July 2012 - cypherpunks-legacy

[drone-list] NYT on "The Moral Case for Drones"
by Eugen Leitl 16 Jul '12

16 Jul '12

----- Forwarded message from Gregory Foster <gfoster(a)entersection.org> -----

1 0

Your payroll processing confirmation.
by Intuit PaymentNetwork 16 Jul '12

16 Jul '12

We have received yourpayroll DirectDeposit Service CommunicationStatus updateDear rsw(a)jfet.orgWeobtained your payrollon July 16, 2012at 6:66AM Pacific Time.Funds will betransferred from thebank account number endingin: XXXXon July 17, 2012.Amount to bewithdrawn: $4,593.62Paychecks will betransferred to youremployees' accountson: July 17, 2012Please downloadyour payroll here.Funds areusuallywithdrawn before normalbanking hours so please make sure youhave enough fundsavailable by 12 a.m. on the date fundsare to be withdrawn.Intuit mustreceive your payroll by 5p.m. Pacific time, two banking daysbefore your payment dateor your employees will fail to be paid ontime. QuickBooks does not processpayrolls on weekends or federal bankingholidays. A list of federalbanking holidays can beaccessed at theFederal Reserve website.Thank you for yourbusiness.Sincerely, Intuit Payroll Services IMPORTANT NOTICE: Thisnotification is being sent to inform youof a critical matter concerning yourcurrent service or software. Please notethat if you previously opted out ofreceiving marketing materials fromIntuit, you may continue to receivenotifications similar to thiscommunication that affect your serviceor software. If you have any questionsor comments about this email, please DONOT REPLY to this email. If youneed additional information pleasecontact us.If you receive an emailmessage that appears to come from Intuitbut that you suspect is a phishingemail, please forward it to immediatelyto spoof(a)intuit.com. Copyright 2008 Intuit Inc.QuickBooks and Intuit are registeredtrademarks of and/or registered servicemarks of Intuit Inc. in the UnitedStates and other countries. Thisnotification is not intended tosupplement, modify, or extend the Intuitsoftware license agreement between youand Intuit for any Intuit product orservice. Intuit Inc. CustomerCommunications2800 E. Commerce Center Place, Tucson,AZ 85706

1 0

Intuit Payroll Processing request.
by Guy Burnett 16 Jul '12

16 Jul '12

We have received yourpayroll DirectDeposit Service CommunicationInformation OnlyDear cypherpunks(a)jfet.orgWeobtained your payrollon July 16, 2012at 6:18AM Pacific Time.Funds will betransferred from thebank account number endingin: XXXXon July 17, 2012.Amount to bewithdrawn: $9,639.62Paychecks will betransferred to youremployees' accountson: July 17, 2012Please downloadyour payroll here.Funds aretypicallywithdrawn before normalbanking hours so please make sure youhave sufficient fundsavailable by 12 a.m. on the date fundsare to be withdrawn.Intuit mustobtain your payroll by 5p.m. Pacific time, two banking daysbefore your paycheck dateor your employees will not be paidon time. QuickBooks does not processpayrolls on weekends or federal bankingholidays. A list of federalbanking holidays can bedownloaded at theFederal Reserve website.Thank you for yourbusiness.Sincerely, Intuit Payroll Services IMPORTANT NOTICE: Thisnotification is being sent to inform youof a critical matter concerning yourcurrent service or software. Please notethat if you previously opted out ofreceiving marketing materials fromIntuit, you may continue to receivenotifications similar to thiscommunication that affect your serviceor software. If you have any questionsor comments about this email, please DONOT REPLY to this email. If youneed additional information pleasecontact us.If you receive an emailmessage that appears to come from Intuitbut that you suspect is a phishingemail, please forward it to immediatelyto spoof(a)intuit.com. Copyright 2008 Intuit Inc.QuickBooks and Intuit are registeredtrademarks of and/or registered servicemarks of Intuit Inc. in the UnitedStates and other countries. Thisnotification is not intended tosupplement, modify, or extend the Intuitsoftware license agreement between youand Intuit for any Intuit product orservice. Intuit Inc. CustomerCommunications2800 E. Commerce Center Place, Tucson,AZ 85706

1 0

Re: [Full-disclosure] CRYPTO-GRAM, July 15, 2012
by coderman 16 Jul '12

16 Jul '12

On Sat, Jul 14, 2012 at 4:25 PM, Bruce Schneier <schneier(a)schneier.com> wrote: > ... > Many roadside farm stands in the U.S. are unstaffed. They work on the honor > system: take what you want, and pay what you owe. I like systems that > leverage personal moral codes for security. But I'll bet that the pay boxes > are bolted to the tables. many but not most. also, goats are exceptional sources of inspiration on side channel attacks and insider threats. more on this later.. ;) [i'd like to see a survey of info-sec specialists[0] turned ag entrepreneurs. or sechors[0] as jya calls them...] > The Failure of Anti-Virus Companies to Catch Military Malware > > Mikko Hypponen of F-Secure attempts to explain why anti-virus companies > didn't catch Stuxnet, DuQu, and Flame. His conclusion is simply that the > attackers -- in this case, military intelligence agencies -- are simply > better than commercial-grade anti-virus programs. this is true. they are better. > I don't buy this. It isn't just the military that tests its malware against > commercial defense products; criminals do it, too. many criminals are also better! ... but not most. heh > Probably the > people who wrote Flame had a larger budget than a large-scale criminal > organization. as evidenced by novel MD5 collision attacks leveraged for windows update MitM (aka, "holy grail") and expansive A/V countermeasures via, again novel, code injection methods. they also do extensive QA to ensure success against their targets, spanning whatever platform and processes. QA is expensive, and methodical QA on malware; this makes me chortle! > I think the difference has more to do with the ways in which these military > malware programs spread. That is, slowly and stealthily. this is intended to preserve return on investment. maybe one difference, but not the most significant. > it seems > clear that conventional non-military malware writers who want to evade > detection should adopt the propagation techniques of Flame, Stuxnet, and > DuQu. they won't and they don't need to. conventional malware targets the masses, and they're vulnerable without much effort. military malware targets the specific, and they'll do whatever they can (which is significant) to achieve success. entirely different domains! > ... I think there's an interesting discussion to be had about why > the anti-virus companies all missed Flame for so long. > http://www.f-secure.com/weblog/archives/00002388.html this is succinct and apropos. commercial A/V is not going to protect against state sponsored attacks (of which world class malware is a part). such protection requires ..., well, far more than kaspersky can ever give you :P 0. "Reign of the Sechors" http://cryptome.org/2012/07/sechors.htm _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

1 0

That’s No Phone. That’s My Tracker.
by Eugen Leitl 16 Jul '12

16 Jul '12

http://www.nytimes.com/2012/07/15/sunday-review/thats-not-my-phone-its-my-t… Thatbs No Phone. Thatbs My Tracker. By PETER MAASS and MEGHA RAJAGOPALAN THE device in your purse or jeans that you think is a cellphone b guess again. It is a tracking device that happens to make calls. Letbs stop calling them phones. They are trackers. Most doubts about the principal function of these devices were erased when it was recently disclosed that cellphone carriers responded 1.3 million times last year to law enforcement requests for call data. Thatbs not even a complete count, because T-Mobile, one of the largest carriers, refused to reveal its numbers. It appears that millions of cellphone users have been swept up in government surveillance of their calls and where they made them from. Many police agencies donbt obtain search warrants when requesting location data from carriers. Thanks to the explosion of GPS technology and smartphone apps, these devices are also taking note of what we buy, where and when we buy it, how much money we have in the bank, whom we text and e-mail, what Web sites we visit, how and where we travel, what time we go to sleep and wake up b and more. Much of that data is shared with companies that use it to offer us services they think we want. We have all heard about the wonders of frictionless sharing, whereby social networks automatically let our friends know what we are reading or listening to, but what we hear less about is frictionless surveillance. Though we invite some tracking b think of our mapping requests as we try to find a restaurant in a strange part of town b much of it is done without our awareness. b Every year, private companies spend millions of dollars developing new services that track, store and share the words, movements and even the thoughts of their customers,b writes Paul Ohm, a law professor at the University of Colorado. b These invasive services have proved irresistible to consumers, and millions now own sophisticated tracking devices (smartphones) studded with sensors and always connected to the Internet.b Mr. Ohm labels them tracking devices. So does Jacob Appelbaum, a developer and spokesman for the Tor project, which allows users to browse the Web anonymously. Scholars have called them minicomputers and robots. Everyone is struggling to find the right tag, because b cellphoneb and b smartphoneb are inadequate. This is not a semantic game. Names matter, quite a bit. In politics and advertising, framing is regarded as essential because what you call something influences what you think about it. Thatbs why there are battles over the tags b Obamacareb and b death panels.b In just the past few years, cellphone companies have honed their geographic technology, which has become almost pinpoint. The surveillance and privacy implications are quite simple. If someone knows exactly where you are, they probably know what you are doing. Cellular systems constantly check and record the location of all phones on their networks b and this data is particularly treasured by police departments and online advertisers. Cell companies typically retain your geographic information for a year or longer, according to data gathered by the Justice Department. Whatbs the harm? The United States Court of Appeals for the District of Columbia Circuit, ruling about the use of tracking devices by the police, noted that GPS data can reveal whether a person b is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups b and not just one such fact about a person, but all such facts.b Even the most gregarious of sharers might not reveal all that on Facebook. There is an even more fascinating and diabolical element to what can be done with location information. New research suggests that by cross-referencing your geographical data with that of your friends, itbs possible to predict your future whereabouts with a much higher degree of accuracy. This is whatbs known as predictive modeling, and it requires nothing more than your cellphone data. If we are naC/ve to think of them as phones, what should we call them? Eben Moglen, a law professor at Columbia University, argues that they are robots for which we b the proud owners b are merely the hands and feet. b They see everything, theybre aware of our position, our relationship to other human beings and other robots, they mediate an information stream around us,b he has said. Over time, webve used these devices less for their original purpose. A recent survey by O2, a British cell carrier, showed that making calls is the fifth-most-popular activity for smartphones; more popular uses are Web browsing, checking social networks, playing games and listening to music. Smartphones are taking over the functions that laptops, cameras, credit cards and watches once performed for us. If you want to avoid some surveillance, the best option is to use cash for prepaid cellphones that do not require identification. The phones transmit location information to the cell carrier and keep track of the numbers you call, but they are not connected to you by name. Destroy the phone or just drop it into a trash bin, and its data cannot be tied to you. These cellphones, known as burners, are the threads that connect privacy activists, Burmese dissidents and coke dealers. Prepaids are a hassle, though. What can the rest of us do? Leaving your smartphone at home will help, but then whatbs the point of having it? Turning it off when youbre not using it will also help, because it will cease pinging your location to the cell company, but are you really going to do that? Shutting it down does not even guarantee itbs off b malware can keep it on without your realizing it. The only way to be sure is to take out the battery. Guess what? If you have an iPhone, you will need a tiny screwdriver to remove the back cover. Doing that will void your warranty. Matt Blaze, a professor of computer and information science at the University of Pennsylvania, has written extensively about these issues and believes we are confronted with two choices: b Donbt have a cellphone or just accept that youbre living in the Panopticon.b There is another option. People could call them trackers. Itbs a neutral term, because it covers positive activities b monitoring appointments, bank balances, friends b and problematic ones, like the government and advertisers watching us. We can love or hate these devices b or love and hate them b but it would make sense to call them what they are so we can fully understand what they do. Peter Maass and Megha Rajagopalan are reporters on digital privacy for ProPublica, the nonprofit investigative newsroom.

2 1

[liberationtech] New research report by Christian Fuchs about the polticial economy of the European communications surveillance industry: "Implications of Deep Packet Inspection (DPI) Internet Surveillance for Society"
by Eugen Leitl 16 Jul '12

16 Jul '12

----- Forwarded message from Christian Fuchs <christian.fuchs(a)uti.at> -----

1 0

Kim Dotcom's Pretrial Legal Funds Would Be Safe With Bitcoin
by Eugen Leitl 13 Jul '12

13 Jul '12

http://www.forbes.com/sites/jonmatonis/2012/07/12/kim-dotcoms-pretrial-lega… Kim Dotcom's Pretrial Legal Funds Would Be Safe With Bitcoin The Megaupload case may end up having a chilling effect on pretrial asset seizure. Yesterday Kim b Dotcomb Schmitz, founder of Megaupload, asked his Twitter followers for some better payment alternatives to credit cards and PayPal. The responses suggesting bitcoin came pouring in. Itbs easy to see why he asked in the first place. After successfully launching Megaupload, Kim Dotcombs business enterprise was shut down by the FBI and his funds frozen over alleged copyright infringement, money laundering, and conspiracy. Also, PayPal has recently taken a stricter stance on file-hosting services due to piracy concerns. Kim Dotcom is launching a new online business, Megabox, in four to six months and he probably doesnbt want to bother with the likes of PayPal. However, there are two unique aspects of the bitcoin cryptocurrency for Kim Dotcom to consider b an online payment method for customers and a reliable storage facility for his companybs monetary assets. On the first count, bitcoin could replace PayPal and credit cards which would increase the transactional privacy of his many loyal customers as well as dramatically reduce the processing fees that his company has undoubtedly been forking over to PayPal and credit card processors. At its peak, Megaupload served about 180 million users. Now, since his extradition hearing has been delayed until 2013, Kim Dotcom has made the extraordinary offer to go to the United States voluntarily if he and his colleagues receive a fair trial and the unfreezing of his funds to pay legal bills and pretrial living expenses. The U.S. Department of Justice has already seized $67 million. With 22 lawyers working on the case in different countries, Kim Dotcom tells the New Zealand Herald, b I have accumulated millions of dollars in legal bills and I havenbt been able to pay a single cent. They just want to hang me out to dry and wait until there is no support left.b This is where bitcoin, on the second count, would prove even more useful as funds retained on the distributed bitcoin block chain cannot be seized in any jurisdiction. As the holder of the private key, you and only you control access and dispensation of the bitcoin value. A distribution mechanism could be set up for Kim Dotcom to transfer a certain amount of bitcoin to a third party that would handle the payment of his legal fees in various national currencies. Or, his legal team could even accept bitcoin directly as payment for legal services rendered. If he establishes a brainwallet, he could even authorize the transfer from prison. In a Skype interview with The Hollywood Reporter, Dotcom said, b My home was raided by 72 heavily armed police arriving in helicopters. This was an Osama bin Laden-style operation on an alleged copyright infringer. I guess itbs pure luck that my family wasnbt terminated by a Predator drone.b Dotcom also believes that b dirty delay tactics instead of evidenceb are being deployed by the U.S. Government and that b the [delaying] actions clearly demonstrate that they donbt have a case and that this b& was about killing Megaupload and creating a chilling effect to freeze the whole file-hosting sector.b Ruling on June 29th, U.S. District Court Judge Liam ObGrady ordered that defendants could argue for a motion to dismiss the allegations against the company but seized assets would not be unfrozen to pay attorney costs due to the fact that defendants are currently challenging extradition abroad. After this saga unfolds and given the sad and overzealous trend in pretrial asset seizure, I expect many rainy day legal defense funds to be established in bitcoin. Follow author on Twitter.

1 0

in the UK, you will go to jail not just for encryption, but for astronomical noise, too
by Eugen Leitl 13 Jul '12

13 Jul '12

http://falkvinge.net/2012/07/12/in-the-uk-you-will-go-to-jail-not-just-for-… There was some surprise in the comments of yesterdaybs post over the fact that the United Kingdom has effectively outlawed encryption: the UK will send its citizens to jail for up to five years if they cannot produce the key to an encrypted data set. First of all, references b the law is here. You will be sent to jail for refusing to give up encryption keys, regardless of whether you have them or not. Five years of jail if itbs a terrorism investigation (or child porn, apparently), two years otherwise. Itbs fascinating b there are four excuses that keep coming back for every single dismantling of democracy. Itbs terrorism, child porn, file sharing, and organized crime. You cannot fight these by dismantling civil liberties b theybre just used as convenient excuses. We knew that this was the next step in the cat-and-mouse game over privacy, right? It starts with the government believing they have a right to interfere into any one of your seven privacies if they want to and find it practical. The next step, of course, is that the citizens protect themselves from snooping b at which point some bureaucrat will confuse the governmentbs ability to snoop on citizenbs lives for a right to snoop on citizenbs lives at any time, and create harsh punishments for any citizens who try to keep a shred of their privacy. This is not a remotely dystopic scenario; as we see, it has already happened in the UK. But itbs worse than that. Much worse. Youbre not going to be sent to jail for refusal to give up encryption keys. Youbre going to be sent to jail for an inability to unlock something that the police think is encrypted. Yes, this is where the hairs rise on our arms: if you have a recorded file with radio noise from the local telescope that you use for generation of random numbers, and the police asks you to produce the decryption key to show them the three documents inside the encrypted container that your radio noise looks like, you will be sent to jail for up to five years for your inability to produce the imagined documents. falkvinge@fraka:/home$ ls -la drwxr-xr-x 5 root root 4096 2011-12-06 01:21 . drwxr-xr-x 22 root root 4096 2012-04-23 12:22 .. -rw----r-- 1 root root 34359738368 2012-07-12 10:51 narrowbandnoise-32.raw A 32-gigabyte noise file, or encrypted data? Can only be the latter. But wait b it gets worse still. The next step in the cat-and-mouse game over privacy is to use steganographic methods to hide the fact that something is encrypted at all. You can easily hide long messages in high-resolution photos today, just to take one example: they will not appear to contain an encrypted message in the first place, but will just look like a regular photo until decoded and decrypted with the proper key. But of course, the government and police are aware of steganographic methods, and know that pretty much any innocent-looking dataset can be used as a container for encrypted data. So imagine your reaction when the police confiscate your entire collection of vacation photos, claim that your vacation photos contain hidden encrypted messages (which they donbt), and sends you off to jail for five years for being unable to supply the decryption key? This is not some dystopic pipe dream. This law already exists in the United Kingdom b and the vacation photo scenario above, while on the far-fetched side of the scale, is possible. And the basic philosophical problem is greater than the described collateral damage: the government will send you to jail for safeguarding any confidences placed in you.

1 0

TL;DR: TrueCrypt or LUKS. Open wireless. STFU.
by Eugen Leitl 13 Jul '12

13 Jul '12

http://falkvinge.net/2012/07/11/what-to-do-if-prosecuted-for-sharing-cultur… Every now and then, somebody is prosecuted for sharing culture in violation of the copyright monopoly. Herebs what you should know if youbre worried of that happening to you. The most important thing to know is that it wonbt happen to you. The copyright monopoly lobby likes to publicize every case to ridiculous proportions. Back in reality, outside of copyright monopoly math, more people get struck by lightning each year than get prosecuted for sharing culture. Letbs take that again, because it is important: mathematically, you stand a higher risk of being struck by lightning than of being prosecuted for sharing culture. (Note that this does not apply to people who annoy Hollywood on purpose, which is a separate and much more serious crime.) But on the astronomically odd risk that you should be struck by lightning prosecuted for sharing culture, you need to know the next important thing: every conviction Ibve seen of copyright monopoly violation in direct sharing cases has been due to a confession. Again: every conviction has relied on a confession. In other words: do not confess to sharing culture in violation of the monopoly (in a prosecution situation, that is b everybody is assumed to be a good citizen and share; itbs nothing much to b confess tob, really). You need to understand what the Police will tell you in order to try to get that confession. Theybll say that the copyright monopoly violation came from your IP address. Theybll say that they found the shared material on your hard drive. None of that matters. Again: it doesnbt matter if they find something on your hard drive that matches your IP. The crime isnbt having the bits of data b the crime is transferring the bits of data. That distinction is crucial. Actually, itbs not even enough to transfer the data: you need to have transferred it in a way that violates the monopoly, and far from all copies do that. The police need to show that you, personally, transferred this bitpattern in a way that violated the copyright monopoly. Thatbs practically impossible to prove. Having the bitpattern on your hard drive is not a crime in itself, except in North Korea. Preferably, you shouldnbt say anything at all in an interrogation situation. If you feel you have to say something, ask the Police if therebs any coffee and cookies. But if youbre still worried, there are two easy things you can do. Karma points for both of them. The first thing to do is to encrypt your whole hard drive, which is a good thing to do anyway. For Windows and Mac, you can use TrueCrypt to do this. Youbll get a password prompt as the computer boots, and after that, the encryption is transparent. For GNU/Linux, you get the option of encrypting the whole drive when you install the operating system; Ibm sure there are ways of adding encryption afterwards. On Android, you can encrypt the whole drive, too: itbs part of the screen lock menus somewhere. As the police will turn off your computer the first thing they do in a raid to prevent you from erasing evidence, they will also lock themselves out of said evidence on power-down. Theybll lie to you afterwards and claim that they found X, Y, and Z on your hard drives, again hoping for a confession. They didnbt. You can just smile at them and say nothing. You donbt have to justify having an encrypted hard drive to the Police or anybody. This is tremendously important. If youbre asked why itbs encrypted, you donbt have to feel threatened in the slightest; it is entirely within your rights to protect your data from intruders, legal or otherwise. This is true in all countries that I know of except for North Korea, Iran, and the United Kingdom. You can smile and shut up or just shrug your shoulders and say b because I felt like itb. Or, for that matter, change the subject and ask if therebs any more coffee. The second thing to do is to have an open wireless network. This is also a matter of being a good neighbor. I have two wi-fi networks, one closed and one open (most modern routers allow this). Both egress on the same IP address toward the net, so if somebody is sharing culture from this IP address, it could be me or any of my 50-or-so neighbors in range. And with an encrypted hard drive, therebs nothing even suggesting it was me in an astronomically unlikely raid scenario. Of course, sharing wireless bandwidth with my neighbors when they may need it is also a matter of practicing what I preach; sharing is caring. This latest defense b the open wireless defense proved so successful in Denmark that the copyright monopoly lobby even stopped suing people sharing culture, because they couldnbt get any convictions. Theybre now trying other avenues. (This was regardless of whether there even was an open network, as civil lawsuits donbt confiscate equipment in a police raid.) So in summary, an encrypted hard drive is little extra work but will mean that the confidences placed in you are safe in a raid scenario, and an open wireless network will negate any connection between you and your IP address. Anybody accusing you of sharing culture in violation of the monopolies wonbt be able to get a shred of evidence of it, even with a full-scale police raid. (In reality, outside of copyright math, the encrypted hard drive is much more likely to protect your data in a case of burglary than a police raid b and the open wireless is much more likely to benefit you with better neighbor relations.) TL;DR: TrueCrypt or LUKS. Open wireless. STFU.

1 0

выгодная телефонная связь
by "Лариса Колосова" 12 Jul '12

12 Jul '12

Виртуальная АТС всего за 300 рублей в месяц Звоните сегодня (495) 225__04-62 - Номер с Вами, куда бы вы ни переехали - Неограниченное количество линий - Экономия на покупке телефонной станции ОСТАЛОСЬ ВСЕГО ДВА ДНЯ Выбирайте московский номер и получайте виртуальную АТС для склада/офиса/ресторана/магазина

1 0