- cypherpunks-legacy - lists.cpunks.org

[pagre@weber.ucsd.edu: computers are the crime scenes of the future]
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

Resent-Date: Thu, 24 Aug 1995 08:08:10 -0700 Date: Thu, 24 Aug 1995 07:59:52 -0700 From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: computers are the crime scenes of the future Resent-From: rre(a)weber.ucsd.edu Reply-To: rre-maintainers(a)weber.ucsd.edu X-Url: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: <rre(a)weber.ucsd.edu> archive/latest/793 X-Loop: rre(a)weber.ucsd.edu Precedence: list Resent-Sender: rre-request(a)weber.ucsd.edu Date: Thu, 24 Aug 1995 01:39:07 -0700 (PDT) From: Michael Papadopoulos <papadop(a)PEAK.ORG> Subject: Proper Methods for Seizing Computers from Criminals [ This is the ASCII transcript of a News Release. I have not transcribed additional informative paragraphs which describe the IACIS and the more than 150 different law anforcement agencies which have sent their "best computer specialists to our training conferences ... since 1991. ] *************************************************************** P.P.B CHIEF'S OFFICE TEL: 503-823-0342 Aug. 18, 95 16.15 .............. City of Portland, Oregon, Bureau of Police Vera Katz, Mayor, Charles A. Moose, Chief of Police 1111 SW 2nd Ave.. Portland Oregon 97204 Lieutenant C.W. Jensen Public Information Officer phone: 503 -823-0010 Digital Pager : 790-1779 August 18, 1995 NEWS RELEASE CHIEF MOOSE TO OPEN 6TH ANNUAL IACIS TRAINING CONFERENCE Chief Charles Moose will deliver the opening remarks at the 6th Annual IACIS Training Conference at the Hilton Hotel in Portland on Monday, August 21, 1995 at 10,00 a.m. IACIS is the acronym for the International Association of Computer Investigative Specialists, headquartered here in Oregon. IACIS was founded by Sgt. Tom Seipert of the Portland Police Bureau, and specializes in training law enforcement officers in the proper methods of seizing computers from criminals, and then extracting items of evidence. Computers are the crime scenes of the future, and require special training to seize and examine. The conference will begin with a series of mock computer raids on August 21, 1995, and end on September 1, 1995, with information on the latest technological changes the investigators need to worry about. Approximately 150 students will be attending the conference, some from as far away as Australia, and the major agencies such as the FBI, DEA, Secret Service, IRS Internal Security, and the Georgia Bureau of Investigation will be represented. For additional information about this conference, and questions regarding computer crime investigations, contact Sgt. Tom Seipert at the Hilton hotel, 274-4087. He will be at this number Friday August 18th as well as Saturday and Sunday, August 19th and 20th. ********************************************************************* --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

1 0

Re: Article in Time Magazine
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> All the more reason to use Linux or FreeBSD - an OS you have the source for, > on hardware that you can examine. How would you want to examine a pentium processor? Just an idea: Take the block move instructions and attach a little state machine. If a certain sequence of bytes is detected, a fuse somewhere on the chip is burned and the processor could switch irreversible into a mode where it does partial incorrect calculations. Send someone an email, an IP packet or an ethernet packet and you can expect the packet to be moved by a block move command. Hadmut

2 1

All about Bernstein
by Peter F Cassidy 17 Dec '03

17 Dec '03

Folks, I'm the guy who authored an upcoming piece about Bernstein's law suit with the state department for WIRED. WIRED loves the piece but, in the style of popular mags, wants more personal stuff on Bernstein, who is super articulate about the science and law of crypto but super shy about his heroic self. (Guy wouldn't even disclose his age! Had to threaten to throw myself in front of a bus to get him to tell me he's from Long Island!) Editor thinks guy comes across as a ghost, not surpisingly. . . One fellow from the list, following up an appeal I made here for Friends of Bernstein to call me and tell me about the litigant's best qualities, I'd appreciate greatly hearing from again. He called when I'd pretty much passed deadline for manuscript delivery. I'm calling Dan again, but after one trip to Delphi, I dunno if the responses from the Oracle will be any more forthcoming. Thanks and regards to all, Peter Cassidy

1 0

Challenge / Anything working ?
by Samuel Tardieu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <sam@manon:~>telnet sksp.brute.cl.cam.ac.uk 19957 Trying 128.232.0.90... (then nothing) Isn't it the right server/port ? Sam - -- "La cervelle des petits enfants, ca doit avoir comme un petit gout de noisette" Charles Baudelaire -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAgUBMD4Mi4FdzKExeYBpAQHaMgP+IgjU/SjM6+9rz0sM191xLLrEuCcdeZUL dVkP2VDTCCQqVCH5PyWWvC1O4bunQVgXaW35g6xmDKnnAiALW3UVRsq0QpiBhcrf 8lKZm6ASZWU8TSEoLrmf/kLvqygW9t72D+ktcXokiLe3OvT6Bs41DhHo8c/3go1u 2G/hylhLV9w= =Yz3+ -----END PGP SIGNATURE-----

1 0

Forwarded: FSTC Electronic Check Project News Release
by Howard Melman 17 Dec '03

17 Dec '03

MAJOR BANKING-COMPUTER CONSORTIUM TO DEVELOP ELECTRONIC CHECK FSTC Promises Early Demonstration Using the Internet Media contacts: Mayer Resnick (201) 836-2968, FSTC, Ed Russell (617) 434-6883, Bank of Boston, FSTC URL: http://www.llnl.gov/fstc New York (Aug. XX, 1995) -- The Financial Services Technology Consortium (FSTC) today announced the formation of a multi-industry team to design and implement an lectronic check for use over the Internet by consumers and businesses. FSTC is a consortium whose goal is to utilize emerging technologies to enhance the competitiveness of the financial services industry. The FSTC Electronic Check, which will work within the existing banking infrastructure, brings the benefits of paper checks to electronic commerce, while permitting the increased efficiency and timeliness of doing business on the "net." FSTC expects to demonstrate the Electronic Check within the next two months. "This project is particularly significant because it represents the first collaborative effort by major banks and their industry partners to develop from inception a new financial standard," said Dan Schutzer, FSTC president and Citibank vice president and director of advanced technology. "FSTC's Electronic Check is designed to be open, secure and convenient. It will bring to electronic commerce on the Internet a level of security and confidence currently found only in traditional banking products," Schutzer added. Bank members of the FSTC Electronic Check program are: Bank of America, Bank of Boston, Bank of Montreal, Bank One, Chemical Bank, Citibank, and Wells Fargo Bank. Industry members are: BBN Inc. (Bolt Beranek & Newman), Equifax, IBM Corporation, Information Resources Engineering Inc., National Semiconductor, Sun Microsystems and Telequip. Research and consulting organizations are: Bellcore, Oak Ridge and Sandia National Laboratories, and the University of Southern California-Information Sciences Institute. Advisory members are: Electronic Check Clearing House Organization (ECCHO) and National Automated Clearing House Association (NACHA). Appointed as the FSTC Electronic Check project director is John Doggett, director of applied technology, and as project manager is Frank Jaffe, senior systems consultant, both from Bank of Boston. "As shown by the over 60 billion checks written annually, paper checks are the payment mechanism of choice. We expect the FSTC Electronic Check and its smart-card or PC-card checkbook to become the preferred method for making and receiving payments due to its cost-effectiveness and embedded safety features," Doggett said. "The vision of a bank in your pocket, a bank at your desk, a bank where your are, can now be achieved with the FSTC electronic check," Doggett added. Formed in September 1993, FSTC is a consortium of some 65 organizations comprising banks, financial services firms, industry partners, national laboratories, universities, and government agencies. FSTC sponsors collaborative research and development on technical projects affecting the entire financial services industry and its users with particular emphasis on projects involving electronic commerce. FSTC development projects include interbank check image exchange, electronic commerce, and fraud detection and management. Editor's note: Attached is a brief description of how the FSTC Electronic Check works. A Brief Description of How FSTC Electronic Check Works The FSTC Electronic Check will provide an enhanced all-electronic replacement to the current paper check, and will be useable over any network. Paper checks and checkbooks will be replaced by electronic checkbooks, handwritten signatures will be replaced by digital signatures and the delivery by the postal service by the Internet or other electronic highway. These changes will greatly increase the convenience and security of check writing since the entire process will be automated and integrated into existing applications. By using "smart cards" and PC cards as electronic checkbooks the FSTC Electronic Check will be almost impossible to forge. Unlike paper checks, the person accepting an FSTC Electronic Check for payment will be able to verify that it has not been altered. As with paper checks, electronic checks will be an open payment instrument, providing for third-party services and a variety of payment options, such as travelers', cashiers' and certified checks. FSTC Electronic Checks also integrate into existing interbank clearing networks such as the Federal Reserve System and various automated clearing houses. FSTC's unique approach to the Electronic Check results in a secure, self-authenticating payment instrument that bridges the barrier between the insecure public network and the trusted financial clearing systems. # # # For further information on how FSTC and how FSTC Electronic Check works, please contact: Mayer Resnick (201) 836-2968, FSTC, or Ed Russell (617) 434-6883, Bank of Boston. # # #

1 0

Re: Florida Drivers Permits
by David K. Merriman 17 Dec '03

17 Dec '03

At 01:10 PM 8/25/95 -0400, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >- -----BEGIN PGP SIGNED MESSAGE----- > >[Welcome back, Professor] You posted: > > >>Will, starting next year, containg a digitized photo, plus the current >>info. > ><snip> > >>Anyone know any details about the technololgy? > ><snip> > >Not really. > I saw the same story. The name, address, age, & height mentioned >are already obvious on licenses, but this may preclude incorrect data entry >by FL cops, and counterfeiting (a problem here for *years*). I saw nothing >on the digitized photo, but we could be looking at different stories. >Phase-in in July, '96. The story I saw suggests that other data, such as >tickets, criminal violations (presumably convictions) and "other >biographical information" [welfare, credit info] could eventually be >included, depending on FL's state budgetary considerations. No author, >just "Associated Press," listed on the story, and the card uses a magnetic >strip "like those on credit cards" rather than a chip, which may be a >mistake [considering the renewal period & my experience with bank-cards]. >Story doesn't say it, but it sounds like FL *may* be the first state to do >this. Are any other states doing this already? Texas is now issuing similar cards - with the addition of a barcode on the back. Front is going to have UV-reactive writing, and be color-coded for class of license (commercial, chauffer, etc). Happily, I renewed just a couple months ago, so have plenty of time to figure out what I can do to the new DL when I get one :-) Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

brutessl web keyservice
by David K. Merriman 17 Dec '03

17 Dec '03

Feh. I've been trying to get allocated some more keyspace from the brutessl web page, and keep getting timeouts. Last time, I requested 8 segments, got issued *3*. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

ssl challenge
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It would be Really Nice if the next version of the brutessl software had a couple of features (particularly for us folks with mini-LANs) - > option to output results to a file (or files, so we can maintain local logging of results: ie, CHAL2a.dat, CHAL2b.dat, etc). > a Windows 3.1 variant (or even win32s) I've got 3 machines (386sx-33, 386DX-20, 486DX2-80), with an option on my roommates machine (386DX-40), all connected via Windows for Workgroups. All 4 are set up with win32s, so could do a *lot* better at keysearches if the software was available. There's plenty of support for Unix variants, and even NT/95, but us humble Win/DOS users are kinda left hanging a bit. Maybe next challenge, we can pre-allocate keyspace based on the results of this one: look at how fast folks are reporting results, and allocate chunks of space accordingly (maybe based on an 8-hour 'cycle'). Sure take some of the load off the poor server :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMD4E48VrTvyYOzAZAQGSMwP8DWxgb5NVDgvIFuw1BGf0E5TP0swHdyZ1 I4gfIGMtjd1AbtJHbxwILSPwb8+BcqZxZtGQXnYRnyoAkK7FltsiGulWApMXmNUU gtSUMr9xngW+Mwq5ju865Ff5wp7s8Bv3BBTqKGLmXWON1ILbEbjUNwqs4i8+wQU0 PCOgvJndj5M= =dyvQ -----END PGP SIGNATURE----- This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

NIST Key Escrow Papers
by Dave Banisar 17 Dec '03

17 Dec '03

fyi... ---- August 25, 1995 MEMORANDUM FOR Registrants for the Sept. 6-7, 1995 Key Escrow Issues Meeting From: NIST - Ed Roback Subject: Discussion Papers Attached for your information are two discussion papers for the upcoming September 6-7, 1995 Key Escrow Issues Meeting to be held at NIST. If you have any questions on this material, you may reach me on 301-975-3696. I look forward to seeing you in September. Attachments ------------------------ Key Escrow Issues Meeting, September 6-7, 1995 Discussion Paper #1 Issues -- Export of Software Key Escrowed Encryption On August 17, 1995, the Administration announced its proposal to permit the ready export of software encryption provided that the products use algorithms with key space that does not exceed 64 bits and the key(s) required to decrypt messages/files are escrowed with approved escrow agents. Under the proposal, products will be reviewed to verify that they satisfy the criteria and, if so, they will be transferred to the Commodity Control List administered by the Department of Commerce where the products can be exported under a general license (in much the same way that 40-bit RC2/RC4 encryption is licensed today). We are working toward creating broadly stated criteria that are in the nature of performance specifications. To meet these criteria, encryption products will need to implement key escrow mechanisms that cannot be readily altered or bypassed so as to defeat the purposes of key escrowing. The criteria, when finalized and published, will state the objectives, but not the exact technical method(s), by which those objectives are satisfied. This is to provide software publishers the flexibility to design methods for meeting our stated objectives in a manner that is compatible with the design of their products. There are, therefore, a number of questions we must work together to answer in order to draft effective criteria. These questions are: * Avoiding multiple encryption -- How can the product be designed so as to prevent doubling (or tripling, etc.) the key space of the algorithm? * Disabling the key escrow mechanism -- How can products be made resistant to alteration that would disable or circumvent the key escrow mechanism? How can the "static patch" problem be avoided? How can this be tested? * Access to escrow information -- What mechanisms must be designed into encryption products to allow authorized access to escrowed keys? This likely includes the identity of the key escrow agent(s) and a serial number for the key escrow agent to use to identify the key(s)/component(s) necessary to decrypt the message. What other information will be necessary to be provided to the escrow agent to identify the necessary key(s)/component(s)? Are there other comparable viable approaches? * Non-escrowed use -- How can products be made so that they do not function with non-escrowed products (or tampered escrowed products)? How can this be tested? * Limiting surveillance -- How can products be designed so that information both sent and received by the user can be decrypted without release of keys of other users? * Practical Key Access -- How can mechanisms be designed so that repeated involvement of escrow agents is not required for decryption for multiple files/messages during the specified access period? * Assurance that keys are escrowed -- How can it be assured that key escrow products are indeed satisfactorily escrowed? For example, products could be required to be escrowed at time of manufacture or be made inoperable until properly escrowed. * Ability to re-escrow keys -- How can products be designed so that new keys can be escrowed at the user's discretion with a U.S. Government approved escrow agent? * Certified escrow agents -- Can products be designed so that only escrow agents certified by the U.S. government (domestic, or under suitable arrangements, foreign) are utilized? What should be the criteria for an acceptable U.S. escrow agent? -------------- With your input, we are hopeful that this effort will lead to definitive criteria, which will facilitate the development of exportable products and help minimize the time required to obtain export licenses. The Administration seeks to finalize such criteria and make formal conforming modifications to the export regulations before the end of 1995. Note: These issues will be discussed at the Key Escrow Issues Meeting to be held September 6-7, 1995 (9:00 a.m. - 5:00 p.m.) at the National Institute of Standards and Technology (Gaithersburg, Maryland). The meeting will be open to the public, although seating is limited. Advance registration is requested, please contact Arlene Carlton on 301/975-3240, fax: 301/948-1784 or e- mail: carlton(a)micf.nist.gov. 8/25/94 ----------------------------- Key Escrow Issues Meeting, September 6-7, 1995 Discussion Paper #2 Discussion Issues: Desirable Characteristics for Key Escrow Agents In the government's recent announcement of its intent to allow the export of 64-bit software key escrow encryption products, one stipulation was that the keys would be escrowed with an approved key escrow agent.(*1) Exactly what qualifications/considerations are appropriate for approval as a key escrow agent have not been defined. Some of the issues which need to be discussed and resolved include the following: * What kinds of organizations should be excluded from consideration as approved key escrow agents? * What sort of legal agreement between the government and the key escrow agent is necessary to stipulate the responsibilities of the agent? Should this include the terms and conditions under which release of a key is required? * How will liability for unauthorized release of key be handled? * Should, for example, intentionally misreleasing or destroying a key be criminalized? Should this include other actions? * How can the government's needs for confidentiality of key release be handled? * Should approval of key escrow agents be tied to a public key infrastructure (for digital signatures and other purposes)? * What procedures need to be developed for the storage and safeguarding of keys? * What are the acceptable performance criteria (e.g., around- the-clock availability, accessibility, reliability, etc.) for approved key escrow agents? * Under what circumstances will key escrow agents in foreign countries be approved? * What process will be used to approve escrow agents? Costs/who pays? --------- (*1) "Approved," for the purposes of this discussion, means that the government (or its agent) has formally granted permission for an organization to hold keys for exportable encryption products. Note: These issues will be discussed at the Key Escrow Issues Meeting to be held September 6-7, 1995 (9:00 a.m. - 5:00 p.m.) at the National Institute of Standards and Technology (Gaithersburg, Maryland). The meeting will be open to the public, although seating is limited. Advance registration is requested, please contact Arlene Carlton on 301/975-3240, fax: 301/948-1784 or e-mail: carlton(a)micf.nist.gov. 8/25/95 _________________________________________________________________________ Subject: NIST Key Escrow Papers _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

Security Mailing Lists
by Christopher Klaus 17 Dec '03

17 Dec '03

This was put together to hopefully promote greater awareness of the security lists that already exist. Most security mailing lists have been only announced once and it was only word of mouth that it would acquire new members. This list should hopefully make the membership grow for each mailing list. If you know of any mailing lists that have been skipped, please e-mail cklaus(a)iss.net with the info. The newest updates for this will be on http://iss.net/. This web site also contains info for the following security issues: Vendor security contacts Security Patches What to do if you are compromised Set up Anon ftp securely Sniffers attacks and solutions Security Mailing Lists The following FAQ is a comprehensive list of security mailing lists. These security mailing lists are important tools to network administrators, network security officers, security consultants, and anyone who needs to keep abreast of the most current security information available. General Security Lists * 8lgm (Eight Little Green Men) * Academic-Firewalls * Best of Security * Bugtraq * Computer Privacy Digest (CPD) * Computer Underground Digest (CuD) * Cypherpunks * Cypherpunks-Announce * Firewalls * Intruder Detection Systems * Phrack * PRIVACY Forum * Risks * Sneakers * Virus * Virus Alert Security Products * Tiger * TIS Firewallk Toolkit Vendors and Organizations * CERT * CIAC * HP * Sun ------------------------------------------------------------------------------- 8lgm (Eight Little Green Men) To join, send e-mail to majordomo(a)8lgm.org and, in the text of your message (not the subject line), write: subscribe 8lgm-list Group of hackers that periodically post exploit scripts for various Unix bugs. ------------------------------------------------------------------------------- Academic Firewalls To join, send e-mail to majordomo(a)net.tamu.edu and, in the text of your message (not the subject line), write: SUBSCRIBE Academic-Firewalls This is an unmoderated list maintained by Texas A&M University. Its purpose is to promote the discussion and use of firewalls and other security tools in an academic environment. It is complementary to the Firewalls list maintained by Brent Chapman (send subscription requests to Majordomo(a)GreatCircle.COM) which deals primarily with firewall issues in a commercial environment. Academic environments have different political structures, ethical issues, expectations of privacy and expectations of access. Many documented incidents of cracker intrusions have either originated at or passed through academic institutions. The security at most universities is notoriously lax or even in some cases completely absent. Most institutions don't use firewalls because they either don't care about their institution's security, they feel firewalls are not appropriate or practical, or they don't know the extent to which they are under attack from the Internet. At Texas A&M University we have been using a combination of a flexible packet filter, intrusion detection tools, and Unix security audit utilities for almost two years. We have found that simple firewalls combined with other tools are feasible in an academic environment. Hopefully the discussion on this list will begin to raise the awareness of other institutions also. ------------------------------------------------------------------------------- Best of Security To join, send e-mail to best-of-security-request(a)suburbia.net with the following in the body of the message: subscribe best-of-security REASONS FOR INCEPTION In order to compile the average security administrator it was found that the compiler had to parse a foreboding number of exceptionally noisy and semantically-content-free data sets. This led to exceptionally high load averages and a dramatic increase in core entropy. Further, the number, names and locations of this data appears to change on an almost daily basis; requiring tedious version control on the part of the mental maintainer. Best-of-Security is at present an un-moderated list. That may sound strange given our stated purpose of massive entropy reduction; but because best often equates with "vital" and the moderator doesn't have an MDA habit it is important that material sent to this list be delivered to its subscribers' in as minimal period of time as is (in)humanly possible. If you find *any* information from *any* source (including other mailinglists, newsgroups, conference notes, papers, etc) that fits into one of the acceptable categories described at the end of this document then you should *immediately* send it to "best-of-security(a)suburbia.net". Do not try and predict whether or not someone else will send the item in question to the list in the immediate future. Unless your on a time-delayed mail vector such as polled uucp or the item has already appeared on best-of-security, mail the info to the list! Even if it is a widely deployed peice of information such as a CERT advisory the proceeding argument still applies. If the information hasn't appeared on this list yet, then SEND IT. It is far better to run the risk of minor duplication in exchange for having the information out where it is needed than act conservatively about occasional doubling up on content. ------------------------------------------------------------------------------- Bugtraq To join, send e-mail to LISTSERV(a)NETSPACE.ORG and, in the text of your message (not the subject line), write: SUBSCRIBE BUGTRAQ This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them. This list is not intended to be about cracking systems or exploiting their vunerabilities. It is about defining, recognizing, and preventing use of security holes and risks. Please refrain from posting one-line messages or messages that do not contain any substance that can relate to this list`s charter. Please follow the below guidelines on what kind of information should be posted to the Bugtraq list: * Information on Unix related security holes/backdoors (past and present) * Exploit programs, scripts or detailed processes about the above * Patches, workarounds, fixes * Announcements, advisories or warnings * Ideas, future plans or current works dealing with Unix security * Information material regarding vendor contacts and procedures * Individual experiences in dealing with above vendors or security organizations * Incident advisories or informational reporting ------------------------------------------------------------------------------- Computer Privacy Digest To join, send e-mail to comp-privacy-request(a)uwm.edu and, in the text of your message (not the subject line), write: subscribe cpd The Computer PRIVACY Digest (CPD) (formerly the Telecom Privacy digest) is run by Leonard P. Levine. It is gatewayed to the USENET newsgroup comp.society.privacy. It is a relatively open (i.e., less tightly moderated) forum, and was established to provide a forum for discussion on the effect of technology on privacy. All too often technology is way ahead of the law and society as it presents us with new devices and applications. Technology can enhance and detract from privacy. ------------------------------------------------------------------------------- Computer Underground Digest To join, send e-mail to LISTSERV(a)VMD.CSO.UIUC.EDU and, in the text of your message (not the subject line), write: SUB CUDIGEST CuD is available as a Usenet newsgroup: comp.society.cu-digest Covers many issues of the computer underground. ------------------------------------------------------------------------------- Cypherpunks To join, send e-mail to majordomo(a)toad.com and, in the text of your message (not the subject line), write: SUBSCRIBE cypherpunks The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. ------------------------------------------------------------------------------- Cypherpunks Announce To join, send e-mail to majordomo(a)toad.com and, in the text of your message (not the subject line), write: SUBSCRIBE cypherpunks-announce There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. ------------------------------------------------------------------------------- Firewalls To join, send e-mail to majordomo(a)greatcircle.com and, in the text of your message (not the subject line), write: SUBSCRIBE firewalls Useful information regarding firewalls and how to implement them for security. This list is for discussions of Internet "firewall" security systems and related issues. It is an outgrowth of the Firewalls BOF session at the Third UNIX Security Symposium in Baltimore on September 15, 1992. ------------------------------------------------------------------------------- Intrusion Detection Systems To join, send e-mail to majordomo(a)uow.edu.au with the following in the body of the message: subscribe ids The list is a forum for discussions on topics related to development of intrusion detection systems. Possible topics include: * techniques used to detect intruders in computer systems and computer networks * audit collection/filtering * subject profiling * knowledge based expert systems * fuzzy logic systems * neural networks * methods used by intruders (known intrusion scenarios) * cert advisories * scripts and tools used by hackers * computer system policies * universal intrusion detection system ------------------------------------------------------------------------------- Phrack To join, send e-mail to phrack(a)well.com and, in the text of your message (not the subject line), write: SUBSCRIBE Phrack Phrack is a Hacker Magazine which deals with phreaking and hacking. ------------------------------------------------------------------------------- PRIVACY Forum To join, send e-mail to privacy-request(a)vortex.com and, in the text of your message (not the subject line), write: information privacy The PRIVACY Forum is run by Lauren Weinstein. He manages it as a rather selectively moderated digest, somewhat akin to RISKS; it spans the full range of both technological and non-technological privacy-related issues (with an emphasis on the former). ------------------------------------------------------------------------------- Risks To join, send e-mail to risks-request(a)csl.sri.com and, in the text of your message (not the subject line), write: SUBSCRIBE Risks is a digest that describes many of the technological risks that happen in today's environment. ------------------------------------------------------------------------------- Sneakers To join, send e-mail to majordomo(a)CS.YALE.EDU and, in the text of your message (not the subject line), write: SUBSCRIBE Sneakers The Sneakers mailing list is for discussion of LEGAL evaluations and experiments in testing various Internet "firewalls" and other TCP/IP network security products. * Vendors are welcome to post challenges to the Internet network security community * Internet users are welcome to post anecdotal experiences regarding (legally) testing the defenses of firewall and security products. * "Above board" organized and/or loosely organized wide area tiger teams (WATTs) can share information, report on their progress or eventual success here. There is a WWW page with instructions on un/subscribing as well as posting, and where notices and pointers to resources (especially if I set up an archive of this list) may be put up from time to time: http://www.cs.yale.edu/HTML/YALE/CS/HyPlans/long-morrow/sneakers.html ------------------------------------------------------------------------------- Virus To join, send e-mail to LISTSERV(a)lehigh.edu and, in the text of your message (not the subject line), write: SUBSCRIBE virus-l your-name It is an electronic mail discussion forum for sharing information and ideas about computer viruses, which is also distributed via the Usenet Netnews as comp.virus. Discussions should include (but not necessarily be limited to): current events (virus sightings), virus prevention (practical and theoretical), and virus related questions/answers. The list is moderated and digested. That means that any message coming in gets sent to me, the editor. I read through the messages and make sure that they adhere to the guidelines of the list (see below) and add them to the next digest. Weekly logs of digests are kept by the LISTSERV (see below for details on how to get them). For those interested in statistics, VIRUS-L is now up to about 2400 direct subscribers. Of those, approximately 10% are local redistribution accounts with an unknown number of readers. In addition, approximately 30,000-40,000 readers read comp.virus on the USENET. ------------------------------------------------------------------------------- Virus Alert To join, send e-mail to LISTSERV(a)lehigh.edu and, in the text of your message (not the subject line), write: SUBSCRIBE valert-l your-name What is VALERT-L? It is an electronic mail discussion forum for sharing urgent virus warnings among other computer users. Postings to VALERT-L are strictly limited to warnings about viruses (e.g., "We here at University/Company X just got hit by virus Y - what should we do?"). Followups to messages on VALERT-L should be done either by private e-mail or to VIRUS-L, a moderated, digested, virus discussion forum also available on this LISTSERV, LISTSERV(a)LEHIGH.EDU. Note that any message sent to VALERT-L will be cross-posted in the next VIRUS-L digest. To preserve the timely nature of such warnings and announcements, the list is moderated on demand (see posting instructions below for more information). What VALERT-L is *not*? A place to to anything other than announce virus infections or warn people about particular computer viruses (symptoms, type of machine which is vulnerable, etc.). ------------------------------------------------------------------------------- Security Products ------------------------------------------------------------------------------- Tiger To join, send e-mail to majordomo(a)net.tamu.edu and, in the text of your message (not the subject line), write: SUBSCRIBE tiger Discussion list for the UNIX security audit tool TIGER This is the TIGER users mailling list. It is for: 1. Update announcements 2. Reporting bugs in TIGER. 3. Discussing new features for TIGER. 4. Discussing use of TIGER. 5. Discussing anything else about TIGER. What is TIGER? TIGER is a set of shell scripts, C code and configuration files which are used to perform a security audit on UNIX systems. The goals for TIGER are to make it very robust and easy to use. TIGER was originally developed for checking hosts at Texas A&M University following a break in in the Fall of 1992. The latest version of TIGER is always available from the directory net.tamu.edu:/pub/security/TAMU. In addition, updated digital signature files for new platforms and new security patches will be maintained in the directory: net.tamu.edu:/pub/security/TAMU/tiger-sigs. ------------------------------------------------------------------------------- TIS Firewall Toolkit To join, send e-mail to fwall-users-request(a)tis.com and, in the text of your message (not the subject line), write: SUBSCRIBE Discussion list for the TIS firewall toolkit ------------------------------------------------------------------------------- Vendors and Organizations ------------------------------------------------------------------------------- CERT (Computer Emergency Response Team) Advisory mailing list. To join, send e-mail to cert(a)cert.org and, in the text of your message (not the subject line), write: I want to be on your mailing list. Past advisories and other information related to computer security are available for anonymous FTP from cert.org (192.88.209.5). ------------------------------------------------------------------------------- The CIAC (Computer Incident Advisory Capability) of DoE CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. CIAC-NOTES for Notes, a collection of computer security articles; 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 4. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. To join, send e-mail to ciac-listproc(a)llnl.gov and, in the text of your message (not the subject line), write any of the following examples: subscribe ciac-bulletin LastName, FirstName PhoneNumber subscribe ciac-notes LastName, FirstName PhoneNumber subscribe spi-announce LastName, FirstName PhoneNumber subscribe spi-notes LastName, FirstName PhoneNumber e.g., subscribe ciac-notes O'Hara, Scarlett 404-555-1212 You will receive an acknowledgment containing address, initial PIN, and information on how to change either of them, cancel your subscription, or get help. ------------------------------------------------------------------------------- HP, Hewlett Packard To join, send e-mail to support(a)support.mayfield.hp.com and, in the text of your message (not the subject line), write: subscribe security_info The latest digest of new HP Security Bulletins will be distributed directly to your mailbox on a routine basis. ------------------------------------------------------------------------------- Sun Security Alert To join, send e-mail to security-alert(a)sun.com and, in the subject of your message write: SUBSCRIBE CWS your-email-addr The message body should contain affiliation and contact information. ------------------------------------------------------------------------------- Copyright This paper is Copyright (c) 1995 by Christopher Klaus of Internet Security Systems, Inc. Permission is hereby granted to give away free copies electronically. You may distribute, transfer, or spread this paper electronically. You may not pretend that you wrote it. This copyright notice must be maintained in any copy made. If you wish to reprint the whole or any part of this paper in any other medium excluding electronic medium, please ask the author for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. Address of Author Please send suggestions, updates, and comments to: Christopher Klaus <cklaus(a)iss.net> of Internet Security Systems, Inc. <iss(a)iss.net> Internet Security Systems, Inc. Internet Security Systems, Inc, located in Atlanta, Ga., specializes in the developement of security scanning software tools. Its flagship product, Internet Scanner, is software that learns an organization's network and probes every device on that network for security holes. It is the most comprehensive "attack simulator" available, checking for over 100 security vulnerabilities. -- Christopher William Klaus Voice: (770)441-2531. Fax: (770)441-2431 Internet Security Systems, Inc. "Internet Scanner lets you find 2000 Miller Court West, Norcross, GA 30071 your network security holes Web: http://iss.net/ Email: cklaus(a)iss.net before the hackers do."

1 0