- cypherpunks-legacy - lists.cpunks.org

WINDOWS *.PWL program
by �ukasz Bromirski 17 Dec '03

17 Dec '03

Two years ago, you've posted an Windows 95 *.PWL cracking program. However, it was severly broken in our news group. Could you post me personally a full-working copy of it (as an e-mail) or a source (full) of this program? I'll be glad to see it. Thanx in advance. -- ### ### ### ### ## ###### £ukasz Bromirski # # # # # # # # ## # #### e-mail: szopen(a)gazeta.pl # # # # # # # ### # ## tel. (+48) 022 699 48 00 # #### # ### # # # ## # #### Agora-Gazeta Sp. z o.o. ###### ####### ### ## ###### Dzia³ Telekomunikacji

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I have your GAK. Mail me your CAK and we'll trade.

1 0

Re: Govt. key escrow justification
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Adam Back wrote: > This is scary stuff... Clipper VI (or whatever number we're up to) in > the making. Expect a fresh onslaught of government master key > attempts from the US government based on this info war initiative. > Michael Wilson <0005514706(a)MCIMAIL.COM> forwards: > > In its formal recommendations, the commission urged the government to > > speed up pilot programs on key recovery, promote efforts to plan for > > implementing large-scale key recovery systems and encourage > > private-sector key recovery efforts. > And there it is, they now want to encourage private sector key > recovery. Now why would they want to do that, if they don't plan to > use it as an infrastructure. > Building central control in _anything_ is asking for trouble > in info war terms. Everything should be as distributed as possible, > to minimise scope of an attacker who compromises keys. InfoWar goes on all the time amongst the Heavy Hitters in governement and commerce. It's called politics and money. Scenario I: Bill Gate$ reads an article where US Federal LEA's are bragging to insider politicians about their history of using their snooping and InfoWar capacities to financially disrupt 'bad' governments and corporations. Bill Gate$ then hands his company's secret keys over to the government because he trusts them to settle their dispute with him in court, instead of just 'grabbing' his money via his secret keys. Scenario II: Bill Gate$ gives his company's secret keys to Lucky Green, who runs toward the site of the Cypherpunks physical meeting, shouting, "Party time! Party time!" BillyG walks back to the limo, muttering, "That Lucky sure has a good sense of humor...I hope!" > Law enforcement with the master keys to the whole country is a huge > risk. Some law enforcement key custodian will simply be bribed or > coerced for the key, and then they really will have an info war risk. The only thing security levels do is determine the end cost of compromising security. Do you have to bribe/coerce a janitor or an executive? > > Asked by the subcommittee's chairman, Jon Kyl, an Arizona Republican, > > if those controls should be mandated, Marsh responded: "We think > > businessmen will find it in their best interest to incorporate these > > controls. ... Of course, in due time, that may be an option if they > > are not willing to accept them." Voluntary-Mandatory == Volmundatory ? GAK, GMR, ATP (Access to Toilet Plungers)...Cookies, Identity Tracking... What is going on is quite simply a battle for access to information. InoWar! Everybody wants access to the information of others, and to deny others access to their own information. Information is power, and power is kept by keeping the keys to that information. Corporations want to play footsie with the Government when it comes to getting access to all information and communications that pass through the self-defined borders of the Corporate Electromagnetic Curtain, but want to avoid being subject to total control within the borders of the Government's own self-defined ElectroMagnetic Curtain. The issues of power and control are the same as they have always been, but the Battle of the Bulge is now the Battle of the Byte. Government, Corporations, Organizations, Individuals...the players will be the same as in MeatSpace, and so will the issues and underlying concepts and ideals. Those seeking power and control will use the same tried-and-true methods, such as Divide and Conquer. "We don't want no 'nigger' data passing through our website. <---> We don't want no 'racist' data passing through our website." Chorus: <everybody sings together> "THERE OUGHT TO BE A LAW!" The Government wants to seize contol of ElectroMagnetic Reality by appointing themselves as our Electronic Protectors. Corporations are fighting to use the new technologies to protect themselves, cutting the Government out of the power loop. Individuals _should_ be trying to do the same. Government has declared Crypto munitions for the same reason they increasingly declare Guns to be 'government-munitions'. Those who have no power to protect themselves are vulnerable to those who have _reserved_ that power for themselves. Crypto or Guns...it's all about power and control of CyberSpace and MeatSpace. MunitionsMonger

1 0

[Fwd: Re: [RePol] Donations Received]
by Six 17 Dec '03

17 Dec '03

This was sent through EFGA's Georgia Cracker Remailer, but seems to have gotten 'lost' in the remail. Go figure... To: remailer(a)anon.efga.org Subject: Re: [RePol] Donations Received From: TruthMonger <tm(a)dev.null> Date: Wed, 05 Nov 1997 22:24:00 -0600 Organization: "It's not FUD until *I* say it's FUD!" References: <3.0.3.32.19971105220233.03538154(a)rboc.net> Reply-To: tm(a)dev.null :: Anon-To: cypherpunks(a)toad.com Robert A. Costner wrote: > > This week Electronic Frontiers Georgia (EFGA) found donations in our > mailbox for the first time. I'd like to thank those of you who have sent > us your support. As you know, EFGA has no endowment or source of income. I was rather surprised when I received a plea for donations from these people via my subscription to a suicide survivors mailing list. Likewise when my 10 year old daughter mentioned receiving one through her 4H Club mailing list. Upon asking others at work, I found that these people have been sending their requests to millions of people, through every conceivable internet forum, and that quite a few of the recipients had been taken in, and sent them donations. In the interests of stopping this obvious scam, I have founded a group dedicated to wiping out this kind of fraud on the internet, starting with the scum at the EFGA. If you are interested in contributing to our effort, send donations to: Electronic Fraud Fighters (EFF) Box 281, Bienfait, Saskatchewan CANADA S0C 0M0 or email me at: TruthMistress <tm(a)dev.null> > If we raise $2,000 we will be getting a new > server. If we raise $900, we will be doing upgrades on the current machine. > The address again is > > Electronic Frontiers Georgia > Suite A-205 > 4780 Ashford Dunwoody Road > Atlanta, GA 30338 > > For membership info, http://www.efga.org/about/membership.html

1 0

Re: [Fwd: Re: [RePol] Donations Received]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Six wrote: > This was sent through EFGA's Georgia Cracker Remailer, but seems to > have gotten 'lost' in the remail. > Go figure... Perhaps they objected to you not using your Government approved 'Prisoner of Citizenship' name.

1 0

Jam Six
by Anonymous 17 Dec '03

17 Dec '03

Jam Six Six

1 0

Re: Hughes Markets? (Was Re: Copyright commerce and the street musician protocol)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Thu, 6 Nov 1997 14:52:30 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Re: Hughes Markets? (Was Re: Copyright commerce and the street musician protocol) Cc: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) Robert Hettinga wrote: >A whole bunch of people are now talking about these cash-settled recursive >auction processes, and they're a direct, and now obvious, consequence of >bearer (or at least instant) settlement markets for information on geodesic >networks. When you add anonymity to the transaction, you pretty much have >the final straw for "rights" tracking. Watermarks just tell you who the >information was stolen from, for instance. So, one more industrial >information process bites the dust. Whoa! Hang on here. Sure, watermarks will tell you who information was stolen from, but they're just a stalking horse... a weak second cousin to *persistent* content control technologies (such as IBM's Cryptolopes and Intertrust's Digiboxes). These allow rightsholders to manage a wide range of parameters (including price, usage context, and any other variable for which you can imagine having a certificate). Whats fundamentally different about what are generically referred to as secure envelopes, is that they can maintain controls *indefinitely* (persistence), across an un- known, ad hoc, web of distribution over which one otherwise has no control. And yes, this can all work even in a completely disconnected environment (laptop at 35,000 feet). They allow rightsholders, if they so choose, to *continue* being rights- holders in a highly networked, digital world, and in a wide range of new ways, based on entirely new (or old) business models, that take advantage of rich/elaborate conditions for usage (e.g. you can view this picture anonymously, but it will cost you 2X as much, and you can only get it at low resolution, and you can't view it at all unless you can prove that you don't live in the Middle East). No certificate for these conditions? Sorry, no content. They are based the same basic stuff (public key cryptography of course) that *can* fuel wild anarchic visions of anonymous exchange. ;) But they aren't at all deterministic of any particular economic model. Regards, - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

FEMA site using cookies
by Attila T. Hun 17 Dec '03

17 Dec '03

1 0

plugin to sell digital files in cyberspace announced!! (fwd)
by Lindsay Haisley 17 Dec '03

17 Dec '03

>wow, I have been thinking that netscape/microsoft would put >something like this in their browser and that this would >kickstart the microcurrency market. however, it sounds like >someone has preempted them for the moment and >built a plugin. this is an extremely significant development >imho. I don't know how credible they are (the notice was >spam) but it's a step in the right direction, and the >creation of a whole new market I predict. I looked at their website and it looks rather fishy to me. Several issues and questions are obvious, not the least being the observation that this is an absolutely fabulous way to collect a bunch of credit card numbers. There is no information on the website to say where I-Vendor is located, or any way to judge whether it's even a legit company. The website is on AOL, so it's real ownership is effectivley concealed, and the owners could be over the border into Mexico with a hard drive full of stolen CC numbers and no one would be the wiser until it was too late :-( A legit domain name and website to use it on are pretty cheap, and make obvious business sense for a legit business - likewise for a phone number, which is also absent from the web pages. Both provide business points of contact and both provide trackability. Maybe I-Vendor doesn't want trackability. Hmmmm. So I download an exe file from a nearly anonymous site on AOL and run it to find out more about it? No thanks!!! It looks too much like a juicy worm on a hook to this fish. Lindsay Haisley (______) FMP Computer Services (oo) "The bull fmouse(a)fmp.com /------\/ stops here!" Austin, Texas, USA / | || 512-259-1190 * ||---|| * * * * * * ~~ ~~ http://www.fmp.com

1 0

From Our Friends at the Fed
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Thu, 6 Nov 1997 20:23:25 -0800 From: jmuller(a)brobeck.com (John D. Muller) Subject: From Our Friends at the Fed To: rah(a)shipwright.com X-MIME-Autoconverted: from quoted-printable to 8bit by pop.sneaker.net id XAA28997 Thought this missive from the Federal Reserve (SR Letter 97-28 for those who insist on a formal citation) might be of interest. Not sure if it's e$ or dcsb or cypherpunk-type material or none of the above, so I punt and let you decide. Cheers. John Muller mailto:jmuller@brobeck.com ---------------------------------------------------------------------- -- Suggested Cover Letter To the Chief Executive Officer or General Manager of Each State Member Bank, Bank Holding Company, State Chartered, Non-Insured U.S. Branch or Agency of a Foreign Bank, and Edge and Agreement Corporation in Your District Dear ______________________: The Federal Bureau of Investigation, working with Federal Reserve staff and representatives from the other federal banking agencies as well as other federal law enforcement agencies, developed the attached guidance concerning the reporting of violations of the federal criminal statute relating to computer crimes, 18 U.S.C. ß 1030 (Fraud and Related Activity in Connection with Computers) in Suspicious Activity Reports (SARs). The guidance is intended to facilitate the timely and accurate reporting of apparent violations of this law to law enforcement and bank supervisory agencies. The guidance describes the provisions of 18 U.S.C. ß 1030 and gives some examples of conduct that may violate the law. It also tells you how to report violations in a SAR. We would appreciate you bringing this matter to the immediate attention of all personnel in your organization responsible for reporting suspicious activity. In the event you have any questions concerning this matter, please contact __________________________. Sincerely, [Reserve Bank Official] Attachment ---------------------------------------------------------------------- -- GUIDANCE CONCERNING THE REPORTING OF COMPUTER-RELATED CRIMES BY FINANCIAL INSTITUTIONS This guidance is provided in order to explain the federal criminal statute relating to computer crimes, 18 U.S.C. ß 1030, and to ensure the timely and accurate reporting of apparent violations of the statute to law enforcement authorities. Background Regulations issued by the Federal Reserve, OCC, FDIC, OTS, and NCUA generally require banks, thrifts, credit unions, the U.S. branches and agencies of foreign banks, and other types of financial institutions to file Suspicious Activity Reports (SARs) whenever they detect any known or suspected federal criminal law violation or suspicious activity. The SAR system facilitates the reporting of suspected criminal activity and money laundering in a standard format to a single collection point, from which the information may be rapidly disseminated to appropriate law enforcement agencies. SARs play a critical role in collecting information about criminal activity affecting the financial community. Under the five financial institutions supervisory agencies' current SAR rules, a financial institution is required to report any known or suspected criminal law violation involving an insider, regardless of amount. A financial institution is also required to report any known or suspected federal criminal law violation that involves or aggregates more than $25,000 in the event no suspect can be identified--a threshold that drops to $5,000 if a potential suspect can be identified. The current SAR form includes in Part III, Box 37, a listing of 17 various categories of criminal law violations and suspicious activities that a financial institution can check. The categories include check, credit and wire transfer fraud, defalcation/embezzlement and mysterious disappearances, and also include a general category under "Other" that is to be used in the event the offense or activity does not appear to fit any of the delineated types of crimes. There is no category in Part III, Box 37, specifically reserved for violations of the provisions of the U.S. criminal code relating to computer crimes--18 U.S.C. ß 1030 (Fraud and Related Activity in Connection with Computers). Criminal Law Relating to Computers Computers and computer networks are at the heart of operations of a modern financial institution. Criminals--both inside and outside of financial institutions-- recognize the potential vulnerability of computer systems. Consequently, financial institutions must be cognizant of the federal computer crime law, 18 U.S.C. ß 1030. This statute specifically includes as a "protected computer," among other computers shielded by the statute, any computer exclusively for the use of a financial institution, or, if not exclusively for such use, used by or for a financial institution where the conduct constituting the offense affects that use. Financial institutions should pay particular attention to three provisions of 18 U.S.C. ß 1030. Section 1030(a)(2) specifically prohibits intentionally accessing a protected computer to obtain certain kinds of information without authority or in excess of authority. Not only does it generally prohibit improperly obtaining information from any "protected" computer, but it specifically prohibits improperly obtaining information contained in a "financial record" of a financial institution. The provision may also apply to an individual who hacks into a financial institution computer system. "Financial record" is defined as information derived from any record held by a financial institution pertaining to a customer's relationship with the institution. Another provision applicable to financial institutions is the prohibition on using a "protected" computer without authorization or in excess of authorization to commit fraud. The provisions of 18 U.S.C. ß 1030(a)(4) criminalize the knowing use of a protected computer without authorization or in excess or authorization with intent to defraud, and by means of such conduct furthering the intended fraud and obtaining anything of value. Thus, an individual who intentionally uses another person's home banking software and purloins that person's password in order to transfer money fraudulently into his or her personal bank account has committed a crime. The third provision--18 U.S.C. ß 1030(a)(5)--with applications to financial institutions is the prohibition on intentional access without authorization that results in "damage" to a protected computer. Damage is defined to include any impairment to the integrity or availability of data, a program, a system, or information that causes loss aggregating at least $5,000 in value during any one-year period. An example may involve a disgruntled former employee who maintains a "back door" into the computer system and uses it to introduce a virus that disrupts the system. Another example may involve an intruder who causes a system outage by flooding an institution's computer system with e-mail requests for information. Other provisions of 18 U.S.C. ß 1030 applicable to financial institutions include subsection (a)(6), which outlaws trafficking in passwords knowingly and with intent to defraud. Subsection (a)(7) prohibits transmitting threats to cause damage to a protected computer with intent to extort money or any other thing of value from any legal entity, specifically including financial institutions. This prohibition applies regardless of whether any actual damage is caused, or whether the offender actually had the ability to cause such damage. A violation of 18 U.S.C. ß 1030 can result in a fine or imprisonment for up to ten years. Guidance A financial institution should report on a SAR any activity that appears to be violative of 18 U.S.C. ß 1030. If a reportable offense is detected, a financial institution should check Box 37r, marked "Other", and describe as completely as possible in Part VII, the narrative section of the SAR, the nature of the illegal or suspicious activity. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0