- cypherpunks-legacy - lists.cpunks.org

w00w00 --AOL msgr gets buffer overflowed
by Anonymous 02 Jan '02

02 Jan '02

New Hole Could Hurt AOL Messenger http://www.washingtonpost.com/wp-dyn/articles/A52687-2002Jan2.html By D. Ian Hopper AP Technology Writer Wednesday, January 2, 2002; 3:09 PM WASHINGTON A security hole in AOL Time Warner's Instant Messenger program used by millions of users worldwide can let a hacker take full control of a victim's computer, according to security researchers and the company. An AOL spokesman said the problem will be fixed soon, and users won't have to download anything. "We have identified the issue and have developed a resolution that should be deployed in the next day or two," AOL's Andrew Weinstein said. "To our knowledge, this issue has not affected any users." The problem affects newest versions as well as many earlier iterations of AOL's Instant Messenger program. Discovered by a loose team of international researchers called 'w00w00,' the hole is a "buffer overflow," like the problem recently found in Microsoft's Windows XP. By sending a stream of junk messages to the program, a hacker can overwhelm the software and make the victim's computer run any commands the hacker wants. "You could do just about anything, (you could) delete files on the computer or take over the machine," w00w00 founder Matt Conover said. Conover said w00w00 has over 30 active members from 14 states and nine countries. Until AOL's fix is released, Conover said, Instant Messenger users should restrict incoming messages to friends on their "Buddy List." "It will at least keep someone from attacking you at random," Conover said, but it wouldn't help if the attack code is added to a virus that propagates without the victim's knowledge. AOL said it has not given its users any advice in the interim. Conover said the group found the problem several weeks ago, but didn't contact AOL until after Christmas. The group didn't get any response from AOL through an e-mail during the holiday week, he said, so w00w00 released details and a program that takes advantage of it to public security mailing lists less than a week later. The program released by w00w00 remotely shuts down a person's Instant Messenger program, but could be modified to do more sinister things. That practice is under scrutiny by security professionals. While some independent researchers argue for a "full disclosure" policy and say software vendors are trying to cover up their mistakes, many companies say users are better protected if the company has time to react. Russ Cooper, who moderates a popular security mailing list and works for security firm TruSecure, said Conover's actions are irresponsible. "I think it's better to provide details of the exploit and then let other people write the actual code," Cooper said. "Unfortunately, these are fundamentally naive people with a very childish view of the world." Cooper said he let Conover send the information out through his mailing list, but only did so after noticing it was released through other channels as well. Conover said w00w00 set a New Year's deadline for sentimental reasons, because it was the anniversary of the group's last major security release. He defended the disclosure of the attack program. "This is the approach that w00w00 has historically taken to the problem," he said. "For us it means providing all the information we have available to the security community." AOL's Weinstein said the company would have appreciated more warning. "We'd encourage any software programmer that discovers a vulnerability to bring it to our attention prior to releasing it," Weinstein said.

1 0

handgun carry and mobile preparedness
by Faustine 02 Jan '02

02 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Petro wrote: >On Monday, December 31, 2001, at 02:15 PM, Faustine wrote: > Thanks to all for the excellent advice and recommendations. I'm sure > it's worth taking the time to try them all before deciding, thanks again for > a more solid place to start. >> How much time do you have? >> There are a *lot* of pistols out there. Oh no, I just meant the ones people here are recommending most. The ones I had my eye on to begin with, plus some .40s and others. david wrote: >After you acquire a handgun you have to figure out what to do with it. Are >you going to carry it on your person, or leave it in your vehicle or at home? Concealed carry it the only way to go, after I iron all the permits out. I'm a firm believer in mobile preparedeness: in fact, every day I never leave home without carrying a complete BOB concealed in a Kate Spade bag. And I mean fucking EVERYTHING, the true survivalist nutcase works: first aid kit, emergency rations, flashlight, space blanket, poncho liner, magnesium fire starter, water purifying tabs, mini-entrenching tool, Swiss army knife, NIOSH-95 filter mask, nitrile gloves, monocular, grundig shortwave, passport, etc etc. (Full contents available on request, it would take awhile!) Since I put some effort into cutting the items' weight, and densely packed and organized everything into 3 see-through zipper pouches for easy access, I can actually get away with going much smaller than a lot of the regular women's handbags you see every day. Total stealth: nobody would ever know it's not just a regular cute, fashionable purse. Would you believe I've actually been complimented on how nice it looks? LOL! If only they knew! Once upon a time, I lived out of such a stealth bag, minus most all of the cool stuff. Just because I'm doing well now, I see no reason to deprive myself of a system that works. It's a nice feeling to know that at the drop of a hat I could disappear completely off the face of the earth, survive and thrive. And even if I were separated from my BOB, I've studied primitive skills (shelter, firemaking, trapping etc) so I know I'd pull through. With the right attitude and knowledge, you can live through most anything. But then, investing in a solid concealed carry never hurt anything either. :) ~Faustine. *** He that would make his own liberty secure must guard even his enemy from oppression; for if he violates this duty he establishes a precedent that will reach to himself. - --Thomas Paine -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 (C) 1997-1999 Network Associates, Inc. and its affiliated companies. (Diffie-Helman/DSS-only version) iQA/AwUBPDNtI/g5Tuca7bfvEQJDQwCg9FaCoZsNfP60kz3BtejHtredOTkAoOCW NdgtOzTuQd5GG5RSWa+dMok+ =S9pU -----END PGP SIGNATURE-----

1 0

Follow the yellow brick road.
by mattd 02 Jan '02

02 Jan '02

WHAT IS MASS MURDER IF YOU'RE AN EX-PRESIDENT? Wayne Madsen While CIA agents and US Special Forces are on the hunt for Al Qaeda cells throughout East Africa, a company on whose International Advisory Board sits George H. W. Bush ("41," sire of "43") is applying a full court press on human rights workers and opposition politicians in Tanzania. In 1996, Tanzanian troops allegedly buried alive some gold miners at Bulyanhulu mine in northwestern Tanzania. The miners were originally invited by the government to mine gold in the region, but in 1996, the government in Dar es Salaam reversed course and granted the Kahama Mining Corporation, an affiliate of Sutton Resources Ltd. of Canada, a permit to mine the gold in Bulyanhulu. Sutton was later acquired by Barrick Gold, another Canadian firm on whose board Bush pere sits along with former Canadian Prime Minister Brian Mulroney and former Clinton First Friend Vernon Jordan. When the Tanzanian independent gold miners refused to comply with a government order to vacate the mine for Sutton, they were said by Tanzanian witnesses to have been buried alive by bulldozers belonging to the mining company. Recent reports and revelations concerning the role of Sutton cum Barrick in the massacre have resulted in a law suit against Britain's Observer newspaper and a decision by Amnesty International to delete references to the massacre in its annual report on human rights. Now, Barrick, in cooperation with the Tanzanian government, is putting the screws to those brave Tanzanians who have dared challenge the official record on what happened at Bulyanhulu. Last month, Tanzanian police arrested Augustine Mrema, the leader of the opposition Tanzania Labor Party, and Rugemeleza Nshala, the head of Lawyers for Environmental Action in Tanzania (LEAT). Tanzania also issued an arrest warrant for Tundu Lissu, a Washington, DC-based human rights lawyer who has documented witness accounts of the 1996 mass murder. Tanzanian police searched the offices of LEAT, reportedly looking for a videotape that displays the charred remains of the bodies of victims, said to have been burnt by the military after they were exhumed from the buried mine. The opposition politicians and human rights workers have refused to turn the tape over to the Tanzanian government wanting to instead get it into the hands of an independent international investigation team. So the deal post September 11 is that if your last name is Bin Laden, Omar, or al-Zahrawi and you killed innocent people, you will have a world coalition hot on your heels. However, if your last name is Bush, Mulroney, or Jordan and it just so happens that another Bush sits in the White House and you sit on an international board of a company accused of covering up genocide, you will get a free pass and a pat on the back. Welcome to the Bush New World Order. God help us all. http://www.spiescafe.com/wm/wayne.htm search also for greg palast's gutsy attack on corporate criminals,Barrick.

1 0

Commercial Van Eck?
by Steve Schear 02 Jan '02

02 Jan '02

Use common sense for best security An established company moves into a downtown high-rise and a few months later discovers that many of its secrets are going public. How is that possible? Its networks are locked down. Its employees use passwords, and are given security clearances. So what's the problem? How about that old warehouse next door? A competitor has rented it and mounted large antennas behind closed window blinds to listen for electronic emissions from its neighbor's electronic equipment. http://www.zdnet.com/zdnn/stories/comment/0,5859,2833569,00.html

1 0

FW: arabic <-> english translation page
by Lucky Green 02 Jan '02

02 Jan '02

I didn't see this on the list, though I may have missed the post due to mail server migration issues. --Lucky Green -----Original Message----- From: rene(a)xs4all.nl [mailto:rene@xs4all.nl] Sent: Tuesday, January 01, 2002 3:04 PM To: [elided] Subject: arabic <-> english translation page Some rogue element at cnn.com posted this on their website.. from now on i'm reading al-jazeera ;-) http://europe.cnn.com/2001/TECH/ptech/12/31/arabic.software.ap/index.htm l In October, Cairo-based Sakhr Software released its Arabic-to-English translation software -- free for the world to use -- on the company's Arabic language Web portal at Ajeeb.com http://english.ajeeb.com/ http://edalilc.ajeeb.com/data/66187.asp -> listing of arab news sources http://tarjim.ajeeb.com/ajeeb/Tarjimtrans.asp?ol=1&url=http://www.al-jaz eera.net&lang=1&interface=0&sentence= -> al-jazeera in english

2 1

Dissent == terrorism
by Nomen Nescio 02 Jan '02

02 Jan '02

http://www.latimes.com/news/nationworld/nation/la-010202unease.story U.N. Fears Abuses of Terror Mandate Excerpt: Insulting Mugabe May Be Outlawed On Dec. 20, the Cuban legislature, with President Fidel Castro presiding, unanimously passed a law that state media said expanded the application of capital punishment for crimes defined as terrorism, including the use of the Internet to incite political violence. A week earlier, the government of Zimbabwe published a proposed law that would make it a crime to "undermine the authority of or insult" President Robert Mugabe, who is again seeking reelection. Mugabe's aides defended the legislation as necessary to combat terrorists, a category they said includes most of the president's opponents as well as critical journalists. ... Hey Mugabe give us your home address we'll bill your estate for the bullet you'll receive before you can hear it.

1 0

thermal camera detects lying
by Anonymous User 02 Jan '02

02 Jan '02

http://www.upi.com/view.cfm?StoryID=01012002-053506-3828r Thermal camera may detect lying Published 1/2/2002 2:04 PM ROCHESTER, Minn., Jan. 2 (UPI) -- An experimental new lie detector that measures sudden flashes of heat from around the eyes may soon provide another line of defense against terrorism. "This is the first technology that allows lying to be measured or lying to be detected without any contact with the subject whatsoever instantaneously, in real time," said lead researcher James Levine, an endocrinologist at the Mayo Clinic in Rochester, Minn. "You don't need to hook them up to anything -- you don't need any sophisticated experts to analyze the data." The researchers say prototypes of the device may aid security operations within the next two years, in areas such as airports and border checkpoints. However, Levine also is concerned about the potential ethical ramifications of the technology if it ever becomes developed for the open market. "If this technology really becomes developed to the desktop phase, you could be sitting in front of your boss and he could ask you 'Do you think you can meet your deadline?' And you can say, 'Sure, of course,' and he'd say, 'I know you're lying,'" Levine said in an interview with United Press International. "Or, on a date, one's boyfriend could say to a person, 'Are you serious about wanting to get married?' and when she answers the question, she's being photographed." "On the other hand, when thinking about the possibility of someone with explosives in his shoes boarding a plane, given the technology's security potential, I think most of us would want this application to be accelerated as quickly as possible," Levine added. "We're making advances in science, and I think the ethical issues need to be dealt with when the advances are being made. Otherwise ethics gets left behind," he said. The device consists of a high-definition thermal imaging camera the size of a shoebox. The scientists also have developed a miniaturized version of the camera, roughly the diameter of a postage stamp. Both are hooked up to a filing cabinet's worth of computer hardware. "As people lie, there is a massive increase in blood flow around the eyes, and associated with that there is sudden warming around the eyes, where the color changes to white in the thermal imaging system," Levine explained. The researchers made their discovery accidentally three years ago while studying, of all things, gum chewing. They were using the thermal imaging device to study the facial muscles at work to analyze how physical activity affected metabolism. "We got these beautiful thermal images every time someone chewed gum, and by accident we detected the very subtle changes that occur in the face with fearfulness -- there was a loud bang when a book fell on the lab floor," Levine told UPI. "The changes in the face that came with that were very consistent with several individuals. And we thought, 'My goodness, if this can detect these very subtle changes instantaneously, perhaps we can see these same changes with lying.'" The research team had 20 volunteers commit a mock crime and then assert innocence under experimental conditions at the Department of Defense Polygraph Institute in Fort Jackson, S.C. Eight of the volunteers stabbed a mannequin and stole $20 from it, while the rest had no knowledge of the crime. The device accurately detected lying roughly 80 percent of the time, a precision level comparable to standard lie detecting polygraph tests performed by experts. "Is the method detecting stress or deceit?" commented physicist Gerry Yonas, principal scientist at Sandia National Laboratories in Albuquerque, N.M. He suggested the researchers needed to further compare this new data with other methods of stress and deceit detection. Levine agreed more evaluation was needed under a variety of conditions outside the laboratory, taking into account factors such as wind speed or what people had to eat. "If this technology has the remote possibility to do what it could do, it's mandatory to get this carefully evaluated as soon as humanly possible," Levine said. The researchers reported their findings in the journal Nature. (Reported by Charles Choi in New York.)

1 0

New Hole in AOL Instant Messenger
by Jim Choate 02 Jan '02

02 Jan '02

http://dailynews.yahoo.com/htx/ap/20020102/tc/aol_security_2.html -- -- ____________________________________________________________________ Day by day the Penguins are making me lose my mind. Bumper Sticker The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Top Secret
by r27009＠mymail.dk 02 Jan '02

02 Jan '02

1 0

Magic Lantern - The FBI's viral key-logger (fwd)
by Eugene Leitl 02 Jan '02

02 Jan '02

1 0