June 2003 - cypherpunks-legacy

RE: unregistered shell
by Trei, Peter 10 Jun '03

10 Jun '03

> Major Variola (ret)[SMTP:mv@cdc.gov] > > At 12:29 AM 6/10/03 -0700, Bill Stewart wrote: > >At 09:48 AM 06/09/2003 -0700, Major Variola (ret.) wrote: > >>the Capitol because it had a gasoline container strapped to its roof. > > But the real point is that ammo has to be registered. Amazing. > I found an old, live cartridge in the desert last weekend, tossed it in > the car. What if I lived near DC instead of SoCal? > Actually, ammunition is not registered as such, but in DC you are only allowed to possess ammunition suitable for one of your DC-registered firearms. This applies even to spent cartridge cases. If this guy didn't own a DC-registered shotgun of the same gauge as the shell found, then he's in violation. The car had California plates, so it seems plausible that he was a non-resident. Peter Trei

1 0

Re: unregistered shell
by Major Variola (ret) 10 Jun '03

10 Jun '03

At 12:29 AM 6/10/03 -0700, Bill Stewart wrote: >At 09:48 AM 06/09/2003 -0700, Major Variola (ret.) wrote: >>the Capitol because it had a gasoline container strapped to its roof. >but this sounds like a case of Darwin catching up with the guy >in a way that only eliminates *him* from the gene pool >rather than taking out innocent bystanders when the >gas can falls off his car roof.... Depends on how sturdily he attached it. Jeeps (et al) have spots for gas cans in the rear exterior of the car. Driving with a tank of gas in the passenger compartment isn't a good thing. Also RVs typically have a few gallons of propane on an exterior tank. And welding trucks.. But the real point is that ammo has to be registered. Amazing. I found an old, live cartridge in the desert last weekend, tossed it in the car. What if I lived near DC instead of SoCal? --- "Did you really think that we want those laws to be observed? . . . We want them broken. You'd better get it straight that it's not a bunch of boy scouts that you're up against - and then you'll know that this is not the age for beautiful gestures. We're after power and we mean it. . . . . There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens? What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced nor objectively interpreted - and you create a nation of lawbreakers - and then you cash in on the guilt. Now that's the system, . . . that's the game, and once you understand it, you'll be much easier to deal with." From Atlas Shrugged, by Ayn Rand.

1 0

Re: An attack on paypal --> secure UI for browsers
by Sunder 10 Jun '03

10 Jun '03

Yes, >NOW< if you can load yourself into kernel space, you can do anything and everything - Thou Art God to quote Heinlein. This is true of every OS. Except if you add that nice little TCPA bugger which can verify the kernel image you're running is the right and approved one. Q.E.D. Look at the XBox hacks for ideas as to why it's not a trival issue, but even so, one James Bond like buffer overflow in something everyone will have marked as trusted (say IE 8.0, or a specially crafted Word 2005 macro), and the 3v1l h4x0r party is back on and you iz ownz0red once more. It's not enough to fear Microsoft, you must learn to love it. Give us 2 minutes of hate for Linux now brother! ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ <--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ + v + : The look on Sadam's face - priceless! --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------ On Tue, 10 Jun 2003, Rich Salz wrote: > But if the system is rooted, then the attacker merely has to find the > "today's secret word" entry in the registry and do the same thing. > Unless Windows is planning on getting real kernel-level kinds of protection. > > > It was none other than Microsoft's NGSCB, nee Palladium. See > > http://news.com.com/2100-1012_3-1000584.html?tag=fd_top: > > See previous sentence. :)

1 0

Re: An attack on paypal --> secure UI for browsers
by Nomen Nescio 10 Jun '03

10 Jun '03

Tim Dierks wrote: > - Get browser makers to design better ways to communicate to users that > UI elements can be trusted. For example, a proposal I saw recently which > would have the OS decorate the borders of "trusted" windows with facts or > images that an attacker wouldn't be able to predict: the name of your > dog, or whatever. (Sorry, can't locate a link right now, but I'd > appreciate one.) It was none other than Microsoft's NGSCB, nee Palladium. See http://news.com.com/2100-1012_3-1000584.html?tag=fd_top: NEW ORLEANS--Microsoft is trying to make security obvious. The software giant plans to visually alter document or application windows that contain private information that's secured through Microsoft's Next-Generation Secure Computing Base (NGSCB), formerly known as Palladium. Secure windows will look different than regular, unsecured windows in order to remind users that they are looking at confidential material, Peter Biddle, product unit manager for Microsoft, said Thursday at the Windows Hardware Engineering Conference (WinHEC) here. ... The border of a secured page may contain information--such as the names of all the dogs that someone has ever owned--to make the data instantly recognizable as sound to the individual owner, as well as difficult to replicate. A hacker can create a spoof page with dogs' names running along the border but, in all likelihood, not one reading "Buffy, Skip and Jack Daniels--and in that order," Biddle said. ... Information on secured windows will vanish if another window is placed on top of it or shifted to the background. Erasing the information will prevent certain types of attacks and remind people that they're dealing with confidential material, Biddle said. When the secure window returns to the top of the stack, the information will reappear, he said. I don't see how this is going to work. The concept seems to assume that there is a distinction between "trusted" and "untrusted" programs. But in the NGSCB architecture, Nexus Computing Agents (NCAs) can be written by anyone. If you've loaded a Trojan application onto your machine, it can create an NCA, which would presumably be eligible to put up a "trusted" window. So either you have to configure a different list of doggie names for every NCA (one for your banking program, one for Media Player, one for each online game you play, etc.), or else each NCA gets access to your Secret Master List of Doggie Names. The first possibility is unmanageable and the second means that the trustedness of the window is meaningless. So what good is this? What problem does it solve? --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

4 3

Re: An attack on paypal --> secure UI for browsers
by pgut001＠cs.auckland.ac.nz 10 Jun '03

10 Jun '03

Nomen Nescio <nobody(a)dizum.com> writes: >I don't see how this is going to work. The concept seems to assume that >there is a distinction between "trusted" and "untrusted" programs. But in the >NGSCB architecture, Nexus Computing Agents (NCAs) can be written by anyone. >If you've loaded a Trojan application onto your machine, it can create an NCA, >which would presumably be eligible to put up a "trusted" window. > >So either you have to configure a different list of doggie names for every >NCA (one for your banking program, one for Media Player, one for each online >game you play, etc.), or else each NCA gets access to your Secret Master List >of Doggie Names. The first possibility is unmanageable and the second means >that the trustedness of the window is meaningless. Maybe MS will implement something like the secure attention key in the old VAX A1 VMM (Ctrl-Alt-Del already serves this purpose for logins) which gives you a guaranteed non-spoofed interface to the kernel (see for example "A Retrospective on the VAX VMM Security Kernel" by Karger et al for more information on this). They certainly have the VMS knowhow :-). Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

unregistered shell
by Major Variola (ret.) 10 Jun '03

10 Jun '03

June 6, 2003 | WASHINGTON -- A man was arrested outside the Capitol Friday for carrying unregistered ammunition in his car, a police spokeswoman said. Capitol Police spokeswoman Jessica Gissubel said police stopped the car as it was traveling on Constitution Avenue on the north side of the Capitol because it had a gasoline container strapped to its roof. The man, who was not identified, voluntarily handed over the ammunition, described as a shotgun shell. It is illegal to carry unregistered ammunition in the District of Columbia. http://www.salon.com/news/wire/2003/06/06/capitol/ They can't find WMD, but they can find a dude with a shell in his truck.

3 2

[Brinworld] Neighbor's surveillance camera?
by Major Variola (ret) 09 Jun '03

09 Jun '03

Authorities said they were considering the possibility that a second person might have been involved in the abduction, based on video from a neighbor's surveillance camera. http://www.cnn.com/2003/US/West/06/09/california.abduction/index.html

1 0

Re: An attack on paypal --> secure UI for browsers
by pgut001＠cs.auckland.ac.nz 09 Jun '03

09 Jun '03

Amir Herzberg <amir(a)herzberg.name> writes: >Ka Ping Yee, User Interface Design for Secure System, ICICS, LNCS 2513, 2002. Ka-Ping Yee has a web page at http://zesty.ca/sid/ and a lot of interesting things to say about secure HCI (and HCI in general), e.g. a characterisation of safe systems vs. general-purpose systems: In order for Alice to use her computer usefully, she has to be able to instruct programs to do things for her. In order for those programs to carry out tasks, she has to trust those programs with some authority. So every useful operation involves making the system a little bit less safe. In order to keep the system from becoming unboundedly unsafe, Alice must also be able to make her system more safe. A system in an ultimately safe state is one that can't do anything other than what was planned ahead of time. General-purpose computing is useful to Alice only because she can make unpredictable inputs into the system, asking it to do new things. Peter.

1 0

[OT] Re: Hitchens: The Cult of ID
by J.A. Terranson 09 Jun '03

09 Jun '03

Good Evening, From roughly 1985 to ~1997, I was a resident of Missouri (USA). Now, Missouri may well be a poster child for backwater living, but they had an unusual thing to recommend them: they understood that a "Driver's License" was somthing you got to prove you knew how to drive a car, rather than something you got to drink beer and vote. Presumable due to this revelation, Missouri did not actually *require* either a photo or a social security number for the issuance of a driver's license. Anyone who had objection to the social security number was given a different encoded "license number", and anyone who objected to the photo had a red box in the corner with the words "PHOTO NOT REQUIRED" emblazoned across it - you needed only to fill out the form which described the basis of your objection(s). Even better was the State of New York, up until ~1983: no photo on any license. Just a piece of paper (no plastic at all) that said you knew enough to drive. Proving that the license belonged to *you*, and not someone else, required actual *ID*! It's time we get back to the reality standard on these... -- Yours, J.A. Terranson sysadmin(a)mfn.org

3 2

Razor
by A.Melon 08 Jun '03

08 Jun '03

I don't care about The Rat's postings like some of my anonymous associates, but someone's razor reporting is inaccurate. Some spam from this list has been revoked at razor so it drops down below 30% confidence, when it shouldn't be revoked at all [1]. Inversely, some legitimate postings are getting reported to razor when they should not be [2]. If you auto-report stuff to razor, please be extra-careful with this list. [1] <20030608161030.83223.qmail(a)web42003.mail.yahoo.com> [2] <Pine.SOL.4.51.0306032216560.21827(a)kruuna.Helsinki.FI>

2 1