August 2003 - cypherpunks-legacy

Digicash Patents
by R. A. Hettinga 21 Aug '03

21 Aug '03

--- begin forwarded text

1 0

Secure Programming Cookbook for C and C++
by R. A. Hettinga 21 Aug '03

21 Aug '03

<http://www.oreilly.com/catalog/secureprgckbk/desc.html> oreilly.com -- Online Catalog: Secure Programming Cookbook for C and C++ Full Description Password sniffing, spoofing, buffer overflows, and denial of service: these are only a few of the attacks on today's computer systems and networks. At the root of this epidemic is poorly written, poorly tested, and insecure code that puts everyone at risk. Clearly, today's developers need help figuring out how to write code that attackers won't be able to exploit. But writing such code is surprisingly difficult. Secure Programming Cookbook for C and C++ is an important new resource for developers serious about writing secure code. It contains a wealth of solutions to problems faced by those who care about the security of their applications. It covers a wide range of topics, including safe initialization, access control, input validation, symmetric and public key cryptography, cryptographic hashes and MACs, authentication and key exchange, PKI, random numbers, and anti-tampering. The rich set of code samples provided in the book's more than 200 recipes will help programmers secure the C and C++ programs they write for both Unix® (including Linux®) and Windows® environments. Readers will learn: How to avoid common programming errors, such as buffer overflows, race conditions, and format string problems How to properly SSL-enable applications How to create secure channels for client-server communication without SSL How to integrate Public Key Infrastructure (PKI) into applications Best practices for using cryptography properly Techniques and strategies for properly validating input to programs How to launch programs securely How to use file access mechanisms properly Techniques for protecting applications from reverse engineering The book's web site supplements the book by providing a place to post new recipes, including those written in additional languages like Perl, Java, and Python. Monthly prizes will reward the best recipes submitted by readers. Secure Programming Cookbook for C and C++ is destined to become an essential part of any developer's library, a code companion developers will turn to again and again as they seek to protect their systems from attackers and reduce the risks they face in today's dangerous world. Return to Secure Programming Cookbook for C and C++ -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Major German Anonymity Service compromised
by Len Sassaman 21 Aug '03

21 Aug '03

A number of cypherpunks have asked me about the current JAP situation. Here's the scoop, as I know it. (I've sent mail to some of the Dresden folks, but haven't heard back yet.) This thread on Usenet contains the pertinent information: http://groups.google.com/groups?selm=f938f87a44e64d6776c635b979aa1c48%40rem… The Java Anonymous Proxy is a real-time web mix system, (originally) designed to provide web browsing anonymity that couldn't be undermined by any one proxy operator. Well, no more. The JAP authors silently introduced a back-channel intended to compromise anonymity of users accessing certain sites, under the guise of an "obligatory update". They claim 30,000 total users. That's a large amount of people who are being lied to about their anonymity. (The JAP website, as of this morning, was still stating: "Since many users use these intermediaries at the same time, the internet connection of any one single user is hidden among the connections of all the other users. No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user." Which would be true if not for the backchannel.) JAP's webpage: http://anon.inf.tu-dresden.de/index_en.html The JAP operators justify their actions (which were taken to comply with German law) by stating that their alternative was to shut the system down. There are a number of problems with this, the first being that anonymity systems which are contingent upon selective government approval for anonymity are ill-suited to a global Internet environment: What makes a court order from Germany, or England, or the US any more valid than a court order from another net-connected UN member, like China, or France? If we believe privacy and anonymity to be human rights, then we cannot build these sort of backdoors into the system and expect them not to be abused. Compare the JAP operator's actions with those of Julf Helsingius, operator of anon.penet.fi (the famous anonymous remailer/pseudonym server): http://www.penet.fi/press-english.html Julf closed down his system, which was inherently vulnerable to subpoena attacks since it stored nym to user mapping information, when he realized he could be forced to reveal any user's identity by almost any entity willing to abuse the global legal systems. Time has shown that was the right choice. Cypherpunk and Mixmaster remailers, already developed and deployed by this time, rose up in penet's place, and at this point it would be impossible for anyone to effectively compromise a user's identity via court order. (There are Mixmaster nodes operating in almost a dozen countries, and the system is truly designed to defeat rogue operators.) With the next-generation of remailers on the horizon (Mixminion and Mixmaster 4.0), ease of use should near that of Penet. Unfortunately, these are email solutions, and don't address the web browsing issue that JAP attempted to solve. Bad anonymity systems are worse than no anonymity systems. JAP has become a bad anonymity system -- mainly because it represents itself as being far stronger and more secure than it is. I am unclear on the JAP source code license. Perhaps it is possible to restore the code to the uncompromised version, and erect a parallel, trusted JAP network -- though the damage to its reputation is certainly severe. This goes to demonstrate again that crypto isn't the only consideration in an anonymity system: Anonymizer, for instance, is still a better choice for web anonymity than JAP, even though JAP offered mixing and independent operators. An anonymity provider should never represent itself as offering a greater level of protection than is actually offered -- which is the worst thing that the JAP team did (and is still doing.) --Len.

1 0

ADMIN: List returning
by R. A. Hettinga 21 Aug '03

21 Aug '03

--- begin forwarded text

1 0

Re: Popular Net anonymity service back-doored (fwd)
by Major Variola (ret) 21 Aug '03

21 Aug '03

At 06:44 PM 8/21/03 +0200, Thomas Shaddack wrote: >Popular Net anonymity service back-doored >Fed-up Feds get court order >http://theregister.co.uk/content/55/32450.html > >The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and >goings across the Internet, has been back-doored by court order. The service >is currently logging access attempts to a particular, and unnamed, Web site >and reporting the IP addys of those who attempt to contact it to the German >police. > >"What was the alternative? Shutting down the service? The security >apparatchiks would have appreciated that - anonymity in the Internet and >especially AN.ON are a thorn in their side anyway." The way the Zealots dealt with Roman collaborators is becoming increasingly attractive... >Sorry, the Feds undoubtedly appreciated the JAP team's willingness to >back-door the app while saying nothing about it a lot more than they would In the US, their claims about anonymity would be *fraudulent* and subject to legal action. Perhaps some extra-German folks should use the proxy and hit a lot of National Socialist sites... don't want Grosser Bruder to get bored...

1 0

JAP back doored
by error 21 Aug '03

21 Aug '03

This is a terrible day for privacy advocates that used the once (perhaps never true) "anonymous" Java Anonymous Proxy. According to a story ( http://theregister.co.uk/content/55/32450.html) by The Register (It was also posted to ("http://securityfocus.com/archive/1/334382/2003-08-18/2003-08-24/0) BugTraq) JAP was back doored by court order. It was a forced upgrade (after a service interruption) to monitor "one site" that continues to be unnamed. How sad it is when a group have a motto of "Anonymity is not a crime." and then hand logs to the police without a word? Clearly if they are able to defend themselves on alt.2600 (http://groups.google.com/groups?dq=&hl=en&lr=&ie=UTF-8&frame=right&th=f4ef43 f695ca29e8&seekm=3f3d3740%241_1%40news.vic.com#link10), they aren't under a gag. Read it and weep. -- error <error(a)lostinthenoise.net> [demime 0.97c removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

National Emergency?
by Harmon Seaver 21 Aug '03

21 Aug '03

So how much of the Constitution gets shredded by Bush's declaration of a "national emergency" right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, but ... -- Harmon Seaver CyberShamanix http://www.cybershamanix.com

4 3

Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 21 Aug '03

21 Aug '03

The good thing on the bad thing is that Java is relatively easy to decompile and audit. The bad thing on this good thing is that next to nobody will bother. The good thing on this bad thing is that at least someone will do, as it turned out in this case. Wondering how difficult it would be to make a "rogue" version of JAP with the logging functions removed or damaged. ---------- Forwarded message ---------- Date: Wed, 20 Aug 2003 21:56:22 -0700 Subject: Popular Net anonymity service back-doored From: Thomas C. Greene <thomas.greene(a)theregister.co.uk> Organization: The Register To: bugtraq(a)securityfocus.com Popular Net anonymity service back-doored Fed-up Feds get court order http://theregister.co.uk/content/55/32450.html The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and goings across the Internet, has been back-doored by court order. The service is currently logging access attempts to a particular, and unnamed, Web site and reporting the IP addys of those who attempt to contact it to the German police. We know this because the JAP operators immediately warned users that their IP traffic might be going straight to Big Brother, right? Wrong. After taking the service down for a few days with the explanation that the interruption was "due to a hardware failure", the operators then required users to install an "upgraded version" (ie. a back-doored version) of the app to continue using the service. "As soon as our service works again, an obligatory update (version 00.02.001) [will be] needed by all users," the public was told. Not a word about Feds or back doors. Fortunately, a nosey troublemaker had a look at the 'upgrade' and noticed some unusual business in it, such as: "CAMsg::printMsg(LOG_INFO,"Loading Crime Detection Data....\n");" "CAMsg::printMsg(LOG_CRIT,"Crime detected - ID: %u - Content: \n%s\n",id,crimeBuff,payLen);" and posted it to alt.2600. Soon the JAP team replied to the thread, admitting that there is now a "crime detection function" in the system mandated by the courts. But they defended their decision: "What was the alternative? Shutting down the service? The security apparatchiks would have appreciated that - anonymity in the Internet and especially AN.ON are a thorn in their side anyway." Sorry, the Feds undoubtedly appreciated the JAP team's willingness to back-door the app while saying nothing about it a lot more than they would have appreciated seeing the service shut down with a warning that JAP can no longer fulfill its stated obligation to protect anonymity due to police interference. Admittedly, the JAP team makes some good points in its apology. For one, they say they're fighting the court order but that they must comply with it until a decision is reached on their appeal. Jap is a collaborative effort of Dresden University of Technology, Free University Berlin and the Independent Centre for Privacy Protection Schleswig-Holstein, Germany (ICPP). A press release from ICPP assures users that JAP is safe to use because access to only one Web site is currently being disclosed, and only under court-ordered monitoring. But that's not the point. Disclosure is the point. The JAP Web site still claims that anonymity is sacrosanct: "No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user." This is obviously no longer true, if it ever was. And that's a serious problem, that element of doubt. Anonymity services can flourish only if users trust providers to be straight with them at all times. This in turn means that providers must be absolutely punctilious and obsessive about disclosing every exception to their assurances of anonymity. One doesn't build confidence by letting the Feds plug in to the network, legally or otherwise, and saying nothing about it. Justifying it after the fact, as the JAP team did, simply isn't good enough. Telling us that they only did it to help catch criminals isn't good enough either. Sure, no normal person is against catching criminals - the more the merrier, I say. But what's criminal is highly relative, always subject to popular perception and state doctrine. If we accept Germany's definition of criminal activity that trumps the natural right to anonymity and privacy, then we must accept North Korea's, China's and Saudi Arabia's. They have laws too, after all. The entire purpose of anonymity services is to sidestep state regulation of what's said and what's read on the basis of natural law. The JAP Web site has a motto: "Anonymity is not a crime." It's a fine one, even a profound one. But it's also a palpably political one. The JAP project inserted itself, uncalled, into the turbulent confluence between natural law and state regulation, and signaled its allegiance to the former. It's tragic to see it bowing to the latter. .

1 0

RE: National Emergency?
by Vincent Penquerc'h 21 Aug '03

21 Aug '03

> So how much of the Constitution gets shredded by Bush's > declaration of a > "national emergency" right after 9/11, and how long can he > maintain that. I > mean, I realize the the Constitution/bill of rights is pretty > much gone anyway, > but ... http://www4.law.cornell.edu/uscode/50/1622.html -- Vincent Penquerc'h

2 1

RE: National Emergency?
by Vincent Penquerc'h 21 Aug '03

21 Aug '03

> Funny, I've never heard or read anything about them doing this. An interesting bit in http://www4.law.cornell.edu/uscode/50/1541.html is that the US president can perform an "introduction of United States Armed Forces into hostilities" without Congress declaring war, if a national emergency is in effect. So the war in Iraq would seem to be essentially legal from a POV of US law. I previously thought that only Congress could do this. National emergency is a very interesting bit of the code to have if you have either a friendly majority in both houses, or if opposing you would be seen as political suicide, as was the case in late 2001... I wonder if the powers conferred include anything like law enacting with Congress bypass (for speed, you know, we don't want Congress delaying this very important new bit of anti terrorist press quashing law...) -- Vincent Penquerc'h

1 0