- cypherpunks-legacy - lists.cpunks.org

Alan Coopersmith: BoS: Yet Another Java security bug
by Perry E. Metzger 17 Dec '03

17 Dec '03

------- Forwarded Message From: lady0065(a)sable.ox.ac.uk (David Hopwood) Newsgroups: comp.lang.java,comp.security.misc,comp.security.unix Subject: Another Java security bug Date: 2 Jun 1996 07:15:06 GMT Organization: Oxford University, England Lines: 30 Sender: david.hopwood(a)lmh.ox.ac.uk Message-ID: <4orf1q$t6f(a)news.ox.ac.uk> There is another serious security bug in the class loading code for all currently available Java browsers: Netscape up to and including versions 2.02 and 3.0beta4 (except for Windows 3.x) Oracle PowerBrowser for Win32 HotJava 1.0beta 'appletviewer' from the Java Development Kit, up to and including version 1.0.2 Sun, Netscape, and Oracle have been sent details of the problem (which is partly related to the ClassLoader attack found by Drew Dean et al in March). The attack works by exploiting a design flaw in the mechanism that separates JVM classes into different namespaces. Using this bug, an attacker can bypass all of Java's security restrictions. This includes executing native code on the client, with the same permissions as the user of the browser. No preconditions are necessary other than viewing the attacker's web page, and the process can be made completely invisible to the victim. The only way to avoid this problem at the moment is to disable Java. For more information see http://ferret.lmh.ox.ac.uk/~david/java/bugs/ Further technical details will be posted when Sun, Netscape, and Oracle release patches. David Hopwood david.hopwood(a)lmh.ox.ac.uk http://ferret.lmh.ox.ac.uk/~david/ ------- End of Forwarded Message

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by rick hoselton 17 Dec '03

17 Dec '03

>Perry E. Metzger writes: >> Timothy C. May writes: Suggestion #1: Never get your legal advice from cypherpunks newsletter. Suggestion #2: If you absolutely can't resist going against Suggestion #1, then listen carefully to Perry. As just a lowly programmer around here, I have often been told that I would be breaking the law if I trade on some piece of information before it becomes public. I am not such an "insider" that I must register my trades 90 days in advance. I've read the actual statute. (though I am not a lawyer and, these days, even lawyers don't know what a law means until the final verdict) You might also want to ask Ivan Boeskey(sp?). I think he's out of Federal prison by now. He's the guy that cut a deal with the Feds to give him time to sell a few billion dollars worth of stock before being arrested, so that he could pay his fine. Once he was arrested, the value of those stocks fell. It looks to me like he and the Feds traded on inside information so that he could pay his fine for trading on inside information. He still went to jail, and he had enough money for good lawyers. Imagine what would happen to me! >IANAL, but I think you must be wrong about this, Perry. If this were >the case then, as an employee of company XYZ, I would never be permitted >to buy XYZ stock (which is clearly not the case) since I *always* have >information that others outside the company do not (about staff changes, >product plans and such). I suspect the deciding factor must have to do >with the ability to execute actions which have substantial direct effects >on the stock price (i.e. buying a company, declaring dividends, having a >massive downsizing, etc.). > > >-- Jeff >

5 4

Re: Class III InfoWar: TST Article
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Jun 04, 1996 12:29:02, 'Dan Haskovec <dhaskove(a)ucsd.edu>' wrote: >Here's the reply I got from a friend that I forwarded it to.... > > >and the verdict is... NetMYTH! I checked the cite in the article on >cyberterrorism... no such article ran on 6/2/96 in the Times >(London)... nor, in fact, in any newspaper available on Nexis... >just thought I would let you know... Gosh, Dan, your friend may want to double-check. After reading Winn Schwartau's post, I bought a copy of The Sunday Times here in NYC late Sunday in which the article led at the top of the Front Page. Be glad to fax anyone a copy who may want such, ahem, verification. E-mail me a number. However, I acknowledge that there is a chance that the TLAs, or Net security/info war consultants (like Schwartau, et al) planted the article, a fake to generate scare-funding and boost conference attendance. Or maybe it's a classic Brit joke, a spoof -- or a sting by the Intergalactic Net Police. Strange terrorist ripoffs happen -- incredible IPOs, vaporware millionaires, and such.

1 0

Cost of brute force decryption
by Bruce M. 17 Dec '03

17 Dec '03

Windows NT Magazine ran an article in their May 1996 issue titled "Secure Enterprise Email - How Safe is Your Mail System" that goes into matters of keeping company email private. PGP and other means of encryption are mentioned along with the following: "If you can ensure secrecy either until no one cares about the information or so that cracking the code costs more than the information is worth, it's 'secure enough.' "For example a 40-bit key takes about $10,000 worth of supercomputer time and two weeks to crack. Although this key may be adequate to protect my checking account, it's probably not large enough for the accounts of a major corporation. "A slightly longer key of 56 bits requres millions of dollars to crack and should protect the information for years to come. A 56-bit encryption key has 2^56-or 72 quadrillion-possible keys. With 1,000 computers, each trying 1,000,000 keys per second, trying them all would take 833 days. On average, you find the key halfway through your search. I was curious as to what type of formula was used to determine these figures since it wasn't mentioned in the article. Obviously, the speed of the computers, method of cracking and other such factors would be important to know. Could anyone shed some additional light on this for me? Thanks. Bruce M. * brucem(a)feist.com ~---------------------------------------------------~ "Knowledge enormous makes a god of me." -- John Keats

1 0

Re: (VTW) BillWatch #48
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 6/4/96 -0400, Carl Ellison wrote: >I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] > >There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... > >After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. I have a solution to that problem. Jim Bell jimbell(a)pacifier.com

1 0

Re:cycle market
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Bryce writes: > I was trying to think what I would use a cycle market for. The > only thing that I wait for more than a minute on currently is > compiling. Tasks which are inherently parallel (preferably ones where the various processes are loosly coupled and the need for inter-task communication is low) are the first things that come to mind, because advances in the speed of CPUs does not give you the same advancement increment in solving these problems. Some examples: -rendering and ray tracing -simulation -analysis of large datasets -genetic algorithms and genetic programming (something I am working on creating a "cycle market" for in my spare time) The other class of tasks which could use such a market are those which are limited more by bandwidth than by processor speed. If the server can be given many "heads" which can provide the service (with the back-end processing done by cycle markets) then it is possible to make significant gains in distributing the I/O load and getting around network latency by creating server which is "virtually omnipresent." jim

1 0

Re: Electronic Signature Act Of 1996
by Deranged Mutant 17 Dec '03

17 Dec '03

On 4 Jun 96 at 10:33, Ben Holiday wrote: > Florida now recognizes electronic signatures as legal and binding. In > other words - its okay to sign it by modem. > > The electronic Signature Act of 1996 passed the Legislature unanimously > and became law Friday. The law does not specify how an electronic document > must be signed, but it probably will mean coding the text and typed > signature so they cannot be changed by anyone other than the writer. [..] I've seen some legal arguments that an email message that reads "Bob, Sounds good--it's a deal. --Alice" can in some circumstances be as binding as an oral contract or a scribbled note, which is not meaningless though not as strong as a legal signed contract. As long as one can show Alice *did* write that, that it referred to a specific deal, etc. etc., it holds some legal weight. But I'm no lawyer, and one should never trust legal advice form Usenet or the c'punks list. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: How can you protect a remailer's keys?
by loki＠infonex.com 17 Dec '03

17 Dec '03

The best solution I could come up with (and was willing to write and use) is to specify the passphrase on the command line argument to the compiler make solaris -DPASS="foozooblue" -Lance At 11:55 PM 6/1/96, Bill Stewart wrote: >Encryption is critical for protecting against traffic analysis, >but it's tough to protect a remailer's keys. Unlike regular email, >where you can type the key in as you read it, remailers need to >run automatically once you set them up. Some of the choices are: >- leave it around in plaintext with only Unix file protections > (Ghio2 works this way - does Mixmaster? My ghio2 version has it > compiled into the binary, and I try to delete it from source.) >- type it in to a long-running remailer process > (with human intervention to start) >- SSL-based remailers, where the web server handles crypto on > a per-machine basis instead of per-remailer >- use unauthenticated Diffie-Hellman (either hanging off > a TCP port somewhere instead of mail, or > 3 pieces of email) >- off-line or off-site remailer such as a POP3 winsock remailer > that makes it Somebody Else's Problem, and separates > the remailer's public interface from the working parts >- human intervention on every message (which may not be totally > worthless for moderated news postings, if you want to > take that approach to spam prevention.) > >Anybody have any other approaches? These are mostly weak, >annoying, or both. > > ># Thanks; Bill ># Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com ># http://www.idiom.com/~wcs ># Rescind Authority! ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: whitehouse web incident, viva la web revolution
by Hallam-Baker 17 Dec '03

17 Dec '03

Vladimir Z. Nuri wrote: <Uninformed crap> Its worth pointing out that a complaint to an editor is not necessarily pressure. Did the Whitehouse threaten to sue HotWired? What _pressure_ was applied? I find Meeks' style somewhat tiresome. It is tabloid jornalism rather than reasoned argument. His dislike for the Clinton is well known - he recently accused the administration of being fascist. I know of no evidence that the Clinton administration has a genocide policy, it is an insult to the 10 million civilians murdered by Hitler to use the term facist simply as a term of abuse, especialy if it is being used as a substitute for an argument. Point of fact: the skeleton closet does not know how traded options work. If one sells a traded option one is liable to pay the broker if the market moves the opposite way to that hoped for. Normally the broker asks a client to put up a deposit or "margin" to ensure that the broker can recoup the money. In this case the broker knew that Hilary had good credit and so accepted only a token deposit as "margin". Had the market moved in the opposite direction Hillary would have been liable for very much more than $1000, she was liable for hundreds of thousands. In most cases it is profitable to sell options, it is only if the market moves in the "wrong" direction that one can lose out. In such cases the losses are unlimited - the potential profit being fixed. This is why most punters buy options - the potential loss is limited. You can see a similar effect in the market each time there is a "short squeeze". A lot of people bet on Netscape going down in price because it was overvalued. The number of short positions turned out to be higher than the number of shares on offer which meant that many people were having to buy shares at high prices to cover their positions. This is how lack of confidence in a stock can send it through the roof. The free market - don't you just love it? Phill

6 10

WWW servers.
by Black Unicorn 17 Dec '03

17 Dec '03

Does there currently exist a system which permits webservers to restrict access to clients who have a given certification? What is the current certification practice? How easy is it to certify a given client? Are webserver certifications sufficently secure today? What are the best servers to use for secure web pages and certification currently in the United States? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

3 3