July 2018 - cypherpunks-legacy

Re: cleversafe says: 3 Reasons Why Encryption is Overrated
by Zooko Wilcox-O'Hearn 06 Jul '18

06 Jul '18

[cross-posted to tahoe-dev(a)allmydata.org and cryptography(a)metzdowd.com] Folks: It doesn't look like I'm going to get time to write a long post about this bundle of issues, comparing Cleversafe with Tahoe-LAFS (both use erasure coding and encryption, and the encryption and key-management part differs), and arguing against the ill-advised Fear, Uncertainty, and Doubt that the Cleversafe folks have posted. So, I'm going to try to throw out a few short pieces which hopefully each make sense. First, the most important issue in all of this is the one that my programming partner Brian Warner already thoroughly addressed in [1] (see also the reply by Jason Resch [2]). That is the issue of access control, which is intertwined with the issues of key management. The other issues are cryptographic details which are important to get right, but the access control and key management issues are the ones that directly impact every user and that make or break the security and usefulness of the system. Second, the Cleversafe documents seem to indicate that the security of their system does not rely on encryption, but it does. The data in Cleversafe is encrypted with AES-256 before being erasure-coded and each share stored on a different server (exactly the same as in Tahoe-LAFS). If AES-256 is crackable, then a storage server can learn information about the file (exactly as in Tahoe-LAFS). The difference is that Cleversafe also stores the decryption key on the storage servers, encoded in such a way that any K of the storage servers must cooperate to recover it. In contrast, Tahoe-LAFS manages the decryption key separately. This added step of including a secret-shared copy of the decryption key on the storage servers does not make the data less vulnerable to weaknesses in AES-256, as their documents claim. (If anything, it makes it more vulnerable, but probably it has no effect and it is just as vulnerable to weaknesses in AES-256 as Tahoe-LAFS is.) Third, I don't understand why Cleversafe documents claim that public key cryptosystems whose security is based on "math" are more likely to fall to future advances in cryptanalysis. I think most cryptographers have the opposite belief -- that encryption based on bit-twiddling such as block ciphers or stream ciphers is much more likely to fall to future cryptanalysis. Certainly the history of modern cryptography seems to fit with this -- of the original crop of public key cryptosystems founded on a math problem, some are still regarded as secure today (RSA, DH, McEliece), but there has been a long succession of symmetric crypto primitives based on bit twiddling which have then turned out to be insecure. (Including, ominously enough, AES-256, which was regarded as a gold standard until a few months ago.) Fourth, it seems like the same access control/key management model that Cleversafe currently offers could be achieved by encrypting the data with a random AES key and then using secret sharing to split the key and store on share of the key with each server. I *think* that this would have the same cryptographic properties as the current Cleversafe approach of using an All-Or-Nothing-Transform followed by erasure coding. Both would qualify as "computation secret sharing" schemes as opposed to "information-theoretic secret sharing" schemes. I would be curious if there are any significant differences between these two constructions. I don't think there is any basis to the claims that Cleversafe makes that their erasure-coding ("Information Dispersal")-based system is fundamentally safer, e.g. these claims from [3]: "a malicious party cannot recreate data from a slice, or two, or three, no matter what the advances in processing power." ... "Maybe encryption alone is 'good enough' in some cases now - but Dispersal is 'good always' and represents the future." Fifth, as I've already mentioned, the emphasis on cryptography being defeated due to advances in processing power e.g. reference to Moore's Law is confused. Advances in processing power would not be sufficient to crack modern cryptosystems and in many cases would not be necessary either. Okay I think that's it. I hope these notes are not so terse as to be confusing or inflammatory. Regards, Zooko Wilcox-O'Hearn [1] http://allmydata.org/pipermail/tahoe-dev/2009-July/002482.html [2] http://allmydata.org/pipermail/tahoe-dev/2009-August/002514.html [3] http://dev.cleversafe.org/weblog/?p=63 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Source for Skype Trojan released
by Jerry Leichter 06 Jul '18

06 Jul '18

It can b ...intercept all audio data coming and going to the Skype process.b Proof of concept, but polished versions will surely follow. http://www.scmagazineus.com/Skype-snooping-trojan-detected/article/147537/ -- Jerry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Google Bows Down To Chinese Government On Censorship
by Maxim Kammerer 06 Jul '18

06 Jul '18

On Fri, Jan 4, 2013 at 8:50 AM, Martin Johnson <greatfire(a)greatfire.org> wrote: > This latest move was fully controlled by Google and can as such only be described as self-censorship. The impression I am getting from my contacts at Google is that this is not true. That is, Google apparently lost to Chinese Cyber experts in being able to keep this censored keywords system up, and decided to drop it altogether. PR team then, for whatever other reasons, decided to keep complete silence on the subject. Of course, one can then ask why didn't Google simply force HTTPS on Chinese users to begin with, but they probably considered complete block of Google by GFC too real a possibility, and were too afraid to lose market share. -- Maxim Kammerer Liberti Linux: http://dee.su/liberte -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Comcast throws down gauntlet to residential accounts
by Scott Bennett 06 Jul '18

06 Jul '18

I'm not spitting nails now, so I guess I've calmed down enough to post this message. Friday, while waiting for Comcast to get its act together to deal with registration problems involving the replacement cablemodem they brought here (still not resolved), I received the monthly call from their insecurity division, claiming that my computer was "infected with malicious software". Yeah, right. I informed the person that their monthly harassment calls about something they obviously knew nothing about were not appreciated. To date, they have never provided so much as an IP address or a port number that supposedly had been attacked in any way from my system. The person then claimed that my system had been "connecting to botnets", but was unable or unwilling to support that claim with any evidence and unable or unwilling to provide even a port number via which the alleged connections had been made. (All of the port numbers allowed in my exit policy are reserved port numbers by IANA or are tor-related ports or are other special purpose ports limited to particular IP addresses, so they are all legitimate.) That leaves only DoS attacks, and it is difficult for me to imagine conducting any effective DoS attacks via tor because of slowness of doing anything over tor. I repeatedly offered to close any exit ports that had been affected, but that they would have to tell me which ones those were. The person refused. I was also told that IP addresses of the supposedly attacked systems or of the supposedly contacted botnets could not be provided to me either. (It was not clear whether the alleged complaints came from the alleged botnet operator(s) or from the supposed targets of the alleged botnets, but it struck me as bizarre that a botnet operator would file a complaint with an ISP alleging interference with the botnet. I'm quite suspicious that Comcast has made the whole thing up out of thin air.) Next, the conversation took a turn in a different direction. I was told that port 443 (my relay's DirPort) was "open facing the Internet", i.e., that a program was actually listening on that port via the interface that connects to the cablemodem. I was told that having *any* ports "open facing the Internet" was a violation of Comcast's Acceptable Use Policy (AUP) for residential accounts. During this part of the conversation I told the person to look at www.torproject.org. This turned out to be a mistake, probably because the web pages there have never been updated to replace the client- server terminology with router terminology, so the person was immediately convinced that I was running a "server", which the person claimed was a violation of the AUP. This means, of course, that one cannot even run sshd on one's system to allow secure logins from other locations to one's own computer. I was told that I would need to upgrade to a Comcast business-class account if I were going to run a "server", by which they meant having any program(s) listening on ports accessable from the Internet. Please note that Comcast is now running port scanners against their customers' IP addresses to determine whether anything is listening on any ports at those addresses. The person I spoke with did so while talking with me, but had already seen port scan results before calling me. I do not know whether they scan the full range of possible port numbers or only a subset. The person kept mentioning that 443 was "open", but never mentioned 995, which was the ORPort and was getting the vast majority of the traffic. The net result of that conversation was that I had the choice of shutting down my relay, MYCROFTsOtherChild, or having my account terminated for a minimum of 12 months. I chose the former, at least while I investigate other options, of which there are only two or three at my location. A minimal Comcast business account will cost $60/mo. and require either a 12-month contract with an installation fee of over $200 or a 24-month contract with no installation fee. However, the Comcast business service does not *yet* have a monthly cap, whereas I've had to throttle my relay quite severely the past several months due to Comcast's bait-and-switch of last year when the service sold as being "unlimited" suddenly got a 250 GB/mo. cap imposed last October. (Currently, I pay $40/mo. + $3/mo. for cablemodem rental and have no contract.) Verizon residential service is only available at my location if I also buy their telephone service, the combination of which would cost ~$80/mo. and also require a 12-month contract. I have yet to get the details on Verizon business-class service, but it seems unlikely to be any cheaper. Verizon's residential service does not currently have a cap, but I don't know whether they prohibit listening on ports accessable from the Internet. I exist on a shoestring, and even an increase of $17/mo. will come out of my food intake each month, which already averages about 1.5 meals/day. If I can manage to revive MYCROFTsOtherChild in the near future, I will do so, but I don't yet know whether that will be feasible, and it may take a while to make it happen even it can be done. Meanwhile, I see my Comcast addresses of relays on the tor status page, and I suspect that not all of them are on Comcast business accounts. If you are a tor operator on a Comcast residential account, be advised that your relay's days on that account are probably numbered, so you ought to begin looking for a different arrangement before they call to threaten you, too. Now that Comcast has become one of the 800 lb. gorillas among ISPs in the U.S., it has apparently become an enemy of Internet growth, probably to preserve its market share without having to invest competitively to keep up with growth. They apparently do not run Quality of Service software on their routers, which is part of the reason they think they need to have a 250 GB/mo. cap on residential accounts, the other part being their presumed need to inhibit Internet growth. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Comcast throws down gauntlet to residential accounts
by Scott Bennett 06 Jul '18

06 Jul '18

I'm not spitting nails now, so I guess I've calmed down enough to post this message. Friday, while waiting for Comcast to get its act together to deal with registration problems involving the replacement cablemodem they brought here (still not resolved), I received the monthly call from their insecurity division, claiming that my computer was "infected with malicious software". Yeah, right. I informed the person that their monthly harassment calls about something they obviously knew nothing about were not appreciated. To date, they have never provided so much as an IP address or a port number that supposedly had been attacked in any way from my system. The person then claimed that my system had been "connecting to botnets", but was unable or unwilling to support that claim with any evidence and unable or unwilling to provide even a port number via which the alleged connections had been made. (All of the port numbers allowed in my exit policy are reserved port numbers by IANA or are tor-related ports or are other special purpose ports limited to particular IP addresses, so they are all legitimate.) That leaves only DoS attacks, and it is difficult for me to imagine conducting any effective DoS attacks via tor because of slowness of doing anything over tor. I repeatedly offered to close any exit ports that had been affected, but that they would have to tell me which ones those were. The person refused. I was also told that IP addresses of the supposedly attacked systems or of the supposedly contacted botnets could not be provided to me either. (It was not clear whether the alleged complaints came from the alleged botnet operator(s) or from the supposed targets of the alleged botnets, but it struck me as bizarre that a botnet operator would file a complaint with an ISP alleging interference with the botnet. I'm quite suspicious that Comcast has made the whole thing up out of thin air.) Next, the conversation took a turn in a different direction. I was told that port 443 (my relay's DirPort) was "open facing the Internet", i.e., that a program was actually listening on that port via the interface that connects to the cablemodem. I was told that having *any* ports "open facing the Internet" was a violation of Comcast's Acceptable Use Policy (AUP) for residential accounts. During this part of the conversation I told the person to look at www.torproject.org. This turned out to be a mistake, probably because the web pages there have never been updated to replace the client- server terminology with router terminology, so the person was immediately convinced that I was running a "server", which the person claimed was a violation of the AUP. This means, of course, that one cannot even run sshd on one's system to allow secure logins from other locations to one's own computer. I was told that I would need to upgrade to a Comcast business-class account if I were going to run a "server", by which they meant having any program(s) listening on ports accessable from the Internet. Please note that Comcast is now running port scanners against their customers' IP addresses to determine whether anything is listening on any ports at those addresses. The person I spoke with did so while talking with me, but had already seen port scan results before calling me. I do not know whether they scan the full range of possible port numbers or only a subset. The person kept mentioning that 443 was "open", but never mentioned 995, which was the ORPort and was getting the vast majority of the traffic. The net result of that conversation was that I had the choice of shutting down my relay, MYCROFTsOtherChild, or having my account terminated for a minimum of 12 months. I chose the former, at least while I investigate other options, of which there are only two or three at my location. A minimal Comcast business account will cost $60/mo. and require either a 12-month contract with an installation fee of over $200 or a 24-month contract with no installation fee. However, the Comcast business service does not *yet* have a monthly cap, whereas I've had to throttle my relay quite severely the past several months due to Comcast's bait-and-switch of last year when the service sold as being "unlimited" suddenly got a 250 GB/mo. cap imposed last October. (Currently, I pay $40/mo. + $3/mo. for cablemodem rental and have no contract.) Verizon residential service is only available at my location if I also buy their telephone service, the combination of which would cost ~$80/mo. and also require a 12-month contract. I have yet to get the details on Verizon business-class service, but it seems unlikely to be any cheaper. Verizon's residential service does not currently have a cap, but I don't know whether they prohibit listening on ports accessable from the Internet. I exist on a shoestring, and even an increase of $17/mo. will come out of my food intake each month, which already averages about 1.5 meals/day. If I can manage to revive MYCROFTsOtherChild in the near future, I will do so, but I don't yet know whether that will be feasible, and it may take a while to make it happen even it can be done. Meanwhile, I see my Comcast addresses of relays on the tor status page, and I suspect that not all of them are on Comcast business accounts. If you are a tor operator on a Comcast residential account, be advised that your relay's days on that account are probably numbered, so you ought to begin looking for a different arrangement before they call to threaten you, too. Now that Comcast has become one of the 800 lb. gorillas among ISPs in the U.S., it has apparently become an enemy of Internet growth, probably to preserve its market share without having to invest competitively to keep up with growth. They apparently do not run Quality of Service software on their routers, which is part of the reason they think they need to have a 250 GB/mo. cap on residential accounts, the other part being their presumed need to inhibit Internet growth. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [P2P-F] Bitcoin @ EFF
by Douglas Rushkoff 06 Jul '18

06 Jul '18

Fascinating. Sounds like he got the same attack that Paypal did in the early days, when the banks went after the company for earning its profit on the "float." The thing that could bring Bitcoin to its knees in the US is the tax law. Ultimately, the network operator would be responsible for tax reporting when people are making exchanges of value and not using cash. I found all this out while working with the Superfluid guys. If I administrate trades for you like ebay does, in US currency, I'm not obligated to produce 1099's. If I don't do the value exchange in dollars, I must report the dollar equivalency to the IRS. This law has yet to be enforced, but it surely would be if any of these currencies scaled up. On Jan 23, 2011, at 11:59 AM, magius wrote: > Bitcoin and Opencoin are "sons" of David Chaum's Digicash both. Chaum > is one of the most important cryptographers and freedom fighters in > the world and invented in the eighties the first digital cash, that > was refused, attacked and destroyed by credit card companies > societies, that instead wanted to propagate a model not based on > anonimity. The big difference between them is that Bitcoin is a > complete currency system instead Opencoin is the system to make a > currency (a digital mint). Bitcoin you need to use as-it-is, with > Opencoin instead you can create your own currency system. > > _______________________________________________ > P2P Foundation - Mailing list > http://www.p2pfoundation.net > https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation _______________________________________________ P2P Foundation - Mailing list http://www.p2pfoundation.net https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [P2P-F] Bitcoin @ EFF
by Douglas Rushkoff 06 Jul '18

06 Jul '18

Fascinating. Sounds like he got the same attack that Paypal did in the early days, when the banks went after the company for earning its profit on the "float." The thing that could bring Bitcoin to its knees in the US is the tax law. Ultimately, the network operator would be responsible for tax reporting when people are making exchanges of value and not using cash. I found all this out while working with the Superfluid guys. If I administrate trades for you like ebay does, in US currency, I'm not obligated to produce 1099's. If I don't do the value exchange in dollars, I must report the dollar equivalency to the IRS. This law has yet to be enforced, but it surely would be if any of these currencies scaled up. On Jan 23, 2011, at 11:59 AM, magius wrote: > Bitcoin and Opencoin are "sons" of David Chaum's Digicash both. Chaum > is one of the most important cryptographers and freedom fighters in > the world and invented in the eighties the first digital cash, that > was refused, attacked and destroyed by credit card companies > societies, that instead wanted to propagate a model not based on > anonimity. The big difference between them is that Bitcoin is a > complete currency system instead Opencoin is the system to make a > currency (a digital mint). Bitcoin you need to use as-it-is, with > Opencoin instead you can create your own currency system. > > _______________________________________________ > P2P Foundation - Mailing list > http://www.p2pfoundation.net > https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation _______________________________________________ P2P Foundation - Mailing list http://www.p2pfoundation.net https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Pigdog] Forbes on Bitcoin - praise for its financial innovation
by Baron Earl 06 Jul '18

06 Jul '18

Not what I would expect from Forbes. "Therebs a lot of talk about dongles recently. Square has always relied on a dongle and now PayPal is sporting a fancy triangle-shaped dongle, nicknamed the bBlue Doritob. Both of these dongles equip your mobile phone to accept and process credit cards securely by inserting the device into the smartphonebs 3.5mm audio input jack. Apparently, this passes for financial innovation in mobile payments but I file it under the bnot-disruptive-enoughb category. Truly-disruptive financial innovation is already here with decentralized bitcoin. And, bitcoin doesnbt need a dongle!" http://www.forbes.com/sites/jonmatonis/2012/03/24/bitcoin-doesnt-need-a-don… P.S. If you're not using https://Blekko.com for finding the latest tech-oriented news, try it. I entered "bitcoin /date" to get the latest news on bitcoin and the results contained no spam or linkspam sites. _______________________________________________ Pigdog mailing list Pigdog(a)lists.pigdog.org http://lists.pigdog.org/listinfo.cgi/pigdog-pigdog.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[FoRK] SANS NewsBites Vol. 14 Num. 44 : FLASH: President Obama (and predecessor) ordered Stuxnet and campaign of cyber attacks against Iran's nuclear program
by Stephen D. Williams 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FLASH: The New York Times reported this morning that President Obama (and his predecessor) ordered a sophisticated campaign of cyberattacks against Iran's nuclear program, and has either attacked or considered attacking networks in China, Syria, and North Korea as well. Because the publication of this story is likely to herald substantive and far-ranging changes in the way cybersecurity is managed in the US and in many other countries, we have included an analysis by Gautham Nagesh. Under normal circumstances, his thoughtful, in-depth analyses are available only to paid subscribers to CQ Roll Call "Executive Briefing on Technology." This is an abnormal circumstance. There is great value in the security community understanding that the game has changed, and what it means. Alan PS Another very valuable piece of cybersecurity reporting will appear on the front page of the Washington Post on Sunday or Monday and then be discussed on National Public Radio (the Diane Rehm show) on Monday morning. TOP OF THE NEWS --President Obama Ordered Stuxnet and More Attacks on Iran (June 1, 2012) (By Gautham Nagesh, CQ Executive Briefing on Technology) The New York Times has a bombshell this morning: President Obama began ordering cyberattacks on Iran within days of taking office. The story, which is a must-read, finally confirms what many cybersecurity experts have suspected: the Stuxnet worm, which disabled industrial equipment in Iran and Europe, was originally designed by Israel and the U.S. to slow down Iran's nuclear enrichment plant. The virus' escape from Iran's Natanz plant and subsequent discovery in Germany in 2010 was a mistake that U.S. authorities blamed on Israel. Former CIA chief Michael Hayden also acknowledged to the Times that Stuxnet is the first major cyberattack intended to cause physical destruction (to Iranian centrifuges). "Somebody crossed the Rubicon," he said. The article includes a history of the classified cyberweapons program, dubbed "Olympic Games," which began under President Bush, and includes details of how President Obama decided that digital attacks were preferable to a potential military conflict between Iran and Israel. But the bottom line is that President Obama (and his predecessor) ordered a sophisticated campaign of cyberattacks against Iran's nuclear program, and has either attacked or considered attacking networks in China, Syria, and North Korea as well. The Obama administration previously acknowledged that it might respond to cyberattacks with physical force, but the report makes it clear that even as the U.S. was making those threats, it was perpetrating cyberattacks on the very nations it accuses of targeting its networks. In doing so, the White House has seemingly opened a Pandora's box. Administration officials have placed a greater emphasis on cybersecurity and the threat to our nation's networks that any previous administration, doubtless because they had first-hand knowledge of just how much damage sophisticated cyberattacks are capable of causing. Those officials might have also feared reprisals from nations that were targeted by Stuxnet and other digital attacks from the U.S. The revelation also sheds some light on the Pentagon's reluctance to outline its cyberwarfare policies in detail, since doing so might have involved disclosing to Congress that the U.S. already was fully engaged in online battle. Having taken such an aggressive stance on deploying Stuxnet, it will be very difficult for the U.S. to keep casting itself as the innocent victim of unprovoked attacks by countries looking to steal our economic and military secrets. Today's report makes it clear that the White House long ago decided to embrace digital warfare, and puts the onus squarely back on the administration to clearly explain its rules of engagement online. But the greatest impact may be internationally, where hostile nations now have confirmation the U.S. could be targeting their networks. If hackers in those countries weren't already attempting to take down U.S. critical infrastructure, they probably are now. http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cy… <http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cy…> > Then the N.S.A. and a secret Israeli unit respected by American > intelligence officials for its cyberskills set to work developing the > enormously complex computer worm that would become the attacker from > within. > > The unusually tight collaboration with Israel was driven by two > imperatives. Israelbs Unit 8200, a part of its military, had technical > expertise that rivaled the N.S.A.bs, and the Israelis had deep > intelligence about operations at Natanz that would be vital to making > the cyberattack a success. But American officials had another interest, > to dissuade the Israelis from carrying out their own pre-emptive strike > against the Iranian nuclear facilities. To do that, the Israelis would > have to be convinced that the new line of attack was working. The only > way to convince them, several officials said in interviews, was to have > them deeply involved in every aspect of the program. > > Soon the two countries had developed a complex worm that the Americans > called b the bug.b But the bug needed to be tested. So, under enormous > secrecy, the United States began building replicas of Iranbs P-1 > centrifuges, an aging, unreliable design that Iran purchased from Abdul > Qadeer Khan, the Pakistani nuclear chief who had begun selling > fuel-making technology on the black market. Fortunately for the United > States, it already owned some P-1s, thanks to the Libyan dictator, Col. > Muammar el-Qaddafi. > > When Colonel Qaddafi gave up his nuclear weapons program in 2003, he > turned over the centrifuges he had bought from the Pakistani nuclear > ring, and they were placed in storage at a weapons laboratory in > Tennessee. The military and intelligence officials overseeing Olympic > Games borrowed some for what they termed b destructive testing,b > essentially building a virtual replica of Natanz, but spreading the test > over several of the Energy Departmentbs national laboratories to keep > even the most trusted nuclear workers from figuring out what was afoot. > > Those first small-scale tests were surprisingly successful: the bug > invaded the computers, lurking for days or weeks, before sending > instructions to speed them up or slow them down so suddenly that their > delicate parts, spinning at supersonic speeds, self-destructed. After > several false starts, it worked. One day, toward the end of Mr. Bushbs > term, the rubble of a centrifuge was spread out on the conference table > in the Situation Room, proof of the potential power of a cyberweapon. > The worm was declared ready to test against the real target: Iranbs > underground enrichment plant. > > b Previous cyberattacks had effects limited to other computers,b Michael > V. Hayden, the former chief of the C.I.A., said, declining to describe > what he knew of these attacks when he was in office. b This is the first > attack of a major nature in which a cyberattack was used to effect > physical destruction,b rather than just slow another computer, or hack > into it to steal data. > > b Somebody crossed the Rubicon,b he said. > > Getting the worm into Natanz, however, was no easy trick. The United > States and Israel would have to rely on engineers, maintenance workers > and others b both spies and unwitting accomplices b with physical access > to the plant. b That was our holy grail,b one of the architects of the > plan said. b It turns out there is always an idiot around who doesnbt > think much about the thumb drive in their hand.b > ... > > But by the time Mr. Bush left office, no wholesale destruction had been > accomplished. Meeting with Mr. Obama in the White House days before his > inauguration, Mr. Bush urged him to preserve two classified programs, > Olympic Games and the drone program in Pakistan. Mr. Obama took Mr. > Bushbs advice. > > *The Stuxnet Surprise* > > Mr. Obama came to office with an interest in cyberissues, but he had > discussed them during the campaign mostly in terms of threats to > personal privacy and the risks to infrastructure like the electrical > grid and the air traffic control system. He commissioned a major study > on how to improve Americabs defenses and announced it with great fanfare > in the East Room. > > What he did not say then was that he was also learning the arts of > cyberwar > <http://topics.nytimes.com/top/reference/timestopics/subjects/c/cyberwarfare…>. > The architects of Olympic Games would meet him in the Situation Room, > often with what they called the b horse blanket,b a giant foldout > schematic diagram of Iranbs nuclear production facilities. Mr. Obama > authorized the attacks to continue, and every few weeks b certainly > after a major attack b he would get updates and authorize the next step. > Sometimes it was a strike riskier and bolder than what had been tried > previously. > > b From his first days in office, he was deep into every step in slowing > the Iranian program b the diplomacy, the sanctions, every major > decision,b a senior administration official said. b And itbs safe to say > that whatever other activity might have been under way was no exception > to that rule.b > --Pentagon's Plan X Aims to Develop Robust Cyberwarfare Capabilities (May 30, 2012) The Pentagon's Defense Advanced Research Projects Agency (DARPA) is launching a five-year, US $110 million research program dubbed Plan X. DARPA is seeking input from private sector organizations, universities, and computer game companies in its effort to develop improved cyberwarfare capabilities. Goals include creating a comprehensive map of cyberspace that is updated continuously, developing an operating system strong enough to launch cyber attacks and withstand counterattacks, and creating systems that allow commanders to launch speed-of-light attacks. http://www.washingtonpost.com/world/national-security/with-plan-x-pentagon-… --US Legislators Poised to Reauthorize FISA Amendments Act (May 31, 2012) US legislators appear to be ready to reauthorize the FISA Amendments Act, which grants the government authority to conduct warrantless surveillance on American citizens. The law allows the government to eavesdrop on phone calls and email correspondence of Americans as long as one of the parties in the conversation is outside the US. The FISA Amendments Act requires the Foreign Intelligence Surveillance Act Court to give blanket approval to electronic surveillance requests. The target of the surveillance does not have to be identified, and the surveillance can begin up to a week before the request is made. The FISA Court rulings are not public. Some US legislators did say that intelligence agencies need to be more accountable for how they are using the authority. http://www.wired.com/threatlevel/2012/05/congress-mulls-spy-powers/ --Backdoor in Privacy Tool Sparks Concern Over Cyber Surveillance in Iran (May 30, 2012) Versions of a privacy tool called Simurgh that contain backdoor components have been detected on filesharing sites in Iran, leading to speculation that the government could be using the software to spy on its citizens. Simurgh, a proxy tool, is widely used in Iran to evade censorship technology that the government has put in place. Simurgh in its original form is standalone software that can be run from a USB stick. The version with the backdoor must be installed on PCs. It has the capacity to log users' keystrokes and gather information about which sites they visit. The harvested data are sent to US-based servers that are registered to a Saudi Arabian organization. Because both versions of the software connect with a page that confirms the use of a proxy, the developers are using the opportunity to warn users whose versions appear to be infected. http://www.theregister.co.uk/2012/05/30/trojaned_privacy_tool_hits_iran/ [Editor's Note (Ullrich): Hashes are good. Even better to have the software digitally signed. If you are publishing software, and you are not offering signatures, you are putting your customers (and with that your reputation) at risk.] --White House Anti-Botnet Effort (May 29 & 30, 2012) The US government is planning to take a number of steps in an effort to fight botnets. The coordinated efforts will be undertaken by the Departments of Commerce and Homeland Security, the White House Cybersecurity Office, and the Industry Botnet group, a coalition of private organizations. Plans include increased sharing of information about botnets among government agencies and private organizations and a campaign to educate consumers about botnets. http://krebsonsecurity.com/2012/05/white-house-aims-to-stoke-botnet-fight/ http://www.computerworld.com/s/article/9227569/White_House_launches_coordin… http://news.cnet.com/8301-1009_3-57443380-83/white-house-prepares-to-conven… http://www.darkreading.com/threat-intelligence/167901121/security/antivirus… http://www.nextgov.com/cybersecurity/2012/05/new-partnership-aims-combat-zo… [Editor's Note (Ullrich): The US Govt. might consider just declaring Wednesday "Botnet Day". Appears these efforts spring up about once a week.] --Pentagon to Issue New Social Media Policy for DoD Employees (May 25 & 29, 2012) A new policy to be used by the Pentagon will require troops to hide certain identifying information on social media sites. There have been reports that hackers could gather sensitive information, including military unit location, from some social media posts. The new policy comes in the wake of an attack on a dating site that compromised the personal information of military users. The new policy will require that DoD employees "use non-mission related contact information ... to establish personal accounts." http://www.nextgov.com/cybersecurity/cybersecurity-report/2012/05/no-more-d… http://gcn.com/articles/2012/05/29/dod-social-media-policy-no-dot-mil.aspx [Editor's Note (Murray): We call this "operational security," OPSEC for short. OPSEC policy must be implemented with training. sdw _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Pigdog] Forbes on Bitcoin - praise for its financial innovation
by Baron Earl 06 Jul '18

06 Jul '18

Not what I would expect from Forbes. "Therebs a lot of talk about dongles recently. Square has always relied on a dongle and now PayPal is sporting a fancy triangle-shaped dongle, nicknamed the bBlue Doritob. Both of these dongles equip your mobile phone to accept and process credit cards securely by inserting the device into the smartphonebs 3.5mm audio input jack. Apparently, this passes for financial innovation in mobile payments but I file it under the bnot-disruptive-enoughb category. Truly-disruptive financial innovation is already here with decentralized bitcoin. And, bitcoin doesnbt need a dongle!" http://www.forbes.com/sites/jonmatonis/2012/03/24/bitcoin-doesnt-need-a-don… P.S. If you're not using https://Blekko.com for finding the latest tech-oriented news, try it. I entered "bitcoin /date" to get the latest news on bitcoin and the results contained no spam or linkspam sites. _______________________________________________ Pigdog mailing list Pigdog(a)lists.pigdog.org http://lists.pigdog.org/listinfo.cgi/pigdog-pigdog.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0