December 2003 - cypherpunks-legacy

NSA on OS Flaws
by John Young 17 Dec '03

17 Dec '03

An NSA team presented at NISSC98 in October "The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments:" http://jya.com/paperF1.htm (62K) Abstract Although public awareness of the need for security in computing systems is growing rapidly, current efforts to provide security are unlikely to succeed. Current security efforts suffer from the flawed assumption that adequate security can be provided in applications with the existing security mechanisms of mainstream operating systems. In reality, the need for secure operating systems is growing in todays computing environment due to substantial increases in connectivity and data sharing. The goal of this paper is to motivate a renewed interest in secure operating systems so that future security efforts may build on a solid foundation. This paper identifies several secure operating system features which are lacking in mainstream operating systems, argues that these features are necessary to adequately protect general application-space security mechanisms, and provides concrete examples of how current security solutions are critically dependent on these features. Keywords: secure operating systems, mandatory security, trusted path, Java, Kerberos, IPSEC, SSL, firewalls. ----- The paper advocates greater research on vulnerabilities of operating systems which allow malicious attackers to circumvent application-level security, including cryptographic protection. Ways to get around hardware and software crypto are outlined. Covert channels are a prime concern, as well as benign use inadverdently allowing malicious intrusion. An extensive list of references trace the twenty-five year history of OS flaws and examine why so little has been done to correct known deficiencies which undermine seemingly unbreachable applications. Readings about DTOS, Fluke, Flash and other developments of the NSA-sponsored Synergy program are illuminating. The recent republication of early compsec documents by CSRC is appropriate to this topic, particularly, "Subversion: The Neglected Aspect of Computer Security," by Philip Myer, June 1980, a thesis at NPS: http://csrc.nist.gov/publications/history/myer80.pdf Not that NSA would ever exploit OS weaknesses not warned about. ----- Thanks to JM/RH for pointing to the NISSC papers.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Shouldn't we be using "Mr. Cordian's" real name? Matt Blaze (mab(a)research.att.com) also occasionally known as "M.F. Tones", and even less often as "Mr. Rouge" (There should be an accent mark there actually).

1 0

nm web site
by bill payne 17 Dec '03

17 Dec '03

Saturday 11/14/98 6:13 PM John Young http://www.jya.com/index.htm J Orlin Grabbe http://www.aci.net/kalliste/ As a result of jy's persuasive arguments http://jya.com/whpfiles.htm, we are going to put up a web site. But unlike you-all's sites ours will be somewhat positive 1 masm mixed language programming ... and Microsoft bugs 2 8032 forth programming and hardware 3 pc hardware 4 pro se litigation against the government 5 cypto nonsense 6 ... But, most important, we have learned by your pioneering web information dissemination efforts. And mistakes at other websites. Like bouncing balls. You guys, in my opinion, are the some of the most brilliant, perhaps with the exception of the X-rated sites, at getting the info out there. And yes, we will use THUMBNAIL photos. Of schematics, main boards, .... etc. Simplicity exudes brilliance. Perhaps there is a converse? Thoughtfully, I hope bill

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

At 09:35 PM 11/14/98 -0500, John Young <jya(a)pipeline.com> wrote: > >An NSA team presented at NISSC98 in October >"The Inevitability of Failure: The Flawed Assumption >of Security in Modern Computing Environments:" ... >Not that NSA would ever exploit OS weaknesses not warned >about. > Part of the context for this: NSA is trying to encourage their new testing program for security products. My feeling is that program, in turn, is intended to preserve the spaces for all the employees involved in the failed TCSEC/Rainbow testing program. I say "failed" because it hasn't caught on in the private sector, it's expensive and, of course, the laughable "C2 in '92." If you can't trust your OS, Dum-dum-Dah! NSA to the rescue with testing! The new Common Criteria is to replace TCSEC/Rainbow next year, but if it walks like a duck....

3 2

hello -- do not read
by William H. Geiger III 17 Dec '03

17 Dec '03

This is a test, this is only a test. -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html ---------------------------------------------------------------

1 0

Put America's Best Chili Recipes on Your Christmas List
by bluefish＠swipnet.se 17 Dec '03

17 Dec '03

AMERICA's BEST CHILI RECIPES ARE NOW HERE!!! Check out our special 2 for 1 offer All orders received December 15, 1998 are guaranteed to be delivered by Christmas. Nothing is more American than a hot bowl of Chili, but if you ask a hundred people about how to make the best bowl of chili you'll probably get a hundred different answers. America's Best Chili Recipes hopes to help answer this question by offering fifty of the most diverse Chili recipes that you will find anywhere. Plus, these recipes don't come from any sterile kitchen test labs, but from the family picnics,backyard barbecues, and tailgate parties of Chili lovers from across America. Our book is divided into four separate chapters: Chapter I Traditional Chili Chapter II Chili with Beans Chapter III Low Fat/Vegetarian Chili Chapter IV Prize Winners Among the recipes you'll enjoy are: ***Barbecue Chile from New Jersey ***Lobster Chili from Maine ***Seven Pepper Chili from San Antonio ***Kosher Chili from New York ***Nuclear Chili from San Francisco In addition, with each recipe you'll get the story behind the recipe. Each contribution contains an entertaining story or anecdote from the person who sent the recipe. Read about: *** The Ghost in the Chili Pot *** The Secret behind Comet Chili *** Chili passed down through three generations of LA Firemen Buy the book for the recipes, or buy it for the stories. You'll find that there is a chili recipe for every finicky eater. SPECIAL OFFER!!! Our book normally sells for $12.95 +$2.00 shipping/handling. However, this Holiday Season you can get Ameica's Best Chili Recipes for only $9.95, and we'll pay for shipping and handling -- a savings of $5.00. GET TWO COPIES AND SAVE EVEN MORE!!! Give a copy this Christmas to a friend or relative. If you buy a copy of America's Best Chili Recipes we'll send you an additional copy for only $5.00. That's two copies for only $14.95, 50% off the regular price. ORDER NOW!!! All orders received by December 15, 1998 are guaranteed to be delivered in time for Christmas. You can also have us mail your gift to your friend or relative for you. Please use the form below : ============================================================= ORDER FORM Yes, I'd like to own my own copy of America's Best Chili Recipes. I have filled out this form to help expedite my order: Please check-off your order: ____ One Copy of America's Best Chili Recipes for $9.95 (A savings of $5.00) ____ Two Copies of America's Best Chili Recipes for $14.95 (A savings of $14.95) Name: Address: City: State: Zip: E-mail Address: (For order confirmation) Please send payment to: America's Best Recipes 12762 Brookhurst St. Suite 438-B Garden Grove, CA 92840 (714) 375-5458

1 0

Test [no reply]
by Jim Choate 17 Dec '03

17 Dec '03

Test

1 0

Test 2 [no reply, loop test, last one]
by Jim Choate 17 Dec '03

17 Dec '03

Test 2

1 0

loop test #1
by William H. Geiger III 17 Dec '03

17 Dec '03

Loop, loop, loop -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html ---------------------------------------------------------------

1 0

loop test #2
by William H. Geiger III 17 Dec '03

17 Dec '03

Loop test #2 -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html ---------------------------------------------------------------

1 0