- cypherpunks-legacy - lists.cpunks.org

Re: ALERT / My email address is... (fwd)
by J. Michael Diehl 09 Jun '93

09 Jun '93

> On Mon, 7 Jun 1993 22:18:16 -0600 (MDT), "J. Michael Diehl" <mdiehl(a)triton.unm.edu> wrote: > > > > We could set up aliases and distribute a common secret key for the list.... > > How are you going to do this securely? > Just a thought, We're not. I was very tired and was using my other, much smaller, brain to think with. ;^) I was (thinking?) of distributing a common secret key to people who we know are not spooks, and who would be interested in the cypherpunk's cause. This and anonymous remailers would ensure that anyone could say anything with total anonymity, since we would all share secret keys. The problem is, of course, that many people who would otherwise be interested, could not participate in our new clique. ;^( SO, DISREGUARD MY COMMENTS! Plz! +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

anonymous mail
by remail＠tamsun.tamu.edu 09 Jun '93

09 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Deadbeat wrote: > This "coincidence" brings a name to mind. > Rhymes with "turn right." > Starts with S. > What could I be thinking? This is by far the best explanation for the whole soda/penet/CERT problems! Undoubtedly the work of good old Mr. "Rear of the boat; illumination" Dr. Manhattan -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLBVYzN1uahe7Mr5vAQHLlgQArcKYK9yvgXOhRdtt03z1tz3wpaUi/RAE oL1fjvLWJ7PHyK1BObnEhFjfv/JO4DwPqd1EevVDzyV3G/AydKf6GtuNVofDmu4T JlDLx5DFTZQ24xgljaubJ4yOOXgbsNMvziHq5dmwx2boqyXjufq8lXhKgnDQQBEl xH7ooyA7Aaw= =/16r -----END PGP SIGNATURE-----

1 0

Re: CERT
by smb＠research.att.com 09 Jun '93

09 Jun '93

The paranoia is getting out of hand. Let's take this one point by point. I've deleted the poster's name, because this note is just an example; it's not the only such posting. Certainly that may be so.. but in this case they didn't merely tell 'you' with a simple note, instead they did atleast 2 things which really are bothersome and overstepping common 'courtesy' of merely informing 'you': ``You''? Who is ``you''? The CERT note didn't mention any individual. They might not have the information. If they did, it might be because the account was compromised. (That was the case the last time I helped a friend investigate ftp droppings. In that case, though, it was only the ftp account, not the login account, so notifying the owner would not have been damaging. Btw -- remember the recent CERT advisory on bugs in the WUSTL ftpd?) 1) Instead of going directly to the owner of the directory in question or the administator of the host they jumped over 'your' head and went to the domain administrator. I can see going to a site administrator if they had reason to believe the owner of the directory was doing something illegal.. but then again they have no authority to make/enforce/etc any kind of laws. They were just plain out of line. Consider this example (and I'll give them the benefit of doubt here that someone really did complain to them and they aren't on some witchhunt of their own): I am Cert and Mr Von Karman has emailed me to say that a /jet/Enigma-cypher-code directory appears to have illegal software of some kind.. so I send up my email.. not to you.. but to Goldin, the new NASA head that I believe this directory owned by you has illegal software on it. Well that is a good way to put some bad marks on your record even if you do prove it untrue to your boss.. maybe you had just removed the evidence before he checks out your acct.. either way he shuts down your net access for a while..'just to be sure', and look out next time you want a promotion.. can't be to safe.. you might be a security risk! As I said before, they might not know who was involved. Even if they did, and even if the account wasn't compromised, it's the SA's responsibility to investigate. What if a local user is doing un- authorized things? Take this particular case -- they could easily end up being sued for contributing to copyright infringement. They might win -- but defending against a lawsuit is expensive. 2) They didn't check the system out before hand and blatantly said as much.. what kind of service to you is that? my friend met a guy who knows bigfoot..but certainly you don't see me bothering the people who own the land where bigfoot is supposed to live. Check it out? How? Apart from the question of whether or not you want CERT looking through your directories (and I can just hear the complaints now -- ``On no evidence but an anonymous tip, CERT logged in, listed everything, looked for *my* hidden areas that I used to distribute restricted software, and tied up my link to the Internet for hours while the downloaded everything in sight'') -- it isn't feasible. I just ftp'd to soda for a quick look-see. A ls-lRa generated 160K bytes. Simply screening that takes time. Many of the files showed only numeric uid's; the ftpd passwd file was obviously not up to date. Even if I knew the suspect files, I might not know who the responsible user was. Many of the files had informative names like ``packet123.Z''. They mirrored the full X11R5 distribution. How much time and effort should CERT put in?!?!! A competent SA will at least know the putative ownership and reliability of the owner of most of that stuff; CERT sure doesn't (except, of course, for the list of hackers they may or may not have, and which has been (rightly) objected to). 3) They want to confiscate logs from the system.. That sure as heck isn't any of their business.. Confiscate? Confiscate? They asked for a copy, if available. ``Confiscate'' generally means ``take away''. They're not taking anything from you. If the logs do show anything, it's precisely their business -- evidence of someone abusing your system (I'm assuming here that there really was 3rd-party deposits and retrieval of files). Quick -- how many of those file transfers are coming from stolen accounts? In my experience, a goodly number. Look, I have my own concerns about CERT in this matter, notably the questions of what evidence they're acting on, and whether or not they're being used (consciously or not) to silence unpopular sites. I've sent them a note asking those questions. But let's try to keep things in perspective. Oh yeah -- as an added bonus, I've enclosed a transcript of the kinds of things I do when trying to find an administrative contact for some machine. I don't see any avenues of contact more likely than ``root'' or ``postmaster''. And it's clearly a large-scale timesharing machine, where there's no one individual clearly responsible for it. --Steve Bellovin ----- $ whois -h rs.internic.net soda.berkeley.edu No match for "SODA.BERKELEY.EDU". The InterNIC Registration Services Host ONLY contains Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. $ finger root(a)soda.berkeley.edu [soda.berkeley.edu] Login: root Name: The Allmighty Directory: / Shell: /bin/csh Office: E238, x2-7453 Last login Mon May 31 22:17 (PST) on console No Plan. $ finger postmaster(a)soda.berkeley.edu [soda.berkeley.edu] finger: postmaster: no such user. $ dig mx soda.berkeley.edu ; <<>> DiG 2.0 <<>> mx soda.berkeley.edu ;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 6 ;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 3, Addit: 8 ;; QUESTIONS: ;; soda.berkeley.edu, type = MX, class = IN ;; ANSWERS: soda.berkeley.edu. 55780 MX 4 soda.Berkeley.EDU. soda.berkeley.edu. 55780 MX 6 scotch.Berkeley.EDU. ;; AUTHORITY RECORDS: Berkeley.EDU. 161050 NS VANGOGH.CS.BERKELEY.EDU. Berkeley.EDU. 161050 NS VIOLET.Berkeley.EDU. Berkeley.EDU. 161050 NS UCBVAX.BERKELEY.EDU. ;; ADDITIONAL RECORDS: soda.Berkeley.EDU. 55780 A 128.32.149.19 scotch.Berkeley.EDU. 55780 A 128.32.131.179 VANGOGH.CS.BERKELEY.EDU. 161050 A 128.32.130.2 VIOLET.Berkeley.EDU. 161050 A 128.32.136.22 UCBVAX.BERKELEY.EDU. 39151 A 128.32.137.3 UCBVAX.BERKELEY.EDU. 161050 A 128.32.130.12 UCBVAX.BERKELEY.EDU. 161050 A 128.32.149.36 UCBVAX.BERKELEY.EDU. 51896 A 128.32.133.1 ;; Sent 1 pkts, answer found in time: 0 msec ;; FROM: inet to SERVER: default -- 0.0.0.0 ;; WHEN: Tue Jun 8 20:16:07 1993 ;; MSG SIZE sent: 35 rcvd: 295 $ telnet soda.berkeley.edu 25 Trying... Connected to soda.berkeley.edu. Escape character is '^]'. 220 soda.berkeley.edu Sendmail 5.65/KAOS-1 ready at Tue, 8 Jun 93 17:10:50 -0700 helo research.att.com 250 soda.berkeley.edu Hello research.att.com, pleased to meet you vrfy root 250-Eric Hollander <"|/accounts/hh/remail/slocal.pl"> 250-Keir Morgan <kmorgan> 250-ERic MeHlHaFf <mehlhaff@ocf> 250-ERic MeHlHaFf <\mehlhaff> 250-Tom Holub <tom> 250-John S. Jacob <jsjacob> 250-Matthew L. Seidl <seidl> 250-Shannon D. Appel <"| /usr/local/lib/mh/slocal -user appel -verbose"> 250-Sean N. Welch <welch(a)xcf.berkeley.edu> 250-Dan Wallach <dwallach(a)postgres.berkeley.edu> 250-Donald J. Kubasak <kube> 250-David G. Paschich <dpassage> 250-Adam Glass <\glass> 250 Adam Glass <glass@postgres > vrfy postmaster 250-Eric Hollander <"|/accounts/hh/remail/slocal.pl"> 250-Keir Morgan <kmorgan> 250-ERic MeHlHaFf <mehlhaff@ocf> 250-ERic MeHlHaFf <\mehlhaff> 250-Tom Holub <tom> 250-John S. Jacob <jsjacob> 250-Matthew L. Seidl <seidl> 250-Shannon D. Appel <"| /usr/local/lib/mh/slocal -user appel -verbose"> 250-Sean N. Welch <welch(a)xcf.berkeley.edu> 250-Dan Wallach <dwallach(a)postgres.berkeley.edu> 250-Donald J. Kubasak <kube> 250-David G. Paschich <dpassage> 250-Adam Glass <\glass> 250 Adam Glass <glass@postgres > quit 221 soda.berkeley.edu closing connection Connection closed by foreign host. $ finger @soda.berkeley.edu [soda.berkeley.edu] Login Name Tty Idle Login Time Office Office Phone aaron Aaron C. Smith qR Jun 8 08:58 Limbo 643-7217 aaron Aaron C. Smith *qT Jun 8 08:58 Limbo 643-7217 achoi Andrew Choi pB 3 Jun 7 18:19 appel Shannon D. Appel pK Jun 8 09:57 CEA 643-5657 aswan Andrew Swan pW Jun 8 17:06 calvin Wa Pak qe 22:11 Jun 7 18:57 cgd Chris G. Demetriou qf Jun 7 22:15 278 Cory 510-642-7520 cliffwd Cliff Draper pe 36 Jun 8 16:30 9-204a 643-3426 cynthia cynthia leigh haynes *pr 3 Jun 8 16:43 cynthia cynthia leigh haynes ps Jun 8 16:43 deb Debra Waldorf *p7 Jun 8 16:20 deb Debra Waldorf *qg 51 Jun 8 15:27 eganloo Egan Loo pJ Jun 8 16:57 eric Eric van Bezooijen qz 1:01 Jun 8 15:50 238E gwh George William Herbe pc 1 Jun 8 14:13 238E gwh George William Herbe pm Jun 8 14:26 238E henchiu Henry Chiu pR Jun 8 17:02 ho Kinson Ho *q3 1:13 Jun 8 15:08 608-1 Evan 642-8290 hughes Eric Hughes *qm 36 Jun 8 10:34 238E isaac Isaac Cheng *pE 12 Jun 8 09:51 isaac Isaac Cheng *qw 12 Jun 8 10:59 jenn Jennifer Hom *pF Jun 8 16:52 238E 415-688-8034 jlb Jordana Brown pQ Jun 8 14:45 karlht Karl Thiessen *pb 13 Jun 8 16:28 238 Evans 642-7453 kenji Kenji Hubbard *pX Jun 8 17:08 238E kube Donald J. Kubasak pU 2 Jun 8 17:05 CEA ESOC 643-7367 marco Marco Nicosia qI Jun 8 15:58 238E 510-283-9587 maroo Maroo Lieuw *qx Jun 8 13:33 849-9872 michelle Michelle Tisi *qZ 5:30 Jun 8 11:34 ming Tje Ming *qj 9 Jun 8 15:28 ming Tje Ming *qO 2:17 Jun 8 13:50 mlee Michael Lee *pD Jun 8 16:49 mlee Michael Lee *qC Jun 8 15:52 nancy Nancy Cheng *pf 1:18 Jun 8 14:17 nancy Nancy Cheng *qV 1:53 Jun 8 13:52 payam Payam Mirrashidi po 19:13 Jun 7 20:54 199MD Cory 642-1297 psb partha s. banerjee *py 2:25 Jun 8 14:32 IBM Almade 510-649-7505 psb partha s. banerjee *pz 2:38 Jun 8 14:32 IBM Almade 510-649-7505 ralbers Rick Albers *pV Jun 8 17:06 rmgee Randall Gee *pn Jun 8 14:28 robert Roberto Boyd *pA Jun 8 16:47 rsr Roy S Rapoport *pY Jun 8 17:09 510-540-5535 seidl Matthew L. Seidl qk 1 Jun 8 10:31 238E x2-7453 seidl Matthew L. Seidl *qB Jun 8 08:32 238E x2-7453 sfd Scott Drellishak pl Jun 8 16:40 Kerr 3-202 tom Tom Holub *pH Jun 8 16:53 tom Tom Holub pI Jun 8 16:53 welch Sean N. Welch *p0 Jun 8 09:04 MTV21-122 415-336-4289

2 1

CERT netnews
by norm＠netcom.com 09 Jun '93

09 Jun '93

Netnews group "comp.security.announce" seems to be the product of CERT. About once a week, on the average, they post something relating to the security of some specific operating system. The few postings that I have seen seem directed to the sys-op (typically Unix) regarding some common practice with security implications or often holes in the defaults that some system comes with. What I have seen there is technical and not political.

1 0

Re: News Bytes June 8, 1933
by peter honeyman 09 Jun '93

09 Jun '93

some interesting stuff here -- a little whistle-blowing here, a little clipper punching there ... peter ------- Forwarded Message Date: Tue, 8 Jun 93 13:02:07 -0400 From: rweingar(a)cs.UMD.EDU (Rick Weingarten) Message-Id: <9306081702.AA18515(a)tove.cs.UMD.EDU> To: adrion(a)cs.umass.edu, basili(a)cs.umd.edu, corbato(a)xx.lcs.mit.edu, patterson(a)ginger.berkeley.edu, pfreeman(a)gatech.edu, mrg(a)research.att.com, cwg(a)research.nj.nec.com, ashok(a)almaden.ibm.com, weiser.parc(a)xerox.com, wulf(a)virginia.edu, wise(a)seafox.cs.indiana.edu, tony(a)ide.com, forsythe(a)cs.UMD.EDU, jh(a)cs.cornell.edu, greg(a)cs.arizona.edu, johnsson(a)think.com, klawe(a)cs.ubc.ca, kung(a)harvard.edu, mji(a)guardian.cs.psu.edu, lazowska(a)cs.washington.edu, leveson(a)ics.uci.edu, steve.muchnick(a)eng.sun.com, jrr(a)cs.purdue.edu, ritchie(a)hplabs.hp.com, jes(a)cs.brown.edu, denning(a)cs.georgetown.edu, jwerth(a)cs.utexas.edu, phayes(a)herodotus.cs.uiuc.edu, policy(a)cs.UMD.EDU Subject: News Bytes June 8, 1933 Computing Research News Bytes by Juan Antonio Osuna with Rick Weingarten 6/8/93 GAO Criticizes ARPA on Architecture Research The General Accounting Office released a report in May (GAO/IMTEC- 93-24), criticizing the DoD's Advanced Research Projects Agency for its handling of the High Performance Computers and Communications program. Some researchers have criticized ARPA for procuring only Intel and Thinking Machines supercomputers for use by ARPA projects, while ignoring machines manufactured by other companies.. GAO cleared ARPA of the harsher accusations of serious misconduct, but upheld this general criticism, saying that such a narrow focus has inhibited R&D by other supercomputer manufacturers. The report suggested that ARPA should seek advice from a broader range of researchers who do not directly participate in ARPA projects. Finally, GAO said ARPA needs to give more emphasis to software development, which in the past has been given lower priority than hardware. ARPA claims it has already fixed many of these problems.. GAO is now planning a follow-on study looking more broadly at program management and support for high performance architecture research in all agencies.. House Appropriations Subcom Gives NSF an 11% Increase [elided] "Clipper Chip" Proposal Draws Public Criticism The Clinton Administration's recent proposal to implement the Clipper chip as a government encryption standard is receiving a cold welcome from some in the computer community. During a three-day meeting before the Computer System Security and Privacy Advisory Board of the National Institute of Standards and Technology, dozens of people from academia, industry, and civil liberties groups expressed disapproval for the way the White House is trying to implement its cryptographic policies. Complaints were directed in three directions---to the technology, to the process of selecting the standard, and to the civil liberties implications for Federal wiretapping. The Administration initiated a public review after, rather than before, declaring Clipper as a government standard and ordering thousands of Clipper devices for government use. In light of the negative reaction, the advisory board passed a resolution to extend public review and voted to hold another board meeting in late July. The board also decided to send a letter to the White House to relay public concerns and to suggest tactfully that the president reconsider the Clipper scheme. Amendments to HPCC Act Move Forward [elided] ------- End of Forwarded Message

1 0

AT&T Encrypting Phone Ad in WS Journal
by binski＠u.washington.edu 09 Jun '93

09 Jun '93

FYI The Wall Street Journal, 7 June 93, page B7, has an AT&T ad for an encrypting communications box called "Surity Telephone Device". It plugs between a regular phone and the phone jack. Anybody know what's inside? Is this new? Also, page B6 has a so-so article on digital signatures. bf

2 1

Statement of dissatisfaction with your recent efforts (fwd)
by Mark 09 Jun '93

09 Jun '93

Probably shouldnt have, but they get on my goat. Forwarded message: >From mark Wed Jun 9 10:59:04 1993 >Subject: Statement of dissatisfaction with your recent efforts >To: cert(a)cert.org >Date: Wed, 9 Jun 1993 10:59:04 +1000 (EST) > >Dear cert et al, > >It has come to my notice recently that your organisation has been >involved in a number of accusations against individuals and organisations >with very little to back such accusations. > >I am referring to, and these are the ones I will mention here, the >soda.berkeley.edu and the anon.penet.fi sites., both of which ARE >legitamate in all respects and are SEEN as such by the net.community. >Your organisations actions, in my personal opinion, consititute a form >of harrassment of the worse kind, and it basically smells. > >Whilst any one with any knowledge of your workings already knows the >low quality of feedback, lack of helpfulness and general arrogance of >your methods, it doesnt do you any good at all to set about on a >crusade of self-serving actions against those sites or entities or >groups of individuals you dont like or you see as furthering ideas >and software that might one day make your life difficult. You will >alienate a larger proportion of the net.community than you otherwise >have. > >I would suggest in future you take the time to VERIFY, through whatever >legal means are at your disposal, the authenticity of your information, >to view yourselves the problems/files and then take whatever action your >charter states as appropriate. Going off gun-ho and sending ominous form >letters to people you see as gullible enough to carry out your desires >really is less than professional. > >I fail to see where you get authority for a large proportion of your >actions, but that is a matter between you and your financiers. Just dont >expect people to take you seriously if the above scenarios are repeated. > >The above is my own personal observations and not those of any other >individual or organisation, although they are free to explicitly echo >them if they so desire. As of yet, none have. > >Mark. >mark(a)cheops.anu.edu.au

1 0

Re: CERT
by jet＠nas.nasa.gov 08 Jun '93

08 Jun '93

peter honeyman writes: > jet wrote: > > I personally like being contacted by an organization trying to tell me > > that someone might be misusing my computing resources. > how would you feel about an organization telling your boss that > your actions were contributing to the abuse? I wouldn't care given my current boss(es). If my boss were the sort to believe a vague form letter and take action w/o consulting me, I'd want a different boss anyway.

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by nobody＠cicada.berkeley.edu 08 Jun '93

08 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- This "coincidence" brings a name to mind. Rhymes with "turn right." Starts with S. What could I be thinking? DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBFAgUBLBUF/fFZTpBW/B35AQEFfQGArv/awBslh2T7ybcjtiiiT9Ew3wxPz3Vv od0hAFCl5L0VFOA1MczZozJWf4xH0nFM =LNm6 -----END PGP SIGNATURE-----

2 1

CERT and us
by fnerd＠smds.com 08 Jun '93

08 Jun '93

hey folks a poem by fnerd It looks like CERT may have a habit of sending accusatory-looking form letters without doing much checking of their own based on who knows what tips. Looks like they need to polish their policies and their prose a little bit. BUT We, too, are a group formed to look into problems of computer security. We, too, respond to security emergencies. We, too, distribute patches to help people improve their security. We, too, send messages--even rumors--back and forth about threatening situations and people we suspect. Sure, our style and emphasis are different, but our charter is very similar to theirs. Let's not let our name or style distract us from our mission or blind us to potential allies. Instead of thinking of them as the heavies and us as the rebels, WHY NOT us as the net-wise older brothers, and them as the enthusiastic amateurs who need some advice and calming down? Eric can write one of his authoritative letters, and we become the voice of reason, the watchers of the watchers, Liberty's eyes. Gentlemen and ladies (I reproach you), remember who we are. -fnerd quote me

1 0