December 2003 - cypherpunks-legacy

RSA Material on PKCS#1 Crack
by Bill Stewart 17 Dec '03

17 Dec '03

The attack: ftp://ftp.rsa.com/pub/pdfs/bulletn7.pdf 4-page PDF file. There's also a Postscript version available. The paper is by Bleichenbacher of Lucent and Burt Kaliski and Jessica Staddon of RSA Labs. OEM Countermeasures: http://www.rsa.com/rsalabs/pkcs1/oem_counter.html (below) Countermeasures for Users of Servers: http://www.rsa.com/rsalabs/pkcs1/countermeasures.html (below - it's pointers to vendor home pages, pleasantly including C2. Apparently they've done a good job coordinating it...) Q&A : http://www.rsa.com/rsalabs/pkcs1/qa.html ====== RSA to Provide OEM Customers with Guidelines and Technology to Thwart Potential Web Server Security Attack OAEP Formatting Adds Important Security to Vulnerable Applications June 26, 1998 -- RSA Data Security, Inc. today announced guidelines to assist its OEM customers in both assessing their products vulnerability to a newly discovered potential security attack, and to identify pre-emptive countermeasures to thwart such an attack. The guidelines are designed to help developers understand the nature and mechanism of the threat, pose a series of technical questions to identify vulnerable constructs in the developers software design, and provide a set of countermeasures from which to choose based on the developers needs. These guidelines are available online at http://www.rsa.com/rsalabs/. The potential threat affects server products that employ an interactive key establishment protocol in conjunction with the PKCS #1 standard for digital envelopes, including SSL-based servers. SET (Secure Electronic Transaction) and other secure messaging protocols, such as S/MIME (Secure Multipurpose Internet Mail Extension), are not susceptible to or already implement mechanisms preventing this potential attack. Recent research by cryptographer Daniel Bleichenbacher of the Bell Labs Secure Systems Research Department, the research and development arm of Lucent Technologies, indicate that the above combination is potentially vulnerable to a class of attack known as Adaptive Chosen Ciphertext Attacks. The potential attack noted by Mr. Bleichenbacher relies on sending a target server on the order of a million carefully constructed messages and observing variations in the servers response. As such, the attack is both detectable and can be prevented with countermeasures. For some developers, the most effective countermeasure is incorporation of the Optimal Asymmetric Encryption Padding (OAEP) technology, a method of formatting an encrypted message so that attackers cannot learn information about the contents through repeated probing. OAEP is designed to thwart a variety of attacks, including the Adaptive Chosen Ciphertext Attack. For other developers, the most effective countermeasure will be preventing an assailant from gaining information from messages returned from their server. RSAs guidelines provide design information for developers to use in implementing this form of countermeasure as well. RSA Laboratories, the research arm of RSA, plans to include OAEP in the next version of PKCS #1, a widely used cryptography standard, that will be available as a draft for comment in July. PKCS #1 is used in SSL and other popular security mechanisms to provide confidentiality for exchange of symmetric encryption keys (digital envelopes), as well as to construct digital signatures. OAEP has already been integrated into RSAs newest release of BSAFE 4.0, the companys flagship cryptographic security development suite which began shipping this month. RSA intends to make available OAEP updates conforming to the new PKCS #1 specification for its BSAFE 3.0 and 4.0 products in July, and to incorporate OAEP in an upcoming version of JSAFE, RSAs security engine for Java. RSA recommends that developers target these upcoming OAEP updates for inclusion in their products. Check this site for more information on OAEP updates in the coming weeks. RSAs Website will also host links to vendors sites where countermeasures are made available as a service to both OEMs and end customers. See RSAs related announcement on this subject. Currently, the following vendor information Website links are available: C2Net Software, Inc. http://www.c2.net Consensus Development Corporation http://www.consensus.com/ssl-rsa.html IBM Corporation http://www.ibm.com/security Lotus Development Corporation http://www.lotus.com/security Microsoft Corporation http://www.microsoft.com/security Netscape Communications Corporation http://www.netscape.com Open Market, Inc. http://www.openmarket.com/security/ RSA Data Security, Inc. http://www.rsa.com/rsalabs An RSA Labs technical paper discussing this vulnerability, as well as additional information, is available on RSAs Website, http://www.rsa.com/rsalabs. ============ SSL Countermeasures These countermeasures enhance the security of popular Internet servers and software products based on the Secure Sockets Layer (SSL) protocol. The countermeasures are available from respective vendors' Web sites, and include configuration guidelines, software updates where applicable and additional information. Currently available vendor information may be found at the following sites: Aventail Corporation http://www.aventail.com/ C2Net Software, Inc. http://www.c2.net/ Consensus Development Corporation http://www.consensus.com/ Lotus Development Corporation http://www.lotus.com/security IBM Corporation http://www.ibm.com/security/ Microsoft Corporation http://www.microsoft.com/security/ Netscape Communications Corporation http://help.netscape.com/products/server/ssldisc overy/index.html Open Market, Inc. http://www.openmarket.com/security/ RSA Data Security, Inc. http://www.rsa.com/rsalabs/ Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

WORRIED ABOUT HIS OR HER BACKGROUND?
by lee7＠msn.com 17 Dec '03

17 Dec '03

<HTML><BODY BGCOLOR="#ff0080">INFORMATION USA Your Source For Information LOCATE Business & Individuals in the USA Old Friends, Lost Loved Ones, Dead Beat Parents, Debtors Assets Local, State, National & International Information needed varies, sometimes just a name. Helpful information would be Last Known Address, Social Security Number, Date of Birth and any other information you feel would be of use. Provide us with everything you have and let the Professionals at Information USA do the rest. Information USA has the most competitive prices in the industry! Call today for a free price quote. Other Services Available *Criminal Background *Civil Court Records *Bankruptcy & Liens & Judgments *National Real Property *Business Credit Reports *Corporate Profiles *National Bank Asset Information *Stocks & Bonds & Mutual Fund Search *Safe Deposit Box Search *Social Security Death Records *Marriage & Divorce *Workers Compensation Records *Non-Published Numbers *Drivers License Records *Vehicle Records Search *Water & Aircraft Search *Pre-Trial Comprehensive Reports *Pre-Employment Background *Verify Education *Verify Professional License *Verify Employment Call for additional Services Information USA Call Toll Free 1-888-370-9112 Ask for Ken Wagner Visa, MasterCard & Discover Cards Accepted </HTML>

1 0

BumBoy III - SPACE ALIENS HIDE MY DRUGS!!!
by Linda Reed--PCC West Campus CSC 17 Dec '03

17 Dec '03

BumBoy III - SPACE ALIENS HIDE M DRUGS!!! __________________________________________ BumBoy Interview: C-J VAN DAMNNED (will it never end?) { AnInterViewerToBeNamedLater, sucking medication out of Baby's twat, only to find that it was a surprisingly pleasureable experience, made the mistake of allowing the Author to continue the interview on his own, while she and the TruthMongrel engaged in behavior that even the disgusting perverts on the BumBoy staff found to be revolting, since it was being done by two females.} VOICES: "Tell them about US..." VAN DAMNNED: It's not always voices...sometimes it's dreams... sometimes the TV, or the Radio, or...anything, really... Like the dream where I'm in the front row at a prizefight, and two guys are beating the living shit out of each other, until the final bell sounds and the winner is declared. Then the two guys get out of the ring and come after me. The one wearing the elephant-colored boxing trunks holds me down while the one wearing the donkey-colored trunks starts shoving a large box up my asshole, and pieces of paper fall out, giving me papercuts, until one of the pieces of paper cuts my throat as I puke it out, and the two guys who pretended to be fighting each other are sucking up my blood out of the trough at the edge of the boxing ring, which turns out to be a pig-pen. As the last of my lifeblood drains out of me, a person in a dirty white smock appears, saying, "I'm from the government, and I'm here to help you." As the person places the piece of paper that cut my throat onto my juglar vein, to stop the bleeding, I notice that it is an election ballot--it is *my* election ballot. As the ambulance rushes me back to my office, to return to work, with the attendants telling me I should be back to normal in about forty months, the two boxers walk past me, arm in arm, with two sinister-looking agents walking behind them, discussing their 'fighters' rematch, four years hence. They have decided to raise the price of tickets from $100.00 to $500.00, since the government automatically deducts it from everyone's paycheck, whether they attend the 'fight' or not. As they discuss how much to raise the concession prices for beer, soda, peanuts, popcorn and hot dogs, they seem to suddenly notice me, and stop to offer their sincere condolences for my 'accident', and say that they hope it won't prevent me from attending the rematch. As if on cue, the fight-promoter, who tells me he is from the government, and is here to help me, picks up a pig-turd containing a small piece of the hot-dog I was eating when I was sodomized by the boxers, and hands it to me, saying, "This is your share of the 'take'. ou know, in Communist countries, the government keeps it all..." I don't think I'll attend the rematch. I have a feeling that I already know who wins...and who loses... VOICES: "ou're getting excited again. Why don't you take your medicine, and read a book, or something, to calm you down?" VAN DAMNNED: ou sadistic pricks, you *know* that the only book I have with me is Collier and Horowitz's, 'The KENNEDS, AN AMERICAN DRAMA,' and it's not in the least bit entertaining, since I just finished a book about the Mafia, so I know how everything in the Kennedy book, or *any book on politics, is going to turn out even before the authors even finish writing about it. It's even more depressing than reading Hitler's "Mein Kamf" and "New World Order" and then reading mainstream press reports about government news conferences. Doesn't anybody do 'original material' any more, or is everyone just plagarizing President Henny oungman, who said, "Take my citizens...please!" And take them...and take them...and take them... VOICES: "We *told* you that everything since the Big Bang has been plagarism..." VAN DAMNNED: Oh, yeah? What about my song, "Booger-Eating Dog (Don't Bite The Nose That Feeds ou)," or, "I Was Sitting On My Horse, And She Jerked Me Off," and all of the other sick, depraved songs I've written? Do you see a big lineup of people claiming credit for the lyrics? VOICES: "ou're getting excited again. See, you even placed your quote marks in the correct place..." VAN DAMNNED: See, there is another thing that proves that people are capable of original, independent thought and actions... Just because I'm the Author doesn't mean I have to use correct spelling, punctuation, syntax (whatever the hell that is), or write in a manner that indicates a well-researched and well- reasoned train of thought. VOICES: "That doesn't make you unique, you fucking imbecile. Just ask any one of a thousand publishing editors who have to wade through the mountains of trash sent to them by self- declared 'authors' who eventually end up cashing in Andy Warhol's IOU for 'Fifteen Minutes Of Fame' by becoming a guest on the Jerry Springer Show and telling the whole world about how they got their dog pregnant by sucking themselves off and blowing their sperm up her twat." VAN DAMNNED: That wasn't *me*! That was someone who just looked like me and deposited Jerry Springer's check in my bank account to make me look bad. But I don't mind, because it makes me unique! VOICES: "Everything since the BigBang is Plagarism. ou're just like all the other Sheeple." VAN DAMNNED: No! ou're trying to trick me into thinking that I'm not a free, independent human being. ou're trying to take away the only things I have to hold on to that make me unique. ou want me to believe that I am not the only sick, depraved pervert in the world who spreads FUD (Fear, Uncertainty and Disinformation) in an attempt to cloak my evil, wretched life in an aura of grandoise importance and imagined righteousness. VOICES: "ou haven't been following the Clinton-Lewinski affair in the news, have you?" VAN DAMNNED: Shut up! I'm not listening! I AM *NOT* LIKE PRESIDENT CLINTON!!! I did *not* give strong encryption to those Chinese people who let me have my way with Buddy in the Lincoln bedroom before they ate him. I'm the one who tried to expose the fact that the *real* Buddy had been replaced by a cross-cloning of Spuds Mackenzie and Janet Reno. I told the CypherPunks to draw glasses on a picture of Buddy and see if it looked like Reno. That was *me*, *really*! I just forged Mark Hedges name to that post to make him look like an asshole! Honest! VOICES: "ou're just like all of the other sorry, pathetic losers who can't get a *real* publishing contract with a *real* publisher who is helping to destroy the Rain Forests by printing millions of hardcover and paperback books decrying the destruction and loss of the Rain Forests. "Instead, you continue to contribute to the destruction of the Digital Environment by sending mountains of your rotting, greasy Digital SPAM to the CypherPunks Disturbed Male List, where your sins are compounded in MeatSpace as a result of the millions of plastic <Delete> keys that need to be created every day in order for decent, moral, law-abiding NetiZens to protect themselves and their children from your mindless drivel. "As punishment, WE are going to tell you the *real* name of the right-hand square bracket..." VAN DAMNNED: Noooo!!! I'M NOT LISTENING!!! AAARRRRRGGHHHHH!!!!!!!!!!!!!!!!!!!!!!!!!!! {The BumBoy Interview with C-J VAN DAMNNED came to a sudden end, as heavily armed, black-clad ninja agents of ACypherNipsNode- ToBeNamedLater, came bursting through the door, screaming, "Torah! Torah! Torah! Chop! Chop! <Hee-Hee>", surrounding the Author and allowing AnInterviewerToBeNamedLater to grab Baby and the tape recorder, making her escape while clutching her skirt close to her body, as the Author was trying to peek up it even as he lie on the floor taking a tremendous beating. "ou've got to admire his persistence." she told BumBoy editors while dropping off the interview tapes. Sadly, we must report that Baby, obviously a codependent enabler of the Author's sickness, failed to make it to California, where BumBoy was prepared to foot the bill for her to see a Doggie Therapist, instead choosing to return to the Author, once again dropping the BadBillyG mask at HisOrHer feet and backing toward him with her tail raised in eager anticipation. Redoubtable sources inform us that the black-clad ninja agents of ACypherNipsNodeToBeNamedLater sat back, drinking the Author's Scotch and enjoying the spectacle, as well as tucking money in the Author's panties when HeOrShe bound Baby's feet for the second performance. Official Police Reports indicate that, when officers arrived in response to noise complaints from the neighbors, that the ninjas were fighting violently over a Din-Din Tin roasting pan and a bottle of barbeque sauce, seemingly surprised that the Author and Baby TruthMongrel had vanished. The leader of the black-clad ninja agents was quoted as saying, "Shit! We come to Ito his dog, and now we have to go home and Ito mole of his SPAM, instead." Turning to his companions, he said, "We go now...chop-chop!" Looking embarassed, the leader explained to police, "We not even know what that mean, until oul fliend, Timmy-San, point us to the alchives, whele we find out it mean we have big cocks, rike Amelican bikels. Then we aporogized fol accusing Timmy-San of making fun of us. He good guy..." The editors at BumBoy, upon receiving Declan McCullagh's expense receipts for the clothing he purchased to go undercover as AnInterviewerToBeNamedLater, could not help but notice that an article of clothing conspicuously missing from the receipts was...panties.}

1 0

What does it mean and How much does it cost a healthy diet? A natural foods one !
by Jorge C. Palma 17 Dec '03

17 Dec '03

Cantabrian Altamira Shopping http:/www.cantabrian.com/altamira/altamira.htm Hello: How much does it cost a healthy diet?. Cantabrian Altamira Shopping shows in its web pages natural and ecological foods without additives and preservants from Spain. You will find there white tuna, anchovies, honeys, partridges, wines and assocites. We apologize if this message has been missadressed, Thanks, Cantabrian Virtual Publishers http://www.cantabrian.com

1 0

Program: 'Speak Feely' for "secure comminucations"...
by Jan 17 Dec '03

17 Dec '03

Greetings, I've come across this program on the net which claims to give "secure communications"... could any of you folks comment of this program? Speak Freely 6.1 For Windows 95/NT (295K) Author: John Walker Homepage: http://www.fourmilab.ch/speakfree/windows/ Description: Real time one to one audio chat, half or full duplex, bitmap transfer. Encryption for secure communications. Might be slow with modem connections. The text below is part of the text on the homepage... ======================== Speak Freely for Windows Release 6.1 Speak Freely is a Windows application that allows you to talk (actually send voice, not typed characters) over a network. If your network connection isn't fast enough to support real-time voice data, four forms of compression may allow you, assuming your computer is fast enough, to converse nonetheless. To enable secure communications, encryption with DES, IDEA, and/or a key file is available. If PGP is installed on the user's machine, it can be invoked automatically to exchange IDEA session keys for a given conversation. Speak Freely for Windows is compatible with Speak Freely for Unix, and users of the two programs can intercommunicate. Users can find one another by communicating with a "Look Who's Listening" phone book server. You can designate a bitmap file to be sent to users who connect so they can see who they're talking to. Speak Freely supports Internet RTP protocol, allowing it to communicate with other Internet voice programs which use that protocol; in addition, Speak Freely can also communicate with programs which support the VAT (Visual Audio Tool) protocol. ... [remainder snipped] Jan out.

1 0

Use Your Computer To Make Money From Home
by workathome＠grid.sk 17 Dec '03

17 Dec '03

Use Your Computer To Make Money From Home Great Home-Based Business Opportunity. Secret Marketing Software Turns YOUR PC Into A MONEY MACHINE! Easy And Simple. No Risk! Free Marketing Software Explains How! Act Now! To Turn YOUR Computer Into A Money Machine, Send Your Name, Address, and Phone Number within 48 hrs. to: mailto:cashsoftware6@juno.com Click here for removal -> mailto:optout3@juno.com

1 0

New on-line moderated forum for Pauline Hanson's One Nation
by Global Web Builders 17 Dec '03

17 Dec '03

G'day One Nation supporter in NSW Pauline Hanson's One Nation now has its own moderated discussion group on-line. You may participate by requesting a unique username and password from GWB by reply email. The URL for the discussion board is: http://plato.cc.adfa.oz.au/auspolitics/ Follow the link to Pauline Hanson's One Nation discussion group in the frame on the right. The purpose of the discussion group is to discuss One Nation policy, issues and brain storm. Please not IT IS a moderated discussion group and any offensive posts will result in the poster being taken off the forum. GWB Scott Balson

1 0

AU Cryptozilla Attack
by John Young 17 Dec '03

17 Dec '03

Thanks to Anonymous we offer the article which describes the AU government attack on Eric Young's and Tim Hudson's full-strength Cryptozilla for Netscape: http://jya.com/oz-crypto.htm It's also a good overview of crypto policy battles down under -- the pols, the crats, the laws, the regs, the obfuscations, the work arounds of export controls and runarounds with chicken heads off -- like like all around hereabouts.

1 0

Earn $100 every time OUR phone rings...
by ci0u＠worldnet.att.net 17 Dec '03

17 Dec '03

ALL YOU DO IS ADVERTISE THIS 800 NUMBER! THAT'S ALL!! $100 goes to you for EVERY sale that the company closes! Does the idea of making at least $1,000 per week beginning your 2nd week of doing business excite you? How about never having to sell a thing to your customer and never having to talk to ANYONE to make money? I don't know how this could get any easier. EVERY aspect of selling or talking to someone is DONE COMPLETELY by the company! The number one home based business for the 2nd year in a row, Fortune 5000 is a member of the Better Business Bureau and the U.S. Chamber of Commerce. WHAT THIS BUSINESS WILL DO FOR YOU: * Handles all your calls, closes your sales, and sends you WEEKLY commission checks! * It pays you a $100 commission (that's over 50% of the total sale) for EVERY sale. CHECKS put $$$ in your pocket in less than your first week or two... Quick commission earnings build and maintain motivation. ALL YOU DO IS ADVERTISE the toll-free number and your ID number. * You can get STARTED TODAY. Just advertise the business toll-free number with your ID # and let this business CLOSE YOUR SALES every day... They do all the work and YOU GET PAID FOR IT! * You may advertise any way you choose: Bulk E-Mail, Flyers, Classifieds, Postcards, etc. Suppose you use bulk E-Mail, as I am: 100,000 E-Mails with a 1/10th of a percent (0.1%) sales rate at $100 per sale nets $10,000... not too bad. There is nothing else out there that will provide you with an immediate income beginning THIS WEEK with minimal effort. Before you call, I want you to think about the quality of the live operators handling your call. I am convinced you will not find a better team of closers for your own personal sales. You will clearly understand what I am talking about once you call. PLEASE DON'T LET THIS PASS YOU BY. MAKE THE CALL!! 1-800-811-2141 You will be asked for ID #50030 when you call. (Live operators are available from 8 AM-10 PM CST Monday through Saturday and will be able to answer any questions you may have.) Call one of the 24hr TESTIMONIAL lines at 888-703-5389, 888-446-6949, 888-446-6951 or 888-731-3457 (all toll free).

1 0

CIA Hires Lo/Hi-Tech Spies
by John Young 17 Dec '03

17 Dec '03

NYT, June 27, 1998: Getting Back to Basics, C.I.A. Is Hiring More Spies Taking steps to reduce dependence on high-tech spying. By James Risen Washington, June 26--The Central Intelligence Agency is beginning the largest recruitment drive for new spies in its history, in an ambitious effort to rebuild its espionage service, which has been severely damaged by spy scandals, budget cutbacks and high turnover since the end of the cold war, officials said. With Congress already providing increased financing, the Directorate of Operations, the C.I.A.'s clandestine espionage arm, will hire record numbers of case officers --spies-- beginning this year as part of a new strategic plan to repair the decaying espionage capabilities of the United States by 2005, officials said. In addition to expanded hiring, the agency also plans to reopen several overseas stations that were closed in the early 1990's after the demise of the Soviet Union led Congress and the White House to reduce the C.I.A.'s budget sharply. The recruitment plan is a sign that the C.I.A. recognizes that it has become far too dependent on so-called technical intelligence, or eavesdropping devices and spy satellites. Now, the agency wants to get back to espionage basics, by increasing its ability to place a spy behind enemy lines or inside the offices of a rival government. The spread of new technologies like encryption and computer networks has eroded the value of spy satellites and listening devices and has led the C.I.A. to see the need for an expanded cadre of spies. Without having an agent in place, the C.I.A. has found it much harder to gain access to secrets from rival governments, terrorists and international organized crime groups. ... The C.I.A. is recruiting case officers, and people to support them with technical skills that spies have rarely been asked to learn in the past. "As we tried to figure out our requirements for the future, we realized we needed to have greater technical support for agent operations," said one American official. At the top of the list of requirements is computer expertise. The proliferation of global computer data networks, for example, has made it more difficult for the agency to slip into a country using false identifications. Only computer experts can defeat those local computer systems, and even developing countries routinely make sophisticated computer checks on passports and visas. ... ----- Full story: http://jya.com/cia-hires.htm

2 1