- cypherpunks-legacy - lists.cpunks.org

Big Java security hole
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Forwarded to me by a fellow webmaster; I don't know the original source. -Paul Date: Sun, 18 Feb 1996 23:57:02 -0500 From: Drew Dean <ddean(a)CS.Princeton.EDU> Subject: Java security problems We have discovered a serious security problem with Netscape Navigator's 2.0 Java implementation. (The problem is also present in the 1.0 release of the Java Development Kit from Sun.) An applet is normally allowed to connect only to the host from which it was loaded. However, this restriction is not properly enforced. A malicious applet can open a connection to an arbitrary host on the Internet. At this point, bugs in any TCP/IP-based network service can be exploited. We have implemented (as a proof of concept) an exploitation of an old sendmail bug. If the user viewing the applet is behind a firewall, this attack can be used against any other machine behind the same firewall. The firewall will fail to defend against attacks on internal networks, because the attack originates behind the firewall. The immediate fix for this problem is to disable Java from Netscape's "Security Preferences" dialog. An HTTP proxy server could also disable Java applets by refusing to fetch Java ".class" files. We've sent a more detailed description of this bug to CERT, Sun, and Netscape. A second, also serious, bug exists in javap, the bytecode disassembler. An overly long method name can overflow a stack allocated buffer, potentially causing arbitrary native code to be executed. The problem is an unchecked sprintf() call, just like the syslog(3) problem last year. Many such bugs were in the alpha 3 release's runtime, but were carefully fixed in the beta release. The disassembler bug apparently slipped through. This attack only works on users who disassemble applets. The fix is to not run javap until Sun releases a patch. Note that we've only had success in exploiting the first flaw on an SGI. Windows 95 and DEC Alpha versions of Netscape have other bugs in their socket implementations that make it harder (although not necessarily impossible) to exploit the problem. This is the second time that unrelated implementation bugs have prevented us from demonstrating security problems in Java. http://www.cs.princeton.edu/~ddean/java will contain more information soon, including a revised version of our paper, to appear in the 1996 IEEE Symposium on Security and Privacy. Drew Dean <ddean(a)cs.princeton.edu> Ed Felten <felten(a)cs.princeton.edu> Dan Wallach <dwallach(a)cs.princeton.edu> Department of Computer Science, Princeton University For more information, please contact Ed Felten, 609-258-5906, FAX 609-258-1771. _______________________________________________________ Travis Weller WebMaster, Metrowerks, Inc. tcweller(a)metrowerks.com http://www.metrowerks.com/

3 2

No Subject
by Andy Silber 17 Dec '03

17 Dec '03

> NED_PUEV <NED_PUEV(a)HP-Loveland-om2.om.hp.com>, > Radar <radar(a)itouch.net>, > Denise HP TechSupport <sdm(a)hpuerca.atl.hp.com>, > sgajar <sgajar(a)crosslink.net> >Subject: FW: FWD>Bill O Rights >Date: Wed, 21 Feb 96 14:27:43 PST >Encoding: 120 TEXT >X-Mailer: Microsoft Mail V3.0 >Status: > > > > ---------- >From: Dave Behrns >To: MIS Mail Group >Subject: FW: FWD>Bill O Rights >Date: Wednesday, February 21, 1996 2:10PM > > > >>>To whoever may read this, >>> >>>This is not a typical letter, in that by passing it on to as >>>many people as you can, you are taking part in what may yet become the >>>world's biggest practical joke. The U.S. Government has rece ntly >>>passed an act which enforces censorship on the internet. A group of >>>internet users has now come together to kick back at this oppression, >>>and have a bit of fun at the same time. >The aim of this exercise is >>>to re-establish the United States as "The land of the Free", not a >>>fascist state where freedom of speech and thought are curtailed. >>>Communist Russia fell as a result of s uch limits being placed upon >>>the minds of the general populus. On receiving this letter, please >>>pass it on to as many friends or E-mail lists as you can. We predict >>>that if everybody copies the lette r to 5 other addresses, by February >>>29th 1996, this letter should have reached in excess of 2 million >>>people. That's when the fun begins........ >On February 29th, please >>>send the message: >>> >>>Dear Mr. President, >>>Do you remember this: >>> >>>And afterwards enclose the pre-typed copy of the Bill of rights. By >>>sending the letter on the date above, you will contribute to either >>>one huge petition for freedom, or else lead to a crash of the >>>whitehouse server.Send all letters to: >President(a)Whitehouse.gov >>> >>>Remember that solidarity is the key to success !!!!! >>> >>> >>>--------------------------------------------------- >>> >>>THE BILL OF RIGHTS >>> >>>Amendment I >>> >>>Congress shall make no law respecting an establishment of religion, or >>>prohibiting the free exercise thereof; or abridging the freedom of >>>speech, or of the press; or the right of the people peaceably to >>>assemble, and to petition the government for a redress of grievances. >>> >>>Amendment II >>> >>>A well regulated militia, being necessary to the security of a free >>>state, the right of the people to keep and bear arms, shall not be >>>infringed. >>> >>>Amendment III >>> >>>No soldier shall, in time of peace be quartered in any house, without >>>the consent of the owner, nor in time of war, but in a manner to be >>>prescribed by law. >>> >>>Amendment IV >>> >>>The right of the people to be secure in their persons, houses, >>>papers, and >>>effects, against unreasonable searches and seizures, shall not be >>>violated, and no warrants shall issue, but upon probable cause, >>>supported by oath or affirmation, and particularly describing the >>>place to be searched, and the persons or things to be seized. >>> >>>Amendment V >>> >>>No person shall be held to answer for a capital, or otherwise >>>infamous >>>crime, unless on a presentment or indictment of a grand jury, except >>>in cases arising in the land or naval forces, or in the militia, when >>>in actual service in time of war or public danger; nor shall any >>>person be subject for the same offense to be twice put in jeopardy of >>>life or limb; nor shall be compelled in any criminal case to be a >>>witness against himself, nor be deprived of life, liberty, or >>>property, without due process of law; nor shall private property be >>>taken for public use, without just compensation. >>> >>>Amendment VI >>> >>>In all criminal prosecutions, the accused shall enjoy the right to a >>>speedy and public trial, by an impartial jury of the state and >>>district wherein the crime shall have been committed, which district >>>shall have been previously ascertained by law, and to be informed of >>>the nature and cause of the accusation; to be confronted with the >>>witnesses against him; to have compulsory process for obtaining >>>witnesses in his favor, and to have the assistance of counsel for his >>>defense. >>> >>>Amendment VII >>> >>>In suits at common law, where the value in controversy shall exceed >>>twenty dollars, the right of trial by jury shall be preserved, and no >>>fact tried by a jury, shall be otherwise reexamined in any court of >>>the United States, than according to the rules of the common law. >>> >>>Amendment VIII >>> >>>Excessive bail shall not be required, nor excessive fines imposed, nor >>>cruel and unusual punishments inflicted. >>> >>>Amendment IX >>> >>>The enumeration in the Constitution, of certain rights, shall not be >>>construed to deny or disparage others retained by the people. >>> >>>Amendment X >>> >>>The powers not delegated to the United States by the Constitution, nor >>>prohibited by it to the states, are reserved to the states >>>respectively, or to the people. >> >> >> >

1 0

Re: "and two forms of ID"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>You got my position completely backward on this. I feel much better now. :-). I really didn't want to cross swords with someone who's S/N ratio is as high as yours is around here. >You may be thinking of what I said about the >cost of defeating traffic analysis. That must have been it. >The natural state of the Net seems to be a kind of semi-anonymity. Ah. I believe this is what I'm talking about... >Trying to push it in either direction (complete traceability or >anonymity) is costly. I'm going to build a rant about this pretty soon, but I think that in a geodesic network, audit trails of any kind cost more money, particularly in the "fringes" of the network, where all the processor growth is going to happen, assymetries or not. As processors handle smaller and smaller stuff faster and faster, it becomes harder and harder to "control" and monitor all of them. To operate efficiently, they have to be more and more autonomous. One way to provide decision rules for autonomous processors is to introduce micro-e$ auction markets into the net's infrastructure. A good example might be packet routing. Suppose you attach some very skinny money to a packet (something issued with Micromint, maybe?), and strip it off as the packet goes through the network, sender pays. Routers price their throughput based on their load at any given moment. When you create this "economy of switches", it becomes harder to establish the hierarchical book-entry control/coodination models we all know and love, certificate hierarchies among them. I think that something like this might work as a way of randomizing traffic in a network of remailers, by the way. Let the market determine the remailer path. Specify the number of hops left, and attach enough money for that number of hops. This is one way for people to pay for the use of remailers, and eventually, it could map to packet-level-anonymity someday. For the moment, I'm going to claim that anonymous auction markets are always more efficient than identified, command economies, just like flight is faster than surface travel. At least that's what I think this morning. :-). More as I get some time. However, I do agree that it's foolish to simply declare that everything must be unauditable, just as it is to declare universal auditability. It's better to let the market figure this out. ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:09 AM 9/12/96 -0700, #6 wrote: >WSJ 9/12/96 > >Paraphrasing: > >Panix has been under attack for the last week by someone flooding >their server with bogus "requests for information" [see below] ... Even though service has suffered, Panix is still useable. Until I read the MOTDs on Tuesday, I thought it was just normal flakiness. DCF

1 0

ASS_alt
by John Young 17 Dec '03

17 Dec '03

EcoMist of Feb 17 has more on The Seychelles lure for wealthy outlaws; a look at Richleson's new book on spying; and the assault on Swiss vaults for outlaws and spies by outlaw, spying prosecutors. ASS_alt (for the 3) [Thanks to AS]

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Anonymous User 17 Dec '03

17 Dec '03

IPG Sales wrote: > running fakers like us out of business should be its own reward On the contrary: it's a voluntary waste of time, for which there seems to be an unending supply of fodder.

1 0

Re: Edupage, 20 Feb 1996
by Duncan Frissell 17 Dec '03

17 Dec '03

>>EUROPE BACKS V-CHIP >>The European Parliament has followed the lead of the United States in >>supporting the use of Canadian-developed V-chip technology that allows >>parents to screen violent or adult content from their televisions. >>(Montreal Gazette 20 Feb 96 C7) Why, Oh why is there so so much talk about the V Chip. This stupid device only covers over-the-air broadcast TV a dying part of the spectrum. It does not cover cable-only programs (HBO, etc) and it does not cover net-based audio and (soon) video programming. It is meaningless. DCF

1 0

Digital Signature Legislation (fwd)
by Jack Keith 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 21 Feb 1996 10:25:39 -0800 (PST) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: Digital Signature Legislation [This message includes some interesting information about significant consumer and privacy issues in state-level "digital signature" legislation that is being modeled on Utah's law -- http://www.state.ut.us/ccjj/digsig/ It is also an example of a trend I'd like to encourage: academics using the Internet to propagate ideas in concise, useful form while getting feedback from a broad public before their work gets frozen forever in journals.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 20 Feb 1996 20:54:03 -0800 (PST) From: C. Bradford Biddle <biddle(a)pwa.acusd.edu> To: ca-digsig(a)commerce.net Subject: Digital Signature Legislation DIGITAL SIGNATURE LEGISLATION: SOME REASONS FOR CONCERN by Brad Biddle <biddle(a)acusd.edu> February 20, 1996 [Copyright 1996 by Brad Biddle; permission granted for non-commercial electronic redistribution] A recent flurry of state digital signature legislation should provoke some concern among consumer activists, privacy advocates, and others interested in the evolving legal landscape of cyberspace. At least ten states are developing or have already implemented digital signature legislation. Much of this legislation is based on the pioneering Utah Digital Signature Act, passed in 1995 (and currently in the process of being amended). States which have introduced legislation based on the Utah Act include Arizona, Georgia, Hawaii, Oregon, and Washington. California has passed a different form of digital signature legislation, and a bill is pending in Illinois which is similar to the California approach. Florida and Virginia have formal resolutions pending which call for legislative investigation into digital signature laws. The American Bar Association's Information Security Committee (a sub-committee of the Section of Science and Technology) released its Digital Signature Guidelines in October of 1995. These Guidelines are "general, abstract statements of principle" and are not intended as model legislation. The Information Security Committee intended to release model digital signature legislation in June of 1995, but this effort has been, as one report describes it, "stymied by bureaucratic maneuvering." (Information Law Alert, 10/13/95). In the absence of this model legislation, the Utah Act has become a de facto model act. The intent of this message (distributed to the "ca-digsig" mailing list and to some other folks via direct e-mail) is to raise some concerns about the Utah Digital Signature Act and its progeny. The author of this message is a second-year law student at the University of San Diego School of Law, and is writing an article on this topic for the San Diego Law Review. Feedback and criticism are very welcome, and will likely be incorporated into the developing article. THE UTAH DIGITAL SIGNATURE ACT [Sec. 46-3-101 et seq., Utah Code Annotated 1953] No attempt will be made here to explain or summarize the complex and detailed provisions of the Act. Generally, the Act envisions an infrastructure in which computer users utilize state-licensed certification authorities, online databases called repositories, and public-key encryption technology in order to "sign" electronic documents in a legally binding fashion. The Utah Act sets out an ambitious legal and regulatory framework intended to implement a public key infrastructure. It also carves out a place for digital signatures in the broader legal landscape. That is, it provides digital signatures with legal status as valid signatures and addresses a variety of issues relating to the place of electronic documents in contract and evidence law. Much of what the Utah Act accomplishes is laudable, and demonstrates how legislation can effectively solve unsettled issues in the novel arena of cyberspace. However, several aspects of the Act are troubling. The potential problem areas can be categorized generally as liability, privacy, and costs. A very brief discussion of each of these problem areas follows. LIABILITY The Utah Act makes two policy choices concerning liability allocation which are potentially troubling. First, consumers who participate in the infrastructure developed under the Utah Act subject themselves to a far greater risk of extensive liability than they face in other electronic transactions, such as credit card or debit card transactions. Most electronic transactions made by consumers are subject the Electronic Funds Transfer Act (EFTA) which limits consumer liability in the event of fraud to (in most cases) $50. Even if a consumer is negligent, liability is still capped at a rather low fixed amount. Critics of this scheme argue that it is paternalistic and ultimately drives up costs for other consumers who are careful to avoid exposing themselves to fraud. Supporters argue that if consumers were exposed to potential unlimited liability when engaging in electronic transactions they would not participate in these transactions at all, and the potential benefits of electronic transactions would not be achieved. Also, supporters say, consumers are often unable to prevent fraud, and forcing consumers to prove they were not negligent anytime fraud occurs would be an unreasonable burden. Under the Utah Act, consumers are held to a negligence standard in guarding their private encryption key. Thus, if a criminal obtains a consumer's private key and commits fraud, the consumer is financially responsible for that fraud unless the consumer can prove that the consumer used reasonable care in guarding the private key. If the consumer cannot prove this in court, or if the consumer was in fact negligent, then the consumer will bear all losses resulting from the fraud. The arguments in support of the EFTA may be applicable here. Will consumers participate in a system which subjects them to unlimited liability? Is it sensible to make consumers prove the absence of negligence? (Two related points are worth noting. First, drafters of the Utah Act initially advocated a strict liability standard, rather than negligence, for the security of private keys -- even "worse" for consumers -- and the drafters continue to advocate strict liability as an alternative for other state legislators considering digital signature laws. Second, a plausible argument can be made that the federal EFTA should preempt the state digital signature legislation on this issue -- this question is unsettled.) There is a second troubling policy choice relating to liability. The Utah Act limits the potential liability of one actor in the infrastructure -- the certification authority -- to a fixed amount (termed a "suitable guarantee" and determined by a complex formula or by administrative rule). This amount may be less than the actual damages a certification authority can cause. This policy decision, designed to create certainty for an entrepreneur contemplating a certification authority business and foster development of a certification authority industry, may have unintended consequences. It is easy to envision a scenario in which a certification authority's private key is compromised -- by brute force cryptanalysis, bribery, or incompetence, for example. A criminal with a certification authority's private key could cause an immense amount of financial damage, imposing huge losses on a number of innocent parties. These innocent parties would be unable to recover their full losses from the certification authority if the total of these losses was greater than the amount of the "suitable guarantee" -- even if the certification authority was totally at fault in creating the circumstances that led to the losses. Because the certification authority would not have to bear the full costs of any losses resulting from a compromised private key, they may not have the incentive to take expensive precautions to protect against that occurrence. PRIVACY The system contemplated by the Utah Act also raises several different types of privacy-related concerns. At a broad level, one commentator has pronounced the general type of system embodied in the Utah Act a "cultural misfit" because every merchant and consumer potentially must register with an outside authority in order to acquire the basic capacity to transact commerce. In light of the more limited scope of the Utah Act and the current state of electronic commerce, however, this argument is not particularly persuasive. More significantly, under the Utah Act's approach certain entities -- the online databases of public encryption keys termed "recognized repositories" -- will have unrestricted access to valuable transaction-generated information that could expose sensitive relationships among individuals or businesses. If Company A sends a digitally signed message to Company B, Company B must verify the digital signature by connecting to a state-recognized privately-managed database, verifying the digital signature and making sure that Company A's certificate is not on a certificate revocation list. This process, of course, will leave electronic footprints. Could the owner of the recognized repository disclose the fact that A and B were corresponding? What if A and B were discussing a possible merger, or other transaction with significant consequences in the securities markets? Similarly, could the owner of the repository disclose to Joe Whistleblower's defense-contractor employer that Whistleblower was verifying digital signatures of a reporter from the New York Times? The Utah Act is totally silent on this issue. Additionally, the public databases contemplated by the Act could expose financial data, information about affiliations, and other private information to public scrutiny -- and put this information into the direct marketing universe. Publicly-accessible certificates will contain the name of subscribers and a "recommended reliance limit," a dollar figure that may be a good indication of general financial standing. Certificates may also indicate an individual's affiliation with a company or other organization. There is no provision for anonymous or pseudonymous certificates. Proponents of the Utah Act point out that participation in the system established by the Act is voluntary, and that non-licensed certification authorities will be available for individuals who object to the requirements of the Act. However, in light of the advantages the Act gives to licensed certification authorities (liability limitations, presumptions concerning the legality of digital signatures, and the like) this may not in fact turn out to be true. Additionally, some individuals may be forced to use certificates in the course of their employment. Would an employee who did not want to be listed in an easily searchable database (perhaps because they were being harassed) be forced to quit his or her job? Finally, a very important privacy-related issue that is purposefully not addressed in the Utah Act concerns whether the infrastructure contemplated by the Act will support confidentiality of messages as well as legally binding digital signatures (a technically feasible proposition, but a politically sensitive one). The Utah Act empowers an administrative agency to determine which public key encryption algorithms are appropriate. A public key algorithm like RSA can be used both for encryption and digital signatures. A public key algorithm like DSA (implemented in DSS) can only be used for digital signatures -- it cannot be used to encrypt messages. Should such a fundamental policy decision be made in the obscurity of an administrative agency's rulemaking process? COSTS The Utah Digital Signature Act also raises several issues relating to costs. The institutional overhead associated with creating and maintaining the Act's infrastructure will be passed along to participants, and participants must have access to expensive computer hardware and software in order to participate in the system. One issue not addressed by the Utah Act is whether citizens who are unable to afford these costs should be provided with subsidized or reduced-cost access to th infrastructure. A prominent commentator has noted that, in the long term, the type of system embodied in the Utah Act is "anticipated to become indispensable for conducting government, business, and even private affairs." Another cost-related issue concerns the costs associated with legislative endorsement of one particular technology (public-key encryption technology, or more narrowly, specific implementations of this technology) and whether this endorsement will affect the development of alternative solutions to the problems posed by communications over open computer networks. An advocate of a particular biometric technology has argued that the type of infrastructure contemplated by the Utah Act is costly overkill, and is far more complex and expensive than is necessary. Even if one accepts the appropriateness of a public-key approach, note that costs could vary widely depending upon which particular proprietary encryption algorithms are licensed. As originally passed, the Utah Act limited the role of certification authority to Utah-licensed attorneys, financial institutions, title companies, and government agencies. This sort of oligopolistic arrangement is, of course, anathema to a vibrant, competitive market which would drive down costs for consumers. The pending amendments to the Utah Act eliminate this requirement. Some of the states which are following the Utah Act as a model have retained this limitation, however. CONCLUSION Legislative activity concerning digital signatures is generally appropriate and potentially helpful. The Utah Digital Signature Act, particularly its provisions establishing the legal status of digital signatures, is a step in the right direction. However, lawmakers contemplating digital signature legislation should reconsider some of the policy choices made by the Utah Act. ------------------------------------------------- Brad Biddle, Legal Intern <biddle(a)acusd.edu> Privacy Rights Clearinghouse, Ctr for Public Interest Law http://pwa.acusd.edu/~prc [The views expressed in this article are not necessarily those of the Privacy Rights Clearinghouse or the Center for Public Interest Law.]

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

IDG: Get real. Publish the stuff like the rest of the world does. The only ones who don't are just not players in the game. If you want to try to snow consumer-types then go ahead. But if you want validation from the crypto community you'll have to just publish it. And if you don't, and just continue the marketing fluff, then people from this list, and others in the community, will be all over you and the publications (lists, press, etc) with the theoretical and inferred weaknesses of your system. I would say the onus is on you to put up or shut up and don't try to orchestrate or control the parameters of the disclosure. It's really in your own interests, I would think.

1 0

Re: Edupage, 20 Feb 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 22-FEB-1996 12:01:13.17 >Why, Oh why is there so so much talk about the V Chip. This stupid device >only covers over-the-air broadcast TV a dying part of the spectrum. It does >not cover cable-only programs (HBO, etc) and it does not cover net-based >audio and (soon) video programming. It is meaningless. If I recall correctly, Europe still has a lot of over-the-air broadcast TV. Moreover, if the device works from signals cosent with the TV broadcast, it could perfectly well work with cable. Indeed, I had thought it did - the companies that mainly produce stuff for cable seemed to be protesting it just as much as the broadcast networks. -Allen

1 0