June 2003 - cypherpunks-legacy

Re: An attack on paypal
by pgut001＠cs.auckland.ac.nz 12 Jun '03

12 Jun '03

"Matt Crawford" <crawdad(a)fnal.gov> writes: >True as written, but Netscrape ind Internet Exploder each have a hack for >honoring the same cert for multiple server names. Opera seems to honor at >least one of the two hacks, and a cert can incorporate both at once. > > /C=US/ST=Illinois/L=Batavia/O=Fermilab/OU=Services > /CN=(alpha|bravo|charlie).fnal.gov/CN=alpha.fnal.gov > /CN=bravo.fnal.gov/CN=charlie.fnal.gov Just to clarify this, so you need a multivalued CN, with one containing the expression "(a|b|c)" and the remaining containing each of "a", "b", and "c"? Is it multiple AVAs in an RDN, or multiple RDNs? (Either of these could be hard to generate with a lot of software, which can't handle multiple AVAs in an RDN or multiple same-type RDNs). Which hack is for MSIE and which is for Netscape? Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

3 2

Busted for hijacking web site (social engr)
by Major Variola (ret.) 12 Jun '03

12 Jun '03

Man Is Accused of Hijacking Web Site [*] He allegedly diverted Al Jazeera viewers to a bogus home page at the height of the war. By David Rosenzweig, Times Staff Writer A California man has been charged by federal authorities with hijacking Al Jazeera's Internet Web site during the Iraqi war and diverting viewers to a bogus home page that displayed an American flag and the message, "Let freedom ring." John William Racine II, a 24-year-old Web site designer from Norco, has agreed to plead guilty to wire fraud and unlawful interception of an electronic communication, a spokesman for the U.S. attorney's office said Wednesday . Impersonating an employee of the Arab television network's Web site, Racine allegedly tricked an Internet service provider into changing a password that enabled him to commandeer the Al Jazeera site, according to a criminal complaint. Racine was accused of intercepting about 300 e-mail messages intended for Al Jazeera before the takeover was discovered during the height of the war in March. Al Jazeera, the popular Arab satellite television channel based in Qatar, has been the target of some criticism in the United States because of its airing of videotaped pronouncements from fugitive Al Qaeda leaders Al Jazeera is backed by the government of Qatar but is widely perceived as editorially independent, experts said. Racine could not be reached for comment Wednesday. http://www.latimes.com/news/local/la-me-jazeera12jun12,1,4525407.story?coll…

1 0

Re: sic transit blix
by John Kelsey 12 Jun '03

12 Jun '03

At 10:58 AM 6/12/03 -0400, Sunder wrote: ... We were shocked--*shocked*--to discover that lying was being used in diplomacy. Oh, the horror! --John Kelsey, kelsey.j(a)ix.netcom.com PGP: FA48 3237 9AD5 30AC EEDD BBC8 2A80 6948 4CAA F259

1 0

sic transit blix
by Sunder 12 Jun '03

12 Jun '03

http://www.newsday.com/news/nationworld/world/ny-woblix123329266jun12,0,366… June 12, 2003 London - Chief United Nations weapons inspector Hans Blix, in an interview published yesterday, accused U.S. officials of mounting a smear campaign against him. <SNIP> "But toward the end, the [Bush] administration leaned on us." <SNIP> and more of the same here: http://www.newsday.com/news/nationworld/world/ny-woblix12q3329323jun12,0,20… Not that any of this is in any way unexpected. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ <--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ + v + : The look on Sadam's face - priceless! --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------

1 0

Re: An attack on paypal
by Steven M. Bellovin 12 Jun '03

12 Jun '03

In message <200306111913.h5BJDPV1004648(a)gungnir.fnal.gov>, "Matt Crawford" writ es: >> The worst trouble I've had with https is that you have no way to use host >> header names to differentiate between sites that require different SSL >> certificates. > >True as written, but Netscrape ind Internet Exploder each have a hack >for honoring the same cert for multiple server names. Opera seems to >honor at least one of the two hacks, and a cert can incorporate both >at once. > > /C=US/ST=Illinois/L=Batavia/O=Fermilab/OU=Services > /CN=(alpha|bravo|charlie).fnal.gov/CN=alpha.fnal.gov > /CN=bravo.fnal.gov/CN=charlie.fnal.gov You can also use *.fnal.gov --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Please post this on the USENET : alt.politics.org.ciaforme .... somebody tries t
by Mark Saarelainen 12 Jun '03

12 Jun '03

They stopped my USENET communication after I had told that my thesis on the business consolidation of a foreign corporation in the North America was 100 % correct. I had told in 1991 that the consolidation of Ahlstrom Machinery, Inc. (AMI) was a failure and unsuccessful. During the 1990s many Ahsltrom Machinery's businesses were sold and the remaining parts were or are to be sold to Andritz from Graz, Austria in 2003. I had told them the truth in 1991 and I was punished by the executive management of AMI and people spread bad stories about me and my thesis in 1991 although it was graded as very good by one Professor. The Business Development Director of Ahsltrom Machinery, Inc. even forced me to change my thesis tosome extent by threatening to prevent me from graduating as the Masters of Science in Industrial Engineering and Management in April/May, 1991. His name is Markku Perkola. Itwas just my academic work.They had even told to my so called birthmother that my thesis was! no t good, although it was graded as very good and as it is now concluded I was 100 % correct and right. So my thesis was right and these people of Ahsltrom Machinery and many people of Varkaus, Finland, just wanted to hurt me and destroyed my careerat my age of 24 (12 years ago), when I had told them the truth about the failing business operations of Ahsltrom Machinery in the North America in 1991. So as the conclusion I was punished by people of Finland after I had told them the truth,which was my job in the first place. I was hired to write my thesis on their business consolidation and I told the truth. As we know now today Ahlstrom Machinery does not exist any longer. Markku J. Saarelainen Varkaus, Finland ---- 5/31/2003 Andritz acquires 50% of Ahlstrom Machinery Group - extension to 100% possible Increase of sales by 50% to 1,000 million Euros Graz (Austria) based Andritz AG initially buys 50 per cent of the Finnish Ahlstrom Machinery Group. The acquisition became effective as of May 31, 2000, after obtaining the required permissions under anti-trust laws. Ahlstrom Machinery Group's future company name will be Andritz- Ahlstrom Corporation. Both Andritz and the Seller have options whose exercise would make Andritz the sole owner of Ahlstrom Machinery Group. Need a new email address that people can remember Check out the new EudoraMail at http://www.eudoramail.com

1 0

Slashdot | FTC Wants Secret Spam Investigation Powers (fwd)
by Jim Choate 11 Jun '03

11 Jun '03

http://yro.slashdot.org/article.pl?sid=03/06/11/222206 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Online NewsHour: Forum -- Copyright Conundrum (fwd)
by Jim Choate 11 Jun '03

11 Jun '03

http://www.pbs.org/newshour/forum/june03/copyright.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: An attack on paypal
by Major Variola (ret) 11 Jun '03

11 Jun '03

At 03:39 PM 6/10/03 -0700, Bill Frantz wrote: >At 5:12 PM -0700 6/8/03, Anne & Lynn Wheeler wrote: >>somebody (else) commented (in the thread) that anybody that currently >>(still) writes code resulting in buffer overflow exploit maybe should be >>thrown in jail. Not a very friendly bug-submission mechanism :-) >IMHO, the problem is that the C language is just too error prone to be used >for most software. In "Thirty Years Later: Lessons from the Multics >Security Evaluation", Paul A. Karger and Roger R. Schell ><www.acsac.org/2002/papers/classic-multics.pdf> credit the use of PL/I for >the lack of buffer overruns in Multics. However, in the Unix/Linux/PC/Mac >world, a successor language has not yet appeared. What about Java? Apart from implementation bugs, its secure by design. --- "and then you go to jail" is a bad error-handler for a protocol.

2 1

The real problem that https has conspicuously failed to fix
by James A. Donald 11 Jun '03

11 Jun '03

I keep posting "you cannot do this using https", and people keep = replying "yes you can" No you cannot, cause if you could, paypal, e-gold, e-bay, and the rest = would not be suffering from the problem illustrated by scam mails such = as the following (When you hit the submit button, guess what happens) =20 =20 =20 Dear PayPal Customer=20 This e-mail is the notification of recent innovations taken by = PayPal to detect inactive customers and non-functioning mailboxes. The inactive customers are subject to restriction and removal in = the next 3 months. Please confirm your email address and Credit or Check Card = information using the form below: =20 Email Address: =20 Password: =20 First Name: =20 Last Name: =20 ZIP: =20 Credit or Check Card #: =20 Expiration Date: Month 01 02 03 04 05 06 07 08 09 10 11 12 / Year 2003 = 2004 2005 2006 2007 2008 2009 2010 2011 2012 =20 ATM PIN: =20 =20 Information transmitted using 128bit SSL encryption.=20 =20 =20 Thanks for using PayPal!=20 =20 =20 This PayPal notification was sent to this email address because = you are a Web Accept user and chose to receive the PayPal Periodical = newsletter and Product Updates. To modify your notification preferences, = go to https://www.paypal.com/PREFS-NOTI and log in to your account. = Changes may take several days to be reflected in our mailings. Replies = to this email will not be processed. =20 Copyright=A9 2003 PayPal Inc. All rights reserved. Designated = trademarks and brands are the property of their respective owners. =20 [demime 0.97c removed an attachment of type image/gif which had a name of paypal_logo.gif] [demime 0.97c removed an attachment of type image/gif which had a name of pixel.gif] [demime 0.97c removed an attachment of type image/gif which had a name of dot_row_long.gif]

4 3