September 2012 - cypherpunks-legacy

Таможенный кодекс
by "Таможня" 27 Sep '12

27 Sep '12

Таможенный союз. Таможенное регулирование и контроль Таможенного Союза. Новое во внешнеэкономической деятельности. 08 - 09 октября 2012 г., Санкт-Петербург КРАТКАЯ программа: - Правовое регулирование ВЭД в рамках Таможенного союза. - Единый список мер таможенно-тарифного и нетарифного регулирования Таможенного союза; Единый Таможенный тариф; Единый таможенный кодекс Таможенного союза. - Особенности развития Таможенного союза в 2012 году. - Информация о состоянии дел по присоединению к ВТО стран Таможенного союза. - Соглашения ВТО, правила рассмотрения споров и т.п. информация.Внешнеторговые сделки и таможенное оформление в рамках ВТО - Компетенция органов Таможенного союза и процедуры принятия решений. - Таможенные процедуры Таможенного кодекса Таможенного союза. - Защита прав и интересов участников ВЭД в условиях Таможенного союза. - Новая редакция единой Товарной номенклатуры внешнеэкономической деятельности Таможенного союза (ТН ВЭД ТС). - Таможенное регулирование и контроль Таможенного союза. - Условия поставки. Инкотермс 90/2000. Новый Инкотермс 2010. - Нетарифные меры регулирования в Таможенном союзе. - Требования к лицам, осуществляющим деятельность в области таможенного дела. РЕГИСТРИРУЙТЕСЬ: Тел.: 8 (Петербург) 6Ч2 -- 2I ^ з..2

1 0

islamists webforums
by Karel Bílek 26 Sep '12

26 Sep '12

well, this list is already listed as terrorist by Jester, so why not I am looking for as much islamists webfora as possible (english is better)... either regular web or torspace/darknet/i2p/... it is good for both laughing at them + sort of testing the freedom of the internet, I donno the only one I really know in English is https://www.ansar1.info I found a few working in Arabic in here - http://www.ministrywarning.com/terrorists%20sites%20with%20Forumer.htm - but since I don't understand Arabic that well I can't really tell which are just regular Arabic forums ;( http://muslm.net/vb I would guess there will be lots of them on torspace, OTOH tor is so slow few islamists would really be using it... who knows

1 0

Re: [tor-talk] Tor and P2P
by Eugen Leitl 26 Sep '12

26 Sep '12

----- Forwarded message from Mike Perry <mikeperry(a)torproject.org> -----

1 0

Re: [tor-talk] Tor and P2P (Hidden SMS)
by Eugen Leitl 26 Sep '12

26 Sep '12

----- Forwarded message from Nathan Freitas <nathan(a)freitas.net> -----

1 0

EDRi-gram newsletter - Number 10.18, 26 September 2012
by Eugen Leitl 26 Sep '12

26 Sep '12

----- Forwarded message from EDRi-gram <edrigram(a)edri.org> -----

1 0

Fwd: [liberationtech] facebook sim card
by b. brewer 26 Sep '12

26 Sep '12

Interesting, interesting indeed. -------- Original Message -------- Subject: [liberationtech] facebook sim card Date: Wed, 26 Sep 2012 19:16:21 +0200 From: oli <oli(a)cryptosms.org> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> To: liberationtech(a)lists.stanford.edu hi there, i would be happy if anyone knows details or can point me somewhere to get to know more about the facebook sim card: http://fr.sitestat.com/gemplus/gemalto/s?tel_facebook&ns_type=pdf http://gigaom.com/mobile/facebook-sim-card-uses-sms-gemalto/ do you know of independent technical documents, academic papers or other good sources of information? fyi: this is one of the ways how facebook is getting access to new users that are using so called "simple phones", the ones without even j2me capabilites. and this user group is huge in many parts of the world. if you are interested in the general trajectory and technological set up of facebook how to reach more mobile phones, this text is really good: http://qz.com/5180/facebooks-plan-to-find-its-next-billion-users-convince-t… fb has developed solutions for all the different types of phones and uses the fast growing mobile telephony market e.g. in some african countries to lock-in users at their first contact with mobile media. thanks, oliver -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech

1 0

Fwd: [cryptography] Data breach at IEEE.org: 100k plaintext passwords.
by b. brewer 25 Sep '12

25 Sep '12

Wow. This is extremely stupid. -------- Original Message -------- Subject: [cryptography] Data breach at IEEE.org: 100k plaintext passwords. Date: Tue, 25 Sep 2012 13:39:34 -0400 From: Jeffrey Walton <noloader(a)gmail.com> Reply-To: noloader(a)gmail.com To: Randombit List <cryptography(a)randombit.net> In case anyone on the list might be affected... [Please note: I am not the "I' in the text below] http://ieeelog.com IEEE and the log story IEEE (Institute of Electrical and Electronics Engineers) is renowned as one of the world-leading organizations in standard development and the promotion of scientific and educational development within the Electrical, Electronics, Communications, Computer Engineering, Computer Science and related fields. The organization has more than 415,000 members all over the world, almost half of them in the United States [1]. By the nature of the organization, IEEE members are highly specialised individuals, many of them working in critical industry, governmental and military projects. Furthermore, it would be reasonable to assume, that an organization publishing leading security-focused publications [2], would value the privacy of its members, and be proactive in keeping their data secure. Due to several undoubtedly grave mistakes, the ieee.org account username and plaintext password of around 100,000 IEEE members were publicly available on the IEEE FTP server for at least one month. Furthermore, all the actions these users performed on the ieee.org website were also available. Separately, spectrum.ieee.org visitor activity is also publicly available. The simplest and most important mistake on the part of the IEEE web administrators was that they failed to restrict access to their webserver logs for both ieee.org and spectrum.ieee.org allowing these to be viewed by anyone going to the address ftp://ftp.ieee.org/uploads/akamai/ (closed on September 24 around 13:00 UTC, after I reported it). On these logs, as is the norm, every web request was recorded (more than 376 million HTTP requests in total). Web server logs should never be publicly available, since they usually contain information that can be used to identify users (sometimes even after the log was anonymized as in the "AOL incident" [3]). However, this case is much worse, since 411.308 of the log entries contain both usernames and passwords. Out of these, there seem to be 99.979 unique usernames. If leaving an FTP directory containing 100GB of logs publicly open could be a simple mistake in setting access permissions, keeping both usernames and passwords in plaintext is much more troublesome. Keeping a salted cryptographic hash of the password is considered best practice, since it would mitigate exactly such an access permission mistake. Also, keeping passwords in logs is inherently insecure, especially plaintext passwords, since any employee with access to logs (for the purpose of analysis, monitoring or intrusion detection) could pose a threat to the privacy of users. Log analysis It is certainly unfortunate this information was leaked out, and who knows who got it before it got fixed. Maybe there are access logs for the FTP so the damage can be assessed. Anyway, the affected users will probably have to be informed, since it is my understanding that the law requires it. In Europe there is Article 4 of the Directive on privacy and electronic communications (Directive 2002/58/EC) and its amendment (Directive 2009/136/EC). In the US, 46 states seem to have similar requirements [4]. While the cause of the data breach has been solved, one must point out the value of this dataset from a research perspective. It is rare that researchers gain access to such rich datasets. Various ethical and privacy-related considerations must be evaluated before such datasets can be publicly released. Deciding on how to anonymize the data is no easy challenge. Simply excluding any information making users directly identifiable is not enough, as past dataset releases have shown that some users can still be pinpointed. This resulted in lawsuits in the case of Netflix [5] and AOL [6], or the withdrawal of the data, like in the recent Wikipedia case [7]. For this reason, companies such as Google prefer to keep such data for study by internal researchers and do not release it to the public [3]. Furthermore, some companies release data to a trusted researcher with the condition to remain anonymous, like an unnamed European mobile phone operator did for Albert-LC!szlC3 BarabC!si [8]. This means academic researchers working in such fields as Information Retrieval have limited access to fresh real-world data, being at a disadvantage to their industrial counterparts. For these reasons, I cannot not give in to the urge to perform a basic analysis of this serendipitously acquired data, although I acknowledge this might be ethically dubious. However, I did not, and plan not to release the raw log data to anyone else. Data overview Log data time span: 01/Aug/2012:20:46:28 +0000b to 18/Sep/2012:08:47:17 +0000 Total number of log entries: 376.021.496 log entries for ieee.org: 301.319.566 log entries for spectrum.ieee.org: 74.701.930 log entries with password details: 411.308 (of which 17.157 are password reset requests and have no username field) ... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

Fwd: [cryptography] Preemptive compromise of Apple ID accounts
by b. brewer 23 Sep '12

23 Sep '12

-------- Original Message -------- Subject: [cryptography] Preemptive compromise of Apple ID accounts Date: Sun, 23 Sep 2012 20:26:42 +1200 From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> To: cryptography(a)randombit.net I just got email from Apple asking me to confirm setting up a rescue email address for my Apple ID account (I haven't owned any Apple products since the IIe). It's the real thing from Apple, not a phishing email. So it looks like attackers have gone beyond social engineering access to Apple accounts and are pre-emptively creating mechanisms for access on the off chance that the target may at some point become an Apple account user who can then be exploited. That's pretty sophisticated forward planning. Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

Re: [Freedombox-discuss] [ZS] ZS reboot seed
by Eugen Leitl 23 Sep '12

23 Sep '12

----- Forwarded message from Bryce Lynch <virtualadept(a)gmail.com> -----

1 0

Re: This Machine Kills Secrets
by John Young 22 Sep '12

22 Sep '12

Here are the book's contents, list of characters, and index: http://cryptome.org/2012/08/greenberg-leaks-secrets.pdf Not a few in the book will regret talking to Greenberg and might seek revenge using cpunks wizardry and subterfuge against the author and Forbes. Smells of a smear by the capitalist fools. Pretty good Wired-level read, above average on the tech, but marred by the personal slop, authorial preening and evasion of inconvenient truth which are now obligatory among craven journalists running scared of their salacity-demanding fans, censorious lawyers and immoral publishers. While that is not news here, Greenberg managed to breach defenses by MTMing targets induced to finger one another. Personal stuff allegedly revealed by Greenberg's "characters" Tim May, John Gilmore, Phil Zimmermann and Mudge, for example, might arouse gossip-loving readers to hoot and holler. Formulaic padding about WikiLeaks and hangers-on is rancid recycling still being massively churned to entice rabid book sellers and advertizers sustaining Forbe's fortune. At 10:01 PM 9/18/2012, you wrote: >Lotsa Cypherpunk stuff in there, apparently. Anyone talk to this guy? > >Reward with dollars (ie, buy)? Or does information in this case want to be >free? If the former, no doubt I'll be buying in cash. > >-TD

3 4