July 2018 - cypherpunks-legacy

RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn
by Declan McCullagh 06 Jul '18

06 Jul '18

ivore us e Cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> To: "Baker, Stewart" <SBaker(a)steptoe.com>, farber(a)cis.upenn.edu, ip-sub-1(a)majordomo.pobox.com Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn ivore us e Cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> Stu, Maybe you're right. Maybe this expansion of warrantless surveillance powers is unobjectionable. Maybe the FBI and the state law enforcement agencies that will be able to legally use Carnivore without a court order in some circumstances will prove entirely trustworthy. Maybe they truly do need this power in emergencies. Maybe it'll even stop some terrorists. Maybe you're correct to say, "What's the big deal?" But let's have that discussion in public, during daylight hours, in a hearing room where reasoned conversation can take place. Let's ask the FBI director and the attorney general to testify, and let's invite representatives from groups like the ACLU, CDT and EPIC to join them. Let's allow senators to ask the bill's sponsors tough questions about what this oddly-written legislation really does. And let's give them as much time as they need to answer. What we shouldn't do is rush substantial rewrites of wiretapping law through the Senate in the middle of the night, just two days after the worst terrorist attack ever, when the country is in the throes of a national emergency. What we shouldn't do is have the legislation's sponsors -- and I don't doubt that they have the best of intentions -- hand it to their fellow senators just 30 minutes or so before a vote, which is what reportedly happened Thursday night. Stu, you've worked both in the government and in the private sector. You've studied wiretap law more closely than nearly anyone else. You know how it works. But would most senators know offhand what expanding wiretapping to include "any criminal violation of sections 2332, 2332a, 2332b, 2332d, 2339A, or 2339B" means? This is what Senator Patrick Leahy of Vermont, the chairman of the Judiciary committee and a former prosecutor, said during the floor debate: "Do we really show respect to the American people by slapping something together, something that nobody on the floor can explain, and say we are changing the duties of the Attorney General, the Director of the CIA, the U.S. attorneys, we are going to change your rights as Americans, your rights to privacy? We are going to do it with no hearings, no debate. We are going to do it with numbers on a page that nobody can understand." Senator Carl Levin of Michigan said he had no time to read what he was being asked to vote on, adding that he had been told the bill was merely an anti-terrorism measure but it seemed to do far more: "I am trying to understand what is in it since it came to me for the first time tonight. I want to be very clear, at least the way I read this, that this is not something that is just limited to counterterrorism, about which I think all of us would have a passion." The spending bill to which the wiretap legislation ("Combating Terrorism Act of 2001") was attached will have to go to conference committee and then, probably, both chambers of Congress for another vote. That process means the bill won't become law for weeks at best. During that time, Congress could have held at least one hearing on the bill; in fact, Leahy said he would have done so immediately. If the bill is so vital to our national security, couldn't it survive a straight up-or-down floor vote, rather than be attached to a massive must-pass appropriations bill for the Justice, Commerce, and State departments? As a side note, even if you believe the language to be unobjectionable, Senate Judiciary committee aides told me they believe the wording of the bill -- apparently hastily-drafted, complete with typos -- may cover the content of communications, not just origin-desination information. If they're not sure, and they had a full day to read it by the time I spoke with them Friday, how can you be so positive your interpretation is correct? Even if you're right, doesn't it make sense to double-check? During the next few months and years, we may see calls for restricting the freedoms Americans have enjoyed as a way to respond to and thwart terrorists. Many of these new laws and regulations are unobjectionable; I don't mind tighter temporary security around government buildings and airports. But others are more deserving of enlightened discussion and debate. Let's hope that happens, not in the darkness of midnight votes, but in public in the light of day. -Declan ********** ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn ivore us e
by Baker, Stewart 06 Jul '18

06 Jul '18

Declan, I ignored the first two points because I don't think they're that important. These "warrantless searches" are emergency orders that have to be followed by a court order in 48 hours. Sometimes courts are closed and the cops need data right away. Tuesday evening would be a good example. This is not some out-of-control police authority. The people who can ask for emergency orders have to be designated by one of several officials at Main Justice. That's to make sure someone responsible ends up with the authority to declare an emergency. So an assistant US attorney could be designated by Main Justice in each district right now. What's the big deal with letting the US Attorney for the district do the designating instead of Main Justice? Seems to me that the US Attorney probably knows more about staff changeovers than Main Justice, so it makes sense for the US Attorney to do the designating locally. Stewart **********

1 0

FC: Debate over warrantless Carnivore bill with Stu Baker
by Declan McCullagh 06 Jul '18

06 Jul '18

Stewart Baker is the former general counsel to the National Security Agency and now a partner at the Washington law firm of Steptoe and Johnson: http://www.steptoe.com/WebBio.nsf/biographies/Stewart+A.+Baker?OpenDocument http://www.mccullagh.org/image/10/stewart-baker.html Below is a few rounds of a debate we had on Dave Farber's IP list in response to my article ("Senate votes to permit warrantless Net-wiretaps, Carnivore use"): http://www.wired.com/news/politics/0,1283,46852,00.html -Declan ********** >To: "'farber(a)cis.upenn.edu'" <farber(a)cis.upenn.edu> >cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> >Subject: RE: Senate votes to permit warrantless Net-wiretaps, Carnivore > us e >Date: Fri, 14 Sep 2001 19:28:17 -0400 > >This seems a bit alarmist. The FBI has long had the authority to get the >phone numbers that are called from or that call to a suspect's phone. These >are trap-and-trace and pen-register orders. The Justice Department has >generally taken the position that the Internet equivalent of such data is >the addressing information in emails. This bill would enshrine the Justice >Department position in law -- without changing the warrant requirements or >the predicate for getting such Internet pen register data. It's not that >big a change from the status quo. I would guess that, even without the law, >Justice would have about a 60-40 or even 70-30 chance of winning its >argument in court. > >In my view there are some reasons to be uneasy about the bill but not >frothing. > >First, the to and from lines on my emails (plus the URLs I visit) are in >fact more intimate information than the phone numbers I call. What's more, >I'm already on notice that the phone numbers aren't all that private -- >they're used to bill me, after all. Not true for URLs or "to" lines. Once >that data is gathered by the police(on a very easy standard, I agree), it >may never be thrown out, and lots of people can access it. So extending >police authority to such data ought to be the occasion for thinking >creatively about how to discipline the use of that authority. If I were >writing the bill, I'd let the police gather such data, but I'd do more to >audit the people who access it and require prosecutors to notify people >after the fact that they've been targeted for surveillance (unless that >would blow an ongoing investigation). As things stand, the only people who >find out about such surveillance and thus get a chance to challenge it are >criminal defendants. Isn't that just backwards? I mean, who came up with a >system in which crooks may go free because their privacy was violated while >innocent people who've suffered the same violation never have a remedy? > >Second, most ISPs would like to see an assurance that Carnivore won't be >used if they have their own systems that can accomplish the same thing, or >that they'll be indemnified for any damage Carnivore might do to the system. > >In short, we may be missing some opportunities to improve privacy law, but >it's hard to say that the privacy sky is falling. > >Stewart **********

1 0

[Neuclear-general] ANNOUNCE: NeuClear XMLSig 0.13 Released
by Pelle Braendgaard 06 Jul '18

06 Jul '18

Panama City, 28th of April 2004. We are happy to announce the 0.13 release of NeuClear XMLSIG. Major new features are: * Support for Interactive signing * HTML Signatures For more info see: http://dev.neuclear.org/xmlsig/ For a quick usage introduction see the Busy Developers Guide at: http://dev.neuclear.org/xmlsig/bdg.html To try it out interactively run the following (Requires Java 1.4 or above with Java Web Start) http://dist.neuclear.org/app/neuclear-signer.jnlp -- http://talk.org + Live and direct from Panama http://neuclear.org + Clear it both ways with NeuClear ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Neuclear-general mailing list Neuclear-general(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/neuclear-general --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Endorse EDRI's Statement Against Data Retention
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/09/13/0128222 Posted by: timothy, on 2004-09-13 08:31:00 from the but-they're-offering-a-free-backup-service dept. [1]Ville Oksanen writes "Privacy International (PI) and European Digital Rights (EDRI) have published their [2]joint answer to [3]the consultation on mandatory data retention. The European Commission asked for public comments on a proposed retention regime across Europe between 12 and 36 months for all traffic data generated by using fixed and mobile telephony and Internet. As [4]Statewatch puts it: 'This is a proposal so intrusive that Ashcroft, Ridge and company can only dream about it, exceeding even the U.S. Patriot Act.' EDRI and PI are currently collecting endorsements from organizations and companies for their stamement [5]here. This is unfortunately not enough to stop the process - expecially more should be done in the member states, which ultimately decide the fate of the proposal. So contact your local politicians today!" [6]Click Here References 1. http://www.effi.org/ 2. http://www.privacyinternational.org/issues/terrorism/rpt/responsetoretention. html 3. http://europa.eu.int/information_society/topics/ecomm/useful_information/li… ary/public_consult/text_en.htm#data_retention 4. http://www.statewatch.org/ 5. http://www.edri.org/cgi-bin/index?id=000100000162 6. http://ads.osdn.com/?ad_id=5137&alloc_id=11055&site_id=1&request_id=9560795… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [linux-elitists] Re: MCI boots send-safe (Register) -- adds a
by Karsten M. Self 06 Jul '18

06 Jul '18

net of 11 more spam hosts User-Agent: Mutt/1.5.6+20040907i on Thu, Mar 03, 2005 at 12:05:48PM -0500, Aaron Sherman (ajs(a)ajs.com) wrote: > On Wed, 2005-03-02 at 23:52, Karsten M. Self wrote: > > on Wed, Mar 02, 2005 at 06:16:38PM -0500, Aaron Sherman (ajs(a)ajs.com) wrote: > > > > Ok, I won't speak for Nick, but here's why I get all flustered about > > > this kind of thing: I have this nervous tick that forces me to imagine > > > how every "victory" in the war against X (drugs, spam, terrorism, you > > > name it) will, in turn, be used against me in future. > > > [...] > > I believe in a _balance_ of powers, a weighting on _merits_, and an > > avoidance of _extremes_. Large low-entropy pools are inherently > > dangerous. > > Interesting. I would not have thought to phrase it that way, but it's a > fair point. Thank you. > > _Those_ are the particulars of _this_ case. > > Yep, and I'm glad they've been booted, and I was over-reacting as a > result of a mis-reading. However, I defend the reaction in that, had the > root servers (or some subset) taken such unilateral action, I think it > would have been wildly inappropriate and would have set a frightening > precedent. The root servers situation is interesting and unclear. I haven't been referring to it. That said: if someone thumbs their nose at the world sufficiently long and hard, they shouldn't be too suprised to find the world thumbing back. Unconstrained, this does lead to breakdowns and opportunities for abuse (Joe-jobs, reputation trashing). I can't deny feeling a sense of karmic justice, however. > I know you may have come away from the previous discussion with the > sense that I have a desire to defend send-safe, but I assure you that > nothing could be farther from the truth. My feeling on the MCI policy > issue is that, worst-case, they should have amended their rules, > refunded send-safe's money and terminated the contract long ago. s/refunded.*money// ...particulary in the face of an AUP denying network abuse, spamming, etc. Send-safe were likely skating under the rules and were taking an overt business risk in doing so. > I do want to point out, though, that this means financial hardship for > MCI, ...my heart bleeds.... > which implies that some other company is going to be able to step > in to this market and make money by supporting the send-safes of the > world... get ready for the next phase of spam growth: the large, > international corporation that owns several ISPs and is entirely willing > to mix large pools of legitimate users, servers and networks in with > their spam services. Welcome to 1999, Aaron. Large ISPs have been doing this for years. Its one of the direct motives behind SPEWS. While emission-specific blocklists (SBL/XBL, SpamCop, etc.) track spam by source: SPEWS maintains a list of known spam sources and spam friendly hosts so that e-mail can be rejected from these problem sites. http://www.spews.org/ Track NANAE for a week and you'll see a litany of sob stories: "my IP is blocked by SPEWS, please delist me". No, your _hosting provider_ is listed by SPEWS. _They_ need to clean up their act. > You're going to NEED a real reputation system sometime soon, or spam > WILL become even more unmanageable than it is today. If you think IPV4 is bad, try IPV6. That's among the reasons I'm strongly promoting ASN/CIDR tracking: IPV6 aggregates that much more. Still, it's going to be problematic. There's the corrolary aspect that ever more traffic is going to be IP based. Currently it's email, web services, chat, and the like. Moving forward, it's going to be phone, IM, SMS, and more. What do you think the mean time between rings for, say, a high-score socioeconomic class areacode (202, 212, 415, 650, 312, 818) will be where long distance is free and Choicepoint household data floats freely on the Dark Net? And you _don't_ have realtime content/context data to filter in realtime audio. As for reputation systems: yeah, look at Senderbase / Iron Mountain. I see big things for them, particularly if they've got _any_ brains. > > > What if the complaints start originating from the MPAA or the US > > > government or the IMF or spammers? > > > > I don't particularly care where a complaint originates from. I _do_ > > care that the complaint is legitimate and valid. > > Also fair. I wonder though who writes the spec on those two terms? How about we judge based on community outrage ;-) > > > We're forcing them to evolve or die... what happens when that > > > evolution involves buying a very large ISP? Do we shut off half > > > the world or come up with a better plan? > > > > Do you connect your sewer mains to your spigots or your drains, > > Aaron? That's really a no-brainer. > > > So yes: if a large portion of the Net turns black, well, it turns > > black more ways than one. > > Your points about ASN/CIDR identification are good, but this last > statement bothers me. Plus, IPs are a poor metric. As we all know they > are ephemeral. I've had this discussion in the past week. IP ownership is ephemeral, particularly in dialup / dynamic access. ASN assignment is markedly less so, though they also change over time. What's markedly _less_ ephemeral are private blocklists. Remember, the public DNSBLs are just the visible tip of the iceberg. Private, site-specific lists, and dark lists, passed among friends and associates, but not made generally public, are legion. I used one such, with 65K+ domains, as part of my web content filtering for a youth center tech lab. Getting on and off public DNSBLs is _relatively_ sane. The lists have to be accountable to their users, and not violate either stated policy or useful effects too greatly, or they lose following. Within a private site, both usage patterns and propriety mean that once on, getting off a list is at best iffy. The result is that network abuse leads to a continuous erosion of useful IPs. Rotating abusive activity through a large block merely accelerates that process *and* provides a useful behavioral pattern identifying black-hat providers. > We *NEED* a reputation system that's based on strong encryption. Encryption without authentication _and_ reputation data is useless. The response time of such a system may be infeasible. And systems with weak authentication may work well: honeypots, web content, and other abuse monitors identifying specific IPs of interest. A watch that extends to a sensible range (say, a /24 initially, broader based on other heuristics). Local management of such lists means that defenses are continuously adapted to conditions. Hardwired whitelists for criticial contacts to avoid friendly fire losses. Hard-fail conditions to provide feedback to those who are inadvertantly blocked. It's not an ideal system. It's probably a 95% solution. And it doesn't rely on encryption at all. Sure: encryption and PKI are useful. I use and advocate their use. Uptake remains limited. And in large-volume processing, it's expensive. That said: opportunistic authentication _should_ be used and favored where it exists. > We have all of the tools (SMTP/TLS + CAs + DNS), we just need a single > protocol that at least a few large players agree to use that connects > them. Once that's in place, we could END spam. Yeah, sure. You want to split the profits? Since when do you trust CAs to identify nonspammers? What's this protocol you're talking about? How does it extend past email to _other_ forms of abuse? I see a handwave and "Profit!". I don't see a workable system yet. Care to expand? > Sure, there would be trade in stolen keys, but a decent system would > adapt (via the same mechanisms as DNSBLs) and repair quickly enough > that using a key would result in a return on investment insufficient > to warrant the effort in stealing it. Y'know, key repudiation _remains_ one of the weak points of current PKI. And the number of SSL sites lacking valid, authoritative, or other than non-self-signed keys is large. Plus the whole level of intermediation through browsers leads to _many_ user education issues. > New players who want to establish a rep would have to be "introduced" or > suffer most of their mail being black-holed until a sufficient > reputation had been established (perhaps years) How long does it take you to make friends? How long does it take you to _really_ trust someone? If there's such a reputation system, I'd like it to offer two features: - Love at first sight: the ability to decide, quickly, that yes, you pretty much do trust someone rather highly. - Disowning: Ok, so you've changed your mind (or have sufficient experience that you really ought to) about this relationship. Can you get a divorce? When I designed the K5 moderation and mojo systems, I built in two features: - Moderation should quickly reflect initial experiences. The first moderation counts most. Subsequent mods _can_ change the overall score, but it takes a lot of 'em to do much shifting. After a time, the message moderation tends to stabilize. - Mojo should weight recent activity. If someone's been long-term trustworthy, but suddenly gets all wiggly, three-year-old rep _really_ shouldn't count that much. > but let's face it: if you're deploying your own mail server then one > of the following is going to be true: > > * Your up-stream ISP approves and will vouch for you as a customer > who is under certain contractual obligations (not a guarantee of > validity, but a starting point) > * You know someone who trusts you and is willing to sign your key > (risking their own reputation). > * You are sending to a fair number of specific individuals who > will white-list you, slowly building your reputation. Under the scheme I envision, your relationship _largely_ is of concern to those with whom you're doing business. Basically: behave yourself the first time you come around. Eventually, you'll be considered a member of the family. Or at least given a neighborly greeting. Fortunately, most spammers currently exhibit such flagrant disregard for _any_ social niceties that you can write them off quickly. > Built properly, such a system would account for differing "opinions" > (e.g. many small businessmen in Russia seem to trust each other, even > though the rest of the world thinks they're evil... that's fine, they > have their view, we have ours). This is easily accomplished by doing > roughly what DNSBLs do: centering each origin of trust on a domain name, > and allowing any domain name to originate a new root of trust at any > time. Sounds complicated and my brain's not wrapping around this well ATM. There is the fundamental problem of trust transitivity. OTOH, if you use a weighting system in which you simply _correlate_ others' opinions with your own, you don't have to worry about agreement, you only need concern yourself with predictive value. That chap with whom you have _no_ common tastes is a perfect predictor: corrolation is -1. The useless data is the person with whom you're aligned half the time, corrolation 0. Authentication here is useful in that you're reasonably assured that the reputation is the one you think it is. Beyond that, you don't really need to trust it. > Nice things about this system are: the SPF problem goes away. You don't > care who initially started the chain, only who delivered it to your > front door. They have the power to vouch for bad-guys, but it will nuke > their rep. Your own relays would have a level of trust that puts your > central delivery host into a slave mode, so no reputation updates would > be performed (preventing your central MTA from harming your relay's > reputation when it passes you spam, and also reducing overhead). Right. I think I get at this somewhat more trivially with a proportionate rejection scheme: - Accept the first mail from a new source. - Rank that mail for spamminess. - Rinse, wash, repeat for some reasonable sample, over some aggregated netblock. You're going to find you're getting some proportion of spam vs. ham for that block. - Toss in curves for behavior: is the peer doing a dictionary attack on your space? Do they ignore temporary rejects, or not follow traditional retry intervals? Score goes down. - Based on the ratio of spam/ham coming from the site, at whatever granularity gives you a good statistical sample, say 10-30 datapoints per defined time period, where a week to a month should be more than sufficient, issue your own randomly assigned accept / reject responses. - Season to taste. > This might be rocket science, but it's not HARD rocket science. To the contrary, it's cooking with spam. Peace. -- Karsten M. Self <kmself(a)ix.netcom.com> http://kmself.home.netcom.com/ What Part of "Gestalt" don't you understand? A guide to GNU/Linux backups: http://kmself.home.netcom.com/Linux/FAQs/backups.html _______________________________________________ linux-elitists http://zgp.org/mailman/listinfo/linux-elitists ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [cryptography] Bitcoin-mining Botnets observed in the wild? (was: Re: Bitcoin in endgame
by Zooko Wilcox-O'Hearn 06 Jul '18

06 Jul '18

Folks: Here's a copy of a post I just made to my Google+ account about this alleged Botnet herder who has been answering questions about his operation on reddit: https://plus.google.com/108313527900507320366/posts/1oi1v7RxR1i === introduction === Someone is posting to reddit claiming to be a malware author, botnet operator, and that they use their Botnet to mine Bitcoin: B9. I asked them a question about the economics of using a Botnet for the Bitcoin distributed transaction-verification service ("Bitcoin mining"): B2. They haven't provided any proof of their claims, but on the other hand what they write and how they write it sounds plausible to me. === details === Here are my notes where I try to double-check their numbers and see if they make sense. They in their initial post B9 that they do 13-20 gigahashes/sec of work on the Bitcoin distributed transaction verification service. The screenshot they provided B3 shows 10.6 gigahashes/sec (GH/s) in progress, and that they're using a mining pool named BTCGuild. According to this chart of mining pools b4, BTCGuild currently totals about 12.5% of all known hashing power, and according to b5 the current total hashing power on the network is about 12.5 terahashes/sec (TH/s), so BTCGuild probably accounts for about 1.5 TH/s. They say that their Botnet has about 10,000 bots. The screen shot shows a count of "total bots" = 12,000 and "connected in the last 24 hours" = 3500. This ratio of total bots to bots connected in the last 24 hours is consistent with other reports I've read of Botnets b6, and also consistent with my experience in p2p networking. The number of "live bots" available at any one time for this Botnet herder should probably average out to somewhere between 350 and 550. Let's pick 500 as an easy number to work with. Does it makes sense that 500 bots could generate 10 GH/s? That's 20 MH/s per live bot. According to the Bitcoin wiki's page on mining hardware b7, a typical widely-available GPU should provide about 200 MH/s. Hm, so they are claiming only 1/10 the total hashpower that our back-of-the-envelope estimates would assign to them. Here is an answer they give to another person's question that sheds light on this: b8. Q: "Isn't Bitcoin mining pretty resource intensive on a computer? Like to the point someone would notice something is up on their system form it slowing eveyrthing down?" A: "My Botnet only mines if the computer is unused for 2 minutes and if the owner gets back it stops mining immidiatly, so it doesn't suck your fps at MW3. Also it mines as low priority so movies don't lag. I also set up a very safe threshold, the cards work at around 60% so they don't get overheated and the fans don't spin as crazy." It sounds plausible to me that those stealth measures could cut the throughput by 10 compared to running flat-out 24/7. Also it isn't clear if the botnet counts computers that don't have a GPU at all, or don't have a usable one. Maybe such computers are rare nowadays? Anyway if they are counted in there then that would be another reason why the hashing throughput per bot is lower than I calculated. In answer to another question B9b0, they said they get a steady $40/day from running the Bitcoin transaction-confirmation ("mining") service. According to this chart B9B9 from B9B2, the current U.S. Dollar value of Bitcoin mining is (or was a couple of days ago when they wrote that) about $0.33 per day for 100 MH/s. Multiplying that out by their claim of 10.6 GH/s results in $35/day. So that adds up, too. (Note that it sounds like their primary business is stealing and selling credit card numbers, and the Bitcoin transaction-verification service is a sideline.) I don't see a reason to doubt that they really generate about 10.6 GH/s of the Bitcoin distributed transaction verification service. My primary question is: if this is profitable on a per-bot basis, then why don't they scale up their operation? Of course, the answer to this presumably sheds light on the related question of why competitors of theirs don't launch similar operations. Perhaps one limiting factor is that the larger your Botnet, the more likely you'll be arrested by police or extorted by competitors. That may be a limiting factor that this person doesn't yet know about or doesn't like to think about. They mentioned b9 that most of their fellow cybercriminals are "too inexperienced to accept Bitcoin", so it may be that this person is just ahead of the curve and more people will launch operations like this in the future. That's the question that I asked them on redditbwhy don't they scale up? They haven't yet replied to my question, but they earlier mentioned in response to a different question b9: Q: "How many botted machines do you typically gain per month or per campaign." A: "about 500-1000 a day, weekends more. I'm thinking about just buying them in bulks and milking them for bitcoins. Asian installs are very cheap, 15$/1000 installs and have good GPUs." If they're really gaining 500 to 1000 new bots per day but they have a total of only 12,000 then either their operation is rapidly expanding, or the attrition rate is similarly high as the acquisition rate. === the bottom line and my take === I don't see any reason to doubt that this is real, and that this person with their Botnet is responsible for about 0.08% (i.e. less than 1/1000 b not 8%!) of the total Bitcoin distributed transaction-verification service, and that they profit for it at the rate of about $35 per day. There's one open question in my mind about whether this particular operator is currently rapidly expanding (adding 1000 bots per day to their network of 12,000 bots) or if the attrition rate of bots departing from the 12,000-node network is close to 1000 per day. If the $35/day revenue is really mostly profit (i.e., they don't have to spend so much time maintaining their 12,000-node Botnet that they forego more profitable activities, like stealing more credit cards or finishing their homework), I would expect them and others like them to turn more and more bots to this purpose. However, the nature of Bitcoin is that all providers of distributed transaction-confirmation service are in competition with one another. In the two weeks since this post went up on reddit, people around the globe deployed about 2 TH/s more hash power (see this graph of aggregate Bitcoin hash power b5), which cut the profitability of this one person's operation from $35.00/day to $30.00/day. If more and more Botnet operators get into the Bitcoin mining game, they will reduce the profitability of Bitcoin mining. (As well as competing with each other for access to victim computers, which has got to be a limited resources, right? Right? Or is there just a practically infinite supply of vulnerable computers waiting to be tapped if only someone can find a way to profit from them?) In parallel, the legitimate Bitcoin miners appear to be continuing to roll out new distributed transaction-verification service on their own hardware. Here is a recent post by "Bitcoinminer" about commercial Bitcoin farms based on GPU: B9B3. The operation spotlighted in that post apparently delivers 100 GH/s (about 10X that of our Botnet herder). At the same time, sales of FPGA-based Bitcoin devices appear to be booming. I wrote a post about that: B9b4. You'll have to scroll down through extensive discussion to find where I summarized the numbers, but in summary it appears that people are in the process of investing half a million USD in Bitcoin FPGA which, when all deployed, will deliver around 430 GH/s. I think there may be a kind of "Game of Chicken" going on: if someone makes a convincing show of investing in Bitcoin mining then they may deter other people from getting into the game and dividing up the profits. That may be the subtext of Bitcoinminer's blog postbhe may be trying to discourage competitors. An interesting thing about "Game of Chicken" is that large upfront costs can actually be an advantage because they demonstrate your commitment! If people are spending half a million dollars on FPGA Bitcoin miners, then their competitors had better believe they're really going to keep running them, even if competition drives down profitability. See, to deploy 10 GH/s of Bitcoin hash power using FPGA would require you to purchase about $10,000 worth of hardware which has no resell value except to other Bitcoin miners. To deploy 10 GH/s using GPU would require an outlay on about $5000 of hardware, which you could later resell for gaming (or whatever other uses GPUs have nowadays -- CAD/CAM?). To deploy 10 GH/s using a Botnet requires an unknown-to-me outlay of time, money, skill, or risk of personal harm, but at least the marginal cost of adding another few MH/s seems much lower than in the hardware-based approach. Our Botnet herder on reddit said he could buy access to Asian PCs with good GPUs for $15 for 1000 PCs. If that's true then it should cost a piddling $180 to set up a new network as big as his current 10 GH/s network. However, if he is considering doing something else with his time and money, then the fact that people have convincingly committed to large-scale FGPA mining may deter him, because no matter how well he does at competing with them, they've already paid a sunk cost, and their marginal cost for electricity is low, so they won't quit. (Unless competition swells to such a level that it drives revenue below their cost of electricity, which seems like a distant prospect at this point.) Thus they might win at the Game of Chicken and persuade him to spend his time and money on different projects (such stealing more credit cards or doing a better job on his homework). (There are also several organizations who are loudly proclaiming that they're developing custom ASIC chips for Bitcoin mining. I haven't yet seen hard evidence of any of them having really spent substantial money on it or having demonstrable progress on the engineering and manufacturing.) === last word === I'm delighted to see such vigorous and varied competition for contributing to the distributed, planet-wide transaction-confirmation service. I especially like the "sunk-cost" people such as the FPGA miners with their low electricity requirements, because they seem likely to be long-term, always-on contributors. B9 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B2 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B3 https://lafsgateway.zooko.com/file/URI:CHK:sdk72a5zmncihhmhdsremrglem:ez25w… b4 http://blockorigin.pfoe.be/chart.php b5 http://bitcoin.sipa.be b6 http://blog.damballa.com/?p=330 b7 https://en.bitcoin.it/wiki/Mining_Hardware_Comparison b8 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… b9 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B9b0 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B9B9 http://bitcoinx.com/charts/chart_large_lin_30d.png B9B2 http://bitcoinx.com/charts/ B9B3 http://www.bitcoinminer.com/post/22769728108/commercial-mining-farms B9b4 https://plus.google.com/108313527900507320366/posts/2ztAhLnXQK _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: IP: RE: Senate votes to permit warrantless Net-wiretaps,
by None 06 Jul '18

06 Jul '18

Carnivore us e Cc: SAlbertazzie(a)steptoe.com, SBaker(a)steptoe.com Dave, I'm glad to see Stu joining the civil libertarian crowd. He's right, of course, that there are reasons to be uneasy about the new "Combating Terrorism Act." Current law permits specific Justice Department officials to authorize meatspace telephone pen register and trap and trace devices without a court order in two circumstances. Here's an excerpt from the U.S. Code: http://www4.law.cornell.edu/uscode/18/3125.html >an emergency situation exists that involves immediate danger of death or >serious bodily injury to any person [or] conspiratorial activities >characteristic of organized crime This bill does three things of note: 1. It adds "U.S. Attorney" to the list of officials who can authorize warantless surveillance. 2. It expands the "emergency situation" rule beyond serious bodily injury/organized crime. I described this in my article: http://www.wired.com/news/politics/0,1283,46852,00.html >Circumstances that don't require court orders include an "immediate threat >to the national security interests of the United States, (an) immediate >threat to public health or safety or an attack on the integrity or >availability of a protected computer." That covers most computer hacking >offenses. 3. It rewrites pen register/trap and trace law and moves it from the telephone world to explicitly cover computer networks as well, which would permit Carnivore's use under this section (when operated in trap-and-trace/pen-register mode). Here are some excerpts from the bill: http://www.politechbot.com/docs/cta.091401.html >The order shall, upon service of the order, apply to any entity providing >wire or electronic communication service in the United States... inserting >``, routing, addressing,'' after ``dialing''... by striking ``call >processing'' and inserting ``the processing and transmitting of wire and >electronic communications''... Now, whether all this is, as Stu blandly suggests, "a bit alarmist," is up to IPers to decide. But I think Senator Patrick Leahy, the chairman of the Senate Judiciary committee, put it well during the floor debate last night. Here's a quote from the Congressional Record. http://www.fas.org/sgp/congress/2001/s091301.html >LEAHY: Maybe the Senate wants to just go ahead and adopt new abilities to >wiretap our citizens. Maybe they want to adopt new abilities to go into >people's computers. Maybe that will make us feel safer. Maybe. And maybe >what the terrorists have done made us a little bit less safe. Maybe they >have increased Big Brother in this country. -Declan **********

1 0

RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn
by Declan McCullagh 06 Jul '18

06 Jul '18

ivore us e Cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> To: "Baker, Stewart" <SBaker(a)steptoe.com>, farber(a)cis.upenn.edu, ip-sub-1(a)majordomo.pobox.com Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn ivore us e Cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> Stu, Maybe you're right. Maybe this expansion of warrantless surveillance powers is unobjectionable. Maybe the FBI and the state law enforcement agencies that will be able to legally use Carnivore without a court order in some circumstances will prove entirely trustworthy. Maybe they truly do need this power in emergencies. Maybe it'll even stop some terrorists. Maybe you're correct to say, "What's the big deal?" But let's have that discussion in public, during daylight hours, in a hearing room where reasoned conversation can take place. Let's ask the FBI director and the attorney general to testify, and let's invite representatives from groups like the ACLU, CDT and EPIC to join them. Let's allow senators to ask the bill's sponsors tough questions about what this oddly-written legislation really does. And let's give them as much time as they need to answer. What we shouldn't do is rush substantial rewrites of wiretapping law through the Senate in the middle of the night, just two days after the worst terrorist attack ever, when the country is in the throes of a national emergency. What we shouldn't do is have the legislation's sponsors -- and I don't doubt that they have the best of intentions -- hand it to their fellow senators just 30 minutes or so before a vote, which is what reportedly happened Thursday night. Stu, you've worked both in the government and in the private sector. You've studied wiretap law more closely than nearly anyone else. You know how it works. But would most senators know offhand what expanding wiretapping to include "any criminal violation of sections 2332, 2332a, 2332b, 2332d, 2339A, or 2339B" means? This is what Senator Patrick Leahy of Vermont, the chairman of the Judiciary committee and a former prosecutor, said during the floor debate: "Do we really show respect to the American people by slapping something together, something that nobody on the floor can explain, and say we are changing the duties of the Attorney General, the Director of the CIA, the U.S. attorneys, we are going to change your rights as Americans, your rights to privacy? We are going to do it with no hearings, no debate. We are going to do it with numbers on a page that nobody can understand." Senator Carl Levin of Michigan said he had no time to read what he was being asked to vote on, adding that he had been told the bill was merely an anti-terrorism measure but it seemed to do far more: "I am trying to understand what is in it since it came to me for the first time tonight. I want to be very clear, at least the way I read this, that this is not something that is just limited to counterterrorism, about which I think all of us would have a passion." The spending bill to which the wiretap legislation ("Combating Terrorism Act of 2001") was attached will have to go to conference committee and then, probably, both chambers of Congress for another vote. That process means the bill won't become law for weeks at best. During that time, Congress could have held at least one hearing on the bill; in fact, Leahy said he would have done so immediately. If the bill is so vital to our national security, couldn't it survive a straight up-or-down floor vote, rather than be attached to a massive must-pass appropriations bill for the Justice, Commerce, and State departments? As a side note, even if you believe the language to be unobjectionable, Senate Judiciary committee aides told me they believe the wording of the bill -- apparently hastily-drafted, complete with typos -- may cover the content of communications, not just origin-desination information. If they're not sure, and they had a full day to read it by the time I spoke with them Friday, how can you be so positive your interpretation is correct? Even if you're right, doesn't it make sense to double-check? During the next few months and years, we may see calls for restricting the freedoms Americans have enjoyed as a way to respond to and thwart terrorists. Many of these new laws and regulations are unobjectionable; I don't mind tighter temporary security around government buildings and airports. But others are more deserving of enlightened discussion and debate. Let's hope that happens, not in the darkness of midnight votes, but in public in the light of day. -Declan ********** ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn ivore us e
by Baker, Stewart 06 Jul '18

06 Jul '18

Declan, I ignored the first two points because I don't think they're that important. These "warrantless searches" are emergency orders that have to be followed by a court order in 48 hours. Sometimes courts are closed and the cops need data right away. Tuesday evening would be a good example. This is not some out-of-control police authority. The people who can ask for emergency orders have to be designated by one of several officials at Main Justice. That's to make sure someone responsible ends up with the authority to declare an emergency. So an assistant US attorney could be designated by Main Justice in each district right now. What's the big deal with letting the US Attorney for the district do the designating instead of Main Justice? Seems to me that the US Attorney probably knows more about staff changeovers than Main Justice, so it makes sense for the US Attorney to do the designating locally. Stewart **********

1 0