- cypherpunks-legacy - lists.cpunks.org

Hack Microsoft Promotion Gets some Press
by Rich Graves 17 Dec '03

17 Dec '03

Just FYI, and patting everybody on the back. I've tried to deflect the credit, and at least in PC Week I was successful. January 8th PC Week, Netwired section, only distributed in print I think (which is odd). It mentions c2.org as a "controversial link" on the win95netbugs FAQ, which is odd because nobody has ever complained to me or on the newsgroups about it. But controversy sells, so that's probably a plus anyway. http://www.zdnet.com/~pcweek/ (their Web server sucks, though, you might not get through) InfoWorld, next issue, probably on the cover. http://www.infoworld.com/pageone/nickextra.htm San Jose Mercury News, probably tomorrow or the next day, not sure whether it's the main section or the computing/business section. http://www.sjmercury.com/ MERCURY on America "Online" Simson is rapidly approaching deadline and has frozen his sources, so please disregard my last about sending anything further to him. I will accept it and pass it on to anyone who inquires in the future. I think I was probably too timid by half in not violating anyone's anonymity by even forwarding notes to Simson and by not spamming Simson's mailbox, but that's OK, it'll all come out eventually. Watch these spaces for Microsoft's response. http://www.microsoft.com/windows/pr/clarifications.htm http://www.wagged.com/ Three cheers especially for Peter, Frank, and Sameer. -rich(a)c2.org http://www.c2.org/hackmsoft/ llurch(a)networking.stanford.edu http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Re: A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>>[WFWSYS.CFG file] > >This is the file used by admincfg.exe (on WFW3.11 disk 8). This file >contains "security" settings, such as whether or not to cache passwords >on disk (*.PWL files). Ahh, so you can silently reenable password cacheing by manipulating this file, thereby defeating Microsoft's "turn off password cacheing" kludge. Wonderful. I'll have a poke around on Monday to figure out what bits to flip and post the results here. Thanks for the info... Peter.

1 0

CryptoAPI and export question
by Tom Johnston 17 Dec '03

17 Dec '03

Two points: the CSP development kit is export-controlled; and signing a CSP developed by a foreign vendor is treated as a export -- so the signature is export-controlled. We would ship a CSP development kit to a foreign vendor, and sign a CSP developed by the foreign vendor, but only with the appropriate export licenses. -TJ ---------- From: Dr. Dimitri Vulis <dlv(a)bwalk.dm.com> To: <cypherpunks(a)toad.com> Subject: Re: FW: CrytoAPI on Cypherpunks Date: Wednesday, January 17, 1996 8:37PM Tom Johnston <tomj(a)microsoft.com> writes: > >>> We won't charge high fees (right now, it's free!). Our policy is > >>> simple: we'll sign the CSP of anyone who follows the rules. Would you sign a foreign-developed CSP (which isn't subject to the rules)? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: A Modest Proposal: Fattening up the Proles
by stevenw＠best.com 17 Dec '03

17 Dec '03

Tim May: >(Ironically, I brought up the new book, "The Winner Take All Society," at >the last Cypherpunks meeting. No time to discuss it here, but it confirms >my strong belief that we are heading for a economy in which a shrinking >fraction of workers have really valuable things to contribute, and a >growing fraction of the population does not. I had not recalled the >authors, but Strick had a battery-powered laptop and Metricom wireless >modem, and ran an Alta Vista search from where he was sitting: ROBERT FRANK >& PHILIP COOK, The Winner-Take-All Society, New York: The Free Press.) See also _The End of Work_ by Rifkin. It chronicles changing work patterns from agriculture through mass manufacturing and the service age on to an uncertain future. Lots of interesting numbers and "look what is already happening" statements. It also shows that the changes are inexorable, just as the decline in agriculture based on human and animal labor was. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Attack Simulator
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Internet Scanner Software Checks Network Security Atlanta, Jan. 17 -- Internet Security Systems has released version 3.2 of its Internet Scanner software. The company said the program is an "attack simulator" that tests your organization's network for security holes. ISS said Internet Scanner 3.2 has enhanced reporting capabilities and added tests for more than 130 security vulnerabilities, including the recently revealed Microsoft File Sharing bug. "Our added focus on Microsoft security holes stems from our customers' rapid adoption of TCP/IP (Transmission Control Protocol/Internet Protocol)-enabled Microsoft Windows NT and Windows 95," said Chris Klaus, founder and chief executive officer of ISS. According to Don Ulsch, a security consultant affiliated with the National Security Institute in Westborough, Massachusetts, The movement to Windows 95 created a whole new set of security concerns for network administrators. "Similar to virus scanning software, a security scanning tools' value to a corporation declines quickly unless it can detect the latest security holes. In the security arena, every upgrade is crucial," said Ulsch. New features of Internet Scanner 3.2 include added reporting capabilities including hyperlinks that connect to CERT advisories and vendor World Wide Web sites to pull down patches and information regarding network holes, and addition of Linux as a supported platform. The company said that will allow easy scanning from laptop PCs. The additional tests added to the new version include the Microsoft File Sharing bug, the TelnetD bug, the Stealth Scan, Finger Bomb, and misconfigured Linux NIS services. The company said its customers who have current maintenance contracts can now electronically download the updated version from the USS Web home page at http://iss.net. Internet Security Systems, tel 770-441-2531, fax 770-441-2431

1 0

Re: A weakness in PGP signatures, and a suggested solution (long)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Rich Graves <llurch(a)Networking.Stanford.EDU> allegedly wrote: > > An easy short-term partial solution would be to modify mailcrypt, bap, or > whatever front end you use to automatically put the current date and (a > shortened form of) the To: or Newsgroups: header into the PGP signature > Comments: line. I wrote: > > A good idea, and one I was about to implement for BAP, but > doesn't PGP itself stick a timestamp into the signature? > When I verify a signature it says "verified, signed at > XXX time & date.". Whoops! I misunderstood. The fix I am considering is putting some information inside the *body* of the message, probably at the end just before the signature. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMP2Bj/WZSllhfG25AQHxWwP/bHmOcuAPAHdCShaeZhpLYQPJEJWyApuV EQhA/k1TSxmowH0cPff1rBZw4+2HFzfKiWHgBO12lf6gO+ihVGq/7GAJuwEVmMb6 aNKhSRESmb2YgV8/luj401KnknSP1x3xC56wzE1mhIiN8LOtav2J+rxM398DTzEc 8mzb7dETBRU= =ZDiw -----END PGP SIGNATURE-----

1 0

ITSEC?
by Juan D. Sandoval 17 Dec '03

17 Dec '03

does anyone know where I can get info on Information Technology Secure Evaluation Criteria (ITSEC)? I think it is more or less like "the orange book" but in Europe. Thanks

1 0

Re: A Modest Proposal: Fattening up the Proles
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:46 PM 1/17/96 -0800, Steven Weller wrote: >See also _The End of Work_ by Rifkin. It chronicles changing work patterns >from agriculture through mass manufacturing and the service age on to an >uncertain future. Lots of interesting numbers and "look what is already >happening" statements. It also shows that the changes are inexorable, just >as the decline in agriculture based on human and animal labor was. Except when I had Rifkin on the phone on a National Commie Radio talk show he dishonestly refused to admit the fact that -- so far -- employment in the US (total and percentage workforce participation) is higher than it's ever been. A lot of that is the commie belief that a job is something someone else gives you rather than something that you do. It's a bit hard to be without work if you assign it to yourself. And if wants are unlimited then one of the "goods" for which wants are unlimited is labor. DCF "A job he calls it! Reading the legal notices in the Times searching for unclaimed bequests in his name." -- The New Yorker

1 0

Re: Blacknet & Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:13 1/18/96, Adam Shostack wrote: [...] > So...Is Notes V4 shipping yet? Do we know how many bits of >key we're after? (NB: I'm assuming that (some part of) the US >government has an RSA private key which is used to encrypt the 24 bits >of GAK'd key.) What I would like to know is which agencies have the key. Any hard info? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Lotus to export 64 bit, partially-escrowed Notes
by jim bell 17 Dec '03

17 Dec '03

At 03:45 PM 1/17/96 -6, Peter Trei wrote: >A new 'international' version of Lotus notes is being released, with >64 bit session keys, as opposed to the old 40 bit version. > >24 bits of the session key are stored encrypted under a special, >government-access RSA public key. This is in addittion to the full >64 bit key being available under the recipient's public RSA key. > >The idea is that the USG would have to search only a 40-bit keyspace, >while others will need to search a 64-bit keyspace. >Reportedly, this 'workfactor reduction key' will NOT be available to >foreign governments. >My colleague reports that opinion at the conference was divided over >whether Lotus was doing something which made good business >sense, or whether this was 'caving-in'. My "vote"? They're "caving-in."

2 1