July 2018 - cypherpunks-legacy

[tt] NS 2836: Inside Facebook's massive cyber-security system
by Premise Checker 06 Jul '18

06 Jul '18

NS 2836: Inside Facebook's massive cyber-security system http://www.newscientist.com/article/dn21095-inside-facebooks-massive-cybers… * 17:20 26 October 2011 by Jim Giles FACEBOOK has released details of the extraordinary security infrastructure it uses to fight off spam and other cyber-scams. Known as the Facebook Immune System (FIS), the massive defence network appears to be successful: numbers released by the company this week show that less than 1 per cent of users experience spam. Yet it's not perfect. Researchers have built a novel attack that evaded the cyber-defences and extracted private material from real users' Facebook accounts. It took just three years for FIS to evolve from basic beginnings into an all-seeing set of algorithms that monitors every photo posted to the network, every status update- indeed, every click made by every one of the 800 million users. There are more than 25 billion of these "read and write actions" every day. At peak activity the system checks 650,000 actions a second. "It's a big challenge," says Jim Larus, a Microsoft researcher in Redmond, Washington, who studies large networks. The only network bigger, Larus suspects, is the web itself. That makes Facebook's defence system one of the largest in existence. It protects against scams by harnessing artificially intelligent software to detect suspicious patterns of behaviour. The system is overseen by a team of 30 people, but it can learn in real time and is able to take action without checking with a human supervisor. One notable attack took place in April, says [10]Tao Stein, a Facebook engineer who works on the system. It began when several users were duped into copying computer code into their browser's address bar. The code commandeered the person's Facebook account, and started sending chat messages to their friends saying things like "I just got a free iPad", along with a link where the friends could go to get their own. Friends who clicked on the link went to a site that encouraged them to paste the same code into their browsers, further spreading the plague. "Attacks like these can generate millions of messages per minute," says Stein. [10] http://research.microsoft.com/en-us/projects/ldg/a10-stein.pdf Users are less likely to fall for a similar tactic when using email, because the message would probably be sent by a stranger. But inside Facebook's network it's much more persuasive. "It's easier to exploit trust relationships in online social networks," says Justin Ma, a computer scientist at the University of California, Berkeley, who develops methods to combat email spam. To tackle the attack, FIS generated a signature that it used to differentiate between spam and legitimate messages. This was based on the links in the spam messages, keywords like "free" and "iPad", and the IP addresses of the computers sending the messages. But spammers can use multiple machines to switch IP addresses, and link redirection services like [11]bit.ly can change links on the fly. So FIS checked to see which messages were being flagged as spam by users and blocked messages with similar keywords in the text. Together with other features of the message, which Facebook declined to discuss for fear of aiding spammers, the system was able to begin developing a signature to identify the spam within seconds of the attack emerging. [11] https://bitly.com/ Facebook said this week that, thanks to FIS, less than 4 per cent of the network's messages are spam and that fewer than 1 in 200 users experience spam on any given day. "It's pretty good," says Ma, who has a Facebook account. "I'm pretty happy with the level of security." Yet like any defence based on patterns of known behaviour, FIS is vulnerable to strategies it has not seen before. Yazan Boshmaf and colleagues at the University of British Columbia in Vancouver, Canada, [12]have exploited this and eluded the system by creating "socialbots"- software that can pose as a human and control a Facebook account. [12] http://lersse-dl.ece.ubc.ca/record/264 The bots began by sending friend requests to random users, around 1 in 5 of whom accepted. They then sent requests to the friends of the people they had connected with, and the acceptance rate jumped to almost 60 per cent. After seven weeks the team's 102 bots had made a combined 3000 friends. Facebook's privacy settings allow users to shield personal information from public view. But because the socialbots posed as friends, they were able to extract some 46,500 email addresses and 14,500 physical addresses from users' profiles- information that could be used to launch phishing attacks or aid in identity theft. "An attacker could do many things with this data," says Boshmaf, who will present the team's work at the Annual Computer Security Applications Conference in Orlando, Florida, next month. A socialbot attack is yet to happen, but it's only a matter of time. Socialbots behave differently to humans that enter Facebook for the first time, in part because they have no real-world friends to connect with, and their random requests lead to an unusually high number of rejections. FIS would be able to use this pattern to recognise and block an attack of socialbots, says Stein. That would put Facebook back on top- if only until hackers release their next innovation. _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Apparent large telco liability based on USA Today facts
by Peter Swire 06 Jul '18

06 Jul '18

Dave: Perhaps your list can spot a flaw here. Based on the statutory language, it seems that the telcos face really large liability on the facts as reported in USA Today. Thanks, Peter http://thinkprogress.org/2006/05/11/telcos-liable/ This morning, USA Today reported that three telecommunications companies - AT&T, Verizon and BellSouth - provided "phone call records of tens of millions of Americans" to the National Security Agency. Such conduct appears to be illegal and could make the telco firms liable for tens of billions of dollars. Here's why: 1. It violates the Stored Communications Act. The Stored Communications Act, Section 2703(c), provides exactly five exceptions that would permit a phone company to disclose to the government the list of calls to or from a subscriber: (i) a warrant; (ii) a court order; (iii) the customer's consent; (iv) for telemarketing enforcement; or (v) by "administrative subpoena." The first four clearly don't apply. As for administrative subpoenas, where a government agency asks for records without court approval, there is a simple answer - the NSA has no administrative subpoena authority, and it is the NSA that reportedly got the phone records. 2. The penalty for violating the Stored Communications Act is $1000 per individual violation. Section 2707 of the Stored Communications Act gives a private right of action to any telephone customer "aggrieved by any violation." If the phone company acted with a "knowing or intentional state of mind," then the customer wins actual harm, attorney's fees, and "in no case shall a person entitled to recover receive less than the sum of $1,000." (The phone companies might say they didn't "know" they were violating the law. But USA Today reports that Qwest's lawyers knew about the legal risks, which are bright and clear in the statute book.) 3. The Foreign Intelligence Surveillance Act doesn't get the telcos off the hook. According to USA Today, the NSA did not go to the FISA court to get a court order. And Qwest is quoted as saying that the Attorney General would not certify that the request was lawful under FISA. So FISA provides no defense for the phone companies, either. In other words, for every 1 million Americans whose records were turned over to NSA, the telcos could be liable for $1 billion in penalties, plus attorneys fees. You do the math. Prof. Peter P. Swire C. William O'Neill Professor of Law Moritz College of Law of The Ohio State University Visiting Senior Fellow, Center for American Progress (240) 994-4142, www.peterswire.net ------------------------------------- You are subscribed as synthesis.law.and.technology(a)gmail.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ -- ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on COMMENTS REQUESTED -- Apparent large telco liability
by David Farber 06 Jul '18

06 Jul '18

based on USA Today facts X-Mailer: Apple Mail (2.750) Reply-To: dave(a)farber.net Begin forwarded message: From: "Synthesis: Law and Technology" <synthesis.law.and.technology(a)gmail.com> Date: May 12, 2006 12:09:54 PM EDT To: dave(a)farber.net Cc: peter(a)peterswire.net Subject: Re: [IP] COMMENTS REQUESTED -- Apparent large telco liability based on USA Today facts Dave, I doubt Peter expected us to find a flaw in his actual analysis since all the loop holes have already been covered and under the most extreme interpretations one would find it difficult to argue directly against his reasoning. If there is a defence possible for the telcos it might be under yet-another discussion of the presidential authority (or the limits thereof). The difference I see in this one (and I am most definitely not an expert on this) is the monetary one. The direct civil cause of action in the statute would seem to incentive for this one to perhaps be taken further? It will be interesting to observe, especially given Qwest's refusal to comply (apparently without sanction?). If Qwest had concerns and voiced them and was not forced to comply it would appear this could be a difficult one, and not just for the telcos. Dan Steinberg SYNTHESIS:Law & Technology 35, du Ravin phone: (613) 794-5356 Chelsea, Quebec J9B 1N1 On 5/12/06, David Farber <dave(a)farber.net> wrote: Begin forwarded message:

1 0

Re: [IP] more on FBI plans new Net-tapping push
by Phil Karn 06 Jul '18

06 Jul '18

David Farber wrote: >But there's a piece missing. Crypto controls of course! This is of course possible, and it's a bit surprising that this other shoe has not yet fallen so long after 9/11. But consider that any push to regulate or restrict strong crypto would: 1. Draw widespread public attention to the fact that the government cannot break it; 2. Be totally ineffectual since crypto is so widely available from so many places in the world; 3. Go against the strongly stated public positions of many conservative Republicans during the "crypto wars" of the mid 1990s, when, coincidentally, Clinton was in office and pushing the Clipper Chip; 4. Be totally ignored by precisely those people whom the government is supposedly most interested in targeting; and 5. Be mostly irrelevant to what the spooks actually do when they vacuum up electronic communications, namely traffic analysis (who talks to who, when, where and how much) rather than acquiring actual content. Content takes too much effort to analyze (and possibly translate), even when it's in the clear. Traffic analysis can be done automatically on a huge scale, and it can be frighteningly effective. As an aside, I note that not much attention has been paid to the "where" part of communications. Cell phones -- even when they're not in calls -- make excellent physical tracking devices. Not even secure end-to-end encryption can change that. It's inherent in how they work. I have no actual information on this, but based on my knowledge of the technology and ongoing revelations of the government's insatiable appetite for data on non-citizens and citizens alike, I confidently predict that the next big revelation in the ongoing saga of massive government data-mining will involve mobile phone registrations. These are the short "I'm here and ready for a call" data messages that all mobile phones transmit every few minutes whenever they're on and idle. Even without GPS for augmented E911 positioning, registrations tell what cell sector you're in. These sectors can be quite small (a few blocks) in densely populated areas. At the very least, they're certainly sufficient to tell what country and city you're in. --Phil ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on FBI plans new Net-tapping push
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tt] NS 2836: Inside Facebook's massive cyber-security system
by Premise Checker 06 Jul '18

06 Jul '18

NS 2836: Inside Facebook's massive cyber-security system http://www.newscientist.com/article/dn21095-inside-facebooks-massive-cybers… * 17:20 26 October 2011 by Jim Giles FACEBOOK has released details of the extraordinary security infrastructure it uses to fight off spam and other cyber-scams. Known as the Facebook Immune System (FIS), the massive defence network appears to be successful: numbers released by the company this week show that less than 1 per cent of users experience spam. Yet it's not perfect. Researchers have built a novel attack that evaded the cyber-defences and extracted private material from real users' Facebook accounts. It took just three years for FIS to evolve from basic beginnings into an all-seeing set of algorithms that monitors every photo posted to the network, every status update- indeed, every click made by every one of the 800 million users. There are more than 25 billion of these "read and write actions" every day. At peak activity the system checks 650,000 actions a second. "It's a big challenge," says Jim Larus, a Microsoft researcher in Redmond, Washington, who studies large networks. The only network bigger, Larus suspects, is the web itself. That makes Facebook's defence system one of the largest in existence. It protects against scams by harnessing artificially intelligent software to detect suspicious patterns of behaviour. The system is overseen by a team of 30 people, but it can learn in real time and is able to take action without checking with a human supervisor. One notable attack took place in April, says [10]Tao Stein, a Facebook engineer who works on the system. It began when several users were duped into copying computer code into their browser's address bar. The code commandeered the person's Facebook account, and started sending chat messages to their friends saying things like "I just got a free iPad", along with a link where the friends could go to get their own. Friends who clicked on the link went to a site that encouraged them to paste the same code into their browsers, further spreading the plague. "Attacks like these can generate millions of messages per minute," says Stein. [10] http://research.microsoft.com/en-us/projects/ldg/a10-stein.pdf Users are less likely to fall for a similar tactic when using email, because the message would probably be sent by a stranger. But inside Facebook's network it's much more persuasive. "It's easier to exploit trust relationships in online social networks," says Justin Ma, a computer scientist at the University of California, Berkeley, who develops methods to combat email spam. To tackle the attack, FIS generated a signature that it used to differentiate between spam and legitimate messages. This was based on the links in the spam messages, keywords like "free" and "iPad", and the IP addresses of the computers sending the messages. But spammers can use multiple machines to switch IP addresses, and link redirection services like [11]bit.ly can change links on the fly. So FIS checked to see which messages were being flagged as spam by users and blocked messages with similar keywords in the text. Together with other features of the message, which Facebook declined to discuss for fear of aiding spammers, the system was able to begin developing a signature to identify the spam within seconds of the attack emerging. [11] https://bitly.com/ Facebook said this week that, thanks to FIS, less than 4 per cent of the network's messages are spam and that fewer than 1 in 200 users experience spam on any given day. "It's pretty good," says Ma, who has a Facebook account. "I'm pretty happy with the level of security." Yet like any defence based on patterns of known behaviour, FIS is vulnerable to strategies it has not seen before. Yazan Boshmaf and colleagues at the University of British Columbia in Vancouver, Canada, [12]have exploited this and eluded the system by creating "socialbots"- software that can pose as a human and control a Facebook account. [12] http://lersse-dl.ece.ubc.ca/record/264 The bots began by sending friend requests to random users, around 1 in 5 of whom accepted. They then sent requests to the friends of the people they had connected with, and the acceptance rate jumped to almost 60 per cent. After seven weeks the team's 102 bots had made a combined 3000 friends. Facebook's privacy settings allow users to shield personal information from public view. But because the socialbots posed as friends, they were able to extract some 46,500 email addresses and 14,500 physical addresses from users' profiles- information that could be used to launch phishing attacks or aid in identity theft. "An attacker could do many things with this data," says Boshmaf, who will present the team's work at the Annual Computer Security Applications Conference in Orlando, Florida, next month. A socialbot attack is yet to happen, but it's only a matter of time. Socialbots behave differently to humans that enter Facebook for the first time, in part because they have no real-world friends to connect with, and their random requests lead to an unusually high number of rejections. FIS would be able to use this pattern to recognise and block an attack of socialbots, says Stein. That would put Facebook back on top- if only until hackers release their next innovation. _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tahoe-dev] Blog post: Introducing BRIC (Bunch of Redundant Independent Clouds)
by Bitcartel Software 06 Jul '18

06 Jul '18

Hi, I experimented with Tahoe-LAFS to cobble together a cheap (free) cloud from online storage providers. https://bitcartel.wordpress.com/2012/10/21/rbic-redundant-bunch-of-independ… Lots of room for improvement, so feedback is most welcome. Cheers, Simon _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Alternative Physics - Tom Bearden's site
by Gary Jeffers 06 Jul '18

06 Jul '18

Alternative Physics - Tom Bearden's site My fellow Cypherpunks, I've found a really interesting site based on alternative physics. http://www.cheniere.org - Tom Bearden's site. The site also deals with free energy, zero point energy, scalars, health physics, alternate physics weapons, and mind control physics. Some of Bearden's interesting pages: THE FINAL SECRET OF FREE ENERGY http://www.cheniere.org/techpapers/final%secret%209%20feb%201993/index.html - It may or may not be necessary to replace "%" with blanks. ANNOTATED GLOSSARY BY TOM BEARDEN (of physics) http://www.intalek.com/warpdrive/glossary1.pdf Some teasing bait for physicists: 34 FLAWS IN CLASSICAL EM THEORY http://www.cheniere.org/misc/34flaws.htm A VISUAL TOUR OF WHAT THEY DON'T WANT YOU TO KNOW ABOUT ELECTRICAL CIRCUITS http://www.cheniere.org/briefings/circuitcurrents/index.html If this site is true then "EVERYTHING YOU KNOW IS WRONG!" The quote is from FireSign Theater - a comedy group. Yours Truly, Gary Jeffers Beat State! _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Alternative Physics - Tom Bearden's site
by Gary Jeffers 06 Jul '18

06 Jul '18

Alternative Physics - Tom Bearden's site My fellow Cypherpunks, I've found a really interesting site based on alternative physics. http://www.cheniere.org - Tom Bearden's site. The site also deals with free energy, zero point energy, scalars, health physics, alternate physics weapons, and mind control physics. Some of Bearden's interesting pages: THE FINAL SECRET OF FREE ENERGY http://www.cheniere.org/techpapers/final%secret%209%20feb%201993/index.html - It may or may not be necessary to replace "%" with blanks. ANNOTATED GLOSSARY BY TOM BEARDEN (of physics) http://www.intalek.com/warpdrive/glossary1.pdf Some teasing bait for physicists: 34 FLAWS IN CLASSICAL EM THEORY http://www.cheniere.org/misc/34flaws.htm A VISUAL TOUR OF WHAT THEY DON'T WANT YOU TO KNOW ABOUT ELECTRICAL CIRCUITS http://www.cheniere.org/briefings/circuitcurrents/index.html If this site is true then "EVERYTHING YOU KNOW IS WRONG!" The quote is from FireSign Theater - a comedy group. Yours Truly, Gary Jeffers Beat State! _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Alternative Physics - Tom Bearden's site
by Gary Jeffers 06 Jul '18

06 Jul '18

Alternative Physics - Tom Bearden's site My fellow Cypherpunks, I've found a really interesting site based on alternative physics. http://www.cheniere.org - Tom Bearden's site. The site also deals with free energy, zero point energy, scalars, health physics, alternate physics weapons, and mind control physics. Some of Bearden's interesting pages: THE FINAL SECRET OF FREE ENERGY http://www.cheniere.org/techpapers/final%secret%209%20feb%201993/index.html - It may or may not be necessary to replace "%" with blanks. ANNOTATED GLOSSARY BY TOM BEARDEN (of physics) http://www.intalek.com/warpdrive/glossary1.pdf Some teasing bait for physicists: 34 FLAWS IN CLASSICAL EM THEORY http://www.cheniere.org/misc/34flaws.htm A VISUAL TOUR OF WHAT THEY DON'T WANT YOU TO KNOW ABOUT ELECTRICAL CIRCUITS http://www.cheniere.org/briefings/circuitcurrents/index.html If this site is true then "EVERYTHING YOU KNOW IS WRONG!" The quote is from FireSign Theater - a comedy group. Yours Truly, Gary Jeffers Beat State! _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0