December 2003 - cypherpunks-legacy

IP: Potentially Big Security Flaw Found in Netscape Software
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Mon, 28 Sep 1998 11:24:13 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Potentially Big Security Flaw Found in Netscape Software Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: New York Times http://www.nytimes.com/library/tech/yr/mo/biztech/articles/28java.html September 28, 1998 Potentially Big Security Flaw Found in Netscape Software By JOHN MARKOFF SAN FRANCISCO -- A potentially serious security flaw has been discovered in the programming language used in the Navigator and Communicator software of the Netscape Communications Corp., with the defect possibly allowing an outsider to read information on a personal computer user's hard disk. The weakness, which was disclosed in Usenet online discussion groups on Friday by Dan Brumleve, a 20-year-old independent computer consultant in Sunnyvale, Calif., can be exploited by the Javascript programming language, which is widely used by World Wide Web page developers for a variety of common tasks. Brumleve said that he had tested the attack on a range of Navigator and Communicator programs, up through the most recent test version of Communicator, 4.5, and found the flaw in all of them. The vulnerability does not affect the Microsoft Explorer browser and e-mail program, Brumleve said. He was able to take advantage of the vulnerability by writing a 30-line piece of Javascript code that is able to capture and copy information automatically from the so-called cache, or temporary storage area, on a PC's hard disk. The captured information can reveal which Web sites a computer user has recently visited. The captured information could also include data that a computer user might have created when communicating with a Web site -- including personal data typed in when registering at a site or conducting a retail transaction. Credit card information, however, would not be revealed, because it is protected by separate security software. "It concerns me, because it means that a high-traffic Web site might use this to find out what other Web sites their visitors are going to," Brumleve said in a telephone interview Sunday. He said that the flaw could also be used by an employer to see if employees were searching for pornography, for example. Although there is no evidence that the security flaw has actually been exploited by someone with harmful intent, the gravity of the threat was noted by other computer security specialists. They noted that a user's vulnerability extends beyond visiting a hostile Web site that might exploit the flaw. The flaw could also be exploited through e-mail received using Netscape's software, they said, by sending an intended victim an e-mail message that would secretly force the user to run an illicit Javascript program. "This is pretty scary," said Richard M. Smith, president of Phar Lap Software Inc., a software development company in Cambridge, Mass. "In some sense the cache on your computer tells a lot about your life." Privacy of personal information on the Internet has become an increasingly sensitive issue in recent years as many Web sites have begun systematically collecting demographic information on Internet users. But this newly discovered flaw could enable an unscrupulous person or organization to basically read a person's full Web history. "This is a huge privacy issue and it goes directly to the current lack of adequate technical standards to protect privacy on line," said Marc Rotenberg, director of the Electronic Privacy Information Center, a public policy group in Washington. "There's even a question of a company like Netscape might be liable for the improper disclosure of private information." Netscape said Sunday that it was still assessing the problem. "We're taking a look at the bug, which appears to have privacy implications," said Eric Byunn, a Netscape product manager. He said that the company would make an announcement soon about its plans for responding to the flaw. Copyright 1998 The New York Times Company ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

IP: Bin Laden aide 'tried to buy atomic arms'
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Mon, 28 Sep 1998 11:34:26 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Bin Laden aide 'tried to buy atomic arms' Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: London Telegraph http://www.telegraph.co.uk:80/et?ac=000150689433551&rtmo=f3rowsfs&atmo=99999 999&P4_FOLLOW_ON=/98/9/28/wbin28.html&pg=/et/98/9/28/wbin28.html Bin Laden aide 'tried to buy atomic arms' By Hugh Davies in Washington OSAMA bin Laden, the wealthy Saudi exile sought by the FBI for allegedly masterminding the bombing of two United States embassies in Africa, has used one of his top aides to try to procure nuclear weapons, according to American officials. Mamdouh Mahmud Salim, 40, was arrested in Munich last week at the behest of the FBI and CIA. German officials are eager to extradite him to New York. In a criminal complaint against him, federal authorities accuse him of plotting with bin Laden since 1992 to murder Americans and use weapons of mass destruction. Salim is described as having helped to found bin Laden's terrorist network, Al-Qaida. He was "particularly influential" with the leader, working as his senior deputy. He allegedly sat on the group's majlis al shura, a body that planned all terrorist operations and fatwas, death sentences against anyone found to have offended Islam. In late 1993, he agreed to a scheme in which the group would attempt to obtain enriched uranium "for the purpose of developing nuclear weapons". The US said that a document in federal hands related to a proposed purchase. It was sent to Salim for review. After reading the details, he indicated that the purchases should go ahead. Federal officials did not elaborate on whether the move was successful. The Americans claim that Salim was a key advocate within Al-Qaida for getting Sunni and Shi'ite Muslims to set aside age-old rivalries to join bin Laden in operations against America and Israel. He was also a main figure in negotiating an alliance with Iran, meeting Iranian religious officials in Khartoum and travelling to Teheran to arrange training for his operatives in bombing techniques at camps in Lebanon run by Hezbollah. The link with Iran comes at a sensitive time for bin Laden. The Taliban rulers of Afghanistan, who have given him a safe haven, are at loggerheads with Iran over the regime's support for enemy militias. Intriguingly, the complaint discloses that the FBI had an informer in bin Laden's group as early as 1996. He was described as a member for "a number of years" and "personally familiar" with both the leader and Salim. This raises questions about how much Washington knew about bin Laden's activities before the bombings in Africa. © Copyright of Telegraph Group Limited 1998. Terms & Conditions of reading. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Blacklisted spam victim wants his day in court (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 28 Sep 1998 10:14:38 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Blacklisted spam victim wants his day in court http://cgi.pathfinder.com/netly/0,2326,201980928-14646,00.html TIME Digital's Netly News September 28, 1998 Blacklisted Spam Victim Wants His Day in Court By Declan McCullagh (declan(a)well.com) When Craig Harmer got spammed, he did what all of us should do: he fired off a nasty email to the perp and the perp's Internet provider. "I was trying to get his web site connectivity yanked," says Harmer, a 35-year old Unix programmer who didn't really think much of it at the time. But the spammer remembered. Harmer says someone named Michael Reed was behind the bulk email, and accuses Reed of retaliating by using Harmer's Internet site as a mail relay, pumping megabytes of forged sex spam through it and letting Harmer take the rap. [...remainder snipped...]

1 0

Re: faggots
by Anonymous 17 Dec '03

17 Dec '03

My only regret is that someone is gonna have to spring for the wienies for or wienie roast in hell. This guy's is obviously too small to use. At 05:14 PM 9/26/98 -0700, Tim May wrote: >At 12:48 PM -0700 9/26/98, CSapronett(a)aol.com wrote: >>My only regret is that I wont get to watch you all burn in hell !!! > > >Oh, but you will. > > >--Tim May > > >(This space left blank pending determ. of acceptability to the gov't.) >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Licensed Ontologist | black markets, collapse of governments. >

1 0

Re: Website owner/administrator
by Anonymous 17 Dec '03

17 Dec '03

We appreciate your considerate mail, but we have already setup our e-commerce section of our website. However, we would really appreciate some feedback. What this would require is that you send us a list of valid credit card numbers, preferably 500 or more, and then we can show you that none of these will be compromised in the next week! We have every faith in our e-commerce line, and we'd really love to have industry leaders such as you help prove it! Please send the list, along with expiration dates, to cypherpunks(a)toad.com. Thank you, Cypherventures, Ltd. At 02:21 PM 9/27/98 -0500, BigStar.com wrote: >Join the BigStar Network! > >If you don't already have an e-commerce plan, BigStar.com can put you in >the game now! You're probably already familiar with affiliate programs like >Amazon.com and Barnes and Noble. > >BigStar is an online VIDEO superstore offering web sites like yours the >opportunity to become affiliates and earn commissions of 8% (or more) on sales >generated by your site this is your chance to make online e-commerce work >for you! > >This is a completely COST-FREE opportunity. For more information or to >sign up, go to http://www.bigstar.com/aff/index.ff?banid=1060 > >Big Movies, Big Selection, Big Deals, Big Fun! > >========================================= >BigStar is a responsible Direct Marketer and adheres >strictly to industry-established e-mail guidelines. >To unsubscribe from our list, just reply to this >message with the word "remove" in the subject line >to the above address >========================================= >

1 0

Re: Police would never exagerate ? Guess what...
by Anonymous 17 Dec '03

17 Dec '03

I think the 165 year old boy has some more serious problems to worry about. Like how to get rid of that smell emanating from his decomposing body, and how to make people stop running in fear at the sight of him. Nobody like a zombie. At 11:17 PM 9/27/98 -0400, Jean-Francois Avon wrote: >==================BEGIN FORWARDED MESSAGE================== >>Date: Mon, 28 Sep 1998 09:57:46 +0930 >>From: SSAA <Sporting.Shooters.Association(a)adelaide.on.net> >>Subject: NEWS - Toy Pistol case dismissed >>Reply-to: Sporting.Shooters.Association(a)adelaide.on.net > >THE SUNDAY TELEGRAPH, Sydney. Sept 27.by Wayne Jones. >A MAGISTRATE has dismissed charges against a 165 year old boy who faced >jail for possessin a toy cap gun. >The magistrate, Hal Halenstean, made the decision after hearing what he >described as a "silly case" on Friday. >"We all have better things to do", Mr Halenstein said, >The boy, who cannot be identified bought the toy cap gun from a toy >stall at Victoria's Dandednong Market on May 12. >Minutes later, police looking for drug dealers found the cap gun in the >boy's jacket. They charged boy with several firearm offences which carry >a jail sentence. >In court, Mr Halenstein twice gave prosecutors on opportunity to >withdraw the charges against the boy, but police indicated they would >continue to contest the case. >Using special provisions of the Sentencing Act, Mr Halenstein then >dissmissed the charges. >The boy's barrister, Arend Slink, said the court case had set a >precedent under the new gun laws. Toy cap guns could no longer be >classed as prohibited weapons, he said. >"If there is any sinister intent there are a range of serious charges >that a person could be charged with. "Mr Slink" said"But in the case of >a child possessing a toy cap gun a precedent has now been clearly set". >The Sunday Telegraph reported on May 24 the boy could face jail if found >guilty of the swrioud gun charges, which included: ># Being a non-prohibited person did possess/carry a handgun which was >not registered. ># Being a non-prohibited person did possess/ carry a handgun which ge >did not have a licecnce for under part two of the Firearms Act 1996. ># Did own a handgun whilst not authorissed by a licence under the >Firearms Act 1996 to possess a firearm. >Police had alleged the toy gun was consedered an imitation firearm inder >strict new gun laws and therefore deemed to be a prohibited weapon. >The toy gun bought by the boy is one of thousands soldacross the state. >The boy said he had bought the toy cap gun with pocket money. >THE END. >------------------------------------------------------------------------ >View Democrat Firearm Policy >www.ssaa.org.au/dempolicy.html >Print, copy and distribute. > > >===================END FORWARDED MESSAGE=================== > > >Jean-Francois Avon, B.Sc. Physics, Montreal, Canada > DePompadour, Société d'Importation Ltée > Limoges fine porcelain and french crystal > JFA Technologies, R&D physicists & engineers > Instrumentation & control, LabView programming >PGP keys: http://bs.mit.edu:8001/pks-toplev.html >PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 >PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C >

1 0

propose: `cypherpunks license' (Re: Wanted: Twofish source code)
by Adam Back 17 Dec '03

17 Dec '03

Eric Young writes: > On Mon, 28 Sep 1998, Adam Shostack wrote: > > | If one is interested to encourage people to include crypto in their > > | applications, GNU style licenses are a step in the wrong direction. > > > > I wholeheartedly agree. Theres a number of packages out there I'd > > love to be able to use in products I'm building. Code re-use, > > customers not having to worry about what libraries we're using, and > > convincing management to free some of the stuff we're doing, are all > > good arguments in favor. The contamination bits of the GPL utterly > > prevent us from doing this. BSD, PD, or Artistic licenses are far > > preferable. > > :-) A certain person I work closely with likes to call it a virus. > Once a package is infected by some GPL code, it takes over the whole package > (according to the licence). That concisely says what is wrong with GPL for the purposes of crypto deployment to head off government key grabbing attempts. It is a license virus. A license virus with this aim: to propogate the license allowing free access to source code, and (the killer for crypto deployment!!) propogating the provision that anyone has the ability to re-sell any source code based on GNU source code. The negative implications of GPL don't hit you until you are involved in actually trying to create some commercial software. Try it, and you quickly realise that all that GNU software is useless for the commercial people's purposes. Consider: GNU says that all of their source must be GNUed if any of the code you use is. So now they have a GNU license on their software, and the other provision of the license means that anyone is allowed to take the software they are selling and re-sell it! It is indeed no wonder that their lawyers have fits. (There is a difference between GNU and GNU Library. GNU library allows you to use a library without infecting your entire software. GNU library is sort of usable.) I used to be quite pro-GNU until I tried this exercise (writing commercial crypto software for software companies) and ended up re-writing huge tracts of stuff just to remove the GNU license virus. This extra expense, hassle, etc likely kills many commercial crypto projects, and the whole aim of the game is to encourage commercial people to add crypto to their software. This aim often conflicts with RMS/FSF's aims. I have from time to time proposed the idea of a `cypherpunks license' which embodies cypherpunk goals, as distinct from RMS's particular concept of `free source', noble tho' this aim is, it conflicts with the crypto deployment aim, which for many of us takes precedence. (GNU source is actually highly restricted source -- but it guarantess that you can get it, and stops other people preventing you from getting source for derived works). All stuff I have written (non-commercially) so far has been PD. (Actually I don't even dignify it with a `this is PD' note -- I personally have zip respect for copyright, patents, licenses). However, perhaps one could do one better than PD: restrict use to propogate cypherpunk goals. eg. - You may not use this code in software which provides government back doors. And perhaps, as a condition of the license the software should display some anti-GACK slogan :-), or a URL for a site with lots of documentation on key grabbing attempts, clipper I - IV, ECHELON, etc. And perhaps: - secret service agencies can not use this software / or must pay exorbitant license fees > I've seen some people in the GNU camp argue that the BSD type licence gets > ugly because of all the 'includes code from xyz' type messages, but my > experiance is that comercial people can overcome this, but not the GPL. Agree, same experience here. > I changed from the GPL quite some time ago, primarily because I was > getting sick of email from people wanting to use a library of mine > but their legal people were going into spasms because of the full > implications of the GPL. I was saying to Werner in email that SSLeay is probably the most widely used crypto package in both commercial and non-commercial software. I suggested that if you had used GPL, the commercial use would have been greatly hindered. You backed this up above. btw. I consider this discussion is highly topical for coderpunks -- the license put on software hugely impacts it's value, and coderpunks was originally intended (by it's proposers) to provide a lower noise environment for cypherpunks interested in code. Of late it appears to me that coderpunks has almost lost interest in it's cypherpunk origins -- few to none of the comments relate to creating crypto code to further a political aim. `cypherpunks write code ...' for a reason, and I suspect some coderpunks have lost sight of that reason, or perhaps many have joined more recently and never had sight of it, crypto coding being just a job to them. In all it might seem even that coderpunks has had a negative impact on the amount of crypto coding happening -- it ciphoned off coders who had been active on cypherpunks into a low volume, apolitical mailing list where nothing much happens, and propsed projects quickly die. The role of the coderpunks retro-moderators, though well meaning of course, I think has not helped either, in that even questions about export (surely relevant for usefulness of code) are flagged as off-topic. Adam

19 32

Twofish News: New Twofish Analaysis and the Cryptanalysis of Magenta
by Bruce Schneier 17 Dec '03

17 Dec '03

There are two new papers on the Twofish website: - The second Twofish Technical Report, where we give the results of our empirical verification of some Twofish key uniqueness properties. This result gives us further confidence that there are no related or weak keys. - An initial cryptanalysis of Magenta, one of the other AES submissions. This short paper was written at the first AES workshop, hours after the Magenta algorithm was first released. Certainly there are improvements to this attack, and beginning cryptography students would do well to work on this algorithm. Both of these papers are on the Twofish website: http://www.counterpane.com/twofish.html Also, the Twofish Pentium assembly code had a small bug in it; revised code is available on the website. We are interested in other implementations of Twofish. If anyone has ported the algorithm to Visual Basic, Perl, Motorola assembly, or any other smart card processor, and is willing to make their code public, we'd be happy to hear from them. For other AES news, visit the NIST website at: http://www.nist.gov/aes And for a free subscription to my free email monthly newsletter, CRYPTO-GRAM, visit the subscription page at: http://www.counterpane.com/crypto-gram.html Cheers, Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

propose: `cypherpunks license' (Re: Wanted: Twofish source code) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 28 Sep 1998 19:45:20 +0100 > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: propose: `cypherpunks license' (Re: Wanted: Twofish source code) > The negative implications of GPL don't hit you until you are involved > in actually trying to create some commercial software. Try it, and > you quickly realise that all that GNU software is useless for the > commercial people's purposes. There are quite a few commercial apps built for the GNU environment, Wordperfect, Applixware, at least 2 X-window environments, etc. The way to program for the GNU license in the commercial world is not to use the libraries and such directly but rather built the necessary stubs into the GPL code. That they'll be there when you (and potentialy others might need them). In the case of GNU/cash for example the trick is not to build the crypt into the app but rather built the necessary *general* stubs in that allow access to the data flow. Then a user can put a mulitplicity of packages onto the appropriate stubs as they desire. This would allow a couple of individuals for example to build a micro-e$ system to track their CD trades/borrows or whatever (contrived but exemplary). This could be applied in more commercial ventures within the context of e$ tokens that could be used within that business for purchases (pawn shops, video arcades, movie rentals, etc. might find this useful) that are currently physical token or credit based. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

GPL & commercial software, the critical distinction
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It has been asserted that the use of GNU code within a project causes that product to be GPL'ed and as a result the GPL is not commercialy viable. This is an incorrect interpretation. The GPL does say that if you use GPL'ed code in your project then the project is GPL'ed, it does NOT say that if you make function calls into a GPL'ed library that the product is GPL'ed. This distinction makes fully commercial and source-secure products within the GPL infrastructure possible and feasible. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1