December 2003 - cypherpunks-legacy

F00FC7C8 Kills P5
by Eric Cordian 17 Dec '03

17 Dec '03

In comp.sys.intel, the keeper of the Intel Secrets Website, rcollins(a)slip.net (Robert Collins) writes this absolutely amazing paragraph: > If nobody knew about this problem, nobody would be affected > by it. Therefore, without knowledge of this problem, there > really isn't a reasonable security risk to multi-user > systems. > No, I had no desire to publicize the bug. Egads. Talk about "Security by Obscurity"! Someone buy this poor man a Cypherpunks subscription. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Mathematician Sidney Darlington Dies
by John Young 17 Dec '03

17 Dec '03

NYT obit November 8: Sidney Darlington, a Bell Labs mathematician who pioneered the design of electronic circuits and whose formulas helped launch rockets 300 times without error, died on Oct. 31 at his home in Exeter, N.H. He was 91. At Bell Labs, in Murray Hill, N.J., where he headed the mathematics research center, Dr. Darlington was ranked alongside his colleague Claude Shannon for breakthroughs in communications networks that foreshadowed the integrated circuit and in turn computers and modern communications. Dr. Darlington's discovery of ways to custom-design circuits using precise mathematical specifications, a speciality now called network synthesis theory, made him a leading authority in electronic cirsuits for decades, said Dr. Ernest Kuh, a former colleague who is now at the University of California at Berkeley. Before Dr. Darlington's work, circuits were designed in an intuitive, ad hoc manner. His advances won him the highest award in his field, the Medal of Honor of the Institute of Electrical and Electronic Engineers. At a chalkborad at Bell labs with three or four other rocket guidance experts, he would scrawl equations that became the basis for guiding the Air Force Titan I, the Thor-Delta and dozens of other rockets. His rocket guidance formulas could instantly plug in the information from several sources -- the trajectory designed to launch a staellite, the data from radar that tracked the rocket, and the instruments in the rocket itself -- and could then return a flow of commands to the rocket. Always a tinkerer, Dr. Darlington in the 1950's spent a weekend at home playing with a new gadget, the transistor. Trying to get more gain from an amplifier the size of a kernel of corn, he found a way to combine two or more transistors in one chip, an idea that became the Darlington Compound Chip and pointed the way toward integrated circuits. ----- For more see NYT online: http://www.nytimes.com

1 0

Mixed Messages / Re: F00FC7C8 Kills P5 AND Re: Major security flaw in Cybercash 2.1.2 (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Eric Cordian wrote: > In comp.sys.intel, the keeper of the Intel Secrets Website, > rcollins(a)slip.net (Robert Collins) writes this absolutely amazing > paragraph: > > If nobody knew about this problem, nobody would be affected > > by it. > > No, I had no desire to publicize the bug. > Egads. Talk about "Security by Obscurity"! Robert Hettinga wrote: > Subject: Major security flaw in Cybercash 2.1.2 (fwd) > CyberCash v. 2.1.2 has a major security flaw that causes all credit > card information processed by the server to be logged in a file with > world-readable permissions. This security flaw exists in the default > CyberCash installation and configuration. We at the Electronic Fraud Foundation also have no desire for these bugs to be publicized. We're making a goddamn fortune off of them. (Damn near as much as we're making off of our remailer-donation scam.) Ura Fishpal, Flounder, Electronic Fraud Foundation [Note: You are required by Federal Law to pay me one dollar for reading this post. Send $1 to EFF, Box 281, Bienfait, Sask. Canada S0C 0M0] [Note From Your System Administrator: Failure to comply with the above will result in loss of your access privileges and a hernia.]

2 1

Re: Content controls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > Someone typing with gloves on wrote: > >by analogy, if you're going to wear a ski mask into a > >jewelry store, you aren't likely to be shown the expensive stuff Sounds like the voice of experience. > Once you have given me the keys to unlock and display the data I can save > it, copy it, reproduce it and distribut it. > As far as the anonymous purchaces, no a big deal. Wan Sin Soo pays the > full $$$ amount decrypts the data, copies it and send it too his buddies > in Bangledesh. Next week there is a million copies of your data floating > around the Far-East and Wan Sin Soo is nowhere to be found. The fact that > he bought it non-anonymously is of little relevance. I have found WGMicro$oft.com to be much faster than the original web site as well as having much better prices. e.g. - $9.95 for Win95. As well, access to the CIA Internal Search Engine ("The Search Engine that Searches Back!") is just one of the many nice touches to be found on pirate sites. A.B. User "It's not free until the *judge and jury* say it's free."

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by 3umoelle＠informatik.uni-hamburg.de 17 Dec '03

17 Dec '03

> > 20 % of the users who have posted digitally signed messages that are > > available in my news spool (international and local newsgroups and > > mailing lists) use PGP 5. The sample contains 545 unique e-mail > > addresses. YMMV. > > These are very interesting results. One question: what are the groups > about? Are they close in to PGP topics or far away? A number of them are crypto related, including the OpenPGP and a German PGP users' mailing list. Perhaps someone with access to a large newsserver could grep for PGP signatures on the rec.* hierarchy?

1 0

FREE Software makes you MONEY
by Success＠www.kse.or.kr 17 Dec '03

17 Dec '03

Fellow Networker: Please take a close look at MEGA RESOURCE software for fast cash building and advertising you product and program on software WORLDWIDE! This is NOT Meganets, Megabucks, or like any of those other software programs out there. You actually get a product for each code you buy to unlock the software. UNLIMITED LEVELS-unlike the other programs where you drop off the disks. For a FREE EVALUATION copy and the download site and info, "mail to: freeinfo(a)globals-ads.com" for instant info back. DO NOT HIT "REPLY" If you wish to be REMOVED from *this* mailing list, please hit reply and type "REMOVE" in the SUBJECT field (not the body). Our servers are will automatically remove you from our database within 24hrs.

1 0

Sloppy Chips from Intel
by Eric Cordian 17 Dec '03

17 Dec '03

By now everyone has probably heard that Intel Pentium and Pentium MMX chips hang when executing the instruction sequence F00FC7C8 even when in an outer ring of privilege or in V86 mode. With numerous small Linux-based ISPs out there, often providing shell services to anonymous customers, or serving customer-provided CGI programs, the existence and public disclosure such an easily exploitable flaw in their CPU's hardware protection mechanism is catastrophic. Intel, rather than extensively verifying their microprocessors before shipping them out the door, now advertises that its chips may contain "errata," or "deviations from published specifications" and doesn't seem to regard such problems as any big deal. This latest flaw is the third unexpected surprise in Intel's Pentium product line. A serious precision problem in double precision floating divide was discovered in early Pentium chips, and it was recently disclosed that there are circumstances under which the Pentium Pro may fail to generate an exception when a Float to Integer conversion overflows. While today's problem does not permit clandestine entry into a system, since it kills the system when it is exercised, it does raise the question of whether there are other more subtle problems in the hardware protection mechanism, which might enable knowlegable users to execute an occasional instruction at the wrong privelege level, or otherwise do things which should be prohibited according to the published hardware specifications. It is interesting to note that such problems have not been reported in compatible chips manufactured by AMD, a competitor of Intel. Buggy microprocessor microcode can produce very subtle exploitable faults in a chip, which are almost impossible to notice when running ordinary applications and operating systems. Instructions may do the wrong thing only when they follow certain other instructions. There may be rare times when the processor is wrongly interruptable, or when a restricted instruction is not forbidden, or is given access at the wrong privilege level, or with incorrect address translation. Were such features to be deliberately introduced into a chip, in order to permit a backdoor for undetected entry, they could be made completely undetectable, and could depend upon any number of unlikely conditions, or even specific hidden register values, in order to be made manifest. Every microprocessor could even have its own "key" for the activation of such "special features." Unlike Unix, for which complete compilable source code is available, we know little about what what microcode is run through the several million transistors on a typical microprocessor. If sloppy engineering alone produces such dangerous faults, imagine what could happen should industry decide to deliberately cooperate with various LEAs and TLAs. (In the national interest, of course.) The possiblities are truly mind-boggling. Perhaps exploits like tapping Aldrich Ames' PC and crashing Saddam Husseins' PCs en masse were not done by black bag jobs and viri, but by the activation of "National Security" backdoors present in all complex modern microprocessors. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by Robert A. Costner 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:23 AM 11/9/97 +0100, Ulf Möller wrote: >> > 20 % of the users who have posted digitally signed messages that are >> > available in my news spool (international and local newsgroups and >> > mailing lists) use PGP 5. The sample contains 545 unique e-mail >> > addresses. YMMV. Just to skew the numbers, I for instance have PGP 5.0 but am using a 2.6.2 DOS generated key that is RSA, not DSS. Grepping would show me to be PGP5.x, which perhaps technically I am, but my key is really 2.x -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQBVAwUBNGUQUEGpGhRXg5NZAQF7fQH5AfV2VfTwuLYs1ND6UTwoWIzAf3OjTSA8 saBlUQJquCUotwr5zk3cU+KiJJ9/hgLsLzOfet16ow1Do3zop7zUJw== =VDPv -----END PGP SIGNATURE----- -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key

1 0

Make money From People Watching TV
by skyway＠t-1net.com 17 Dec '03

17 Dec '03

Just Released Bill Gates has just joined with Ted Turner and Rupert Murdock to form the greatest consortium of combined technology and opportunity available today! Their plan is to take over the digital communications market by setting up people with DSS satellite equipment at no charge. As a representative with our company, you will get paid between $25 and $100 for "giving away" Digital Direct Satellites, For every person that joins the business with you to give away free Digital Direct Satellites, you will make an additional $55 to $280 We are getting paid for getting consumers set up with a total Digital Direct Satellite system with no charge, and building the distribution network of the future. Imagine how easy it is to give these away! In the first week sharing it with friends I gave away 5 not even trying and made an extra $375. There are no credit applications for the client to fill out, no mandatory 12 month contracts to join, and no surprises later down the line. The company will even upgrade the system later if it becomes obsolete, For Free! This new union was created intentionally to capture a huge active ongoing database of consumers. That's right, consumers who will purchase continuously from shows like QVC, HSN and many others, and when they purchase off of the TV you as a distributor will also make a commission off everything that they order, even while you are out golfing or sleeping, 24 hours a day. All this from you having them fill out an application that should take no more than 60 seconds. There are several other ways to get paid also, and I have enclosed the actual application for you to review. Could you imagine Christmas when they are buying like crazy and you are getting paid up to 30% of what they purchase off the television? I could and that's why we are here. Come "profit from the future of television" and join the fastest growing segment of this company and become a winner with us. If you are ready for the greatest business opportunity to come down the pike, don't miss this one, it is only 2 months old!!! Give our information hot line a call at 1-800-942-9304 pin #20088 CHECK OUT http://www.millenniumgroup2000.com -------------------------- Removes to skyway(a)t-1net.com, put remove in subject, thanks.

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Robert A. Costner wrote: > Just to skew the numbers, I for instance have PGP 5.0 but am using a 2.6.2 > DOS generated key that is RSA, not DSS. Grepping would show me to be PGP5.x, > which perhaps technically I am, but my key is really 2.x > > -----BEGIN PGP SIGNATURE----- > Version: PGP for Personal Privacy 5.0 This information is mostly for advertising/accreditation purposes. As such, it provides very little information useful for statistical purposes. e.g. - whether people are using PGP 5.X mostly for management of their PGP 2.6.X keys.

1 0