December 2003 - cypherpunks-legacy

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0

Re: Why Digital Video Disks are late to market
by Anonymous 17 Dec '03

17 Dec '03

> ... there apparently has been some speculation among the U.S. PC community > that Matsushita may be stonewalling on the software-licensing issue so that > it can establish its hardware-based decryption solution in the marketplace. The day it gets published in software is the day someone runs a disassembler on it. That's all there is to it.

2 1

security breached by NaughtyRobot
by eiwasaki＠gol.com 17 Dec '03

17 Dec '03

HELP! Can anyone tell me what this message is that I received in my mail today? Is it real? Should I do as it suggests? I have used the Internet once to purchase some books? Was my credit card number stolen in the process? How did this happen and how will it affect me? What should I do? PLEASE ADVISE ASAP! Thank you for your help Ellen Iwasaki Kumamoto, Japan > From: eiwasaki(a)gol.com > Date: Wed, 19 Feb 97 02:27 CST > Apparently-From: eiwasaki(a)gol.com > Apparently-To: eiwasaki(a)gol.com > Reply-to: eiwasaki(a)gol.com > Registered-mail-reply-requested-by: eiwasaki(a)gol.com > Sensitivity: PERSONAL-CONFIDENTIAL > Precedence: EMERGENCY > Priority: URGENT > Comment: Authenticated sender is <eiwasaki(a)gol.com> > Organization: NaughtyRobot > Subject: security breached by NaughtyRobot > > This message was sent to you by NaughtyRobot, an Internet spider that > crawls into your server through a tiny hole in the World Wide Web. > > NaughtyRobot exploits a security bug in HTTP and has visited your host > system to collect personal, private, and sensitive information. > > It has captured your Email and physical addresses, as well as your phone > and credit card numbers. To protect yourself against the misuse of this > information, do the following: > > 1. alert your server SysOp, > 2. contact your local police, > 3. disconnect your telephone, and > 4. report your credit cards as lost. > > Act at once. Remember: only YOU can prevent DATA fires. > > This has been a public service announcement from the makers of > NaughtyRobot -- CarJacking its way onto the Information SuperHighway. >

2 1

"cypherpunks is dead..."
by Robert Hettinga 17 Dec '03

17 Dec '03

"...long live cypherpunks?" "So long, and thanks for all the fish?" But, seriously, folks... Lucky Green echoed many of my own thoughts when he talked about all the things being on this list has meant to him. Like Lucky, there is a rediculously huge list of things that this list has taught me over the almost three (wow..) years or so that I've been here. Thanks to all of you here, I have had nothing short of a Copernican transformation in my perception of the universe, and it completely changed what I wanted to do with the rest of my life. From the very first time I started reading this list and applying what I learned here to what I already knew, right then, for the first time in a *very* long time, I knew *exactly* how some very important pieces of the world actually worked, and more important, why they were going to change. I now *know* where the world is going to go. Maybe not when, of course, but certainly where and how. :-) (Old stock picker's joke: "I can tell you what. I can tell you when. I can't tell you both. If I did, I wouldn't tell *you*.") Anyway, I've learned all these things from many cypherpunks, some still here, and a lot who've left. I expect that, as we move into the next phase of this "group", we'll continue to teach ourselves much more about the world and strong cryptography's effect on it. But, nothing will compare to the feeling we'll get when we remember the time we've spent here at Toad Hall. We have John Gilmore to thank for the "lodgings", of course, and, certainly, for his encouragement and support. And, obviously, his tolerance, which finally sagged and broke under the weight of both his expectations and those of our own. We also have to thank Tim May for his um, ideological, presence on this list from since before it existed, :-), and, or course, for his current "leadership", both moral and political. (Of course, I can say all the next few wierd and gushy things about him without fear of refutation on his part, 'cause, in his wisdom, I'm still in his killfile ;-)) It was Tim who was our compass. It was Tim who came down from the mountain and stopped us from worshiping the fatted calf of censorship, and who is now leading us into the promised land of unfettered discourse, both on usenet and on the new cypherpunk server network. Since Tim paper-trained most of us here (myself included, though some may debate how well he succeeded :-)), that is, how to behave on this list, and, most important, how to imagine what a world of strong crytography on ubiquitous networks would look like, I now find his "leading" us out onto the net, and away from Sinai, most symmetrical indeed. :-). And so, in this last 24 hours or so on toad.com, I want to thank *both* Tim and John. But, also, I personally want to thank the "money-punks". People like Eric Hughes, and Perry Metzger, and Ian Goldberg, and Hal Finney, and Lucky Green, and Duncan Frissell, and Black Unicorn, and many, many other people, who have helped me work through, on this list, or in private e-mail, or, occasionally, in person, all of the stuff they know, and the stuff I have figured out myself. All about e$, about digital bearer certificate markets, about microintermediation. All the things which completely occupy almost all my waking thoughts these days. Because of this list's effect on my life, I have been motivated to start the Digital Commerce Society of Boston, to evangelize financial cryptography to any audience who would listen to me, to create a web site dedicated to e$, to create a group of e$ lists with some 300 total subscribers, to work with Vinnie Moscaritolo to create both the Mac-Crypto lists and conferences, to work with Vince Cate and Ray Hirschfeld to create the world's first peer-reviewed conference on financial cryptography, and with Vince and Ian Goldberg to create the world's first intensive financial cryptography bootcamp (which is going on as I write this). To create, with Vinnie, and Rachel Wilmer, and Anthony Templer, and Bob Antia, and Rodney Thayer, the next generation of the e$ website and mailing lists. Next week, I go to FC97 in Anguilla because of the things I've learned on this list. In the middle of March, I go to Cupertino to help Vinnie with Mac-Crypto 2.0, because of the things I've learned on this list. I've been invited to speak all over the world (and New Hampshire, too :-)) to talk about this stuff. I get quoted in the newspapers. I write magazine op-ed pieces. It has even earned me a buck or two. :-). In short, I owe everything I do of any consequence these days to my participation on this list, and, for that, I'm profoundly grateful to all of you for the privelege of being here: to listen, to learn, and, occasionally, to pay back all the stuff I've learned with a thing or two that I've worked out myself. Like that creosote bush I talked about before, cypherpunks is not going to die just because the address "cypherpunks(a)toad.com" ceases to exist. There are already 3rd-order cypherpunks lists out there. 3rd generation copies of the same "memetic" material. cypherpunks will *never* die, short of a cybernetic Chixalub event of some kind, and, frankly, even then. The internet sees censorship as damage and routes around it. So. In a very real sense, today on cypherpunks is like any other day in the life of a creosote bush. It's a big desert, folks. We're the only ones who know how to live out here. The whole damn desert, as far as the eye can see, is ours to move into. All we have to do is keep filling in the empty spots... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

4 3

Re: Anguilla is not Marxist!
by networks＠vir.com 17 Dec '03

17 Dec '03

Just an interesting point here about the absence of * and # keys on Anguilla's phones... The US is not immune from similar anti- competitive tactics at pay phones. A number of new pay phones now have only numbers on their keypads (no letters). The reasoning behind this is that people will not be able to place their long distance charges though other companies (e.g. 1-800 CALL ATT etc.). Alan networks(a)vir.com

1 0

DES_pon
by John Young 17 Dec '03

17 Dec '03

3-10-97 "U.S. Diplomat in Germany Reported Expelled for Spying" A U.S. diplomat is reported to have been expelled from Bonn, after being accused of committing economic espionage against Germany, one of Washington's staunchest allies. ----- DES_pon

1 0

Failed mail
by NTMail 17 Dec '03

17 Dec '03

--------------------------------------------------------------------- Your message to mail.astrobiz.com was rejected. I said: RCPT To:<<debbi(a)astrobiz.com> And mail.astrobiz.com responded with 553 <<debbi(a)astrobiz.com>... Unbalanced '<' --------------------------------------------------------------------- Your message follows: >Received: from [206.155.199.70] by smtp1.abraxis.com (NTMail 3.01.03) id sa227154; Tue, 11 Mar 1997 10:02:33 -0500 >Subject: Citizens affecting with but >Enemies >Date: Tue, 11 Mar 1997 10:02:33 -0500 >Message-Id: <15023345500546(a)abraxis.com> > >no State several >be > >but. erected shall >of be for the >of as > >United of. to seventh and Lord >Hamilton be States > >by >the assembled. chosen of >God Creator destructive effect >by such Britain wholesome. He at >.

1 0

Re: Anguilla
by Wayne Clerke 17 Dec '03

17 Dec '03

> From: Vincent Cate <vince(a)offshore.com.ai> > To: Charles Platt <cp(a)panix.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Anguilla > Date: Sunday, 9 March 1997 9:22 > > Charles: > > his country shows few signs of libertarian ideology; e.g. they have a > > state-owned radio station, they haven't quite embraced the idea of > > competitive bids for government projects, and they still have a > > monopolistic phone service that has disabled all the pound and star keys > > on island phones so that people can't save money using American call-back > > services. > > I am going to have to check tomorrow and see about thse star and > pound keys. It would amuse me if we had seen the birth of an urban > legend. Hopefully stillborn. I use these services regularly and have never bothered to use the # or * keys. BTW a 'pound' symbol is NOT the same as a 'hatch', fer chrissake! While I'm on the soapbox, a 'hash' is NOT a 'hatch' as well ... but that's a losing battle. > > Anguilla vs USA > 1) Income taxes Libertarian Socialist > 2) Sales Taxes Libertarian Socialist > 3) State owned radio Yes Yes > 4) Competative bids Sometimes Sometimes > 5) Pound keys that work ? Will check Yes > 6) Reporting of finances Libertarian Totalitarian > 7) Free Speech Yes, sort of Yes, sort of > > -- Vince > Regards, Mail: <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 If you're not living on the edge, you're taking up too much space.

4 3

Re: Wassenaar Arrangement
by Hayashi_Tsuyoshi 17 Dec '03

17 Dec '03

On Sun, 09 Mar 1997 17:07:27 -0500, John Young said: >The doc is on my site at: > > http://jya.com/wassnr52.htm I checked an above page out now. Thanks. # Sorry too short. ///hayashi

1 0