September 2012 - cypherpunks-legacy

Secrecy News -- 09/13/12
by Eugen Leitl 13 Sep '12

13 Sep '12

----- Forwarded message from Steven Aftergood <saftergood(a)fas.org> -----

1 0

Crack in Internet's foundation of trust allows HTTPS session hijacking
by Eugen Leitl 13 Sep '12

13 Sep '12

http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/?utm_s… Crack in Internet's foundation of trust allows HTTPS session hijacking Attack dubbed CRIME breaks crypto used to prevent snooping of sensitive data. by Dan Goodin - Sep 13, 2012 7:47 am UTC Black Hat National Security A screen shot from a video showing CRIME decrypting the contents of an encrypted cookie used to authenticate a dropbox.com user account. Researchers have identified a security weakness that allows them to hijack web browser sessions even when they're protected by the HTTPS encryption that banks and ecommerce sites use to prevent snooping on sensitive transactions. The technique exploits web sessions protected by the Secure Sockets Layer and Transport Layer Security protocols when they use one of two data-compression schemes designed to reduce network congestion or the time it takes for webpages to load. Short for Compression Ratio Info-leak Made Easy, CRIME works only when both the browser and server support TLS compression or SPDY, an open networking protocol used by both Google and Twitter. Microsoft's Internet Explorer, Google's Chrome and Mozilla's Firefox browsers are all believed to be immune to the attack, but at time of writing smartphone browsers and a myriad of other applications that rely on TLS are believed to remain vulnerable. CRIME is the latest black eye for the widely used encryption protocols, which act as the Internet's foundation of trust by encrypting traffic that flows over open networks and cryptographically proving websites such as Gmail are really operated by Google rather than criminal hackers or state-sponsored spies. The specter of a new attack that could subvert one of the only widely available protections preventing the interception of sensitive e-mails and web transactions, follows revelations that both Iran and China have actively worked to defeat it so they could spy on its citizens. "The CRIME attack is the nation-state attack," Matthew Green, a professor specializing in cryptography at Johns Hopkins University, told Ars. "It's not something that some hackers are going to do when you're sitting in Starbucks. It's really something that Iran is going to do to try to find dissidents or China is going to do for the same reason. And it's a big deal because of that, especially if Google and Twitter are the ones who are vulnerable." Representatives from Google, Mozilla, and Microsoft said their companies' browsers weren't vulnerable to CRIME attacks. Both Google and Mozilla released patches after the weaknesses were privately reported by Juliano Rizzo and Thai Duong, the researchers who devised the CRIME exploits. Internet Explorer was never vulnerable because it never supported SPDY (pronounced "speedy") or the TLS compression scheme known as Deflate. That still leaves open the possibility that a raft of smaller browsers are susceptible. This webpage maintained by self-described "Web tinkerer" and Adobe employee Alexis Deveria says that SPDY is supported in beta versions of Opera and production versions of both Firefox and Chrome for Android, as well as the Android browser. Apple's Safari browser doesn't support SPDY, but its use of compression is unknown. The status of TLS compression in smaller browsers also remained unknown at time of writing. Rizzo told Ars that encryption schemes used in a variety of chat applications, virtual private networks, and other software may also be vulnerable. Even when a browser is vulnerable, an HTTPS session can only be hijacked when one of those browsers is used to connect to a site that supports SPDY or TLS compression. The Qualys SSL Labs page, which tracks the quality of sites that offer HTTPS protection, shows that services offered by Google and Twitter support SPDY. Ivan Ristic, director of engineering at security firm Qualys, told Ars that 42 percent of sites surveyed by his service support TLS compression. A demonstration video taken by Rizzo and Duong on Wednesday shows Github.com, Dropbox.com, and Stripe.com succumbing to the CRIME attack, although all three of those sites had disabled compression at time of writing, meaning they are no longer vulnerable. CRIME vs startups Both the GnuTLS and OpenSSL TLS implementations for clients and servers respectively support TLS, making it easy for developers and engineers to fold it into web servers. The chosen one Rizzo and Duong are the architects of a separate attack from last year that also defeated TLS protection. It was dubbed BEAST and was short for Browser Exploit Against SSL/TLS). Like that attack, compression-based exploits wield what cryptographers call a chosen plaintext attack on an encrypted session. The technique mixes clear-text data under the control of the attacker with the encrypted payload being targeted. By modifying the clear-text payload hundreds or thousands of times and watching how each one interacts with the encrypted data, an attacker can deduce its contents, usually character by character. Such attacks can be particularly useful against SSL, since the beginning of each web HTML request contains an authentication cookie with a secret key (which may look something like XS8b1MWZ0QEKJtM1t+QCofRpCsT2u). In a CRIME attack, the encrypted message is combined with attacker-controlled JavaScript that, letter by letter, performs a brute-force attack on the secret key. When it guesses the letter X as the first character of the cookie secret, the encrypted message will appear differently than an encrypted message that uses W or Y. Once the first character is correctly guessed, the attack repeats the process again on the next character in the key until the remainder of the secret is deduced. Once the session cookie is decrypted, hackers can exploit it to gain unauthorized access to the user account the session cookie is designed to authenticate. The process from start to finish takes "a few minutes," Rizzo said. Data compression reduces the number of bytes contained in a file or data stream by removing redundant information. CRIME forces a web browser to compress and encrypt requests that contain attacker-controlled data that is combined with the cookie secret. If one of the requests produces fewer encrypted network packets, that's an indication there's more redundancy in the request, and hence the attacker data and the secret data have more information in common. CRIME algorithms decrypt the session cookies by guessing their contents byte by byte. The attacks don't require any browser plugins, and the use of JavaScript isn't necessary, although it does make the brute-force attack faster. A side effect of compression, security experts have long known, is that it leaks clues about the encrypted contents. That means it provides a "side channel" to adversaries who have the ability to monitor the data. A research paper published in 2002 by John Kelsey looks eerily similar to CRIME, but only in retrospect. "I don't think anyone realized that this enables an attack on HTTP over TLS, or that an attacker could learn the value of secret cookies sent over a TLS-encrypted connection," a participant in this online discussion observed. "The paper looks at attacks on compression mainly in the abstract, rather than in the specific context of the web, and is pretty theoretical. So, CRIME (or Thomas Pornin's attack) is still a significant novel extension of these ideas." ("Pornin's attack" is a reference to an exploit described in this blog post, in which the well known cryptographer by that name correctly guessed how CRIME worked based on bare-bones clues offered in previous news coverage of the attack. Other speculation that proved to be correct is here.) Chain of fools Last year's BEAST attack worked only against an encryption mode known as cipher block chaining. That limitation allowed engineers to block attacks by using encryption algorithms such as RC4, which don't rely on the mode. There is no such restriction with compression attacks, so the only known way to block them is to disable TLS compression or apply a SPDY patch that's comparable to the one recently added to Chrome. Rizzo and Duong are scheduled to demonstrate CRIME on September 21 at the Ekoparty security conference in Buenos Aires. Although the attack no longer works on the three most popular browsers to connect to HTTPS-protected websites, CRIME is a potent reminder of the fragility of the protection of encryption. But it likely won't be the last. "It is easy to try the idea with a short script," Rizzo told Ars. "It's a practical attack against HTTPS and could be a starting point to attack other secure protocols. It's another powerful tool for attackers with access to your network." Story updated to add Safari details.

1 0

Что нужно знать для оперативного управления.
by "Что можно и что нельзя делегировать." 13 Sep '12

13 Sep '12

Приглашаем Вас принять участие в ТРЕНИНГЕ: СОВРЕМЕННЫЙ ЭФФЕКТИВНЫЙ РУКОВОДИТЕЛЬ 15 - 16 октября 2012 г. Санкт-Петербург ---------------------------------------------------------------------------------------- ПРОГРАММА МЕРОПРИЯТИЯ: 1. Компетентность руководителя. ╥ Основные техники деловой коммуникации. ╥ Использование знаний о типологии личности в руководстве подчиненными. ╥ Стили руководства. ╥ Методы экспресс-диагностики сотрудников. 2. Функции менеджера в организации. ╥ Основные функции менеджмента. ╥ Цель распределения функций. ╥ Пирамида навыков менеджера. Что нужно знать для оперативного управления. ╥ Понятие, основные виды и методы планирования. Планирование работы отдела (подразделения, фирмы). ╥ Взаимосвязь функций. Как расставлять приоритеты: иерархия ценностей и целей. ╥ За что платят менеджеру (зона ответственности). 3. Постановка целей, планирование, координация и организация работы подчиненных: ╥ Целеполагание как основа любой деятельности. ╥ Расстановка приоритетов в соответствии с поставленными целями. ╥ Роль менеджера в трансформации целей организации в индивидуальные цели подчиненных. ╥ Основы профессиональной деятельности управленца. Чем именно мы управляем. Что такое управление. 4. Управление персоналом. ╥ Делегирование полномочий, ответственность и полномочия. Правила и принципы делегирования: кому, когда, как и зачем. ╥ Что можно и что нельзя делегировать. ╥ Организация повседневной деятельности сотрудников. Как поставить подчиненным задачу? Использование внешних и внутренних ресурсов. Правила, отчетность, стандарты и результаты. ╥ Организация и координация процесса работы отдела. ╥ Чего ждут от нас, и что ждем мы (подчиненные, коллеги и руководство). ╥ Лидер и менеджер √ в чем различие. ╥ Как не стать заложником подчиненных. ╥ На чьей стороне играем. ╥ Эффективные методы руководства и взаимодействия с подчиненными. Стили управления. Матрица ситуационного руководства. 5. Организация исполнения. ╥ Пошаговая методика. ╥ Технологии постановки задач: инструктирование. ╥ Классификация задач сотрудников. 6. Управленческое взаимодействие с подчиненными по вопросам, находящимся за рамками их сферы деятельности. ╥ Методы управления в подобных ситуациях. ╥ Способы определения и развития потенциала подчиненного. 7. Практика управления. ╥ Как оперативно получить обратную связь? ╥ Выявление сбоев и их причин. ╥ Информирование подчиненных (информационные тромбы?) ╥ Возврат и корректировка планов. ╥ Регулирование: аварийное и системное. ╥ Контроль повседневной деятельности подчиненных. ╥ Координация деятельности подчиненных на основе показателей деятельности. ╥ Системная связь между планированием, контролем и мотивацией. 8. Способы разрешения проблемных ситуаций с подчиненными. 9. Мотивация подчиненных: практические способы и методы. ************************************************************* Зaнятия прoйдyт в цeнтрe Caнкт-Пeтeрбyргa в течение двyx днeй c 10:00 дo 18:00 c пeрeрывaми нa кoфe-брeйк и oбeд. Для пoлyчeния пoлнoй прoгрaммы и ycлoвий yчacтия cвяжитecь c нaми пo тeлeфoнy в Caнкт-Пeтeрбyргe: 8 [ код СПб ] 98-.6 8-2 -. 29

1 0

Отходы производства и потребления
by "Природоохранное законодательство" 13 Sep '12

13 Sep '12

1 0

Counter Threat-Finance Analyst
by Eugen Leitl 13 Sep '12

13 Sep '12

https://sjobs.brassring.com/1033/ASP/TG/cim_jobdetail.asp?SID=&jobId=255705… Req ID 244705BR Industry Job Title Counter Threat-Finance Analyst Standard Job Code/Title E2483:Intelligence Analyst Sr Required skills Place of performance is MacDill AFB, Tampa, FL (Primary); USCENTCOM AOR (Secondary) 5-7 years joint interagency intel-ops fusion and/or counter-threat experience in the CT, CTF, and/or CD/CN communities. Minimum 4 years prior military/government service required. Bachelorbs or Masterbs Degrees in a related field is desired, but not necessary. OR 5-7 commercial anti-money laundering, financial investigation, or export compliance experience is acceptable in lieu of 2-4 years of joint interagency intel-ops fusion experience.Minimum of 7 years of hands-on analysis experience in one or more relevant military or defense industry functional area Top Secret/Specialized Compartmented Information Security Clearance Position requires ability to perform OCONUS deployment to theatre of operations Desired skills Experience working CT, CTF or CD/CN analysis Language experience with Dari Pashtu Specific Job Description High paced environment within U.S. Central Command with requirement to deploy to USCENTCOM AOR locations such as Afghanistan and Dubai, UAE. The CTF Operations-Intelligence Analyst shall coordinate USCENTCOM Operations Directorate CTF activities throughout USCENTCOM area of responsibility (AOR). SMEs will deploy to the AOR to support Combined Joint Operations Area (CJOA) Commanders, Task Force Commanders, and Interagency threat finance cells. Analyst shall Plan, organize, and coordinate the CTF activities in USCENTCOM AOR, ensuring that CTF activities comply with legal and regulatory requirements and meets the Commander, Component Commanders, deployed Task Forces, and other USG agencies/departmentbs operational needs and directives. Experienced and motivated analysts with significant CTF and joint-interagency analytical and intel-ops fusion experience to work on the leading edge of combating Counter-Narco-Terror illicit finance at USCENTCOM. Analysts shall have a strong working knowledge of various DoD, CTF and LE action instruments and directives including, but not limited to: Direct Action (Title 10/50) influence operations; Executive Order 13224; Foreign Terrorist Organization Designation; Commerce Denied Entities/Persons List; UNSCR 1988/1989. Analysts shall be intimately familiar with intelligence sharing with law enforcement and Treasury Department and on the use of LE and Treasury Department information within DoD and intelligence frameworks, with awareness of judicial discoverability and financial intelligence. Analysts should also have financial investigatory/forensic accounting experience in non-traditional arenas including drug money laundering, Sharia-compliant banking, terrorist finance, informal and formal money transfer mechanisms (hawala), trade based value transfers, and parallel reconstruction. Knowledge of emerging alternative and mobile payment methods is also desired (Bitcoin, Secondlife, etc). Analyst should also have experience with recommending intelligence collection strategies. Place of performance: MacDill AFB, Tampa, FL (Primary); USCENTCOM AOR (Secondary) 84 hour work week anticipatedin Afghanistan, in CENTCOM AOR a 48 hour work week. A 1 year deployment for Afghanistan and CENTCOM AOR staff. Standard Job Description Provides analysis and research for industry, infrastructure, technology, country, geographic area, biographic and targeted vulnerability. Prepares assessments of current events based on the sophisticated collection, research and analysis of classified and open source information. Develops and maintains analytical procedures to meet changing requirements and ensure maximum operations. Collects data using a combination of standard intelligence methods and business processes. Security Clearance TS/SCI Typical Minimums Bachelors degree from an accredited college in a related discipline, or equivalent experience/combined education, with 5 years of professional experience; or 3 years of professional experience with a related Masters degree. Considered career, or journey, level. LMCareers Business Unit ESS0999 IS&GS-DEFENSE (S8200) Business Area Info Systems & Global Sol Program GTL CNTPO Department 6222024:Intel Tech-ClientSite OTO3(OS) Job Class Intelligence Analysis Job Category Experienced Professional City MacDill Air Force Base State Florida Relocation Available No Work Schedule FLEX-Non-Standard 40 hour week Req Type Blue Sky Direct/Indirect Direct Shift First

1 0

[drone-list] Paul Rogers on drones
by Eugen Leitl 13 Sep '12

13 Sep '12

----- Forwarded message from francesca recchia <kiccovich(a)gmail.com> -----

1 0

Отходы производства и потребления
by "Природоохранное законодательство" 13 Sep '12

13 Sep '12

1 0

[drone-list] New article
by Eugen Leitl 13 Sep '12

13 Sep '12

----- Forwarded message from villa(a)ee.ucla.edu -----

1 0

[drone-list] End-Use Monitoring on Unmanned Aerial Vehicle Exports
by Eugen Leitl 13 Sep '12

13 Sep '12

----- Forwarded message from John Young <jya(a)pipeline.com> -----

1 0

Типография дает лучшие цены на полиграфию
by "ТИПОГРАФИЯ" 13 Sep '12

13 Sep '12

Фабрика печати АТАКУЕТ ценами и сроками Московский рынок И ПРЕДЛАГАЕТ - Лучшее в регионе соотношение цена-качество на полиграфию (календари, каталоги, журналы, ПОС, брошюры, папки, кашировка...) в т.ч.- эксклюзивная полиграфия (сложные книги, нестандартная упаковка) - Логистика - склад Москва (доставка до клиента) - Офис - Курская (можно приехать посмотреть образцы) - Машины - формат А1, А2, полный комплекс постпечатки Посчитайте Ваши заказы - Вас приятно удивят наши цены и сервис! Москва 495-589-76-12 Написать нам Вы можете тут www.письмо-онлайн.рф

1 0