July 2018 - cypherpunks-legacy

Re: [tor-talk] Email provider for privacy-minded folk
by Mr Dash Four 05 Jul '18

05 Jul '18

> IMO, only stupid idiot doesn't use https with gmail. > That's why I think all talkings about gmail and beeing hacked is useless. > Let him set "Use always https" in the gmail settings, then log out, log in, change password and secure q/answer and that's all. > > This should be about Tor and Tor close stuff... > > > Game's over. > Indeed! I also employ one additional measure, which, admittedly, may not be to everyone's taste - I have all my browser/system/email/everything-else-you-care-to-name root certificate store wiped out clean! If I have to access a specific (https) site or access a new email account (by using secure pop/starttls, secure smtp or secure imap) I tend to get the site's certificate well in advance via other means (not through tor, obviously) and store it manually on my system for use by these programs. That way, I know that if the "certificate unrecognised" error pops up there is either 1) a new site I have never accessed before (most likely); or 2) someone is trying to use spoof certificates. The latter doesn't occur very often, though I've had this on a number of (rare) occasions when a tor exit node for example (prior to being banned in my torrc file and banished forever) tries to pretend to be my email server and gets caught out with its pants down, quite literally... This measure also prevents the likes of hacked/rogue CA's out there leaking certificates to people/organisations who use them for various criminal/unsavoury purposes. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

gov't to "anonymously" sharing cyberthreat data?
by Bradley Malin 05 Jul '18

05 Jul '18

Prof Dave - looks like UPenn is the facilitator. -brad http://informationweek.com/story/showArticle.jhtml?articleID=170000319 New Cybersecurity Center To Warn Law Enforcement Of Critical Infrastructure Attacks Aug. 24, 2005 Several businesses and organizations are testing a new process for anonymously sharing cyberthreat and attack data with their peers and government agencies without being subject to law-enforcement audits. By Larry Greenemeier InformationWeek With about 85% of the nation's critical infrastructure--energy utilities, manufacturing and transportation facilities, telecommunication and data networks, and financial services--in the private sector, it's no wonder there have been so many attempts to create services that keep these companies apprised of threats to their IT networks. But there's a problem: Most companies aren't eager to share their adventures in cybersecurity with each other or the government. Keeping this in mind, several Philadelphia-area businesses and organizations are testing out a new model called the Cyber Incident Detection & Data Analysis Center, or CIDDAC, which lets private- sector entities anonymously share cyberthreat and attack data with their peers and government agencies such as the Homeland Security Department and the FBI without that data being subject to law- enforcement audits. CIDDAC arose out of the deficiencies in the different organizations already working on cybersecurity, says Brad Rawling, a CIDDAC board member. A major sticking point that has hindered other attempts to create cyberattack-reporting infrastructures is the concern by businesses and other organizations that their proprietary information will be made public. Once information about a company's inner workings and security issues is documented by the government, that proprietary information may become fair game for Freedom Of Information Act requests by the press and public. CIDDAC circumvents this sticky situation because it's not a government entity and it doesn't provide specific information to members or law enforcement about the identity of the organization reporting a cyberattack. Participation in CIDDAC is voluntary. Since its April debut, the effort has been funded with about $100,000 in contributions from members, as well as $200,000 from the Homeland Security Department's Science and Technology Directorate. CIDDAC is searching for an additional $400,000 in funding to move it from the pilot stage to a point where data can be collected and shared and the program can sustain itself. Membership will cost $10,000 per year and will include one sensor, a year of monitoring service, and access to CIDDAC reports. CIDDAC's services are expected to be fully functional by the end of the year. The organization is piloting its sensor technology and reporting system at test locations in Philadelphia, southern New Jersey, and North Carolina. The next phase of testing, as CIDDAC receives production models of its network sensors over the next month and a half, will include as many as 10 large companies and institutions that have volunteered to participate and to whom CIDDAC has promised anonymity. The University of Pennsylvania has donated lab space, E-mail listserv services, and Internet access via its Institute of Strategy Threat Analysis and Response for the CIDDAC's pilot phase, although the initiative may have to look elsewhere for a permanent home. A company called AdminForce Remote LLC has developed the underlying real-time cyberattack-detection sensor technology that CIDDAC uses to gather information from its members' networks, and AdminForce chairman and CEO Charles Fleming serves as CIDDAC's executive director. Board members include Liberty Bell Bank chief technology officer Brian Schaeffer, Federal Reserve Bank of Philadelphia directory of information security Keith Morales, Air Products and Chemicals Inc. computer crime investigator Lance Hawk, and Kema Inc. senior principal consultant Scott Mix. FBI special agent John Chesson and Homeland Security Department director of privacy technology Peter Sand have served as advisers to the CIDDAC effort. As envisioned, a CIDDAC member connects AdminForce's sensors within their corporate network. If an intruder attempts to hack or penetrate the system, this intrusion-monitoring device sends a message to law enforcement and to other CIDDAC participants but protects the identity of the reporting entity. CIDDAC's plan is to provide members with trend-analysis information about specific intrusion activity that they can use to assess risks to their own networks. CIDDAC's arrival is timely. This year's FBI Computer Security Institute computer crime and security survey results, based on the responses of 700 computer security practitioners in U.S. companies, government agencies, financial institutions, medical institutions, and universities, indicates that the percentage of organizations reporting computer intrusions to law enforcement continues to decline. Only 20% of organizations reported cyberattacks to law enforcement, while only 12% reported such attacks to legal counsel. The key reason cited for not reporting intrusions to law enforcement is the concern for negative publicity. FBI Director Robert Mueller has acknowledged this reluctance that organizations have to air their dirty cyber laundry in public, thus hurting their image and giving rivals an edge. Mueller made these comments earlier this month at a conference hosted by InfraGard, an FBI program begun in 1996 in Cleveland as a local effort to gain support from the IT industry and academia for the FBI's cybersecurity investigative efforts. The program expanded nationally through the late 1990s. At the conference, Mueller likened a malicious command sent over a network to harm a power station's control computer to being as deadly as a backpack full of explosives. The FBI is expected to receive CIDDAC-generated law-enforcement incident reports when different criminal thresholds are exceeded. Homeland Security is likewise expected to be a consumer of CIDDAC reports. The FBI will use CIDDAC incident reports to initiate preliminary investigations to determine the magnitude of the cyberthreat, Rawling says. Such reports could be used as a basis to justify opening a criminal or intelligence case, for example, but are not expected to be used as evidence to be presented in a court of law. "The FBI must use the tools they have to build a case without revealing the identity of the source," Rawling adds. CIDDAC is by no means the only organization established to provide business-technology managers with information about cyberthreats. The new effort most closely resembles the SANS Institute's Internet Storm Center, although that service has no direct link with federal law enforcement. CIDDAC also is targeting large companies with similar IT security needs. Internet Storm Center uses the DShield distributed intrusion-detection system technology to collect data from users' intrusion-detection logs and disseminate this information to other users. DShield is a piece of freeware maintained by the SANS Institute. The Internet Storm Center, a free service, lets users submit firewall logs anonymously, but they must register with the SANS Institute to view an archive of firewall logs they submitted to the DShield database in the past 30 days and get confirmation of log submissions. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] gov't to "anonymously" sharing cyberthreat data?
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

Re: <nettime> Interview with Tommaso Debenedetti and Matze Schmidtabout WikiLeaks
by John Young 05 Jul '18

05 Jul '18

Yes, quite true. Bear with this: Yesterday RT TV conducted an interview at its fourth or fifth New York bureau location. A person was videoed by an unstaffed camera being coached by an earpod from voices at the DC or Moscow control room, ye gads, Moscow Central is alive at the Counterrrorism Center, Mclean, VA. The stooge watched his image tilting forward a la Charlies Rose stupor with an inserted background of teeming 3rd Avenue outside not the actual background drooping black fabric, surgical clogs and getaway bags. An engineer had arranged the mic and earbud and checked the camera then left for lunch or a secret mission to climb into the ceiling above to capture brainwaves, or plant a tiny seed in the noggin of the dupe, or wank a wad of infinite jest. Nobody below in the "news bureau" except the dolt yarping artless drivel to monodical questions of an android unseen being patched into the show, live, it was lied, but probably a staff lunchroom comedy lampooning eager beggars of attention at the bottom of the TV cess spew. RT TV in NYC is located amidst the UN missionary-rich SIGINT-capacious nabe of copious diplomatic cablings of neant cum dasein cum dang an sich. Viewable panning in neighbhood windows are pan-national cameras capturing the UN Central urgency of how little is happening outside the overtaxed homelands. Shortly a live butt-heaving beauty enters the suite, declaiming, that was fantastic, the best we've ever had. We want you back, what's your availability frame? Hypnotic smile, a squeeze of your bicep, leg akimbo. Well, you blurt, pumped with range-free lust , I'm free all week. That's fantastic, she says, fantastic, let me check with headquarters, I'll email you in an hour. You were great, just great. Thank you for coming. Cheek kiss, not air, real gloss to mark you pwned. You wait in the hall for the elevator. The bureau emits telltale SIGINT hoots. No email, nothing, that's it, fake-humped and forgotten. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> Interview with Tommaso Debenedetti and Matze Schmidtabout WikiLeaks
by John Young 05 Jul '18

05 Jul '18

Yes, quite true. Bear with this: Yesterday RT TV conducted an interview at its fourth or fifth New York bureau location. A person was videoed by an unstaffed camera being coached by an earpod from voices at the DC or Moscow control room, ye gads, Moscow Central is alive at the Counterrrorism Center, Mclean, VA. The stooge watched his image tilting forward a la Charlies Rose stupor with an inserted background of teeming 3rd Avenue outside not the actual background drooping black fabric, surgical clogs and getaway bags. An engineer had arranged the mic and earbud and checked the camera then left for lunch or a secret mission to climb into the ceiling above to capture brainwaves, or plant a tiny seed in the noggin of the dupe, or wank a wad of infinite jest. Nobody below in the "news bureau" except the dolt yarping artless drivel to monodical questions of an android unseen being patched into the show, live, it was lied, but probably a staff lunchroom comedy lampooning eager beggars of attention at the bottom of the TV cess spew. RT TV in NYC is located amidst the UN missionary-rich SIGINT-capacious nabe of copious diplomatic cablings of neant cum dasein cum dang an sich. Viewable panning in neighbhood windows are pan-national cameras capturing the UN Central urgency of how little is happening outside the overtaxed homelands. Shortly a live butt-heaving beauty enters the suite, declaiming, that was fantastic, the best we've ever had. We want you back, what's your availability frame? Hypnotic smile, a squeeze of your bicep, leg akimbo. Well, you blurt, pumped with range-free lust , I'm free all week. That's fantastic, she says, fantastic, let me check with headquarters, I'll email you in an hour. You were great, just great. Thank you for coming. Cheek kiss, not air, real gloss to mark you pwned. You wait in the hall for the elevator. The bureau emits telltale SIGINT hoots. No email, nothing, that's it, fake-humped and forgotten. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Rumors of Tor's compromise
by Andrew Lewman 05 Jul '18

05 Jul '18

I keep having the same conversation over and over again with various reporters from various news agencies. I've put up a [blog post] (https://blog.torproject.org/blog/rumors-tors-compromise-are-greatly- exaggerated) as our answer. The content of the blog post is also included below. # Rumors of Tor's compromise are greatly exaggerated Recently, there are two stories claiming the Tor network is compromised. It seems it is easier to get press than to publish research, work with us on the details, and further, to propose solutions. Our comments are based upon the same stories you are reading. We have no insider information. The first story has been around 'Freedom Hosting' and their hosting of child abuse materials as exposed by [Anonymous Operation Darknet](http://arstechnica.com/business/news/2011/10/anonymous-takes-down- darknet-child-porn-site-on-tor-network.ars). We're reading the press articles, pastebin urls, and talking to the same people as you. It appears 'Anonymous' cracked the Apache/PHP/MySQL setup at Freedom Hosting and published some, or all, of their users in the database. These sites happened to be hosted on a [Tor hidden servce](https://www.torproject.org/docs/hidden-services.html.en). Further, 'Anonymous' used an old denial of service attack on 'Freedom Hosting' known as the [slowloris](https://secure.wikimedia.org/wikipedia/en/wiki/Slowloris) attack. It's a simple resource starvation attack that can be conducted over low bandwidth, low resource requirement connections to individual hosts. This isn't an attack on Tor, but rather an attack on some software behind a Tor hidden service. This attack was discussed in a thread on the [tor-talk](https://lists.torproject.org/pipermail/tor-talk/2011- October/021822.html) mailing list starting October 19th. The second story is around Eric Filiol's claims of compromising the Tor network leading up to his Hackers to Hackers talk in Brazil in a few days. This was initially announced by some French press websites; however, it has spread further, such as this [Hackers Brazil in a few days. This claim was initially announced by some French websites; however, it has spread further, such as this [Hacker News](http://thehackernews.com/2011/10/tor-anonymizing-network-compromised- by.html) story. Again, the [tor-talk](https://lists.torproject.org/pipermail/tor-talk/2011- October/021722.html) mailing list had the first discussions of these attacks back on October 13th. To be clear, neither Eric nor his researchers have disclosed anything about this attack to us. They have not talked to us, nor shared any data with us — despite some mail exchanges where we reminded him about the phrase "responsible disclosure". Here's the attack as we understand it, from reading the various press reports: They enumerated 6000 IP addresses that they think are Tor relays. There aren't that many Tor relays in the world — [2500](https://metrics.torproject.org/network.html) is a more accurate number. We're not sure what caused them to overcount so much. Perhaps they watched the Tor network over a matter of weeks and collected a bunch of addresses that aren't relays anymore? The set of relays is public information, so there's no reason to collect a list and no reason to end up with a wrong list. One-third of the machines on those IP addresses are vulnerable to operating system or other system level attacks, meaning he can break in. That's quite a few! We wonder if that's true with the real Tor network, or just their simulated one? Even ignoring the question of what these 3500 extra IP addresses are, it's important to remember that one-third by number is not at all the same as one-third by capacity: Tor clients load-balance over relays based on the relay capacity, so any useful statement should be about how much of the *capacity* of the Tor network is vulnerable. It would indeed be shocking if one-third of the Tor network by capacity is vulnerable to external attacks. (There's also an aside about enumerating bridges. They say they found 181 bridges, and then there's a quote saying they "now have a complete picture of the topography of Tor", which is a particularly unfortunate time for that quote since there are currently around 600 bridges running.) We expect the talk will include discussion about some cool Windows trick that can modify the crypto keys in a running Tor relay that you have local system access to; but it's simpler and smarter just to say that when the attacker has local system access to a Tor relay, the attacker controls the relay. Once they've broken into some relays, they do congestion attacks like [packet spinning](http://freehaven.net/anonbib/#torspinISC08) to congest the relays they couldn't compromise, to drive users toward the relays they own. It's unclear how many resources are needed to keep the rest of the relays continuously occupied long enough to keep the user from using them. There are probably some better heuristics that clients can use to distinguish between a loaded relay and an unavailable relay; we look forward to learning how well their attack here actually worked. >From there, the attack gets vague. The only hint we have is this nonsense sentence from the article: The remaining flow can then be decrypted via a fully method of attack called "to clear unknown" based on statistical analysis. Do they have a new attack on AES, or on OpenSSL's implementation of it, or on our use of OpenSSL? Or are they instead doing some sort of timing attack, where if you own the client's first hop and also the destination you can use statistics to confirm that the two flows are on the same circuit? There's a history of [confused researchers](https://blog.torproject.org/blog/one-cell-enough) proclaiming some sort of novel active attack when passive correlation attacks are much simpler and just as effective. So the summary of the attack might be "take control of the nodes you can, then congest the other ones so your targets avoid them and use the nodes you control. Then do some unspecified magic crypto attack to defeat the layers of encryption for later hops in the circuit." But really, these are just guesses based on the same news articles you're reading. We look forwarding to finding out if there's actually an attack we can fix, or if they are just playing all the journalists to get attention. More generally, there are two broader lessons to remember here. First, research into anonymity-breaking attacks is how the field moves forward, and using Tor for your target is [common](http://freehaven.net/anonbib/) because a) it's resistant to all the simpler attacks and b) we make it [really easy](https://www.torproject.org/getinvolved/research.html.en) to do your research on. And second, remember that most other anonymity systems out there fall to these attacks so quickly and thoroughly that no researchers even talk about it anymore. For some recent examples, see the single-hop proxy discussions in [How Much Anonymity does Network Latency Leak?](http://freehaven.net/anonbib/#tissec-latency-leak) and [Website Fingerprinting in Onion Routing Based Anonymization Networks](http://freehaven.net/anonbib/#wpes11-panchenko). I thank Roger, Nick, and Runa for helping with this post. -- Andrew pgp 0x74ED336B _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

gov't to "anonymously" sharing cyberthreat data?
by Bradley Malin 05 Jul '18

05 Jul '18

Prof Dave - looks like UPenn is the facilitator. -brad http://informationweek.com/story/showArticle.jhtml?articleID=170000319 New Cybersecurity Center To Warn Law Enforcement Of Critical Infrastructure Attacks Aug. 24, 2005 Several businesses and organizations are testing a new process for anonymously sharing cyberthreat and attack data with their peers and government agencies without being subject to law-enforcement audits. By Larry Greenemeier InformationWeek With about 85% of the nation's critical infrastructure--energy utilities, manufacturing and transportation facilities, telecommunication and data networks, and financial services--in the private sector, it's no wonder there have been so many attempts to create services that keep these companies apprised of threats to their IT networks. But there's a problem: Most companies aren't eager to share their adventures in cybersecurity with each other or the government. Keeping this in mind, several Philadelphia-area businesses and organizations are testing out a new model called the Cyber Incident Detection & Data Analysis Center, or CIDDAC, which lets private- sector entities anonymously share cyberthreat and attack data with their peers and government agencies such as the Homeland Security Department and the FBI without that data being subject to law- enforcement audits. CIDDAC arose out of the deficiencies in the different organizations already working on cybersecurity, says Brad Rawling, a CIDDAC board member. A major sticking point that has hindered other attempts to create cyberattack-reporting infrastructures is the concern by businesses and other organizations that their proprietary information will be made public. Once information about a company's inner workings and security issues is documented by the government, that proprietary information may become fair game for Freedom Of Information Act requests by the press and public. CIDDAC circumvents this sticky situation because it's not a government entity and it doesn't provide specific information to members or law enforcement about the identity of the organization reporting a cyberattack. Participation in CIDDAC is voluntary. Since its April debut, the effort has been funded with about $100,000 in contributions from members, as well as $200,000 from the Homeland Security Department's Science and Technology Directorate. CIDDAC is searching for an additional $400,000 in funding to move it from the pilot stage to a point where data can be collected and shared and the program can sustain itself. Membership will cost $10,000 per year and will include one sensor, a year of monitoring service, and access to CIDDAC reports. CIDDAC's services are expected to be fully functional by the end of the year. The organization is piloting its sensor technology and reporting system at test locations in Philadelphia, southern New Jersey, and North Carolina. The next phase of testing, as CIDDAC receives production models of its network sensors over the next month and a half, will include as many as 10 large companies and institutions that have volunteered to participate and to whom CIDDAC has promised anonymity. The University of Pennsylvania has donated lab space, E-mail listserv services, and Internet access via its Institute of Strategy Threat Analysis and Response for the CIDDAC's pilot phase, although the initiative may have to look elsewhere for a permanent home. A company called AdminForce Remote LLC has developed the underlying real-time cyberattack-detection sensor technology that CIDDAC uses to gather information from its members' networks, and AdminForce chairman and CEO Charles Fleming serves as CIDDAC's executive director. Board members include Liberty Bell Bank chief technology officer Brian Schaeffer, Federal Reserve Bank of Philadelphia directory of information security Keith Morales, Air Products and Chemicals Inc. computer crime investigator Lance Hawk, and Kema Inc. senior principal consultant Scott Mix. FBI special agent John Chesson and Homeland Security Department director of privacy technology Peter Sand have served as advisers to the CIDDAC effort. As envisioned, a CIDDAC member connects AdminForce's sensors within their corporate network. If an intruder attempts to hack or penetrate the system, this intrusion-monitoring device sends a message to law enforcement and to other CIDDAC participants but protects the identity of the reporting entity. CIDDAC's plan is to provide members with trend-analysis information about specific intrusion activity that they can use to assess risks to their own networks. CIDDAC's arrival is timely. This year's FBI Computer Security Institute computer crime and security survey results, based on the responses of 700 computer security practitioners in U.S. companies, government agencies, financial institutions, medical institutions, and universities, indicates that the percentage of organizations reporting computer intrusions to law enforcement continues to decline. Only 20% of organizations reported cyberattacks to law enforcement, while only 12% reported such attacks to legal counsel. The key reason cited for not reporting intrusions to law enforcement is the concern for negative publicity. FBI Director Robert Mueller has acknowledged this reluctance that organizations have to air their dirty cyber laundry in public, thus hurting their image and giving rivals an edge. Mueller made these comments earlier this month at a conference hosted by InfraGard, an FBI program begun in 1996 in Cleveland as a local effort to gain support from the IT industry and academia for the FBI's cybersecurity investigative efforts. The program expanded nationally through the late 1990s. At the conference, Mueller likened a malicious command sent over a network to harm a power station's control computer to being as deadly as a backpack full of explosives. The FBI is expected to receive CIDDAC-generated law-enforcement incident reports when different criminal thresholds are exceeded. Homeland Security is likewise expected to be a consumer of CIDDAC reports. The FBI will use CIDDAC incident reports to initiate preliminary investigations to determine the magnitude of the cyberthreat, Rawling says. Such reports could be used as a basis to justify opening a criminal or intelligence case, for example, but are not expected to be used as evidence to be presented in a court of law. "The FBI must use the tools they have to build a case without revealing the identity of the source," Rawling adds. CIDDAC is by no means the only organization established to provide business-technology managers with information about cyberthreats. The new effort most closely resembles the SANS Institute's Internet Storm Center, although that service has no direct link with federal law enforcement. CIDDAC also is targeting large companies with similar IT security needs. Internet Storm Center uses the DShield distributed intrusion-detection system technology to collect data from users' intrusion-detection logs and disseminate this information to other users. DShield is a piece of freeware maintained by the SANS Institute. The Internet Storm Center, a free service, lets users submit firewall logs anonymously, but they must register with the SANS Institute to view an archive of firewall logs they submitted to the DShield database in the past 30 days and get confirmation of log submissions. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] gov't to "anonymously" sharing cyberthreat data?
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

[tor-talk] Rumors of Tor's compromise
by Andrew Lewman 05 Jul '18

05 Jul '18

I keep having the same conversation over and over again with various reporters from various news agencies. I've put up a [blog post] (https://blog.torproject.org/blog/rumors-tors-compromise-are-greatly- exaggerated) as our answer. The content of the blog post is also included below. # Rumors of Tor's compromise are greatly exaggerated Recently, there are two stories claiming the Tor network is compromised. It seems it is easier to get press than to publish research, work with us on the details, and further, to propose solutions. Our comments are based upon the same stories you are reading. We have no insider information. The first story has been around 'Freedom Hosting' and their hosting of child abuse materials as exposed by [Anonymous Operation Darknet](http://arstechnica.com/business/news/2011/10/anonymous-takes-down- darknet-child-porn-site-on-tor-network.ars). We're reading the press articles, pastebin urls, and talking to the same people as you. It appears 'Anonymous' cracked the Apache/PHP/MySQL setup at Freedom Hosting and published some, or all, of their users in the database. These sites happened to be hosted on a [Tor hidden servce](https://www.torproject.org/docs/hidden-services.html.en). Further, 'Anonymous' used an old denial of service attack on 'Freedom Hosting' known as the [slowloris](https://secure.wikimedia.org/wikipedia/en/wiki/Slowloris) attack. It's a simple resource starvation attack that can be conducted over low bandwidth, low resource requirement connections to individual hosts. This isn't an attack on Tor, but rather an attack on some software behind a Tor hidden service. This attack was discussed in a thread on the [tor-talk](https://lists.torproject.org/pipermail/tor-talk/2011- October/021822.html) mailing list starting October 19th. The second story is around Eric Filiol's claims of compromising the Tor network leading up to his Hackers to Hackers talk in Brazil in a few days. This was initially announced by some French press websites; however, it has spread further, such as this [Hackers Brazil in a few days. This claim was initially announced by some French websites; however, it has spread further, such as this [Hacker News](http://thehackernews.com/2011/10/tor-anonymizing-network-compromised- by.html) story. Again, the [tor-talk](https://lists.torproject.org/pipermail/tor-talk/2011- October/021722.html) mailing list had the first discussions of these attacks back on October 13th. To be clear, neither Eric nor his researchers have disclosed anything about this attack to us. They have not talked to us, nor shared any data with us — despite some mail exchanges where we reminded him about the phrase "responsible disclosure". Here's the attack as we understand it, from reading the various press reports: They enumerated 6000 IP addresses that they think are Tor relays. There aren't that many Tor relays in the world — [2500](https://metrics.torproject.org/network.html) is a more accurate number. We're not sure what caused them to overcount so much. Perhaps they watched the Tor network over a matter of weeks and collected a bunch of addresses that aren't relays anymore? The set of relays is public information, so there's no reason to collect a list and no reason to end up with a wrong list. One-third of the machines on those IP addresses are vulnerable to operating system or other system level attacks, meaning he can break in. That's quite a few! We wonder if that's true with the real Tor network, or just their simulated one? Even ignoring the question of what these 3500 extra IP addresses are, it's important to remember that one-third by number is not at all the same as one-third by capacity: Tor clients load-balance over relays based on the relay capacity, so any useful statement should be about how much of the *capacity* of the Tor network is vulnerable. It would indeed be shocking if one-third of the Tor network by capacity is vulnerable to external attacks. (There's also an aside about enumerating bridges. They say they found 181 bridges, and then there's a quote saying they "now have a complete picture of the topography of Tor", which is a particularly unfortunate time for that quote since there are currently around 600 bridges running.) We expect the talk will include discussion about some cool Windows trick that can modify the crypto keys in a running Tor relay that you have local system access to; but it's simpler and smarter just to say that when the attacker has local system access to a Tor relay, the attacker controls the relay. Once they've broken into some relays, they do congestion attacks like [packet spinning](http://freehaven.net/anonbib/#torspinISC08) to congest the relays they couldn't compromise, to drive users toward the relays they own. It's unclear how many resources are needed to keep the rest of the relays continuously occupied long enough to keep the user from using them. There are probably some better heuristics that clients can use to distinguish between a loaded relay and an unavailable relay; we look forward to learning how well their attack here actually worked. >From there, the attack gets vague. The only hint we have is this nonsense sentence from the article: The remaining flow can then be decrypted via a fully method of attack called "to clear unknown" based on statistical analysis. Do they have a new attack on AES, or on OpenSSL's implementation of it, or on our use of OpenSSL? Or are they instead doing some sort of timing attack, where if you own the client's first hop and also the destination you can use statistics to confirm that the two flows are on the same circuit? There's a history of [confused researchers](https://blog.torproject.org/blog/one-cell-enough) proclaiming some sort of novel active attack when passive correlation attacks are much simpler and just as effective. So the summary of the attack might be "take control of the nodes you can, then congest the other ones so your targets avoid them and use the nodes you control. Then do some unspecified magic crypto attack to defeat the layers of encryption for later hops in the circuit." But really, these are just guesses based on the same news articles you're reading. We look forwarding to finding out if there's actually an attack we can fix, or if they are just playing all the journalists to get attention. More generally, there are two broader lessons to remember here. First, research into anonymity-breaking attacks is how the field moves forward, and using Tor for your target is [common](http://freehaven.net/anonbib/) because a) it's resistant to all the simpler attacks and b) we make it [really easy](https://www.torproject.org/getinvolved/research.html.en) to do your research on. And second, remember that most other anonymity systems out there fall to these attacks so quickly and thoroughly that no researchers even talk about it anymore. For some recent examples, see the single-hop proxy discussions in [How Much Anonymity does Network Latency Leak?](http://freehaven.net/anonbib/#tissec-latency-leak) and [Website Fingerprinting in Onion Routing Based Anonymization Networks](http://freehaven.net/anonbib/#wpes11-panchenko). I thank Roger, Nick, and Runa for helping with this post. -- Andrew pgp 0x74ED336B _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] What's wrong with the kids these days? - On the moral decay of the Dutch hacker scene
by puscii 05 Jul '18

05 Jul '18

http://www.puscii.nl/blog/content/whats-wrong-kids-these-days What's wrong with the kids these days? On the moral decay of the Dutch hacker scene A lot has changed since the days when the people around Hacktic set up and defined the Dutch hacker scene. The Hang Out made way for a variety of hackerspaces; Hacktic itself is long dead (who needs dead trees to communicate nowadays anyway?) and the crew organizing OHM2013 is a completely different one from the oldies that had set up the Galactic Hacker Party and HIP. In short, we're looking at a complete new generation of Dutch hackers. Of course, nothing is more normal and healthy than for kids to rebel against their parents, but our parents have given us a difficult task there. For how in hell does one rebel against oldies who self-identified as "techno-anarchists" and were all too pleased with their image as online rebels? Some of the kids found a way: join the police! Well, technically, create a company that does the online dirty work for the police, but in this day and age of neo-liberalism and privatisation the difference is marginal... Now, the notion of hackers voluntarily joining the police probably sounds completely absurd to an outsider, but that's pretty much what happened. The Dutch High Tech Crime Unit is called Fox-IT. In case the name doesn't ring a bell, they're the main sponsor of OHM2013, employer of half of the organising core team, and you may find their logo painted on the wall of a Dutch hackerspace - not as a fuck-the-police-type graffiti, but as a thank-you for their kind sponsorship. Let's have a closer look at this company. Founded in '99 by two TU Delft alumni who had previously worked for the NFI (forensics institute) and the BVD (secret service), Fox-IT started as a relatively normal security company. Such was the hip thing to do for a hacker who wanted to legally cash in on their skills at the height of the IT bubble. Things start to get saucy around 2006 when they developed FoxReplay, a tool for wiretapping, and started selling on the international market. Not caring much for their customers regard for human rights, Fox-IT has promoted their services to countries like Iran and the United Arabic Emirates, and sales to Egypt have also been confirmed. On September 27th 2011, Fox-IT sold their tapping-branch to the US company Netscout, conveniently just one day before a change in EU regulations was to place restrictions on the export of wiretap equipment. But things also get a lot closer to home for the Dutch hackers, as Fox-IT has assisted the Dutch police in the apprehension of 4 members of AntiSec NL, a Dutch group closely linked to Anonymous. To add to the sauce, Fox-IT has been experimenting with 'hacking back', as they call it. In an operation that was meant to take down the Bredolab botnet, Fox-IT used the seized 'command and control' servers to inject code on infected machines worldwide to display a message from the Dutch police. A clever hack, if you will, but also a controversial and illegal one. Lately, Fox-IT has been publicly lobbying to create legal rights for law enforcement to actively crack target systems. Fox-IT now has customers worldwide and around 150 employees. They are the prototype of a privatised blend of law enforcement and defense, unhindered by any ethics and stretching its praxis to the shady borders of legality. That's the kind of company considered hip amongst contemporary Dutch hackers, who seem all too happy associating with and working for them. Fox-IT is actively recruiting within the scene, and many a hacker who used to share his tools and knowledge now works for them. Now, where did that come from? Sure, the scene has always had a bit of a flirtatious relationship with the secret service, but the old Hacktic crew simply giggled at the silly men with sunglasses and trenchcoats who attended their meetings. Moreover, they were exposing the wiretapping and other sniffing methods that were in use then, giving the general public means to detect, if not avoid, or play around with them. Those early days of the hacker scene were marked by a shared sense of ethics: a hands-on attitude, for freedom of information and a healthy distrust of any authority. Luckily, on a global scale, many of these values have persevered. For example, one look at the CCC website is enough to see a strong outspokenness on the political issues surrounding hacking, actively monitoring and criticizing state surveillance. In fact, hackers worldwide are working on tools to subvert (state) surveillance and censorship. Furthermore, with the rise of Anonymous and related groups, we have seen an incredible increase in politically motivated hacks and cracks, all based on those same basic values of personal freedom and distrust towards authority. How are we to interpret the bizarre contrast between upholding these values and happily accepting a company like Fox-IT in our midst? Are OHM and a number of hackerspaces drifting away from the hacker scene towards the security industry? Or do people simply not think or care about these issues because they distract from playing with LEDs and arduinos? Maybe the money is simply too good? Either way, the Dutch hacker scene is suffering from a severe case of schizophrenia where, on the one hand, it identifies itself with a global scene struggling against surveillance and, on the other hand, it condones, receives money from, advertises or even concretely works on the buildup of exactly that surveillance state. The usual approach to such mental illness that is seen all too often within the hacker scene is to simply ignore it and bury it deep down in our subconciousness. Indeed, sometimes simply ignoring the peculiar conflicts that arise within our brain may lead us to perfectly happy (though perhaps somewhat socially awkward) lives. Not in this case, though. As the world around us is transforming, the importance of resolving this inner conflict is becoming ever more urgent. Like it or not, the hacker scene is a key player in a much larger political game that will determine the face of future online communication. If we are to sell away our skills to unscrupulous companies working for power-hungry governments, that future could be very grim. It is for these reasons that the current generation of hackers needs to take a step back and reconsider the wise lessons our parents gave us. One cannot simply take the cool image of being a hacker yet act in ways that are complete opposite. It's not cool to assist in the creation of an Orwellian dystopia. It's also definitely not cool to assist in the apprehension of your fellow hackers (imagine how they might feel about attending the largest European hackercamp this year). That is not to say it's all black and white, or that we should form some sort of unified front, but maintaining a praxis that is the direct opposite of what you are preaching is both unhealthy for yourselves and dangerous towards others. So please, work out who you really are and where you stand. Read the old philes and the new. Rethink what's going on in the world around you. Discuss the role we play in it. Define your identity. And, in the end, if you still wish to call yourself a hacker, leave the fox out. sources: http://www.hacktic.nl/magazine/index.html http://wikileaks.org/spyfiles/list/company-name/foxit.html http://webwereld.nl/nieuws/108047/fox-it-stoot-afluisterdivisie-af.html http://www.techzine.nl/nieuws/27475/eu-legt-export-afluisterapparatuur-a... http://webwereld.nl/analyse/108759/fox-it--is-er-dan-wat-aan-de-hand-in-... http://www.vn.nl/Standaard-Media-Pagina/De-geheimen-van-een-supertapper.htm http://www.computable.nl/artikel/nieuws/security/4049661/1276896/foxit-h... http://www.bredolab.nl/ http://www2.fiu.edu/~mizrachs/hackethic.html -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0