July 2018 - cypherpunks-legacy

None
by Zach Tumin 06 Jul '18

06 Jul '18

I am pleased to announce the availability of FSTC's "Understanding and Countering the Phishing Threat," the summary whitepaper of findings and recommendations of the FSTC Counter-Phishing Project. The whitepaper contains valuable data, published here for the first time, including FSTC's "Phishing Attack Life Cycle" and FSTC's "Taxonomy of Phishing Attacks." This and all other project deliverables are located at http://fstc.org/projects/counter-phishing-phase-1/ In addition to the whitepaper, the following deliverables are being made available on the site, as follows: TO ALL: "Results Summary: FSTC Counter-Phishing Solutions Survey": An overview of the 60+ solutions currently offered on the marketplace, broken down by where they map against the FSTC "Phishing Attack Life Cycle" TO ALL: "Vocabulary of Phishing Terms": A glossary of terms used throughout the project. The project team used these to "speak the same language" when talking about the problem and potential solutions, whether internally, or with vendors, or with customers TO FSTC MEMBERS ONLY: "Results Summarized By Solution": identifies solutions by company and product name as they map against the different phases of the FSTC "Phishing Attack Life Cycle" TO FSTC MEMBERS ONLY: "Directory of Survey Respondents": contact information for each company/solution provider that responded to the survey FOR PURCHASE: "Cost/Impact Spreadsheet Tool": a tool that provides a means to estimate the direct and indirect costs/impacts of phishing to a financial institution FSTC extends its gratitude to its member organizations for their efforts and contributions in completing this important industry research, and to the project's talented management team for helping our members realize their goals. ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Zach Tumin 06 Jul '18

06 Jul '18

I am pleased to announce the availability of FSTC's "Understanding and Countering the Phishing Threat," the summary whitepaper of findings and recommendations of the FSTC Counter-Phishing Project. The whitepaper contains valuable data, published here for the first time, including FSTC's "Phishing Attack Life Cycle" and FSTC's "Taxonomy of Phishing Attacks." This and all other project deliverables are located at http://fstc.org/projects/counter-phishing-phase-1/ In addition to the whitepaper, the following deliverables are being made available on the site, as follows: TO ALL: "Results Summary: FSTC Counter-Phishing Solutions Survey": An overview of the 60+ solutions currently offered on the marketplace, broken down by where they map against the FSTC "Phishing Attack Life Cycle" TO ALL: "Vocabulary of Phishing Terms": A glossary of terms used throughout the project. The project team used these to "speak the same language" when talking about the problem and potential solutions, whether internally, or with vendors, or with customers TO FSTC MEMBERS ONLY: "Results Summarized By Solution": identifies solutions by company and product name as they map against the different phases of the FSTC "Phishing Attack Life Cycle" TO FSTC MEMBERS ONLY: "Directory of Survey Respondents": contact information for each company/solution provider that responded to the survey FOR PURCHASE: "Cost/Impact Spreadsheet Tool": a tool that provides a means to estimate the direct and indirect costs/impacts of phishing to a financial institution FSTC extends its gratitude to its member organizations for their efforts and contributions in completing this important industry research, and to the project's talented management team for helping our members realize their goals. ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Zach Tumin 06 Jul '18

06 Jul '18

I am pleased to announce the availability of FSTC's "Understanding and Countering the Phishing Threat," the summary whitepaper of findings and recommendations of the FSTC Counter-Phishing Project. The whitepaper contains valuable data, published here for the first time, including FSTC's "Phishing Attack Life Cycle" and FSTC's "Taxonomy of Phishing Attacks." This and all other project deliverables are located at http://fstc.org/projects/counter-phishing-phase-1/ In addition to the whitepaper, the following deliverables are being made available on the site, as follows: TO ALL: "Results Summary: FSTC Counter-Phishing Solutions Survey": An overview of the 60+ solutions currently offered on the marketplace, broken down by where they map against the FSTC "Phishing Attack Life Cycle" TO ALL: "Vocabulary of Phishing Terms": A glossary of terms used throughout the project. The project team used these to "speak the same language" when talking about the problem and potential solutions, whether internally, or with vendors, or with customers TO FSTC MEMBERS ONLY: "Results Summarized By Solution": identifies solutions by company and product name as they map against the different phases of the FSTC "Phishing Attack Life Cycle" TO FSTC MEMBERS ONLY: "Directory of Survey Respondents": contact information for each company/solution provider that responded to the survey FOR PURCHASE: "Cost/Impact Spreadsheet Tool": a tool that provides a means to estimate the direct and indirect costs/impacts of phishing to a financial institution FSTC extends its gratitude to its member organizations for their efforts and contributions in completing this important industry research, and to the project's talented management team for helping our members realize their goals. ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Zach Tumin 06 Jul '18

06 Jul '18

I am pleased to announce the availability of FSTC's "Understanding and Countering the Phishing Threat," the summary whitepaper of findings and recommendations of the FSTC Counter-Phishing Project. The whitepaper contains valuable data, published here for the first time, including FSTC's "Phishing Attack Life Cycle" and FSTC's "Taxonomy of Phishing Attacks." This and all other project deliverables are located at http://fstc.org/projects/counter-phishing-phase-1/ In addition to the whitepaper, the following deliverables are being made available on the site, as follows: TO ALL: "Results Summary: FSTC Counter-Phishing Solutions Survey": An overview of the 60+ solutions currently offered on the marketplace, broken down by where they map against the FSTC "Phishing Attack Life Cycle" TO ALL: "Vocabulary of Phishing Terms": A glossary of terms used throughout the project. The project team used these to "speak the same language" when talking about the problem and potential solutions, whether internally, or with vendors, or with customers TO FSTC MEMBERS ONLY: "Results Summarized By Solution": identifies solutions by company and product name as they map against the different phases of the FSTC "Phishing Attack Life Cycle" TO FSTC MEMBERS ONLY: "Directory of Survey Respondents": contact information for each company/solution provider that responded to the survey FOR PURCHASE: "Cost/Impact Spreadsheet Tool": a tool that provides a means to estimate the direct and indirect costs/impacts of phishing to a financial institution FSTC extends its gratitude to its member organizations for their efforts and contributions in completing this important industry research, and to the project's talented management team for helping our members realize their goals. ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Military's news-planting service (New York Times)
by Ted Nelson 06 Jul '18

06 Jul '18

Military's Information War Is Vast and Often Secretive By JEFF GERTH The media center in Fayetteville, N.C., would be the envy of any global communications company. In state of the art studios, producers prepare the daily mix of music and news for the group's radio stations or spots for friendly television outlets. Writers putting out newspapers and magazines in Baghdad and Kabul converse via teleconferences. Mobile trailers with high-tech gear are parked outside, ready for the next crisis. The center is not part of a news organization, but a military operation, and those writers and producers are soldiers. The 1,200-strong psychological operations unit based at Fort Bragg turns out what its officers call "truthful messages" to support the United States government's objectives, though its commander acknowledges that those stories are one-sided and their American sponsorship is hidden. "We call our stuff information and the enemy's propaganda," said Col. Jack N. Summe, then the commander of the Fourth Psychological Operations Group, during a tour in June. Even in the Pentagon, "some public affairs professionals see us unfavorably," and inaccurately, he said, as "lying, dirty tricksters." http://www.nytimes.com/2005/12/11/politics/11propaganda.html?ei=5090&en=3b2… 30b7c656c93&ex=1291957200&partner=rssuserland&emc=rss&pagewanted=print Cheers,T ________________________________________________ Theodor Holm Nelson, Fellow, Oxford Internet Institute University of Oxford, 1 St Giles, Oxford OX1 3JS, UK V. Professor, U. Southampton; V. Fellow, Wadham College Founder, Project Xanadu (the first hypertext project), 1960+ ? e-mail: tandm(a)xanadu.net ? http://ted.hyperland.com, ? xanadu.com ? translit.org ? transcopyright.org ? world-wide phone and fax +1/908-847-0264 _________________________________________________ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Military's news-planting service (New York Times)
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [E-PRV] "Steven M. Bellovin": loophole in FISA?
by John Gilmore 06 Jul '18

06 Jul '18

>Hi John--As I think I've already mentioned, Steven is probably >right--indiscriminate extraterritorial wiretapping that is not >targeted >at particular people likely isn't prohibited by FISA. However, this >loophole is more relevant to ECHELON and global eavesdropping >generally, not the current wiretap controversy, as the >currently-controversial wiretaps definitely targeted specific people >within the US and almost certainly occurred within US borders. Please read the Ars Technica post that Steve cited. It really isn't clear that the currently-controversial wiretaps "definitely targeted specific people". And it's also pretty clear that it almost certainly DIDN'T occur within US borders; see Hayden's press conference, transcripted in full by Declan: http://www.politechbot.com/2005/12/20/transcript-of-briefing/ The clues are piling up that vacuum-cleaner style dragnets are what's at issue: http://arstechnica.com/news.ars/post/20051220-5808.html The new text below from today's Post leads me in the same direction. They make a big distinction between "detecting" and "monitoring", where "monitoring" is what requires warrants, while "detecting" doesn't. (It depends on what the meaning of "is" is.) http://www.washingtonpost.com/wp-dyn/content/article/2005/12/21/ AR2005122102326.html >Still, Bush and his advisers have said they need to operate outside >the FISA system in order to move quickly against suspected >terrorists. In explaining the program, Bush has made the distinction >between detecting threats and plots and monitoring likely, known >targets, as FISA would allow. > >Bush administration officials believe it is not possible, in a >large-scale eavesdropping effort, to provide the kind of evidence the >court requires to approve a warrant. Sources knowledgeable about the >program said there is no way to secure a FISA warrant when the goal is >to listen in on a vast array of communications in the hopes of finding >something that sounds suspicious. Attorney General Alberto R. Gonzales >said the White House had tried but failed to find a way. > >One government official, who spoke on the condition of anonymity, said >the administration complained bitterly that the FISA process demanded >too much: to name a target and give a reason to spy on it. > >"For FISA, they had to put down a written justification for the >wiretap," said the official. "They couldn't dream one up." > >The NSA program, and the technology on which it is based, makes it >impossible to meet that criterion because the program is designed to >intercept selected conversations in real time from among an enormous >number relayed at any moment through satellites. > >"There is a difference between detecting, so we can prevent, and >monitoring. And it's important to note the distinction between the >two," Bush said Monday. It appears that perhaps they've pointed the NSA vacuum cleaner straight into all US-based international telecommunications. [By the way, satellites are only a tiny part of it; the vast majority of conversations go via fiber, and NSA can tap them. It's not clear why the Post said "satellites" here.] Perhaps NSA is just sampling every communication to determine what language it's in, and feeding all the Arabic to further analysis. The theory would be that if they didn't feed your call to further analysis, then it was only "detected", not "monitored". We've seen inklings of this before, in the context of wiretapping IP traffic. They claim that having a computer look at every bit and byte is OK without a warrant as long as it sorts out the "signalling info" like URLs and email addresses, which are buried deep in the user's packets right next to all the un-wiretappable stuff. It's total hokum, unsupported by law, but it's their theory. Hmm, here's my conclusion. Perhaps they're doing a pen-register/ trap-and-trace on every call that leaves or enters the US. They're building up the database containing the huge network of who-calls-who, over the long term. (This would also sweep up any touch-tones during a call, including PIN codes, passwords, dial-back systems, etc). And then when they capture a bad guy who was using phone number X, they look it up and know every number who called phone number X, or received a call from it. And then they do directed wiretaps against those numbers (with or without the FISA court). No wonder a judge in the know would resign to call attention to this! Is this a murky area of international wiretap law? It's clear NSA can't broadly wiretap the CONTENTS of communications of US citizens, without a warrant. Can it broadly wiretap the SIGNALLING of US citizens, and store it forever for easy lookup, without a warrant? >From within the government we see everywhere their assumption that they have carte blanche over signalling info, without warrants. And this is just the sort of Total Information Awareness-like operation that would get a reaction like this from Congress: http://www.washingtonmonthly.com/archives/individual/ 2005_12/007812.php Gonzales: "We've had discussions with members of Congress, certain members of Congress, about whether or not we could get an amendment to FISA, and we were advised that that was not likely to be -- that was not something we could likely get, certainly not without jeopardizing the existence of the program, and therefore, killing the program." Merely raising the possibility publicly would get it killed. I can see why the FISA court would get upset about such a thing too. It's just like the infamous illegal LAPD "handoff" in which illegal wiretaps were used to get evidence that was used in the declarations to get legal wiretap warrants. Here's something said in the press conf today by ex-NSA dir Hayden: We understand that this is a more -- I'll use the word "aggressive" program than would be traditionally available under FISA. It is also less intrusive. It deals only with international calls. It is generally for far shorter periods of time. And it is not designed to collect reams of intelligence, but to detect and warn and prevent about attacks. And, therefore, that's where we've decided to draw that balance between security and liberty. Remember, you read it here first. John ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] worth reading -- loophole in FISA?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[p2p-hackers] Whistle-blower site platform design
by Len Sassaman 06 Jul '18

06 Jul '18

Greetings, p2p-hacker folks, This list seems to be the most direct spiritual successor to the cypherpunks list, which is where I'd want to raise this issue if it still existed. As most of you are undoubtedly aware, the sudden surge in attention Wikileaks has gained in the last months have resulted in at least half a dozen imitation "leaks" sites -- from OpenLeaks, founded by former Wikileaks staff who have different ideas on how such a site should operate, to regional whistle-blower and transparency sites such as Brusselsleaks, Balkanleaks, Pirateleaks.cz, etc. Let me first state I think that this is absolutely a good thing -- in principle. Relying on a single initiative such as Wikileaks both gives way too much power to the organization in question, and makes it a high-profile target. The rise of independant leak publishers decentralizes the fundamental service these sites provide, and brings attention back to the content of their publications rather than the personalities of the individuals involved. It's also problematic for a number of reasons: firstly, reputation. Who is BrusselsLeaks? Why should a whistleblower trust that the operators of that site have his/her interests in mind? What's to say they're not an initiative of an intelligence agency? I'm not sure there's anything to be done about that, except wait and let these other players earn their own reputation capital. However, it's painfully clear to me that a number of these sites don't have the first clue when it comes to technological measures they should be taking to protect their sources. E.g., BrusselsLeaks is running their operation with Wordpress and Hushmail -- hardly a hardened solution. Wikileaks has had four years and the input of top network security experts, cryptographers, p2p-hackers, and cypherpunks, to create a system hardened against predictable threats. It's quite likely that had Bradley Manning not made the mistake of "confessing" to a government snitch posing as a journalist, he'd not be in jail today. Wikileaks, according to what I can gather from press reports and comments from people involved, as well as examining their site, relies on a Tor Hidden Service setup for receiving submissions. That alone is hardly enough to protect the site from attacks on the anonymity of its sources, the integrity and security of its site, or its network presense, but already requires a level of technical sophistication that is lacking in most of these "copy-cat" sites. I'd like to see us come up with an easy-to-deploy solution for launching a leaks site with the security considerations addressed, perhaps in the form of a "soft appliance" distribution, but first we need a basic requirements document. What are the technical security requirements of such a service? Off the top of my head, I think we can divide this into three parts: 1. General site security. The website/servers need to be resistant to compromise, and also need to be prepared for the same. The credibility of Wikileaks would be severely damaged if an attacker were able to, for example, introduce fake diplomatic cables to the cache of documents waiting to be released, so that the Wikileaks staff inadvertantly published false information. So in addition to protecting against breakins, the system needs to be designed to maintain data integrity in the face of compromise. 2. Source protection. The site needs to provide a means for whistleblowers to contact the site operators, discuss issues, and submit documents in an anonymous manner. Wikileaks solves this with Tor, though there might be other ways. We need a clearly defined threat model to build against, and must keep in mind that usability is a security concern -- we have to assume that the whistleblowers are not geeks, and the site operators may not be, either. 3. Censorship resistance. If 2. brings to mind Tor, 3. brings to mind the Eternity Service. In this model, the publisher does not need to be anonymous, but the data needs to be authenticated and the service distributed. The CouchDB-based mirrors of the Afghanistan War Diaries provide a promising first-attempt; to be successful, these sites need to be able to leverage jurisdictional arbitrage and distributed hosting to resist network denial of service attacks and legal attacks aimed at taking their sites offline, as well as data corruption attacks aimed at invalidating the material by attacking its credibility with the introduction of false documents, etc. 3.a. would be a way for third-parties to obtain the material provided by these services in an anonymous fashion; I see this as lower priority than the other issues, but still something to think about. My goal here is to develop a formal, realistic model for the operation of a legitimate journalistic whistle-blower material clearinghouse. I'm basically proposing we replicate in public, with peer-review, the process I assume Wikileaks itself has undergone for the design of their system. Let's identify the likely attacks and attack vectors for given adversaries, compose a solution based on available technology, and assemble it in as easily deployable a manner as possible. Who else is interested? Let's get this discussion rolling. Best, Len _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[p2p-hackers] Some Clarifications regarding Egypt
by Sameh El-Ansary 06 Jul '18

06 Jul '18

Dear P2P-Hackers, I am an Egyptian P2P researcher and an old member of your list. I was really glad to find those two threads about Egypt in the P2P hackers list. Technology (basically Facebook and Twitter) was a foundational part of this revolution. History is being written as we speak, and any simple idea, especially technology-related can make a huge difference. Your brainstorming on this list is extremely valuable!! i have skimmed though the threads, and excuse me if some of the thoughts are redundant or not enough organized. (Have to rush back to the demonstrations!!) I- DIFFERENT PHASES --------------------------------- Let me clarify that at different stages, we had different challenges. Phase 1: Only Twitter was blocked. Solution: People started using public proxies. Even VPNs, were a bit too much of an advanced idea for some people. They started disseminating the info through Facebook. Phase 2: No Internet At this stage, I can not confirm whether routing inside Egypt was still working on or not. All ISPs and Mobile operators were ordered to shut it down. and I am interested to know (as some of you are), how did they do it. But ordering physical powering off of all switches is not unimaginable here. Let me also draw your attention to the fact that symmetric satellite connections are basically illegal to start with, unless you are an embassy or some hotshot petroleum company or something. Phase 3: No SMS Just one more censorship level Phase 4: No Internet & no mobile services. At this point there was nothing working but land-lines. Again, I can not confirm whether routing was working or not. However, if you are using a 3G connection, there was no even GSM signal to start with !! III- DIFFERENT GOALS -------------------------------- Let me aslo clarify that at each time different challenges were in place. a- Organizing protests: that was the initial thing but quickly more challenges came b- Sending out the message: the other challenge was to send to the whole world the real picture of what is going on, especially that the Egyptian media was portraying a totally different picture of what is actually going on. That was extremely important on Friday the 28th, when the police was firing real bullets (claiming that to be rubber ones.) and more importantly when they hired thugs and secret police to attack unarmed pro-democracy protesters on the 2nd of Feb. They collected video testimonies of captured thugs and captured disguised police officers including their ids and their confessions of them being paid to attack. c- On-site communication: during the demonstrations, communicating with the masses (and by masses I mean more than one million people) is a challenge. Protesters had a tough time gathering enough loudspeakers and with the amount of people and large physical space, they could barely communicate with a small portion of the rest of the crowd. May be some simple ad-hoc networking blue-tooth based or something could have helped here. II- THINGS THAT ALMOST WORKED ------------------------------------- a- Voice to Tweet http://www.guardian.co.uk/technology/2011/feb/01/google-twitter-egypt This thing really worked, before the government screwed it as well. b- International Dial-up: In phase 4, luckily this was still possible and some people started doing it individually but there is not up to now enough known phone numbers around. Finally, Internet is back now, but I would not be surprised if it went off again. I hope this gives a closer picture to what has been going on in Egypt. I hope I can still communicate and brainstorm with you on the subject, however, I am rarely online now. Finally, we have no shortage of techies here. We can set up any complex system. Everybody, is volunteering to do something and self-organizing communities are being formed in a speed beyond belief. Needless to say, the things have to be simple enough to be used by non-techie masses. Cheers, -------------- Sameh El-Ansary, PhD Assistant Professor, Nile University, Egypt Co-founder, Peerialism Inc. Stockholm, Sweden _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0