HDTenEightyP/NetNews huggingface dataset:
From: kocherp@leland.Stanford.EDU (Paul Carl Kocher)
Subject: Update on security of new PKZIP (AV & encryption)
Organization: DSG, Stanford University, CA 94305, USA
Date: Thu, 7 Jan 93 06:42:30 GMT

Today I spoke with a representative of PKWARE about the
authenticity verification problems I reported yesterday,
but at the moment they appear to be quite busy with the
DPMI bugs and other troubles with the new release.  I
strongly suggested that they work with someone experienced
in cryptography when they try to fix the problem, but at
this point it remains unclear if the problem will be fixed
at all.

Just a few minutes ago I took a look at the encryption
feature in the new program, and noticed that three
changes have been made:

  -  The program now tries to crash debuggers, although
     this is trivial to defeat.

  -  The encryption header is now generated properly,
     using a loop that does addition/subtraction operations
     on the lowest few kilobytes of memory.  Although this
     random number generator is not cryptographically strong,
     optimized brute-force attacks (ala zipcrack) are no
     longer possible.

   - Instead of placing 2 bytes of the crc32 at the end of 
     the encryption header, there are now 11 pseudorandom 
     bytes followed by a single zero byte.  This change makes
     brute-force attacks impractical in archives containing 
     only one file.

In my opinion, the encryption algorithm is now properly implemented,
although its cryptographic strength remains unproven.

-- Paul Kocher
kocherp@leland.stanford.edu

________Paul C. Kocher, Box 13554, Stanford, CA 94309, 415/497-6589_________
kocherp@leland.stanford.edu (preferred), root@kocher.stanford.edu.  Contract
programming work sought (PC assembly, security, etc) -- write/call for info.
Newsgroups: comp.compression
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Did PKWare fix that famous 486 bug?
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 11 Jan 93 20:11:28 GMT

rdippold@cancun.qualcomm.com (Ron Dippold) writes:

> nevries@accucx.cc.ruu.nl (Nico E de Vries) writes:
> >In <bontchev.726428688@fbihh> bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> >>mine, so I am unable to check, but what the heck is the option '-('

> >:-) (or should that be :-( ). The -( options diables DPMI support. Many
> >of the bugs seem to be there (not all unfortunately). This is important
> >on 386/486 systems running QEMM, Windows or OS/2.

> Almost... actually DPMI disable is "-)".  "-(" uses "Slow MemCopy".  I
> assume that this is so you can force it not to DMA even if their
> workarounds don't work.

Naaww... I already read the documentation. Niko is indeed wrong, "-)"
is used to disable the DPMI, not "-(". The option "-(" is used exactly
as a workaround the famous '486 bug - they are saying so in the docs.
So, what did PKWare spend one year for???? To invent the option "-("
as a solution of that bug? To introduce half a dozen -really- serious
bugs (unlike the '486 bug which is not that serious and is not their
fault, after all)? Just recall those people that used to say "ah, yes,
PKWare indeed wants to produce a really good product, that's why they
don't want to release it. When they release it, it'll be a killer." A
killer, yes. For other people's data... :-((

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: comp.compression
From: rob@sound.demon.co.uk (Robert J Barth)
Subject: Re: PKZ204C (W04) error !
Reply-To: rob@sound.demon.co.uk
Distribution: world
X-Mailer: cppnews $Revision: 1.20 $
Organization: Sound & Vision BBS (UK) 0932 252323
Date: Tue, 12 Jan 1993 01:48:28 +0000

>Only if they hurry up a bit... Don't forget that they've spent the
>last year to fix only one bug (which they didn't fix anyway)... :-(

go on make me laugh, remind me which one this was....

-rob-

=----------------------------------.----------------------------------------=
| Nominal  : Rob Barth             | RJB Communications (+44) (0)932 253131 |
| InterNet : rob@sound.demon.co.uk | Sound & Vision BBS (+44) (0)932 252323 |
| FidoNet  : sysop, 2:254/14       |  The best UK BBS with a full UseNet &  |
| Nyx      : rbarth@nyx.cs.du.edu  | Internet Email feed. All hours/speeds. |
=----------------------------------.----------------------------------------=
From: hartman@ulogic.UUCP (Richard M. Hartman)
Newsgroups: comp.compression
Subject: Re: Saving disk space...
Date: 10 Jan 93 23:08:14 GMT
Organization: negligable

According to another thread here you may want to look into diet
instead of pklite.

Diet apparently hooks into the bios file open and can put text
files on a diet, as well as .exe files.  Much like stacker does.

problems: some virus scanners will choke.

note: I haven't tried it yet, but I plan to.

where: nic.funet.fi:/pub/msdos/utilities/filutl/diet144.zip


=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Blasting, bursting, billowing forth with	|
the power of ten billion butterfly sneezes,	|	-Richard Hartman	
Man, with his flaming fire,			|	hartman@uLogic.COM
has conquered the wayword breezes.		|
Newsgroups: comp.compression
From: robjung@world.std.com (Robert K Jung)
Subject: Re: ARJ 2.30 minor bug
Organization: The World Public Access UNIX, Brookline, MA
Distribution: comp
Date: Fri, 8 Jan 1993 13:08:18 GMT

mmy@vax5.cit.cornell.edu writes:

>There seems to be a minor problem with ARJ 2.30, if you include the same file
>twice in the file list (e.g. ARJ a test dummy dummy or ARJ a test d* dummy),
>ARJ gives an error of not able to find the file after it has compressed it!

After due consideration of this problem, it seems acceptable not to call
situations such as "ARJ a test dummy.bat dummy.bat" an error.  Since LHA
does not consider this wrong and since ARJ is styled after LHA, ARJ at the
next release will NO LONGER consider this an error.

Regards,
Robert K Jung
Newsgroups: comp.compression,comp.os.msdos.programmer,comp.archives.msdos.d,comp.binaries.ibm.pc.wanted
From: ts@uwasa.fi (Timo Salmi)
Subject: Re: ftp sites for C source code for CCITT T4 or T6, or JBIG
Followup-To: comp.compression
Organization: University of Vaasa, Finland
Date: Thu, 7 Jan 1993 05:51:33 GMT

-Subject: Re: Asking Timo to find programs
-To: harrisd@ll.mit.edu (David Harris)
-Date: Thu, 7 Jan 1993 07:45:18 +0200 (EET)
-From: ts@uwasa.fi

The original Subject: ftp sites for C source code for CCITT T4 or T6, or JBIG

>
> I'm looking for source code in C (or any other language) that implements,
> accurately, but not necessarily efficiently, the CCITT T4 and/or T6
> binary data compression algorithms or the JBIG compression algorithm.
> What I'd like to do is to compare the relative performance of those
> methods for binary images derived from astronomical images (CCD, etc.)
> of star fields.  Thanks if you can be of assistance!
>
> Dave Harris
>

Hello Dave,

While very much welcoming your question, this is typically something
that would be better asked on the news.  I have forwarded this reply
to
  comp.compression
  comp.os.msdos.programmer
  comp.archives.msdos.d
  comp.binaries.ibm.pc.wanted
with followups directed this time to
  comp.compression
since it seems to be nearest your subject.

   All the best, Timo

P.S.  I hope that you gentle users will understand that while I try
to be of help, there is a limit to what kind of services I have time
to provide you.  If you are looking for some program or code, I
would very much prefer that you ask publicly on the news after
emplying the standard FTP archives search methods Keith Petersen and
I ofter present for example in comp.archives.msdos.d.

Please do not get this wrong.  I still very much welcome all your
email.  But for practical reasons I have to draw your attention to
this aspect.  Else I am totally swamped.

..................................................................
Prof. Timo Salmi      Co-moderator of comp.archives.msdos.announce
Moderating at garbo.uwasa.fi anonymous FTP archives 128.214.87.1
Faculty of Accounting & Industrial Management; University of Vaasa
Internet: ts@uwasa.fi Bitnet: salmi@finfun   ; SF-65101, Finland
From: jang@acsu.buffalo.edu (Euee S. Jang)
Newsgroups: comp.compression
Subject: Question on Jpeg makefile.
Date: 11 Jan 93 22:10:30 GMT
Distribution: usa
Organization: UB

Subject: Inquiry on Jpeg makefile.

Hi. 
I am sorry if my mail bothers your work. I wish my mail is gone to
the proper person who can help me. 

Now, I am working for wireless network. For comparable reasons, I need
to use the JPEG in my research. I got the source. Also, in the sparc
station, the cjpeg and the djpeg files are already built in.

The problem is that I should modify the jpeg source file to get rid
of huffman coding in both cjpeg and djpeg. I think the modification
was done, but when I tried to make the executable file, the error
everytime came out like the following:

make: Fatal error: Don't know how to make target `jmemsys.c'

Because there are a few makefiles in source, I tried all, but failed.
I believe the proper makefile in Sparc station is `makefile.unix'.
If you know how I can get over the problem, please let me know.

I already read all the relating stuffs on Jpeg. The only problem is 
`makefile'. 

Thanks for reading. I appreciate your future help.

Erik Jang
jang@acsu.buffalo.edu
From: bartlett@oasys.dt.navy.mil (Scott W. Bartlett)
Newsgroups: comp.compression
Subject: PKzip 2.04c and Norton Anti-Virus
Keywords: PKZIP, NAV, Norton, Virus
Date: 5 Jan 93 17:27:54 GMT
Organization: Carderock Division, Naval Surface Warfare Center

FILE: PKZ204C.ZIP from wuarchive /pub/MSDOS_UPLOADS (1/5/93)

VSHIELD/SCAN v99: report no virus present.

Norton Anti-Virus (from Norton Desktop for Windows 2.0) dated 3/23/92:
                  reports variant of the Maltese Amb. virus in the
                  PKUNZIP, PKZIPFIX, and ZIP2EXE files.

ThunderByte/VirX/FluProt+: report no virus, but that non-standard exe-
                           headers are used in the files indicating a
                           programming bug or possible virus.
                           (note- I do not usually use these three virus
                            detectors so the correct answers may vary).
2
PKLITE 1.15/CHKLITE: Reports files compressed with PKLITE 1.20 (higher
                     version than generally available).

** POSSIBLE CAUSE ** PKLite 1.20 generating false-positive alarm in NAV.

** OTHER POSSIBILITES ** open for suggestions....
Newsgroups: comp.compression
From: dboer@let.rug.nl (Ale de Boer)
Subject: Re: *** WARNING *** PKZIP 2.04c is infected by a virus.
Organization: Faculteit der Letteren, Rijksuniversiteit Groningen, NL
Date: Tue, 5 Jan 1993 19:33:56 GMT

In article <3546@accucx.cc.ruu.nl> nevries@accucx.cc.ruu.nl (Nico E de Vries) writes:
>According to warning messages on wuarchive.wustl.edu the PKZIP 2.04c
>is a virus infected version. The virus detected is the "Maltese Amoeba"
>one.
This seems a hoax. I tested the download against four checkers, none
came up positive. I only got some complaints from f-prot about
self-modifying code in three of the programs. I have been contacted
by Ron Dippold, the uploader of the file, and according to him the
presumably false alarm may be due to a new version of PKLITE being
used for file compression.
>
>Unclear is if there is a real PKZIP 2.0x which has been infected 10
>seconds after release or that there is just a cracked new 1.93a version.
>PKWARE has promised to release a new version 5 jan so there might also be
>a real one. 
It is of course possible that some hacker overwrote Ron's upload. I
downloaded at 13:39 local time, and none of my scanners come up positive.

>Clearly some smart cracker have used their chance. It might take ages before
>everyone has a reliable PKZIP 2.0x. We can just hope the authenticy
>verification in PKZIP 2.0x will be strong enough to remove this
>problem in the future.
The file I got did display -AV codes while unpacking
-- 
________________________________________________________________
Ale de Boer, Department of English, University of Groningen
Oude Kijk in 't Jatstraat 26            E-mail: dboer@let.rug.nl
9712 EK  Groningen                      The Netherlands
From: rdippold@cancun.qualcomm.com (Ron Dippold)
Newsgroups: comp.compression
Subject: Re: PKZip 2.04c quick impressions (Screen problems)
Date: 8 Jan 93 01:23:24 GMT
Article-I.D.: cancun.rdippold.726456204
Organization: Qualcomm, Inc., San Diego, CA

kocherp@leland.Stanford.EDU (Paul Carl Kocher) writes:
>In article <1993Jan7.092414.17223@uwasa.fi> ts@uwasa.fi (Timo Salmi) writes:
>>scroll-back buffer you are faced with blank pages.  Perhaps 2.04
>>uses some kind of a weird mix of bios and direct screen writes.  A
>>frustrating feature.  I wish there were some method of turning off

>From the code it looked like there might be a way to disable this,
>though I have no idea what it might be.  (Might try ">con"...)

You might try enabling ANSI support... this might let the output go
through the normal cout-type routines.
-- 
f u cn rd ths, u cn gt a gd jb n cmptr prgrmmng.
Newsgroups: comp.compression
From: lenotre@cenatls.cena.dgac.fr (Jean-Francois Lenotre)
Subject: V.42bis CCITT standard
Originator: lenotre@bendy
Keywords: compression
Organization: Centre d'Etudes de la Navigation Aerienne
Date: Fri, 8 Jan 1993 15:34:03 GMT


Does anybody know where I can get the V.42bis CCITT standard ?

Thanks for any information.

+=========================================================================+
| Jean-Francois LENOTRE (MARBEN)                                          |
| CENA - Division 3A                 E-mail: lenotre@cenatls.cena.dgac.fr |
| 7 avenue Edouard Belin BP 4005     Phone:  (+33) 62 25 95 30            |
| 31055 Toulouse Cedex               Fax:    (+33) 62 25 95 99            |
| FRANCE                                                                  |
+=========================================================================+
From: madler@cco.caltech.edu (Mark Adler)
Newsgroups: comp.compression
Subject: Re: pkzip 2.04c / unzip v5.0 compatibility
Date: 7 Jan 1993 23:37:29 GMT
Organization: California Institute of Technology, Pasadena
NNTP-Posting-Host: sandman.caltech.edu


>> Now that you've made the diff code available, hopefully there will be a MSDOS
>> update of UNZIP50?

Already done--see a previous post by Timo Salmi.

Mark Adler
madler@cco.caltech.edu
Newsgroups: comp.compression,sci.crypt
From: mcastle@cs.umr.edu (Michael R Castle)
Subject: Re: ARJ "Security Envelopes" Broken
Date: Mon, 11 Jan 1993 23:27:31 GMT
Organization: University of Missouri - Rolla, Rolla, MO

In article <bontchev.726782688@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>
>You had to ask me first - it would save you to duplicate the effort...
>:-) They are -extremely- easy to forge, even easier than ZIP's... :-(
>The encryption is also -extremely- weak, -MUCH- wheaker than the one
>in PKZIP...

When ARJ first came out, I sent mail to Rob mentioning the problems with
exporting pkzip and advising that he may want to look into the legalities
of his using encryption in exportable software.  In his response, he 
indicated that he was just using simple xoring (which he expected to be
easily broken).  The _ONLY_ reason for encryption was to keep a casual
user from accidently private data.  Stopping crackers who are trying to
break into archives was not the point behind adding encryption to arj.

>
>Regards,
>Vesselin

regards,
mrc
-- 
Mike Castle .-=NEXUS=-.  Life is like a clock:  You can work constantly
  mcastle@cs.umr.edu     and be right all the time, or not work at all
S087891@UMRVMA.UMR.EDU   and be right at least twice a day.  -- mrc
    We are all of us living in the shadow of Manhattan.  -- Watchmen
Newsgroups: comp.compression
From: ts@uwasa.fi (Timo Salmi)
Subject: Re: *** WARNING *** PKZIP 2.04c is infected by a virus.
Organization: University of Vaasa, Finland
Date: Fri, 8 Jan 1993 10:05:23 GMT

In article <1993Jan7.213149.12431@let.rug.nl> dboer@let.rug.nl (Ale de Boer) writes:
>there has been a lot of criticism lately from archive moderators of
>the world writable dir at wuarchive; I for one think it's a good idea

Warnings, not so much criticisms.  I am simply try to advise the
users of the dangers.  I am not trying to change wuarchive policy. 
I have enough on my plate with Garbo. 

>an a nice way to exchange files fast and world-wide. yet you shoudl
>always check any file you download from wherever. as well as I trust

Quite right.  The only thing I want to point out is that the
wuarchive method is much more susceptible.  I repeat that I am not
rooting for anything in here, just giving the information as I see
it. 

>Keith Petersen and Timo Salmi, I still will check the files I download
>from my favourite sites. and so should everyone. as for those repeated
>warnings on files in wuarchive's upload dir, I never encountered a
>virus in any of them, not that I did not try ;-)

And you well should.  I've often pointed out that while precautions
is taken, no responsibility is assumed.  It is a very sensible thing
to do that you check the files.  I always do the same whenever I
download from SIMTEL20, or from any site. 

>once again, wuarchive admins do not check files in the uploads dir,
>it's your own job. criticizing them for providing the service they do
>is not justified in this case,

I have drifted away from comp.compression subjects.  Sorry fellow
readers. 

   All the best, Timo

..................................................................
Prof. Timo Salmi      Co-moderator of comp.archives.msdos.announce
Moderating at garbo.uwasa.fi anonymous FTP archives 128.214.87.1
Faculty of Accounting & Industrial Management; University of Vaasa
Internet: ts@uwasa.fi Bitnet: salmi@finfun   ; SF-65101, Finland
Newsgroups: comp.compression
From: dboer@let.rug.nl (Ale de Boer)
Subject: Re: I have uploaded PKZip 2.04c to wuarchive
Organization: Faculteit der Letteren, Rijksuniversiteit Groningen, NL
Date: Tue, 5 Jan 1993 17:51:44 GMT

In article <rdippold.726230186@cancun> rdippold@cancun.qualcomm.com (Ron Dippold) writes:
>I have uploaded PKZip 2.04c to wuarchive.wustl.edu in the
>pub/MSDOS_UPLOADS directory.  It's pkz204c.exe and pkz204c.txt.

Hi there,

Well, just downloaded this file this afternoon, check again later and
it had been deleted and some files have been uploaded stating that the
exe was infected. I already ran pkzip and after reading the alert ran
all my scanners, none of which turned up with anything at all, except
f-prot which accused a number of programs of usign self-modifying
code. However, neither McAfee's SCAN (99), nor TBSCAN (5.01), HTSCAN
(1.19), CATCHMTE (1.18 or something), or F-PROT for that matter
indicated Maltese Amoeba.
Of course it is possible that the file was overwritten with a virus
proggie after I downloaded it. The time-stamp of my file (set to
current time through ftp) is 13:39. Corresponding local time in The
States is 4:39 to 7:39 I guess; if you are unsure, execute a
telnet tyr.let.rug.nl daytime
command to get our local time here and you can check how much it
differs from your time. Without further evidence I find it pretty hard
to believe that this file has really been infected, at least when I
donwloaded it,

Best, Ale. (dboer@let.rug.nl)

-- 
________________________________________________________________
Ale de Boer, Department of English, University of Groningen
Oude Kijk in 't Jatstraat 26            E-mail: dboer@let.rug.nl
9712 EK  Groningen                      The Netherlands
Newsgroups: comp.compression
From: rdippold@cancun.qualcomm.com (Ron Dippold)
Subject: Re: ARJ 2.30 minor bug
Organization: Qualcomm, Inc., San Diego, CA
Distribution: comp
Date: Thu, 7 Jan 1993 19:38:56 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
>davidsen@ariel.crd.GE.COM (william E Davidsen) writes:
>> | There seems to be a minor problem with ARJ 2.30, if you include the same fil
>> | twice in the file list (e.g. ARJ a test dummy dummy or ARJ a test d* dummy),
>> | ARJ gives an error of not able to find the file after it has compressed it!
>>   Have you tried this with 2.39?

>Yup, the problem exists there too...

It's a known problem that's been in there a while.  The following is
speculation, but seems to fit the behavior.  The problem is with its
exclusion listing.  ARJ keeps a list of things that shouldn't be
packed.  For instance, if you do an "ARJ a test t*.*" you don't want
test.arj included in the list of things to be packed.  And with the
"d* dummy" you don't want dummy packed twice.  It knows it's already
packed dummy so it doesn't do it again.  However instead of just
noting that and silently ignoring it it reports it as a "file not
found."
-- 
If you don't believe in angels, you haven't heard me sing. If you don't believe
in demons, you haven't heard me snore.
From: bmartin@maemaster.eng.uci.edu (Bryan Martin)
Subject: My .zip archives are corrupt! (and it's my fault)
Newsgroups: comp.compression
Organization: University of California, Irvine
Keywords: help!
Date: 7 Jan 93 03:59:06 GMT

I did the stupidest thing, I transfer from mac to unix a lot, and I use
the utility UTOA to do it.  Well, I typed

utoa * .c

and didn't really mean to leave that space in there!  so now my .zip files from the same directory have had all their LF's replaced by CR's!!!

Does anybody out there know if I can do anything about this? or am I dead?

Thanks.

bmartin@maemaster.eng.uci.edu
owch!
From: nevries@accucx.cc.ruu.nl (Nico E de Vries)
Newsgroups: comp.compression
Subject: Re: PKZIP 2.04c is shipping...
Date: 5 Jan 93 17:53:02 GMT
Organization: Academic Computer Centre Utrecht

In <bontchev.726171229@fbihh> bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

>caeser@csd4.csd.uwm.edu (Robert Michael Trotter) writes:

>>  Do not trust or use any version of PKZIP other than 1.10,1.93, and 
>>  2.04c. All other versions currently circulating on BBS's are fakes.  
>>  These fake programs should be considered hostile and not be trusted, 
>>  they may contain viruses, trojans, or other tricks.  

>Seems about the right time for the virus writers to release yet
>another 1.93 hack and to call it "2.04c"... :-) Just kidding...

Since the PKZIP 2.04c is infected with the Maltese Amoeba virus someone
might have actually done this ..... :-(

>Regards,
>Vesselin

Nico E. de Vries  (nevries@cc.ruu.nl) |------------------*   AA   III  PPP
_ This text is supplied AS IS, no warranties of any kind |  A  A   I   P  P
| apply. No rights can be derived from this text. This   |  AAAA   I   PPP
| text is likely to contain spelling and grammar errors. |  A  A   I   P
*---------------------------( Donate to GreenPeace! )----*  A  A  III  P

To get (many) ==> LOSSLESS DATA COMPRESSION SOURCES <== get lds_10.zip at 
garbo.uwasa.fi /pc/programming. Make files for Borland C are included. 
Newsgroups: comp.compression