December 2003 - cypherpunks-legacy

Mondex help needed
by Lucky Green 17 Dec '03

17 Dec '03

I just received one of the Chase Manhattan Mondex cards. Since I've been doing a bit of work with smartcards lately <https://www.cypherpunks.to/scard/>, I'd like to take an extended look at this card. The task would be much easier if I had one or several of the following: o Mondex card Programer Reference Manual. Somebody on this list must have access to one. o Protocol specifications. Even partial specs would be helpful. o Any PC software that talks RS-232 to a reader that is meant to hold a Mondex card. And of course the reader. If the reader work with non-Mondex cards, all the better, because that probably means that the reader is generic and the commands can be reverse engineered and emulated. o An RS-232 adapter to the PCMCIA sized reader that came with my Chase Mondex card and associated PC software. The reader has a tiny connector on the side meant to connect to a serial port adapter. Since this is a Mondex-only reader, I am not sure how much of the intelligence resides in the reader. Listening to the communication between the PC software and this particular reader may not provide much information. Your help is much appreciated. Anonymous donations are accepted and encouraged. Thanks, -- Lucky Green <shamrock(a)cypherpunks.to> PGP v5 encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?"

3 3

CyberCash response to: Major security flaw in Cybercash 2.1.2 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Sun, 23 Nov 1997 04:08:28 -0500 From: Pat Farrell <pfarrell(a)CYBERCASH.COM> To: BUGTRAQ(a)NETSPACE.ORG Subject: CyberCash response to: Major security flaw in Cybercash 2.1.2 This message is going to bugtraq because I first heard of the report from this list. I believe it is in the spirit of the list's usage guidelines. Redistributed in accordance to the terms below. Other responses should be off list, directly to me. Pat -----BEGIN PGP SIGNED MESSAGE----- I have been asked by Steve Crocker, CyberCash's Chief Technical Officer, to post this message concerning security of CyberCash's software. The following should appear in its entirety if it's printed at all. Permission is granted to repost this message as long as the entire message is reposted unaltered with the PGP signature intact. Pat The following message appeared on the net. > === begin quoted message === > >From: Anonymous <anon(a)ANON.EFGA.ORG> >Subject: Major security flaw in Cybercash 2.1.2 >To: BUGTRAQ(a)NETSPACE.ORG > >CyberCash v. 2.1.2 has a major security flaw that causes all credit >card information processed by the server to be logged in a file with >world-readable permissions. This security flaw exists in the default >CyberCash installation and configuration. > >The flaw is a result of not being able to turn off debugging. Setting >the "DEBUG" flag to "0" in the configuration files simply has no >effect on the operation of the server. > >In CyberCash's server, when the "DEBUG" flag is on, the contents of >all credit card transactions are written to a log file (named >"Debug.log" by default). > >The easiest workaround I've found is to simply delete the existing >Debug.log file. In my experience with the Solaris release, the >CyberCash software does not create this file at start time when the >DEBUG flag is set to 0. > >The inability to turn off debugging is noted on CyberCash's web site >under "Known Limitations". The fact that credit card numbers are >stored in the clear, in a world readable file, is not. > > === end quoted message === We have taken this quite seriously and have put through a full release of our software which will be available Monday 11/24 for three platforms and others shortly thereafter. The flaw was in the debug logging function, not in the protocols or core implementation. Nonetheless, the effect was an unnecessary exposure of potentially sensitive information, and it shouldn't have gone out the door that way. We're tightening our internal processes to avoid this in the future. That said, here's the actual exposure. The credit card information that's in the clear in the log comes from "merchant-initiated" transactions, which means the merchant obtains the credit card number from somewhere -- phone, mail, fax, SSL-protected Internet interaction, or unprotected Internet interaction. The merchant thus has the same info in the clear already. If the card number was provided via a wallet, then the card number is blinded at the consumer's end. It is therefore not in the clear as it passes through the merchant's machine and the reported exposure does not apply.. In order for the unprotected log to pose a risk of exposure, someone has to be able to gain access to the merchant's machine. If the machine is well protected, viz behind a firewall and/or carefully configured, presumably an outsider won't be able to gain access. And in terms of the *additional* exposure the open log represents over existing risks, if the same information is accessible in the clear elsewhere on the machine, eliminating from the log or encrypting the log provides little or no real protection. We continue to advise merchants to take strong steps to protect their machines. To our knowledge, the exposure documented above has not resulted in the actual loss of any customer data or other security incident. - ---------------------------------- Steve Crocker Desk: +1 703 716 5214 CyberCash, Inc. Main: +1 703 620 4200 2100 Reston Parkway Fax: +1 703 620 4215 Reston, VA 20191 crocker(a)cybercash.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNHfwF7CsmOInW9opAQHurAP+MPve2kBqh7Vtt6cMbzohCt2PTjaa6dl3 AzxTVPzgMPdGLB+pehGNxsxrlb/hQ07P3IqMaKcaKXs9O+7Av7ijaUGGkbWpbhEJ Zy38iKpEsMIHe2vrLXyyjVbzorj/8f/OHEr28NbXjviSllyJlGzowgS0AXuFMLMt lByJBsTAAS4= =ZlLs -----END PGP SIGNATURE----- Pat Farrell CyberCash, Inc. w:(703) 715-7834 Senior Engineer pfarrell(a)cybercash.com #include standard.disclaimer

1 0

Re: Junior Jim Bells in Training
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Tim May wrote: > (Vulis, Toto, Detweiler...don't get any ideas.) At least one of us has been there...done that--over ten years ago. Seeing the fuckers face when the Feds knock on his door comes close to being a beautific sexual experience. It is well worth the wait. Anyone familiar with the statute of limitations involved?

1 0

Re: Further costs of war (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 24 Nov 1997 13:04:13 -0500 > From: Fabrice Planchon <fabrice(a)math.Princeton.EDU> > Subject: Re: Further costs of war (fwd) > Reread what you quoted below, and you will see that I don't want to > debate over wether or not in a frontal clash between USSR and Japan the > japanese army wins or not. I will grant you they win the first > battle. The same way the germans won for a while... And even admittedly > if you destroy the organised forces from your enemy, it doesn't mean you > are done. You are only if you manage to get the population on your > side. Dimitri makes a very good point in his post, saying that the > germans fucked up in the west, as they could have taken great advantage > from being seen as liberators. As for "Moscow fall, Stalin fall", > remember Napoleon ? Napolean never took Moscow, he was stopped - just like Hitler - at the gates. The closest either French or German forces got was to look at the spires of the Kremlin. Beyond that similarity there are a wide range of differences between the situation. The fact remains that had Stalin *not* been able to withdraw troops from the Chinese border he would not have been able to keep Stalingrad or Moscow. Further, the *only* reason that Stalin could afford to do that was because Sorge indicated that the Japanese were interested in other goals at the time. Oh, regarding Napolean, the reason that he couldn't take Moscow was because troops, called Cossacks, were moved from the east to the west. > > Had it not been for the oil, food, and weapons we shipped Britian he would > > have owned Europe in toto. It is clear from Hitlers earliest writings that > > he had full intention of taking Russia. Had Stalin not had Sorge's > > Yeah, he was stupid. That's my point ;-) Hitler may have been a lot of things, stupid was not one of them. > Ultimatly this cost them the game. Not enough men. Had the situation > last a little longer, japanese occupation forces in China would have > faced some serious problems (they were already, actually). Such as? The situation in China at the time was that a variety of warlords were spending more time fighting each other than the Japanese. China at that time was not a cohesive entity. The reason that Japan lost WWII was that at no point did they have strategic supplies of oil for longer than 5-9 months *and* the US waged unrestricted submarine warfare in the Pacific destroying what merchant marine the Japanese had so they could not take advantage of the oil refineries in such nifty places as Palembang, Sumatra (whose taking in Feb. 1942 was the first use of Japanese paratroops, all 700 were wiped out). It was not because they didn't have the men. > Well, in 34 it wasn't yet the case: when there were serious rumors that > Hitler might be tempted to invade Austria, Mussolini moved troops close > to his autrian border. He was a close friend of the austrian prime > minister of the time (later to be killed...). How Mussolini changed his > mind is a mix of his internal situation in Italy, and his rejection by > the rest of Europe... In 1934 Mussolini invaded Abyssinia all on his own, Hitler took the opportunity to march into the Rhineland while the rest of the world stood aghast at the use of modern weapons against stone-age tribesmen. The next thing Mussolini did was send troops to help Franco, troops which fought right along side Germans troops. On Nov. 30, 1938 Ciano made a comment in the Fascist Chamber about 'natural aspiration' and the members stood yelling "Corsica, Tunis, Nice!". The talk of taking Nice obviously did nothing to settle the French's worries. In July, 1938 5 billion lire was asigned to modernize the Italian forces. The Abyssinian campaign cost 13 billion lire and tied up 300,000 Italian troops. The help in Spain cost hardware and involved another 50,000 troops who were still there. When the Spanish Civil War ended in 1939 he invaded Albania, which was an Italian protectorate. By this time Italy as allied strongly to Germany in the minds of just about everyone. Around 12 August, 1939 after Ciano discovered the intended invasion of Poland and passed this to Mussolini did there become a measure of doubt in Mussolini's mind that perhaps he had picked the wrong allies. > I think you are the one playing games, not me. Once again, I don't > disagree with you on the fact that the US made the right decision > anyway. But had they waited until Hitler was knocking on their door it > wouldn't probably have changed the issue by much. (I would be a native > german-speaker, perhaps...) If the US had waited until Hitler began dropping bombs on New York and firing V2's from submarines 20 miles off the coast while at the same time Japan was doing the same sorts of things, with a nice base at Pearl Harbor, *and* you claim the US could have stood the test then I can only say you are confused at best. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Barnes and Noble World banner 4MB upgrade only $49.99 rule FACING CRISIS, JAPAN'S OLDEST BROKERAGE TO CLOSE graphic November 23, 1997 Web posted at: 7:06 p.m. EST (0006 GMT) TOKYO (Reuters) -- Yamaichi Securities Co. Ltd, Japan'soldest brokerage, will shut down, a spokesman said Monday,resulting in the country's biggest financial failure since World War II. Financial sources said a last-ditch review at a meeting ofYamaichi's board of directors determined it had no chance ofsurviving a credit crunch, shrinking business and high-profile scandals. The board was to hold a news conference later Monday,the spokesman said. Japanese markets were closed on Monday for a national holiday, but international stock markets and the yen were expected to be hit by the news of the shutdown amid fears of a domino effect across Japan, Asia and possibly beyond. International markets brace for possible fallout International markets were braced for fallout from Asia's latest economic crisis, the final chapter in a saga of Japanese corporate racketeering that has worldwide implications. The fear that Japan might be the next Asian domino to fallhas kept international monetary officials, already dealing with a crisis in South Korea, the world's 11th largest economy, and other Asian nations, on edge. "The initial reaction is likely to be selling pressure onthe yen and equity markets and a firmer opening for U.S.Treasuries," said Kirit Shah, chief market strategist at Sanwa International in London. Bank of Japan sources told Reuters a special board meetingwould be held on Monday morning on whether to extend specialunsecured loans to Yamaichi. The Finance Ministry and central bank contacted overseasauthorities to alleviate global concerns, especially in U.S. and European markets. Third brokerage to collapse in past month The Yamaichi crisis follows the collapse in the past monthof second-tier brokerage Sanyo Securities Co. Ltd. and10th-ranking commercial bank Hokkaido Takushoku Bank. Finger-pointing has already started over what was behind thecollapse in its centenary year of a Japanese household name that has a staff of 7,500 at home and 33 branches abroad. Takeo Nishioka, secretary-general of the main opposition NewFrontier Party, said Prime Minister Ryutaro Hashimoto's ruling Liberal Democratic Party had not acted decisively enough to ensure financial stability in Japan. "The Yamaichi Securities situation has undermined the trustof Japanese investors and international financial markets,"Nishioka said on national television. A financial system in need of reform The criticism added up to a unanimous view that Japan'sfinancial system was in urgent need of reform, deregulation and closer supervision -- and there was more bad news to come. At its core, the liquidity crunch faced by Yamaichi has beendriven by concern that creditors cannot pin down just how large the brokerage's potential losses could become, analysts said. "It's a story of lack of sufficient disclosure andsupervision," said James Fiorillo, senior banking analyst at ING Barings in Tokyo. A Finance Ministry official said on Saturday there weresuspicions of vast off-balance sheet liabilities exceeding 200 billion yen ($1.58 billion) from illegal trading practices. If that is the extent of the problem, one industry source said that a "white knight might be found to pick up at least some of the pieces. But there were worries the numbers may be much larger, withpossibly 1 trillion yen ($7.9 billion) accumulated fromillegal deals since the 1980s. Copyright 1997 Reuters Limited. All rights reserved. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] 4MB upgrade only $49.99 rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Negronics
by Eric Cordian 17 Dec '03

17 Dec '03

According to the Associated Press, the first Black student at the University of Mississippi, James Meredith, has just opened an institute which teaches Black men and boys to be successful by avoiding the use of Black English, or Ebonics. Speaking at a news conference today, Meredith told reporters that Black males could never be intellectual giants unless they learned proper English. Meredith promised that after attending his new Mississippi Meredith Institute's weekend classes, the Black male would be "as comfortable in the library as he is on the basketball court." The Meredith Institute would not be open to girls or women, Meredith explained, although they may sit in on classes if they pay a $50 fee. He explained that Black women would still prevail in the Black family, because, "She's not going to let the boy get ahead of her." Meredith's first school, the Library Scool for Black Boys and Men in Jackson, Mississippi, is scheduled to open in January. A second school will open in February in San Diego. No Ho's or Bitches need apply. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Re: Why posts are not appearing in NG.
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

nobody(a)REPLAY.COM (Anonymous) wrote: > Anonimity has already been lost due to the fact that if some > ass who is a control freak keeps posting crap to the > news.lists.filters newsgroup. Go ahead an see for yourselves > how many groups have been eliminated from receiving posts from > anonymous remailers. All that need be done is post some spam > through the anonymous remailer to a legitimate group, make a > request to cancel all postings to the newsgroup from that remailer > and guess what, your posts will no longer appear in the newsgroup. > > No investigation, no nothing! Just like that all posts from an > anonymous remailer stop appearing in a group. > So if your posts are not appearing on a particular newsgroup, > chances are that it has been prevented from accepting posts due > to idiots that just do as they are requested. By the way, who has > authority to just terminate (restrict the acceptance of posts) > to a newsgroup? > Do not believe it? Go to Deja News, go to power search and type in > the following (anonymous and news.lists.filters) and see what > the results are. Shocking. Someone or group of individuals is > abusing this privalage and must be exposed/dealt with accordingly. That's becoming old hat with the censorious control freaks. If they don't like what's being posted anonymously, the post a whole bunch of anonymous "abuse" themselves, then turn around and demand that "something to be done to stop this abuse". It's gotten remailers banned from posting through certain mail2news gateways, and even gotten remailers (like Mailmasher, Huge Cajones, and Lucifer) shut down entirely. In many cases, it's not hard to figure out who's doing it. Just look for posts where anonymous posters are called "anonymous assholes", accused of "hiding behind the skirts of a remailer", etc. For info on the attack on Jeff Burchell's remailers, visit: http://calvo.teleco.ulpgc.es/listas/cypherpunks-unedited@toad.com/HTML-1997… -or- http://infinity.nus.sg/cypherpunks/dir.archive-97.11.13-97.11.19/0432.html > One of the biggest abusers of this practice is at > Unknown News Administrator <news(a)news.msfc.nasa.gov> > 8862 news.admin.net-abuse.bulletins > This individual posts requests through legitimate servers and is > slowly eroding the anonymous posts purpose. > Go ahead and check to see if the newsgroup you post to is on the > list and report back to the group. If you'll visit the "control" NG, you'll find see that <news(a)news.msfc.nasa.gov> is forging a lot of cancel messages to kill anonymous posts. Perhaps a complaint to NASA is in order to protest government computers being used for forgery. And if someone is also forging a NASA address to make them look bad at the same time, then they need to know about that, too. --

1 0

Anonymity at any cost, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

********* http://cgi.pathfinder.com/netly/opinion/0,1042,1594,00.html The Netly News (http://netlynews.com/) November 24, 1997 Anonymity At Any Cost by Declan McCullagh (declan(a)well.com) When Lance Cottrell created an easy-to-use anonymous e-mail service back in 1994, he feared that nobody would use it. "I used to be worried that people didn't want anonymity enough to pay for it," he says. Today his company, Infonex, boasts 3,000 customers who pay $60 a year to browse the Web without leaving behind digital footprints. Which leaves Cottrell with new and more troubling worries. The mushrooming popularity of his Web-based "Anonymizer" (he also offers a slower, free version) has placed him at the heart of an explosive Internet debate over the limits of free speech and privacy online. Is Infonex - or Cottrell personally - responsible if a user breaks the law and can't be traced? Should the government restrict anonymous remailers or untraceable Web browsing? Last weekend Cottrell and I joined 40 lawyers, technologists and academics at a conference sponsored by the American Association for the Advancement of Science. Our charge: to puzzle through some of the questions surrounding anonymous communication. [...]

1 0

No Subject
by Devin Akin 17 Dec '03

17 Dec '03

Dear Sir, I would like to request a copy of the crack files for Windows 95 and WFW "pwl" files if you have them. I am a network engineer and I'm doing some small-time network security for a couple of clients. I would like to show them just how vulnerable their network is to even the simplest of file utilities. Thanks in advance for any help you might provide. <A href="mailto:Devin-Akin@usa.net">Devin-Akin(a)usa.net MCNE, MCSE

1 0

Another Anti-Privacy Bigot Heard From (was: The Guilmette/Burnore deba
by Mixmaster 17 Dec '03

17 Dec '03

sjsobol(a)devel.nacs.net (Steve Sobol) wrote: > So my challenge to the people posting anonymously is to either go away, or > find some balls and post non-anonymously. I know this won't happen, as much > of the stuff being said is rather libelous and can get the poster into a lot > of legal trouble, but hey, if any of the cowards involved would *like* to > reveal themselves... If you'd to expose ... er, I mean "reveal" yourself, be my guest. <g> But knock off the bigotry -- anonymous posters are not going to be relegated to the back of the bus just because some control freak is annoyed by hearing things with which he disagrees posted by people that he can't identify. You're merely chanting the same line we've all heard over and over -- "unless you have something to hide, you won't mind my snooping and meddling in every aspect of your life". Threats of "a lot of legal trouble" for speaking one's mind are nothing new. But the tort of libel requires that the information be FALSE. There's a difference between something being libellously false and merely being embarassingly true. And, of course, the burden of proof is on the person making the charge. --

1 0