- cypherpunks-legacy - lists.cpunks.org

RRE: crime and technology
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 07:55:48.58 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 19 Feb 1997 18:51:34 -0500 From: Belinda Juran <juran(a)law.harvard.edu> [...] Harvard Journal of Law & Technology Symposium: Crime & Technology Law Enforcement Technology - Cybercrime - Electronic Commerce Saturday, March 15, 1997 Ames Courtroom, Austin Hall at Harvard Law School in Cambridge, MA. Registration: 9:30 A.M. Tentative Schedule, including Confirmed and Tentative Panelists: 9:30-9:45 Registration & coffee 9:45-10 Introduction 10-12 Panel: "Search, Seizure, and Surveillance Technology" (searching of technology & the technology of searching) Moderator: Stephen Heymann assistant United States attorney in Boston who teaches at HLS and was involved with the first wiretap laid on the Internet. Panelists: o Tony West AUSA in San Jose who helped investigate the creator of PGP and is now prosecuting the "Orchid Club" cases against an international child pornography ring that distributed through the Internet. o Chris Slobogin UFlorida professor who is the reporter for the ABA Task Force on Technology and Law Enforcement o Andy Good a Boston defense attorney who has defended computer searches including US v. Steve Jackson Games o Marc Goodman a Los Angeles Police Department sargeant who has investigated computer crimes and has pursued the impact of technology on police departments during his year at the Kennedy School of Government o Elizabeth Marsh a Quinnipiac Law School professor who has done work on encryption and the danger of the federal government's "key" proposal 12 Lunch: box lunch provided 12:45-1:15 Keynote: invited (tentative) keynote speaker: Bob Kahn Corporation for National Research Initiatives 1:15-3:15 Panel: "The Risks of Electronic Banking &Commerce" (content security & payment/banking security) Moderator: Charles Nesson professor at Harvard Law School specializing in legal implications of digital technologies o Marc Rotenberg EPIC (Electronic Privacy & Information Center) o Kelly Frey Copyright Clearance Center o David Byer partner, Testa Hurwitz & Thibeault, Boston, MA o Philip Bane counsel, First Virtual 3:15 end Admission to the Symposium is free to all Harvard affiliates (with valid Harvard ID), $15 for all other students, $30 for public sector professionals, and $100 for private sector professionals. ADVANCE REGISTRATION IS STRONGLY SUGGESTED. - ------------------------Registration Form------------------------------- Harvard Journal of Law & Technology Symposium on Crime & Technology; March 15, 1997; registration begins at 9:30 a.m.; program begins at 10:00 a.m. Ames Courtroom, Austin Hall, Harvard Law School, Cambridge MA Name:____________________________________________________ Affiliation _________________________________________________ Address __________________________________________________ __________________________________________________ Telephone:________________________________________________ Email:____________________________________________________ Check One: _____ Private Sector Professional: $100 _____ Public Sector Professional: $ 30 _____ Student: $ 15 _____ Harvard student (valid ID must be presented at the door): free Make checks payable to: Harvard Journal of Law & Technology Mail the completed registration form with check to: Symposium Registration Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 - ------------------------------Cut Here-------------------------------------- The Symposium is sponsored by Hale and Dorr L.L.P., Boston, MA. The Spring Issue of the Journal will include articles covering the broad topic of "Crime and Technology." For additional information about the Symposium, contact Symposium Editor Belinda Juran, by e-mail at juran(a)law.harvard.edu, or by phone at the Harvard Journal of Law & Technology offices at 617-495-3606 or 617-493-7949. ABOUT THE JOURNAL: The Harvard Journal of Law & Technology is a leading scholarly publication for articles addressing the many diverse interstices of science and technology with law and society. We have published articles by law professors, practitioners, business leaders, and politicians on varied topics including biotechnology, computers, international trade, technology transfer, intellectual property, medical technologies, and telecommunications. These and other subjects are some of the most exciting and rapidly developing areas of the law, and we believe that the dialogue provided by the Harvard Journal of Law & Technology will help to shape the future of this important field. We welcome submissions of articles, case comments, or book reviews addressing the relationship of law and technology. SUBSCRIPTION INFORMATION: For additional information, please contact the Journal at the address below. The Journal publishes three issues each year. To subscribe to the Journal's upcoming issues in Volume 10, please send the Journal a check for U.S. $45.00 (foreign orders $50.00) to the address below. To obtain the issue discussed above or back issues, please send the Journal a check for $35.00 with a note indicating the desired issue (i.e., "Vol. 9 No. 2"). ************************************************************************* Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 Telephone: (617) 495-3606 Fax: (617) 495-8828 E-Mail: jolt(a)law.harvard.edu WWW: http://www.law.harvard.edu/home/jolt/ *************************************************************************

1 0

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0

DES search publicity (was Re: Cryptanalysis)
by Adam Back 17 Dec '03

17 Dec '03

Peter Trei <trei(a)process.com> writes: > Bill Stewart <stewarts(a)ix.netcom.com> writes: > > There may be a distributed Internet crack using that approach, > > though DES is still very inefficient on general-purpose computers and > > works better on bit-twiddliing chips. > > There's one slowly shaping up, organized by the same people who did > the RC5-48 crack. I'm still rooting for an uncoordinated search, > which is already underway. The people who did the RC5-48 crack over on <des-challenge(a)muffin.org>, and <des-pr(a)mail.des-challenge.xtn.net>, or at least one of them in particular, seems dead set on giving the prize fund 50:50 to the EFF/GNU. I'm having a heck of a time talking him out of it. What does your software do with the key if it finds it? Attempt to email it RSA DS/email it to you/report it to user/other? Do you know how many people are running your uncoordinated breaking project? Are you keeping track of how many people have copies. (I suppose that not knowing how many people are running the client is a disadvantage with the uncoordinated approach.) I'm trying to get UK Computer shopper to include an uncoordinated DES searcher in their cover CD, along with a feature article on the challenge (I thought the possibility of winning $10,000 might be a large part of the interest factor for a reader). Don't know if they'll be interested yet. (What I'm keen on is the sheer size of the readership -- if 10% of that lot runs the software, something might happen fast!) Has anyone tried doing something similar in the US? Anyone with contacts with other PC magazine with CD/disk on front format, preferably with large readership, in UK, US, or other countries? For this kind of project, you'd need something with a simple windows interface and install script. I'd have thought a DES breaker which is installed in win3.1/win95 to always start at boot up, and consume free cycles (ie set to back off when the machine is doing other things). A screen saver with nice presentation would be one way to do this. Do any of the breakers do this? Are there clients from other breaks which could be adapted which do? I think someone wrote a screen saver based breaker after the SSL break? Adam ps Have there been any sightings of your code outside the US? Rumor has it that ftp://ftp.replay.com/pub/incoming is a place where things often turn up, but I haven't seen it yet. -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0

RRE: crime and technology
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 07:55:48.58 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 19 Feb 1997 18:51:34 -0500 From: Belinda Juran <juran(a)law.harvard.edu> [...] Harvard Journal of Law & Technology Symposium: Crime & Technology Law Enforcement Technology - Cybercrime - Electronic Commerce Saturday, March 15, 1997 Ames Courtroom, Austin Hall at Harvard Law School in Cambridge, MA. Registration: 9:30 A.M. Tentative Schedule, including Confirmed and Tentative Panelists: 9:30-9:45 Registration & coffee 9:45-10 Introduction 10-12 Panel: "Search, Seizure, and Surveillance Technology" (searching of technology & the technology of searching) Moderator: Stephen Heymann assistant United States attorney in Boston who teaches at HLS and was involved with the first wiretap laid on the Internet. Panelists: o Tony West AUSA in San Jose who helped investigate the creator of PGP and is now prosecuting the "Orchid Club" cases against an international child pornography ring that distributed through the Internet. o Chris Slobogin UFlorida professor who is the reporter for the ABA Task Force on Technology and Law Enforcement o Andy Good a Boston defense attorney who has defended computer searches including US v. Steve Jackson Games o Marc Goodman a Los Angeles Police Department sargeant who has investigated computer crimes and has pursued the impact of technology on police departments during his year at the Kennedy School of Government o Elizabeth Marsh a Quinnipiac Law School professor who has done work on encryption and the danger of the federal government's "key" proposal 12 Lunch: box lunch provided 12:45-1:15 Keynote: invited (tentative) keynote speaker: Bob Kahn Corporation for National Research Initiatives 1:15-3:15 Panel: "The Risks of Electronic Banking &Commerce" (content security & payment/banking security) Moderator: Charles Nesson professor at Harvard Law School specializing in legal implications of digital technologies o Marc Rotenberg EPIC (Electronic Privacy & Information Center) o Kelly Frey Copyright Clearance Center o David Byer partner, Testa Hurwitz & Thibeault, Boston, MA o Philip Bane counsel, First Virtual 3:15 end Admission to the Symposium is free to all Harvard affiliates (with valid Harvard ID), $15 for all other students, $30 for public sector professionals, and $100 for private sector professionals. ADVANCE REGISTRATION IS STRONGLY SUGGESTED. - ------------------------Registration Form------------------------------- Harvard Journal of Law & Technology Symposium on Crime & Technology; March 15, 1997; registration begins at 9:30 a.m.; program begins at 10:00 a.m. Ames Courtroom, Austin Hall, Harvard Law School, Cambridge MA Name:____________________________________________________ Affiliation _________________________________________________ Address __________________________________________________ __________________________________________________ Telephone:________________________________________________ Email:____________________________________________________ Check One: _____ Private Sector Professional: $100 _____ Public Sector Professional: $ 30 _____ Student: $ 15 _____ Harvard student (valid ID must be presented at the door): free Make checks payable to: Harvard Journal of Law & Technology Mail the completed registration form with check to: Symposium Registration Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 - ------------------------------Cut Here-------------------------------------- The Symposium is sponsored by Hale and Dorr L.L.P., Boston, MA. The Spring Issue of the Journal will include articles covering the broad topic of "Crime and Technology." For additional information about the Symposium, contact Symposium Editor Belinda Juran, by e-mail at juran(a)law.harvard.edu, or by phone at the Harvard Journal of Law & Technology offices at 617-495-3606 or 617-493-7949. ABOUT THE JOURNAL: The Harvard Journal of Law & Technology is a leading scholarly publication for articles addressing the many diverse interstices of science and technology with law and society. We have published articles by law professors, practitioners, business leaders, and politicians on varied topics including biotechnology, computers, international trade, technology transfer, intellectual property, medical technologies, and telecommunications. These and other subjects are some of the most exciting and rapidly developing areas of the law, and we believe that the dialogue provided by the Harvard Journal of Law & Technology will help to shape the future of this important field. We welcome submissions of articles, case comments, or book reviews addressing the relationship of law and technology. SUBSCRIPTION INFORMATION: For additional information, please contact the Journal at the address below. The Journal publishes three issues each year. To subscribe to the Journal's upcoming issues in Volume 10, please send the Journal a check for U.S. $45.00 (foreign orders $50.00) to the address below. To obtain the issue discussed above or back issues, please send the Journal a check for $35.00 with a note indicating the desired issue (i.e., "Vol. 9 No. 2"). ************************************************************************* Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 Telephone: (617) 495-3606 Fax: (617) 495-8828 E-Mail: jolt(a)law.harvard.edu WWW: http://www.law.harvard.edu/home/jolt/ *************************************************************************

1 0

The List
by Steve 17 Dec '03

17 Dec '03

Hey all, As a somewhat quiet observer and student of the Cypherpunk list over the last two years, I have been able to keep in touch with an unimaginable amount of issues, info, concerns, and news; and the knowledge I have gained from this list is more than I can say in words. I have sifted through the noise and can say the info gleaned was indeed worth the effort. I am sorry to see the list in its present state, ready to move on to better? things. I hope I speak for many of you, like me who listened learned asked and was answered, that the Cypherpunk list must continue and that each of us, active and passive member has a responsibility to ourselves and each other to continue bring the issues to light , fighting the good fight against the gov't's lousy regulations, and bringing encryption to the masses. I have been working with a security software development company for 2 and half years and have been working on this goal: bringing encryption to the masses. The information both directly (actual posts relating to Crypto) and indirectly (Rants and flames on Snakeoil products) gained has helped guide me and my colleagues closer and closer to our goal. For that and more I thank all of you. We are very close to releasing a beta version of our product to the Internet community to use and abuse. We have worked closely with Bruce Schnieir and Counterpane to insure good implementation of our security measures. I hope our product meets with your standards and approval but more importantly I hope that you (the collective you) can be instrumental in helping us to accomplish our goal. I will post to this list (assuming it is still amongst the living) very shortly a more detailed description of the product and where a beta can be gotten. I am sorry for "whetting the appetites" but I figured since I was E-mailing a post relating to the state of list, I include a bit about how the list has positively effected me and has contributed to society. Steveo (privsoft(a)ix.netcom.com) --Privacy Software Division-- Syntel Technologies, Inc.

1 0

[ADMINISTRATIVIUM] RSA
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timothy `C' May was born when his mother was on the toilet. /\ o-/\ Timothy `C' May ///\|/\\\ / /|\ \

1 0

Re: RSA
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

A warning label ought to be tattooed on Tim C[retin] May's head, saying `Warning: shit content under pressure'. /\_/\ ( x x ) -oo0-(o o)-0oo- Tim C[retin] May

1 0

Kiss the Toad
by John Young 17 Dec '03

17 Dec '03

The news wads we've been posting will appear in the cpunk mail dumpster. Or, we'll e-mail them to anyone who unsubs but wants the stuff. Send us a blank message with subject: DUM_pit ----- Thanks to JG for princely service, a kiss to the toad.

1 0