestion may be to set sendmail expire option to one day > instead of five so that messages that cannot be delivered would bounce > faster and not clog the queue. I like this idea very much. Myself I would set it for like 4 hours or so and if it couldn't be delivered then bye bye. Another motivation for selective sites to operate as archives without themselves being remailers. Another issue related to this is at what point to unsubscribe accounts. It seems to me that if the address times out some number of times it should be deleted. Is anyone interested in acting as a mail-to-news gateway? Jim Choate CyberTects ravage(a)ssz.com

1 0

Win '95 disk crypto...
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Forwarded message: In> Subject: SOFT> Encrypted disks for Windows NT In> From: softwinter(a)post1.com In> Date: Mon, 10 Feb 1997 03:13:22 +0200 (IST) In> Soft Winter Corporation, February 10, 1997 released: In> Shade - strong encryption software for Windows NT. In> Shade allows you to create encrypted disk device inside a file. In> Such a device can then be formatted using any file system In> (like NTFS or FAT) and used as a regular disk. The only difference In> is that Shade will encrypt the data on every write operation In> and decrypt it on every read operation. In> To download go to: http://softwinter.bitbucket.co.il In> Soft Winter Corporation, In> softwinter(a)post1.com Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMv/y1TltEBIEF0MBAQHJGAf8Cyqr97JIRraQNIS+ioHQiT5KDEozoI5w i7C1pEtMk39WX/dmmcECR561KS3/8595a4mf7bebJ9iS8Bl6ZewSHE6F/oo0biWn rLfmCVIAy23ADoww/rwLXhWxntybjQAr2kObbrPhtf8Um8KlmnJ24QTEWWbhugwx UgC+7N4gRAuxv4Qxoshey1oNeASx7cOQ3Q2REj3wsRq1WPFQMkB43lI5YcMQzlYX KgAoCRRLpnRIOpH5gq6qdC8QNs1cy3gZmfoFML/oqBhn0YaxiAs0Hz7LmlSpufgH +7APc4UpVvadRTTi65APbv1BAJQYq+dGo1fhp7Y+rgFYcEeCh4ZC8Q== =0p9D -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: List! No Way: Creati
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:attila@primenet.com to Harka <=- In> I vote we just set up a new majordomo with some additional In> antispam filters including knocking out exploding mail headers, In> etc. I would accept excluding non-members as long as we take the In> remailers which are listed with either JP or RL. Were it possible to use Perry's PGPDomo, which would effectively keep out at least the Spammers? Perry? :) Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMv/y/zltEBIEF0MBAQEnBQf/UVcg/iFUtR3hMk2zrNwZmweqE4XA3cLy ixfNNGoKO6cP0oUnSrqRoWW4LtMrHamMldBMXmFARmkh3joqgFZpzXSwCbiCSFtv yN7tDOmfzvDfI4gRpohuc7ou3rMMlbjs/lZamJAV5iByE8Kh3/phcvOmb5u9zjWK m/bcLsje39fLpIeMHL3y0jYf4Z5wyvb4dndBVeF+m50IguT9hVd3KZ4hza2XiKQr zPkX1Y2uDW1vq9/m2Wd9PLxnio5hrbOuLHdVFzTUxcVBfnJjMB0rrexW3z/2KqJ8 4V0r3xZXqui5z6k55PQTrVZt9Hqb+zVDoDAAA/tzMfHpVU+MOnM3Xg== =Jtwu -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0