- cypherpunks-legacy - lists.cpunks.org

fun with the web and security
by daw＠orodruin.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

Here's a fun way to exploit security holes via the web: http://www.cs.berkeley.edu/~daw/js1.html A rough representation of its contents follow. Whee! The web is awfully convenient for exploiting security bugs.... The following URL contacts your sendmail SMTP server and attempts to exploit an old, well-known security hole, trying to gain root access. Click _here_ to try it. As it stands, clicking on the URL above does not do anything harmful to your machine-- but it could! (This is a test of the emergency broadcast system. This is only a test.) ______________ We can get you to send arbitrary text, to an arbitrary port on an arbitrary host, from your machine. (If you are inside a firewall, we can thereby send arbitrary text to any internal machine by getting you to click on the link above.) The technique is simple: we list the host and port in a gopher URL, and encode the text to be sent in the path. For instance, a successful exploit of the hole could leave a backdoor root shell, and inform us via a pseudonym at an anonymous remailer. The exploit could be hidden by use of the JavaScript "width=1,height=1" techniques pioneered at John LoVerso's _JavaScript security hole page_; then you wouldn't even know when you'd been attacked. The exploit could be forced on you via many standard tricks: the Redirect: or META-EQUIV Refresh: or JavaScript mechanisms work fine, for instance. This is most dangerous when you are behind a firewall. Typically, there will be many machines inside a firewall which run insecure software. Normally, that would be safe, since the firewall prevents an outsider from connecting to the unsafe sendmail servers inside-- yet the example URL above allows outsiders like us to exploit security holes on the inside of your firewall. Nothing stops us from putting the IP address of a vulnerable machine inside your firewall in the URL above, and waiting for you to click on it: the firewall doesn't prevent connections from you to the internal vulnerable machine, and thus can't stop this attack. Using JavaScript, we don't even have to wait for you to click on anything. Furthermore, a JavaScript program could systematically and invisibly try all the machines inside your firewall. We could have used many other well-known security holes: there's nothing special about this particular sendmail bug (except that it was convenient for us to implement). ______________ Be afraid. Be very afraid. -- Ian Goldberg and David Wagner.

2 3

Re: TIS--Building in Big Brother for a Better Tommorrow
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:41 PM 2/26/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On 22 Feb 96, John Young wrote and quoted Steve Walker: >> To supplement TIS's Web site information on CKE, here's a >> mailing from Steve Walker earlier this month: >> TRUSTED INFORMATION SYSTEMS, INC. > February 2, 1996 >> There has been amazing progress on TIS's Commercial Key >> Escrow (CKE) initiative since my last status report. > [Much quite-valid disgust with CKE (GAK!) deleted] >> ...it represents the first export approval of a DES-based key >> escrow encryption system, a small step... > >...backward. > >> ...the private sector's need for encryption protection and >> governments' needs to be able to decrypt the communications >> of criminals, terrorists, and other adversaries... > >There is no difference between the justification for this and >what was offered to justify Clipper. > >"Other adversaries," like those who want to keep their affairs >private, or wish to live free in an increasingly unfree world? >I think I'm gonna puke. Instead of "and other adversaries," why didn't they just come out and say, "and Jim Bell"? I feel left out! Ignored! Now I know how "the Professor and Mary Ann" felt. This is a social slight I can't possibly tolerate! Jim Bell, Adversary. jimbell(a)pacifier.com Klaatu Burada Nikto Something is going to happen... Something...Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTJzNPqHVDBboB2dAQFROAQAge2OrsqHHnQ6fBPw2UWoWdiJcagwWspA s8Zed6Rfeo/X3Hhuy6KT8AaRq2TwaHaiykaEaDMEzdRUhgKQi32pOP3/Pr/ISUqH PXh8QEDdmaYPmVTnw++2TZTJtWosPvn0g/zgpAqPVy5ibVJ03dzdToAj2+2vjdxF j9zauQHsvxQ= =xLqm -----END PGP SIGNATURE-----

1 0

Re: S/MIME outside the US?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:49 PM 2/24/96 -0500, Lewis wrote: >volley(a)lls.se writes: >> If I got things right, DES is "exportable" as long as the keysize >> is kept under a certain size, which is too small to be really secure? > >All things are exportable as long as the keysize is kept under a certain size, >which is too small to be really secure. That's not correct - you can only export crypto code from the US for which you have Permission, and they'll only give you Permission if it's weak crypto or you agree to be Well-Behaved (e.g. US banks can export real DES for talking to other banks, but US banks can be subpoenaed and forced to hand over the plaintext.) There have been people who've gotten export permission for modified DES, e.g. real 56-bit DES with the key chosen from a 40-bit keyspace. I'm assuming from volley's address that he or she is in Sweden, and thus not directly limited by US export laws. Write what you want, and post it somewhere outside the US; we can import it legally. As a non-American, you probably couldn't get US export permission for even 40-bit RC4, and maybe not even for rot13. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

3 2

Re: PGP to PC mail integration
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 08:54 1996-02-28 -0500, lmccarth(a)cs.umass.edu wrote: >Mike Ingle writes: >> Instead of messing with user interfaces, > >I wrote: ># Would you be stuck if you wanted to send something unsigned and/or ># unencrypted ? > >Matts writes: >% Nope. The VB program should give a popup window where you can enter your >% passphrase to sign/decrypt the message. Such a popup can have a <NO> button >% if you don't want it to do its thing. > >Sure sounds like a user interface to me. <shrug> Sure, what did you expect? A program that obtains your pass phrase without a user interface?!? That would be a neat hack if you could pull it off. Should it do mind reading, or just crack the pass phrase by brute force? Seriously, the idea here is that the pgp front end shouldn't deal with the user interface in your present mail program. Nobody (before you) have considered doing it completely without a user interface. Matts

2 1

Windows ssh -- this mail was written with it
by Tatu Ylonen 17 Dec '03

17 Dec '03

Secveral people have been asking recently about the status of my windows SSH client. Well, this mail is being written with it. I have finally had time to work on it almost full time for the last week, and it is finally starting to work. The basic protocol is now in farirluy good condition. Terminal emulation has been written (it is VT102, tested to work with vttest)), but the emulator hasn't been merged to Windows yet (that should be a couple of days work, max)). Channel forwarding code is not yet ready, but probably will in a couple of weeks. I will probably make a pre-alpha test distribution in very near future so that people can get some hands-on experience with it. (Eithher stiill durring this week, or alternatively soon after IETF which will be next week. BTW, I wiill give a presentation on SSH at the IETF.=) Anyway, this was just to give quick update Ö:-) (Sorry for the typos in this message, since emulation is not yet iintegrated it is hard to edit, and also key mappings won't work properly until I get the emulatoor in - hopelfully really really soon.) Tatu

1 0

E$? Whatever
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A GLIMPSE INTO THE FUTURE OF MONEY, AS CITI SEES IT Known inside Citicorp as the Electronic Money System, the bank's version of electronic currency for cyberspace is the result of four years of mostly top-secret toil by technical wizards who report to Colin Crook, the New York money-center's top technology officer. Still in a prototype stage and probably years away from full-scale operation, the Electronic Money System is described as fully equivalent to cash, but hardware and software reside on secure processing environment. At a recent demonstration, one of six laptops was programmed to contain the functions of two banks, with icons representing tellers, security, and other features. The other terminals were set up to display "electronic wallets" that individuals can use to withdraw money from the virtual bank, exchange money with each other, and perform a variety of sophisticated transactions. For example, a customer on one laptop can transfer $100 and 50 British pounds from his bank account to his electronic wallet. The cash then exists in digital form on the individual's computer hardware. "Our system does not depend on any network mechanism for security," said project manager Sholom Rosen. "The security is between the two devices. They have their own cryptography and security." Bank officials said they intend to apply the technology first in wholesale functions, with retail use still far in the future. -- American Banker, 2/23/96 --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Privacy legislation in CA
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > SECTION 1. The Legislature hereby finds and declares the > following: > (a) All people have an inalienable right to privacy as > declared in Section 1 of Article I of the California > Constitution. Does the bill define "privacy" explicitly? Or is it defined clearly anywhere else in California law? That can be a real problem... (the US Supreme Court seems to limit 'privacy' to what goes on in bed between a married heterosexual couple, for instance.) > (b) Advances in technology have made it easier to create, > acquire, and analyze detailed personal information about an > individual. > (c) Personal information, including information about a > person's financial history, shopping habits, medical history, > and travel patterns, is continuously being created. > (d) The unauthorized use of personal information concerning > an individual is an infringement upon that individual's right to > privacy. What is unauthorized use? Is it still acceptable to collect information on someone? Is a person given the right to know who is tracking them, and what someone else or a corporation has about them? > SEC. 2. Section 43.2 is added to the Civil Code, to read: > 43.2. No person or corporation may use or distribute for > profit any personal information concerning a person without that > person's written consent. Such information includes, but is > not limited to, an individual's credit history, finances, > medical history, purchases, and travel patterns. What counts as written consent? Checking a "Yes, you may send my name to interested advertisers so I can receive lots of junk mail to burn in my stove to keep warm in the winter" box? And once a person has checked off on it, is it ok for a corporation to redistribute that info without asking permission (since it's already been signed off), of must that third party again ask permission? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTPdKCoZzwIn1bdtAQEnvAF/dslZaaBn0j8ZyEHH3t97LyzjBHCai04A ng/kuJ5nkkneIVAl2OJKZAnq8JSaIzqp =0Tmm -----END PGP SIGNATURE-----

1 0

Re: RE: [ Death of MOSS? ]
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 12:44 AM 2/28/96, Brad Knowles wrote: > And if you look at what I've said previously, it is my firm belief >that if we are to succeed in giving users a truly interoperable secure >email standard, then said standard must be fully and completely >integrated into MIME and do everything it does in the proper MIME way, >as opposed to just being security grafted on. Allow me to make a contentious statement: MOSS is the only secure email protocol integrated with MIME. You see, integrated to me means that the base is security aware. MIME is only security aware when the security multiparts are used. In all other cases, MIME is not security aware. The use of the application content-type with experimentally defined subtypes gives the appearance of MIME being security aware, but it provides nothing more than a mechanism for carrying a protected object. In addition, the fact that the security service itself must do a callback in order to support recursive services, unlike MOSS which uses the security multiparts framework and thus lets MIME do all the work it was designed to do, further supports my position. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

Re: Internet shutdown Feb 29? (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Brief article on last summer's Minnesota outage is available at http://www.info-nation.com/burnin.html . There's a link in there (I think it still works) to a local IRC log of U of M people trading info during the blackout. *********************************************************************** --The Interview-- | gimonca(a)skypoint.com George Clinton: "Suck on my soul, | Minneapolis MN USA and I will lick your funky emotions!"| http://www.skypoint.com/~gimonca Dave Letterman: "Yuck!!" | A lean, mean meme machine. *********************************************************************** ---------- Forwarded message ---------- Date: Wed, 28 Feb 1996 08:11:36 -0600 (CST) From: Kevin L Prigge <Kevin.L.Prigge-2(a)tc.umn.edu> A few months back, some winos took most of Minnesota off the net for a couple days. Upset with being kicked out from under a bridge, they started a fire that took out the main fiber cable from downtown to MRNet + the U of M. Backup? Due to a mistake at a CO, the backup link was routed thru the same area, and was also burned. Interesting scrambling as nameservers puked and died.

1 0

Re: Remember, RC4 is now PC1
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 4:31 AM 02/28/96, Mutant Rob wrote: >It'd be funny if the next time somebody hacks a proprietary code, if they >make some changes, redo the key schedule, perhaps in mind of >strengthening the algorithm, and then post it to sci.crypt as "hey, I got >this idea for a new crypto algorithm... what do you think?". If the >algorithm is different enough from the proprietary code version, with >no clear connection between them, and the author can give full design >rationale as if s/he wrote it from scratch, then what's a company to do? Umm, if the _algorithm_ is different enough, it's a different algorithm and it's not even an issue. I guess you mean if the algorithm is the substantially the same, but the code implementing it is substantially different. But I'm not sure that matters anyway. The way I understand it with trade secrets is: If I'm an employee of PKP (let's pretend they have employees who actually look at code), and they want to keep something a trade secret, they make me sign a non-disclosure agreement. If I break it, and they can prove I broke it, I am in big trouble for breach of contract. I guess if I can make up a convincing enough lie about inventing it from scratch, I can get off. But if I work for PKP, I don't think I'm going to have too much luck convincing a jury that I just coincidentally stumbled on the same algorithm. If I, who has signed a non-disclosure agreement with PKP, takes the trade secret code and sends it to Mutant Rob, and Mutant Rob posts it near and far, Mutant Rob hasn't done anything illegal, and hasn't broken any contractual obligations, and is basically doing fine. As I understand it. So it doens't matter if he pretends he invented it himself or not. Of course, if they take him in the back room and introduce him to "Mr. Thingy" (or make him testify in court, if you prefer), and they find out it was me who sent it to him, I'm still in Big Trouble. Trade secrets don't really have any legal standing or protection, for the most part. They're just things a company is trying to keep secret, for the most part. Generally by using non-disclosure agreements.

1 0