- cypherpunks-legacy@lists.ogf.org

Re: toad.com mailing list postings from possible virus authors
by gnu 19 Feb '93

19 Feb '93

Keith, Kenneth: I have been busy both cutting a GDB release (which isn't done yet) and dealing with immediate management needs at my company. But your concerns are also of grave concern to me, so I'll take the time to answer you fully. I am uninterested in censorship of discussion of *any* topic on mailing lists through my machine. Your opinion is that this is inappropriate use of the Internet. I own the machine free and clear. I personally pay its network bills. If you examine its net connectivity and the associated connection contracts, you will find that the machine is attached via a worldwide network that explicitly promises not to censor any traffic UNLESS AND UNTIL a court of law -- not you -- has decided that that traffic is actually illegal. And my machine sends email traffic for any host (other than a short list known to be on uncensored networks) to uunet, which is explicitly authorized by NSF to forward uncontrolled outside traffic (e.g. from uucp sites) into the NSFnet. You see, I anticipated that third parties would want to control what I and my friends might want to talk about using this wonderful networking technolgy. And we aren't interested in your opinion. No offense intended, Keith -- I think you have done some truly great work for the community. But when you imply that conversations though my machine are in any way illegal or inappropriate, you've overstepped my respect for you. > This person appears to be a virus > author, one who knows virus authors, and/or one who encourages such > activity. Thank you, Senator McCarthy. I believe that thug(a)phantom.com is not a smart-card-carrying member of the virus authors' guild, but I'm not sure. I think that the attitude that it's OK for "computer scientists" or "virus researchers" to talk about viruses, to dissect them in detail, and to write or modify them, but it isn't OK for anyone else to do so, is two-faced and objectionable. Security by obscurity -- forcing people to be unaware of issues and threats like these, whether by explicit censorship, pressure on intermediate sites, or by social ostracism -- not only doesn't remove the threat, but is an affront to our open society. If you think that the public should be protected from the *content* of the particular message that was forwarded to me, I recommend that you look at recent issues of Info Security News (formerly ISPNews), one of the better trade rags covering security products. They seem to be running an article series by Alan Solomon on exactly how stealth viruses work, and they provided a lot more details than the overview posting that came through toad.com. I've seen articles in the Sep/Oct and Nov/Dec 1992 issues so far. Just as important to the cypherpunks posting was the author's exploration of the impacts on society resulting from the technology (the movement toward memory-protected and permission-controlled operating systems, the impacts of automating virus creation so that children can do it, etc). The Solomon articles focused completely on technical issues, leaving the reader in the dark about how to cope over the next few years. My own opinion is that viruses are what will finally put a stake through the heart of DOS. It's a dirty job, but somebody has to do it. If true, or even 10% likely, it's something that a hundred million people had better talk about, so they can prepare for it. John Gilmore gnu(a)toad.com

3 2

Re: toad.com mailing list postings from possible virus authors
by geoffw＠nexsys.net 19 Feb '93

19 Feb '93

> Subject: Re: toad.com mailing list postings from possible virus authors > From: w8sdz(a)TACOM-EMH1.Army.Mil (Keith Petersen - MACA WSMR) > Content-Type> : > text> > Content-Length: 2643 > X-Lines: 59 > Status: RO > > John, by quoting and reposting without my permission, my private > message to you to a public mailing list you have violated the Federal > Communications Privacy Act of 1986. > > PUBLIC LAW 99-508--OCT. 21, 1986 > > TITLE II--STORED WIRE AND ELECTRONIC COMMUNICA- > TIONS AND TRANSACTIONAL RECORDS ACCESS > > ss. 2702. Disclosure of contents > > "(a) Prohibitions.--Except as provided in subsection (b)-- > "(1) a person or entity providing an electronic > communication service to the public shall not knowingly > divulge to any person or entity the contents of a > communication while in electronic storage by that service; > and > "(2) a person or entity providing remote computing > service to the public shall not knowingly divulge to any > person or entity the contents of any communication which > is carried or maintained on that service-- > "(A) on behalf of, and received by means of > electronic transmission from (or created by means of > computer processing of communications received by > means of electronic transmission from), a subscriber > or customer of such service; and > "(B) solely for the purposed of providing storage or > computer processing services to such subscriber or > customer, if the provider is not authorized to access > the contents of any such communications for purposes > of providing any services other than storage or > computer processing. Keith, Maybe you should read more carefully... > "(b) Exceptions.-- A person or entity may divulge the > contents of a communication-- > "(1) to an addressee or intended recipient of such > communication or an agent of such addressee or intended > recipient; > "(2) as otherwise authorized in section 2516, > 2511(2)(1) , or 2703 of this title; > "(3) with the lawful consent of the originator or an > addressee or intended recipient of such communication, or > the subscriber in the case of remote computing service; I think John is the "intended recipient of such communication" as I am also an "intended recipient" of this communication from you, which I will post to cypherpunks so others can see what kind of person you are. If your intention is to "threaten" with this kind of foolishness, then I must warn you, I consider this type of behavior harassment due to the confrontive nature of your post. Let it go on record that I don't expect to be harassed, intimidated or "threatened" and I think the Internet rules are VERY clear about this type of behavior. Geoff White (GW67) geoffw(a)nexsys.net

1 0

For other news on SDECE and foreign intell ops...
by Peter Wayner 19 Feb '93

19 Feb '93

Check out a new book by Peter Schweitzer entitled _Friendly Spies_. (Atlantic Monthly Press). It tells plenty of stories about how many US companies are the targets for foreign economic intelligence. To me, it is the best argument for the government to _encourage_ the widespread use of strong cryptography. -Peter

1 0

Test the new remailer
by Anonymous＠cs.Buffalo.EDU 19 Feb '93

19 Feb '93

I encourage everyone to at least send a test message through the remailer so that I can lay my fears thtat the reamailer is not working down to rest. Not only that... it's really easy. Try it! -- +==== Internet: babani(a)cs.buffalo.edu ===+======== Amateur-Radio: N2LYC ======+ ! Bitnet: V078LNGT(a)ubvms.BITNET | UUCP: rutgers!ub!babani ! ! Alternate: an173(a)cleveland.freenet.edu | Plsure dpnds on the othrs prmison. ! +== PGP key available. (If you don't know what a PGP key is... find out!) ==+

1 0

PGP anonymous remailer
by Anonymous＠cs.Buffalo.EDU 19 Feb '93

19 Feb '93

Ok, I have finally decided that my remailer is ready for public use. I think I have finally worked all the bugs out of it enough so that it runs very smooth. In case you want to write something to me... Here is my *own* PGP key. Rajesh (Rusty) Babani - babani(a)cs.buffalo.edu -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAislEwoAAAEEAKpPvevD7zlGmpbB9nYhqJghthanWvfoQlKXPa/sJe6B+Ztt lbCVcLHZ4IpQfmcZ0hZqsKjQRunRFk1pT4woQsDSHJjax80xnrUwaLkPTOADahay FCQ6+NqV/7vWLR/XaJ7wxTGwtoCi/69jOfidKIj1HY6cpnImue7qIk/4gBkDAAUR tC1SYWplc2ggKFJ1c3R5KSBCYWJhbmkgPGJhYmFuaUBjcy5idWZmYWxvLmVkdT4= =wZaf -----END PGP PUBLIC KEY BLOCK----- The address where I am running an anonymous remailing server based on Eric Hughes' perl scripts is: <babani(a)cs.buffalo.edu> To use the server, put "Request-Remailing-To: <destination-address>" into the header of the message, and send it to the server address. If your mailer won't let you put things into message headers, instead make the first line of your message body be just the two characters "::", and make the next line be "Request-Remailing-To: <destination-address>", and make the next line be blank. The "::" tells the remailer to take the following lines, up to a blank one, and put them into the header. Also, make sure that you include a subject: line in your message, otherwise, the messge will be sent to a black hole. You will not hear from the message again. To use PGP with the remailer, first compose a message like above then encrypt the message using the remailer's public key. Then, in the message body, make the first line be just the two characters "::", and make the next line be "Encrypted: PGP" and make the next line be balnk. Here is my anonymous remailer's PGP public key: Anonymous Remailer - babani(a)cs.buffalo.edu -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAitx/vQAAAEEAOUPjAfSeFmMsq7eWN47LzOwdSXmXoArMJOcBZ0bB3NRR3Nc BF7ZIIbY5m/b/rBn6+IimthV/aa39hKOSPPnFZn7kxIAUwoolMmxUUPJRzcRcTDK bsgLMCPfDuE8MWj0R960oaAFEE+yCCoDNiyPl6goN3XluVeie+ehVSuMvgdRAAUR tCpBbm9ueW1vdXMgUmVtYWlsZXIgPGJhYmFuaUBjcy5idWZmYWxvLmVkdT4= =BdRu -----END PGP PUBLIC KEY BLOCK-----

1 0

hopmail.bat for MSDOS
by Karl Barrus 19 Feb '93

19 Feb '93

Cypherpunks & cypherpunkettes :-) At long last I beleive a working version of hopmail written in the MSDOS scripting is finished. I've tested it and it seems to work (and I even sent messages with DOS CRLF's instead of unix NL and had no problems), but if you find problems let me know. I'm assuming you are like me in that my pc doesn't have a dedicated net connection, so the scripts just prepare file, but don't mail them. You would upload the file to your network account and go from there. Warning: the code is ugly, but I plead innocence, citing the constraints of the language! I've never used so many goto's since my last BASIC program ~11 years ago. I think in the future I'll just write DOS stuff in C/C++, with system calls, and offer source with executables, so you can recompile if you've think I've added secret password catching commands :-) I'd use 4DOS and other enhancements like some people have suggested (thanks!) but I want to be sure as many people as possible can use the script, so using just plain old DOS seems the best way to go. Well, the best way to go in DOS. I'll write a help file and offer it, the script, and anonmail.bat up for ftp. Quickly, because getting input from the user in DOS is a real pain/impossible without resorting to extra programs/assembly hacks , all parameters are just entered on the command line. Type hopmail and a short help screen will appear. Now I'll clean up the digital bank and circulate the source to those interested. ---------8< -- cut here -- >8---------- @echo off rem hopmail.bat - allows routing a message through various remailers rem extropia not supported just yet rem Karl Barrus - elee9sf(a)menudo.uh.edu rem if no parameters, print help file if '%1'=='' goto help rem get file name shift set filename=%0 if not exist %filename% goto errnofile rem check mode shift set mode=0 if '%0'=='1' set mode=1 if '%0'=='2' set mode=2 if '%mode%'=='0' goto errmode rem set up encrypted pgp header echo :: > zzztemp1.txt echo Encrypted: PGP >> zzztemp1.txt echo. >> zzztemp1.txt rem create null message echo. > zzztemp3.txt rem get email address shift set to=%0 if '%to%'=='' goto errmail :repeat shift if '%0'=='' goto finish if '%0'=='1' set rto=hh(a)pmantis.berkeley.edu if '%0'=='2' set rto=hh(a)cicada.berkeley.edu if '%0'=='3' set rto=hh(a)soda.berkeley.edu if '%0'=='4' set rto=hal(a)alumni.caltech.edu if '%0'=='5' set rto=remailer(a)rebma.mn.org if '%0'=='6' set rto=elee7h5(a)rosebud.ee.uh.edu if '%0'=='7' set rto=phantom(a)mead.u.washington.edu if '%0'=='8' set rto=hfinney(a)shell.portal.com rem set up remailing request header echo :: > zzztemp2.txt echo Request-Remailing-To: %to% >> zzztemp2.txt echo. >> zzztemp2.txt rem append previous message copy zzztemp2.txt + zzztemp3.txt zzztemp4.txt > nul del zzztemp2.txt rename zzztemp4.txt zzztemp2.txt if '%0'=='1' goto none if '%0'=='2' goto none if '%0'=='3' goto none pgp -ea zzztemp2.txt %rto% > nul copy zzztemp1.txt + zzztemp2.asc zzztemp3.txt > nul goto next :none copy zzztemp2.txt zzztemp3.txt > nul :next set to=%rto% goto repeat :finish if '%mode%'=='1' goto incmessage rem append, user chose create to receive echo -----cut here---- >> %filename% copy %filename% + zzztemp3.txt zzztemp4.txt > nul echo. >> zzztemp4.txt echo To reply, save everything below the cut here marks >> zzztemp4.txt echo Type your reply below the blank line two lines above >> zzztemp4.txt echo Mail resultant file to %to% >> zzztemp4.txt del %filename% rename zzztemp4.txt %filename% goto done :incmessage rem user chose create header to send copy zzztemp3.txt + %filename% zzztemp4.txt > nul del %filename% rename zzztemp4.txt %filename% echo Remember to mail %filename% to %to% goto done :help echo Usage: hopmail filename mode address remailer# [remailer#]... echo Mode: echo 1: Mail a file via anonymous remailers echo 2: Create a remailing header and append to a file echo. echo Address: echo for mode 1, destination address echo for mode 2, your address echo. echo Remailers: echo 1: hh(a)pmantis.berkeley.edu echo 2: hh(a)cicada.berkeley.edu echo 3: hh(a)soda.berkeley.edu echo 4: hal(a)alumni.caltech.edu echo 5: remailer(a)rebma.mn.org echo 6: elee7h5(a)rosebud.ee.uh.edu echo 7: phantom(a)mead.u.washington.edu echo 8: hfinney(a)shell.portal.com rem echo 9: remail(a)extropia.wimsey.com goto end :errmode echo Error: mode must be 1 or 2 goto end :errmail echo Error: no destination specified goto done :errnofile echo Error: file %filename% does not exist goto end :done del zzz*.* :end

1 0

toad.com mailing list postings from possible virus authors
by gnu 19 Feb '93

19 Feb '93

This is the message I received which complained about "inappropriate use of the Internet". He also phoned me to complain. I know the cyperpunks already know this, but Dave Farber's audience might not have thought about the implications for free speech of having the government build a multi billion dollar Internet replacement. Bureaucrats and random complaints from third parties on such a network *will* cause you grief about what you are allowed to say and do. The company I buy networking from is Alternet, and because they exist, I can protect myself from this sort of meddling. They will not be able to compete with the taxpayer funded "national information infrastructure", and my only option, if I want to be on the net, will be to hook up under the government's rules. If after seeing this this exchange you still don't believe me, talk to someone at a controversial broadcast radio station. Radio is living under that yoke *now*, and they have some real stories to tell. John Date: Tue, 16 Feb 1993 12:53:14 -0500 (EST) To: gnu(a)cygnus.com (John Gilmore) Cc: CMcDonald(a)WSMR-SIMTEL20.Army.Mil (Chris McDonald), krvw(a)cert.org ("Kenneth R. van Wyk") Subject: toad.com mailing list postings from possible virus authors From: w8sdz(a)TACOM-EMH1.Army.Mil (Keith Petersen - MACA WSMR) Message-Id: <9302161253.16494.w8sdz(a)TACOM-EMH1.Army.Mil> John, below is the posting I called about. In my opinion this is inappropriate use of the Internet. This person appears to be a virus author, one who knows virus authors, and/or one who encourages such activity. What is the policy of toad.com concerning such postings? Keith -- Keith Petersen Maintainer of the MS-DOS archive at WSMR-SIMTEL20.Army.Mil [192.88.110.20] Internet: w8sdz(a)TACOM-EMH1.Army.Mil or w8sdz(a)Vela.ACS.Oakland.Edu Uucp: uunet!umich!vela!w8sdz BITNET: w8sdz@OAKLAND > From: thug(a)phantom.com (Murdering Thug) > Subject: Re: Viral encryption > To: cypherpunks(a)toad.com > Date: Thu, 11 Feb 93 11:47:43 EST > > As Mr. Ferguson pointed out, polymorphic viruses are making their way into the > DOS world. This is a problem in the short term, but not in the long term > because people will be changing to memory-protected & file-permission based > operating systems like NT, OS/2 and Unix, where it is very difficult for > most kinds of virus to spread. > > I myself am very familiar with the virus underground, so for those who are > not, let me explain the two newest and most deadly virus techniques which > are being seen in the DOS world. > > The first is something called "Stealth" viruses. Stealth viruses imbed > themselves into DOS and intercept disk read calls from applications. If > those read system calls are reading non .EXE or .COM files, then they are > processed normally. However when an application such as virus scanning > program is reading in .COM and .EXE files (in order to scan them for virus > code), the stealth code in DOS intercepts this and returns to the application > what the .EXE or .COM file would look like if it wasn't infected by the > stealth virus. Thus, all virus checking programs can be decieved in this > manner. There are steps to get around this, like booting off of a > write-protected floppy disk (with a clean copy of DOS on it) and running > the virus checking program directly from that floppy. But people seldom > do that, so the stealth technology is a worthwhile one for virus creators > to pursue. > > The second is called "Polymorphic" viruses. These are viruses which > contain a tiny encryption/decryption engine. The great thing about > polymorphic viruses is that they encrypt themselves with a different key > each time they replicate (make a new copy of themselves). The small > amount of virus bootstrap code which is not encrypted is changed in each > replication by dispursing random NOP's throughout the virus boostrap code. > Thus each sample of polymorphic virus looks completely different to > virus checking programs. The virus checking programs cannot use > "signature" byte strings to detect polymorphic viruses. > > I have seen something called D.A.M.E., also known as Dark Avenger > Mutation Engine. This is a freeware polymorphic library/kernel/toolkit > which allows anyone to take an ordinary virus and wrap it in a polymorphic > shell. Thus each new copy of the virus will look completely different > as it replicates. D.A.M.E. is a great toolkit for those who want to > release new viruses but don't have the skills to write a virus from > scratch. DAME works very well with Turbo Assembler and MASM. > I believe that DAME II will be coming out sometime this spring. At > least that is what the author has promised. Among the new features > will be more powerful encryption, stealth capabilities, and compatibility > with Stacker and DR DOS compressed file systems. I have read that the > author of DAME and DAME II will be coming out with a Virus Construction > Set, which will allow point-n-click building of new viruses using > object oriented techniques. It works sort of like a Mr. Potatohead, > you point and click on the parts/modules you want and it builds it for > you. You select the replication method, stealth capability, > polymorphism, and payload module (there are several payloads, varying > from playing music and showing graphics, to printing a text message on > screan, to complete wipe out of the HD). The really wonderful thing > is that you will be able to build your own modules and link them into > the virus. I am sure a flourishing of third-party modules will occur. > > With the VCS, a 9 year old can build a competely new virus just by > pointing, clicking, and dragging, popping up windows and choosing options. > > My oh my, aren't we in for fun times ahead... > > Thug

3 2

LIST RULES
by ssandfort＠attmail.com 19 Feb '93

19 Feb '93

_________________________________________________________________ FROM THE VIRTUAL DESK OF SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In a recent post, John Gilmore wrote: "Keith, Kenneth . . . I am uninterested in censorship of discussion of *any* topic on mailing lists through my machine . . . the machine is attached via a worldwide network that explicitly promises not to censor any traffic UNLESS AND UNTIL a court of law --not you -- has decided that that traffic is actually illegal." Because I agree COMPLETELY with what John wrote, I'm somewhat miffed at him for his seeming lack of constituency. Recently, I posted a notice on this list about a software business contact I have in South East Asia. John sent me a terse note asking me not to "advertise" on the list. I was a bit surprised at his response for several reasons. First, a founding Cypherpunk regular, Tim May, suggested I post my question the list when I asked him if he knew anyone working on recreational software. Second, I have had several polite enquiries from list members who where interested in what I posted. Finally, nobody else was offended enough to complain. I sent a respectful note to John asking him, among other things, if I had violated some prohibition of which I was unaware. John's response was: "Please consider this message a prohibition against advertising. Apparently nobody else on the list needed to hear it, except you, since you are the first person to abuse the list in this way." Now I fully agree that it's John's ball, and I will play by his rules, but I find it hard to reconcile John's public tolerance with his private prohibition. Does ANYONE else feel abused? I hope not. What do others on this list think about "commercial" postings? I will not "advertise" on the list as long as John prohibits it. But I sincerely hope his prohibition does not discourage others from discussing the issues it raises. I would like to hear what the rest of you think. S a n d y ssandfort(a)attmail.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Trapdoors
by dmandl＠shearson.com 18 Feb '93

18 Feb '93

> _________________________________________________________________ > FROM THE VIRTUAL DESK OF SANDY SANDFORT > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [...] > Isn't it possible that the Feds have already compromised > Intel or MicroSoft? Is there some way to be sure that the new > 486 chip running your computer isn't recording each PGP or RSA > private key you generate? > > S a n d y ssandfort(a)attmail.com > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You may be right. For example, I know for a fact that all 386/486 chips trap files with the string "Liz" in them--this is so that the NSA can capture and read love letters from me to my girlfriend. I have been getting around this by changing my pet names for her constantly, and placing the string "Liz" at random points in massive junk files to waste the spooks' disk space. Inconvenient, but it works. Ciao. --Dave.

1 0

Re: Trapdoors
by pmetzger＠shearson.com 18 Feb '93

18 Feb '93

> From: ssandfort(a)attmail.com > > How do we know the proposed legislation wasn't just a smoke > screen? Isn't it possible that the Feds have already compromised > Intel or MicroSoft? Is there some way to be sure that the new > 486 chip running your computer isn't recording each PGP or RSA > private key you generate? If you could actually build a 486 such that it was capable of this task, you are a far better chip designer than any I know of. Not merely are we to expect that the 486 is capable of recording anything, but we are also to expect that its capable of solving a computationally undecidable problem as well. Perry

1 0