- cypherpunks-legacy - lists.cpunks.org

SSLeay security
by Ben Laurie 17 Dec '03

17 Dec '03

It seems I have expressed myself poorly. My point was that, as far as I am aware, SSLeay has not been widely reviewed. A lot of people use it, sure, but that is not review. Since there are obvious defects in the code, from a security point of view, such as failure to scrub keys, it wouldn't get a clean bill of health from me. Of course, these kinds of defects require other defects in the user's security policy (such as running on an operating system which permits free access to memory) to exploit. There may or may not be worse problems. I don't know. And I won't know until either it becomes important to me, someone pays me to find out, or someone else points them out. I'm not saying that I'm aware of defects which are not obvious but my experience in using it suggests that it may have them - it isn't that hard to crash, and where there are crashes lurk possible security holes. Tracking these down is where it stops being fun. At least for me. Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

1 0

Seditious Cable!
by nobody＠replay.com 17 Dec '03

17 Dec '03

dlv(a)bwalk.dm.com wrote to All: d> Doug Barnes <cman(a)c2.net> writes: >> (Taiwan story warning...) This reminds me of the pirate cable >> TV wars, which hit their peak during my stay there -- [...] d> Now, what would the U.S. government (state or los federales) do in a d> similar situation? They'd probably fine any resident found with a d> cable TV thousands of dollars and if that didn't work, they'd start d> jailing people. Maybe even burn a few TV viewers, a la Waco. :-) And these are the folks you want to maintain your key escrow?

3 4

denial of service and government rights
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- read the last line. the usual rules of evidence which give the feds the right to anything they well please --constitutional or not! if seizure of a victims property can by obtained a search and sieze warrant for the victimized "object," a whole new mode of regulation has begun. all the government will do to suppress sites as they please, is to initiate a few attacks themselves --and they will. I got tired of paying Lexus $150 for idle months after dumping West for almost $500/month --otherwise I would run down the Feds kangaroo ruling which seems to grant them this absurd right. Several on the list are still maintaining accounts... ? ====== begin forwarded text ====== Computer Attacks Show New Patterns The major trends in computer break-ins involve denial of service and data-driven attacks, says a Department of Justice lawyer. Denial of service occurs when an attacker "bombs" an Internet service provider with so many e-mail messages that the server becomes overloaded and shuts down. Data-driven attacks occur when a virus program is disguised as a data-only file. The file can be hidden in a Java program on a Web page, and when a visitor clicks on the site, he or she unwittingly downloads the virus. A computer crime consultant with SAIC warns that these attacks can be launched on an innocent party's Web server, but once that happens, the server can become the subject of a wiretap and a search warrant. "The title of your computer vests with the government as soon as a hacker uses it to commit a crime," he says. [BNA Daily Report for Executives 25 Nov 96 A20] ====== end forwarded text ====== - -- "In nature, stupidity gets you killed. In the workplace, it gets you promoted. In politics, it gets you re-elected." --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMp83lr04kQrCC2kFAQFYuAP/bLbraU6rFFLQZpFfsvxiGrbm7W26p3t9 GffgoN/LA6OBqIEUpAdPxGoVqco7RDpHHprhObEV4MorR3BsK6pl5EVNbc3Xp7OC pxFThx0O08bscdmVBSYAUsU2hXMuW2AiuAkxBwCRdaG0bxswr97JQI9ye+pjKTPw cARrd7QLmz4= =vUe3 -----END PGP SIGNATURE-----

1 0

Punative Seizure was: Re: denial of service and ...
by Tim Scanlon 17 Dec '03

17 Dec '03

Tired.Fighter(a)dhp.com wrote: > > > This thread is probably already due for a change in > the Subject line, but I'll leave it untouched for > the moment. I changed it, because I'm very familiar with what's being discussed. I also snipped huge chunks, but tried to leave the salient stuff. > On 30 Nov 96 at 13:10, Black Unicorn wrote: > > On Fri, 29 Nov 1996, Greg Broiles wrote: > > > > > I don't see any reason why this wouldn't be true for a > > > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure > > > (but seizure is not forfeiture) of "property that > > > constitutes evidence of the commission of a > > > criminal offense". > [....] > > Recall also that Ripco was never specifically charged > > (or the minor charges that they did try to pin didn't > > stick). > > Also recall that Ripco (now ripco.com) was raided with a > > -sealed- warrant. I dont think that the contents of that > > warrant have, even today, been released (though I could > > be mistaken). Certainly 5 years after they had not. > [....] Yes, it was & is sealed, the justification being that the investigation was "ongoing". The whole thig was weak & shameless, but it works for the feds. Never mind that it's total & utter bullshit. > > > But there's a big difference between "seizure" and > > > "forfeiture". Not really. Only technicly. The technique used by LEO's is one that is known as "Punative Seizure", and is well known in the Computer Underground. It's standard practice for LEO's to engage in seizure of computer equipment and just to keep it. Much of the time it is accompanied with an explicit and literal threat of prosecution if the unindited suspect asks for the equipment back. It's cheaper than prosecuting, easier to accomplish, and often achives the goal of "taking the bad guy off the street" without resort to such niceties as having a case that would hold the moisture of a drop of spit. It is such common practice, that most hackers who have been around for even short lengths of time are very familiar with the practice. In cases involving juviniles, it's a very effective technique. In those specific types of incidents the drill is as follows: Suspect "H", a 15 year old male, living at home with his parents, does something to bring him under suspicion that he is involved in computer fraud. Incidents are ongoing and seem to point to the suspect, local or federal agents become interested in the suspect due to information provided by a C.I. So they go fishing, and seize his equipment. Seizure is accompanied in concert with several other actions and goals, One of which is to explore the contents of the computer for further evidence of wrongdoing. Since aquiring search warrents for such actions are notoriously broad and relativly easy to come by, this is an effective technique. The seizure usualy is stratigicly done to minimize parental involvment and possible protections, in order to give investigators time alone with the juvinile suspect to question him without the intervention of his guardians. Basicly they want Mom or Pop out of the picture long enough to pump the kid for info before the parents can insist on legal counsel. Obviously they use whatever info they can get... Keep in mind a poorly socialized, but bright, teenager is likely to be a rather talkative target and an easy mark for interrogatory techniques. "We find they want to talk, and often brag about their exploits" is such a well worn quote, that I'd have to attribute it to about 7 sources if I tried... You can extrapolate on this. The next stage is threats to the parents of the juvinile, usualy big federal time, that sort of thing, to try to terroroize them into insisting on little Johnny's co-operation. Usualy this is done without the advice of counsel if the feds can pull it off. There's a tradition of inflating numbers far beyond anything rational, so the "damages" are insanely high, and markedly fictional to anyone who knows how to cost such stuff out. It's in the favor of everyone involved to 'play ball' on cost inflation, for a multitude of reasons. Again, you can extrapolate why. The E911 case is a great example of fictional cost inflation. At that point they have Johnny under the gun, the parents terrorized, and can either work that for further co-operation, or let the kid dangle for a few years & pretty much make sure he never sees a computer. What can I say, it works for them. Don't expect them to care any, they've accomplished their goals. Quite often, as I have said, they will explicitly say "Don't ask for your stuff back or we'll charge you". (And YES that is a direct quote given to me on more than one occasion by people who've had such encounters.) In the case of adult individuals, the setup is nearly the same, wether it is a consultant running a small buisness, or a college student. The only big differences are threats to reputation, either academicly, or in the community at large. After all, once branded an 'evil hacker' by the police or media, what company would do buisness with such a scoundrel. Never mind wether or not they have a thing to do with computer security, that part's utterly irrelivant. In the case of college students, usualy it's a threat of expusion & prosecution etc. Obviously techniques vary. But one thing is clear, there's plenty of "examples" that have been made to terrorize people. I'm sure you can think of a few, and probably will sit there and go 'yea but he deserved it...' Well, when you think that I suggest very strongly that you rethink it, and consider that perhaps you don't have all, or even any, facts that have not been spun and spoon fed to you. The nuber of such punative seizures that I am aware of runs into the hundreds. > > And it sums to a very bleak picture, indeed. > Bleak? heh, get used to it. Hell, this is so damned common that it's made it into comic books as a normal operative procedure. Look in "The Hacker Files" to find it. It's a comic book put out in 1993 by D.C. Comics, and in the Jan issue, Vol 6, Page 14-15 you can see exactly what I'm referencing. Obviously this is not something new. This is why the guidelines that were procured via FOIA by EPIC are so important. Hell, look at the 2600 pentagon-city case for some real chilling stuff. The Secret Service mounted what amounts to a covert operation against attendee's at a 2600 meeting at a mall in Northern Virginia. In any case, the search guidelines are pretty important, so is the Steve Jackson Games case when it comes to ISP/Web Site providers and the like. As is the ECPA, as it relates to individuals and service providers. There is substantive law on this stuff, you just have to dig a bit to find it. Some of these "high profile examples" didn't work out too damned well cause of organizations like the EFF & later on EPIC and the ACLU. Pardon me if I don't seem alarmed or appropriatly indignant, but I've long since gotten used to getting calls as 4 am from some poor fucking kid who's had his life ripped to shreds because he was doing something relativly innocuous but altogether stupid and disruprive enough to have him attract attention. Much less having similar calls from peoples counsels who have no freaking clue how to proceed in defending their clients. As for this type of activity from LEO's? Get used to it, this is how it's done in America. I'm totaly sure that there's going to soon be some poor freaking ISP out there who's going to be hit with very similar techniques, and in all probability prosecuted to provide an example or 2. They need a few good examples for ISP's really, there arn't enough right now. And, I am equaly sure that there's been some quiet seizures & returns with deals involving "co-operation" of ISP's for warez and the like. I sure as hell have a very hard time beliving that Sameer and everyone else who got hit with him by the SPA and their fucking goons were unique. I suspect they were to be an "example" however, as the SPA has a traditional role of both being stooges & goons for Federal Law Enforcment, and an appropriately one-step-removed publicity outlet. The SPA is much like what "railroad security" was in the 1800's, basicly a private police force that operates allmost outside the law. As to what anyone can do? Well not much, from what I've seen. It's just not trendy to defend individual civil liberties, the EFF tossed in the towel in favor of Telco donations. EPIC is doing a good job with the resources they have, they could use some serious donations, and it would be money well spent. Beyond that you have the ACLU, and that's pretty much it. Too many software and hardware corporations lost any moral compass at the end of the 80's and in the early 90's, and don't consider such things to be a neccesary part of their world. It's hard to compete with guys in black suits who wave the flag allot and mutter about secrecy and such things. They're the same damned bunch that want us all to have GAK too, so don't think you're somehow immune cause you arn't a "hacker". You may soon be a "pirate cryptographer", and find yourself in the company of child pornographers and terrorists. (What? Oh you've noticed you allready ARE?, well, get used to it, it's only gonna get louder. First they came for the hackers, now it's your turn.) Tim

1 0

PGP 2.63ui support for the MAC
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: PGP 2.63ui support for the MAC I have received a few inquiries about support for the Macintosh. Unfortunately, the small team working on PGP 2.63ui does not have the expertise or tools to support the MAC or platforms other than MSDOS. However, since we have published our source code, we welcome participation by people who want to add support for the MAC or other platforms. All we ask is that any changes be controlled by conditional compile statements so that we can maintain a unified source code for all platforms. American friends who are concerned about legal difficulties may contact me via encrypted Email in strictest confidence. Finally, I understand that Stale's MIT-based version of PGP does have a good selection of support for the MAC and various other platforms. We are not going to object strenuously if some of our enhancements, now unique to 2.63ui, find their way into a future release of Stale's version. Steve Crompton 100645.1716(a)compuserve.com (preferred) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp9MIhRHWQsRmI2RAQGD/wgAuuBRclY2ovL7uZ7nukcR9maz85GSCYS7 gbYcToxWhZMA3YMMDmV8260qG9BmF0dHoNt39HfEjcordiTU2gLOTmyWqTIWXyA3 uRuKwZQiGPc2bxf+p62G0KdXEdEPcJ98vZWAxVkZwNDlkTg8FZ+O0NsQOPkBMSCO cE+kiJDk/71CEMwBhu4Q2QN9KBtX+MpcOvT6v1M5vIFAtO31OHaiz/0/tBCitpDP ukNX8Ntmht+/Izmma3lQaiuFo3i6pXH7qPxKBE38ZNU+w/CtiEPoy/uWN69L3l2D 6RIBbtdvbIkE6ZWotuPcsy/TxqJNsDdnztksfP2EpoKCG9vnHoaU3w== =8vJt -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. mQCNAy+FS/kAAAEEAKsKQxcaOw8GQpGXEm4hCfqWyeVlh2Ai9AYvXxPy1VrWYNUu NDafHwhfoAjM1apHT6CcISw9D4NNeJtXWutv8mKQjumsITzGZ/mSRlOLzxTbdOtD qyuXjSWt2TIm+ffttbZLsurP8genv4LFDHxGiVeKaAA64CnI4wc2DukbwCfhAAUR tC1TdGVwaGVuIENyb21wdG9uIDwxMDA2NDUuMTcxNkBjb21wdXNlcnZlLmNvbT6J AJUDBRAw062s3ic1/dqHwMcBATFuA/9HeAnZWL8MVHSx3/Ux5vRKxpAqrKs9llgN 5RmaGX+lBW6GASnSdpyrBXTG7+li/X57Jmgq04X3rWZm34Qdo6D2266aKkXc9PkM njuMpmw29Ejza5VYUlz8jMm5vUDEgaPtA5a4JL9+HLhCPCv298177kFZrZBvUgll 1/PO1bpTaokAlQMFEC/tv3UuGDEtkMU5FQEBxYAD/Rsbr7PlHSOns3WsULqmdU9Z 1vKrlmp/sma950jMRC75tJNE1R0eBcE+1eHWkpDhcQ2rlpVTiEcO3IcOBv4ycAjG ZeVcv7hEmMd+Rf+75L/Y0DAZEB9SjX46TTagEYAURK/qWMl47nZpQiyo2VyM/5Br 3fGzuUH/ZE8gjhdYVTQE =WBzQ -----END PGP PUBLIC KEY BLOCK-----

1 0

A URL for Dimitri
by Slothrop 17 Dec '03

17 Dec '03

http://www.torah.org/learning/halashon/ jd -- Jason Durbin Stop Reading Here<--

1 0

LON_ely
by John Young 17 Dec '03

17 Dec '03

11-25-96: "Intel Enters Encryption Market With HP For PCMCIA Card " So far, HP is the only computer company offering the combination PCMCIA and smart card encryption hardware. VLSI and Tandem are developing an encryption chip for use on a PCMCIA card. VLSI built the infamous Clipper chip developed by the NSA that was shot down as a proposed government standard after overwhelming industry opposition. In a separate development, National Semi, one of two suppliers of the Fortessa encryption card, scaled back its government encryption operations. Program delays, slim margins, and contract disputes with the NSA disillusioned the chip maker. ----- LON_ely (5 kb)

1 0

Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

I have written an encryption program called Very Good Privacy for Windows 95/NT. It supports drag-and-drop encryption using the following algorithms: ASCII (Caesar), BlowFish, DES, IDEA, NewDES, RC4, Safer SK-128, and Vigenere. After the files are encrypted, the user has the option of securely deleting the source files using a stream of random text. Very Good Privacy is shareware with a $5-$10 registration fee. Please note: Pretty Good Privacy is only "pretty good" but Very Good Privacy is "very good." :-) VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

3 4

Programming Errors
by Weissman, Gregg 17 Dec '03

17 Dec '03

______________________________ Forward Header __________________________________ Subject: Programming Errors Author: Alan Arndt <aga(a)intertrust.com> at internet Date: 11/19/96 1:50 PM >From New Scientist, 28 August 93, Feedback column: "The National Westminster Bank admitted last month that it keeps personal information about its customers, such as their political affiliation on computer. But now Computer Weekly reveals that a financial institution, sadly unnamed, has gone one better and moved into the realm of personal abuse. The institution decided to mailshot 2000 of its richest customers, inviting them to buy extra services. One of its computer programmers wrote a program to search through its databases and select its customers automatically. He tested the program with an imaginary customer called Rich Bastard. Unfortunately, an error resulted in all 2000 letters being addressed "Dear Rich Bastard". The luckless programmer was subsequently sacked."

2 1

Re: denial of service and government rights
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I see two general arguments that go in the direction of the SAIC consultant's comments: 1. Seizure & retention as evidence or instrumentality of a crime - e.g., if someone breaks into my house, steals my gun, and uses it to shoot someone, it'll be a long damn time before I get my gun back. The prosecution will likely want to do various forensic tests, the defense may want to do its own, the prosecutor will want to wave it around at trial, it may even go back to the jury room to pass around while they deliberate - and if there's a mistrial/new trial granted, the cycle starts again. (Off of the top of my head, I can't remember what happens to physical evidence after trial but during appeal.) Generally, people who are unfortunate enough to have property which gets sucked into a criminal investigation/trial are just out of luck. Bummer. I don't see any reason why this wouldn't be true for a computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure (but seizure is not forfeiture) of "property that constitutes evidence of the commission of a criminal offense". 2. Forfeiture of the instrumentality of a crime, or of a nuisance - cf. _Bennis v. Michigan_ <http://www.law.cornell.edu/supct/cases/94-8729.html>, the recent Supreme Court case where the "Justices" (cough cough) upheld the forfeiture of a wife's half interest in a car which was used (without her knowledge/consent) by her husband to facilitate the crime of prostitution. The Supreme Court rejected the idea that the Fifth Amendment's takings clause or the Fourteenth Amendment's due process clause prevents the forfeiture of the instrumentality of a crime without a showing of culpability on the part of the owners. Some forfeiture statues (e.g., 21 USC 881, 1989 Oregon Laws Chapter 791, both re drug-related forfeitures) provide for an "innocent owner" defense to forfeiture, but the Supreme Court doesn't seem to think that's required as a matter of constitutional law. Fed.Rul.Crim.Pro 41(b)(3) allows the seizure of "property designed or intended for use or which is or has been used as the means of committing a criminal offense". There's an excellent resource available re computer search & seizure at <http://www.epic.org/security/computer_search_guidelines.txt> - it's the US DOJ's "Guidelines for Searching & Seizing Computers", pried loose by an EPIC FOIA request and scanned. But there's a big difference between "seizure" and "forfeiture". It's possible that recent legislation has done for computer crime what the drug forfeiture laws have done with respect to title in property - 21 USC 881(h) indicates that "All right, title, and interest in property described in subsection (a) of this section [e.g., property used in connection with a drug crime] shall vest in the United States upon commission of the act giving rise to forfeiture under this section." Given the innocent owner defenses available in an 881 forfeiture, (h) sounds scarier than it works out to be. So yes, there may be a statute which gives title to the government in computers used to commit crimes, and no, the Supreme Court won't necessarily care about an "innocent owner". (Then again, it may make a difference if we're talking about a computer owned by a corporation with political clout, instead of the half-owner of a $600 car used for surreptitious blow jobs. Your cynicism may vary.) I can't seem to find any such statute, but like Ben Laurie pointed out w.r.t. security reviews, there's a line between what folks are willing to do for free, and what feels like work. Digging through a lot of teeny type in the Federal Register/Congressional Record isn't my idea of a good time, so I'll leave the "is there a statute?" question for someone else. I poked around on EPIC's web site and thomas.loc.gov and in 18 USC without finding a computer crime seizure statute, but I may just be too tired. :( At 07:26 PM 11/29/96 +0000, Attila wrote: > I got tired of paying Lexus $150 for idle months after dumping > West for almost $500/month --otherwise I would run down the Feds > kangaroo ruling which seems to grant them this absurd right. > Several on the list are still maintaining accounts... ? > > ====== begin forwarded text ====== > >Computer Attacks Show New Patterns > >The major trends in computer break-ins involve denial of service >and data-driven attacks, says a Department of Justice lawyer. >Denial of service occurs when an attacker "bombs" an Internet >service provider with so many e-mail messages that the server >becomes overloaded and shuts down. Data-driven attacks occur when >a virus program is disguised as a data-only file. The file can be >hidden in a Java program on a Web page, and when a visitor clicks >on the site, he or she unwittingly downloads the virus. A computer >crime consultant with SAIC warns that these attacks can be launched >on an innocent party's Web server, but once that happens, the server >can become the subject of a wiretap and a search warrant. "The title >of your computer vests with the government as soon as a hacker uses >it to commit a crime," he says. > >[BNA Daily Report for Executives 25 Nov 96 A20] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp+GSv37pMWUJFlhAQHEmgf+IfYnc0w47Ja/ETFlt08uHA7OWV9NJetd l3gA4av00CwST1FRtdizAC0C4t2MHT6kzHb1j8NzncazAvgjdTEa9Vd31UTR0HgU 4dYbu9e+YtYT6NcaD4HszewxVo/gfpUKBobOA2lVe1QLR1Dzqbx2cbsmxKgDsdzE Y/TATalZ7c7BkAXJBBgmXs8QYpsBWGUpmf8PUB3731MpGyF6H4gpmssxefjvGghE eQ27k3hkPlZiKGI5MeZrFhUZXJj3VPu4B3/gC+ZFm2M8Jh4z5Wo4r7w690eb9hky dGkUzQOb6sdh3ee1oJzwNWXE7R6DCL+3uiGA8Slt0hPOSBo2LBY2Zg== =dQn5 -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1