- cypherpunks-legacy - lists.cpunks.org

Fwd: [liberationtech] facebook sim card
by b. brewer 26 Sep '12

26 Sep '12

Interesting, interesting indeed. -------- Original Message -------- Subject: [liberationtech] facebook sim card Date: Wed, 26 Sep 2012 19:16:21 +0200 From: oli <oli(a)cryptosms.org> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> To: liberationtech(a)lists.stanford.edu hi there, i would be happy if anyone knows details or can point me somewhere to get to know more about the facebook sim card: http://fr.sitestat.com/gemplus/gemalto/s?tel_facebook&ns_type=pdf http://gigaom.com/mobile/facebook-sim-card-uses-sms-gemalto/ do you know of independent technical documents, academic papers or other good sources of information? fyi: this is one of the ways how facebook is getting access to new users that are using so called "simple phones", the ones without even j2me capabilites. and this user group is huge in many parts of the world. if you are interested in the general trajectory and technological set up of facebook how to reach more mobile phones, this text is really good: http://qz.com/5180/facebooks-plan-to-find-its-next-billion-users-convince-t… fb has developed solutions for all the different types of phones and uses the fast growing mobile telephony market e.g. in some african countries to lock-in users at their first contact with mobile media. thanks, oliver -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech

1 0

Fwd: [cryptography] Data breach at IEEE.org: 100k plaintext passwords.
by b. brewer 25 Sep '12

25 Sep '12

Wow. This is extremely stupid. -------- Original Message -------- Subject: [cryptography] Data breach at IEEE.org: 100k plaintext passwords. Date: Tue, 25 Sep 2012 13:39:34 -0400 From: Jeffrey Walton <noloader(a)gmail.com> Reply-To: noloader(a)gmail.com To: Randombit List <cryptography(a)randombit.net> In case anyone on the list might be affected... [Please note: I am not the "I' in the text below] http://ieeelog.com IEEE and the log story IEEE (Institute of Electrical and Electronics Engineers) is renowned as one of the world-leading organizations in standard development and the promotion of scientific and educational development within the Electrical, Electronics, Communications, Computer Engineering, Computer Science and related fields. The organization has more than 415,000 members all over the world, almost half of them in the United States [1]. By the nature of the organization, IEEE members are highly specialised individuals, many of them working in critical industry, governmental and military projects. Furthermore, it would be reasonable to assume, that an organization publishing leading security-focused publications [2], would value the privacy of its members, and be proactive in keeping their data secure. Due to several undoubtedly grave mistakes, the ieee.org account username and plaintext password of around 100,000 IEEE members were publicly available on the IEEE FTP server for at least one month. Furthermore, all the actions these users performed on the ieee.org website were also available. Separately, spectrum.ieee.org visitor activity is also publicly available. The simplest and most important mistake on the part of the IEEE web administrators was that they failed to restrict access to their webserver logs for both ieee.org and spectrum.ieee.org allowing these to be viewed by anyone going to the address ftp://ftp.ieee.org/uploads/akamai/ (closed on September 24 around 13:00 UTC, after I reported it). On these logs, as is the norm, every web request was recorded (more than 376 million HTTP requests in total). Web server logs should never be publicly available, since they usually contain information that can be used to identify users (sometimes even after the log was anonymized as in the "AOL incident" [3]). However, this case is much worse, since 411.308 of the log entries contain both usernames and passwords. Out of these, there seem to be 99.979 unique usernames. If leaving an FTP directory containing 100GB of logs publicly open could be a simple mistake in setting access permissions, keeping both usernames and passwords in plaintext is much more troublesome. Keeping a salted cryptographic hash of the password is considered best practice, since it would mitigate exactly such an access permission mistake. Also, keeping passwords in logs is inherently insecure, especially plaintext passwords, since any employee with access to logs (for the purpose of analysis, monitoring or intrusion detection) could pose a threat to the privacy of users. Log analysis It is certainly unfortunate this information was leaked out, and who knows who got it before it got fixed. Maybe there are access logs for the FTP so the damage can be assessed. Anyway, the affected users will probably have to be informed, since it is my understanding that the law requires it. In Europe there is Article 4 of the Directive on privacy and electronic communications (Directive 2002/58/EC) and its amendment (Directive 2009/136/EC). In the US, 46 states seem to have similar requirements [4]. While the cause of the data breach has been solved, one must point out the value of this dataset from a research perspective. It is rare that researchers gain access to such rich datasets. Various ethical and privacy-related considerations must be evaluated before such datasets can be publicly released. Deciding on how to anonymize the data is no easy challenge. Simply excluding any information making users directly identifiable is not enough, as past dataset releases have shown that some users can still be pinpointed. This resulted in lawsuits in the case of Netflix [5] and AOL [6], or the withdrawal of the data, like in the recent Wikipedia case [7]. For this reason, companies such as Google prefer to keep such data for study by internal researchers and do not release it to the public [3]. Furthermore, some companies release data to a trusted researcher with the condition to remain anonymous, like an unnamed European mobile phone operator did for Albert-LC!szlC3 BarabC!si [8]. This means academic researchers working in such fields as Information Retrieval have limited access to fresh real-world data, being at a disadvantage to their industrial counterparts. For these reasons, I cannot not give in to the urge to perform a basic analysis of this serendipitously acquired data, although I acknowledge this might be ethically dubious. However, I did not, and plan not to release the raw log data to anyone else. Data overview Log data time span: 01/Aug/2012:20:46:28 +0000b to 18/Sep/2012:08:47:17 +0000 Total number of log entries: 376.021.496 log entries for ieee.org: 301.319.566 log entries for spectrum.ieee.org: 74.701.930 log entries with password details: 411.308 (of which 17.157 are password reset requests and have no username field) ... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

Fwd: [cryptography] Preemptive compromise of Apple ID accounts
by b. brewer 23 Sep '12

23 Sep '12

-------- Original Message -------- Subject: [cryptography] Preemptive compromise of Apple ID accounts Date: Sun, 23 Sep 2012 20:26:42 +1200 From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> To: cryptography(a)randombit.net I just got email from Apple asking me to confirm setting up a rescue email address for my Apple ID account (I haven't owned any Apple products since the IIe). It's the real thing from Apple, not a phishing email. So it looks like attackers have gone beyond social engineering access to Apple accounts and are pre-emptively creating mechanisms for access on the off chance that the target may at some point become an Apple account user who can then be exploited. That's pretty sophisticated forward planning. Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

Re: [Freedombox-discuss] [ZS] ZS reboot seed
by Eugen Leitl 23 Sep '12

23 Sep '12

----- Forwarded message from Bryce Lynch <virtualadept(a)gmail.com> -----

1 0

Re: This Machine Kills Secrets
by John Young 22 Sep '12

22 Sep '12

Here are the book's contents, list of characters, and index: http://cryptome.org/2012/08/greenberg-leaks-secrets.pdf Not a few in the book will regret talking to Greenberg and might seek revenge using cpunks wizardry and subterfuge against the author and Forbes. Smells of a smear by the capitalist fools. Pretty good Wired-level read, above average on the tech, but marred by the personal slop, authorial preening and evasion of inconvenient truth which are now obligatory among craven journalists running scared of their salacity-demanding fans, censorious lawyers and immoral publishers. While that is not news here, Greenberg managed to breach defenses by MTMing targets induced to finger one another. Personal stuff allegedly revealed by Greenberg's "characters" Tim May, John Gilmore, Phil Zimmermann and Mudge, for example, might arouse gossip-loving readers to hoot and holler. Formulaic padding about WikiLeaks and hangers-on is rancid recycling still being massively churned to entice rabid book sellers and advertizers sustaining Forbe's fortune. At 10:01 PM 9/18/2012, you wrote: >Lotsa Cypherpunk stuff in there, apparently. Anyone talk to this guy? > >Reward with dollars (ie, buy)? Or does information in this case want to be >free? If the former, no doubt I'll be buying in cash. > >-TD

3 4

[liberationtech] Cryptocat 2 Alpha Released
by Eugen Leitl 22 Sep '12

22 Sep '12

----- Forwarded message from Nadim Kobeissi <nadim(a)nadim.cc> -----

1 0

[tor-talk] Putin's fascist band intend to ban the Tor
by Eugen Leitl 21 Sep '12

21 Sep '12

----- Forwarded message from James Brown <jbrownfirst(a)gmail.com> -----

1 0

Re: [cryptography] abstract: Air to Ground Quantum Key Distribution
by Eugen Leitl 21 Sep '12

21 Sep '12

----- Forwarded message from "D. J. Bernstein" <djb(a)cr.yp.to> -----

1 0

Drone warfare's deadly civilian toll: a very personal view
by Eugen Leitl 21 Sep '12

21 Sep '12

http://www.guardian.co.uk/commentisfree/2012/sep/19/drone-warfare-deadly-ci… Drone warfare's deadly civilian toll: a very personal view I was minutes from ordering a drone strike on a Taliban insurgent b until I realised I was watching an Afghan child at play James Jeffrey guardian.co.uk, Wednesday 19 September 2012 21.36 BST Predator drone in Afghanistan A US Predator drone in Afghanistan. The strike in Somalia means armed drones are operating in six countries. Photograph: Joel Saget/AFP/Getty Images I find myself caught between the need to follow the drone debate and the need to avoid unpleasant memories it stirs. I used drones b unmanned aerial vehicles b during the nadir of my military career that was an operational tour in Afghanistan. I remember cuing up a US Predator strike before deciding the computer screen wasn't depicting a Taliban insurgent burying an improvised explosive device in the road; rather, a child playing in the dirt. After returning from Afghanistan at the end of 2009, I left the British army in 2010. I wanted to put as much distance as I could between myself and the UK, leaving to study in America (where I still reside). By doing so, I inadvertently placed myself in the country that is spearheading development in drone technology and use, highlighted by each report of a drone strike and the usual attendant civilian casualties. Political theorist Hannah Arendt described the history of warfare in the 20th century as the growing incapacity of the army to fulfil its basic function: defending the civilian population. My experiences in Afghanistan brought this issue to a head, leaving me unable to avoid the realization that my role as a soldier had changed, in Arendt's words, from "that of protector into that of a belated and essentially futile avenger". Our collective actions in Iraq and Afghanistan after 9/11 were, and remain, futile vengeance b with drones the latest technological advance to empower that flawed strategy. Drones are becoming the preferred instruments of vengeance, and their core purpose is analogous to the changing relationship between civil society and warfare, in which the latter is conducted remotely and at a safe distance so that implementing death and murder becomes increasingly palatable. James Jeffrey serving in Iraq, 2004 The author (at far left) as a lieutenant Challenger 2 troop leader in al-Amarah, Iraq, 2004. Photograph: James Jeffrey Hyperbole? But I was there. I sat in my camouflaged combats and I took the rules of engagement and ethical warfare classes. And frankly, I don't buy much, if any, of it now b especially concerning drones. Their effectiveness is without question, but there's terrible fallout from their rampant use. Both Pakistan and Yemen are arguably less stable and more hostile to the west as a result of President Obama's increased reliance on drones. When surveying the poisoned legacy left to the Iraqi people, and what will be left to the Afghan people, it's beyond depressing to hear of the hawks circling around other theatres like Pakistan and Yemen, stoking the flames of interventionism. I fear the folly in which I took part will never end, and society will be irreversibly enmeshed in what George Orwell's 1984 warned of: constant wars against the Other, in order to forge false unity and fealty to the state. It's very easy to kill if you don't view the target as a person. When I went to Iraq as a tank commander in 2004, the fire orders I gave the gunner acknowledged some legitimacy of personhood: "Coax man, 100 meters front." Five years later in Afghanistan, the linguistic corruption that always attends war meant we'd refer to "hot spots", "multiple pax on the ground" and "prosecuting a target", or "maximising the kill chain". The Pentagon operates about 7,000 drones and asked Congress for nearly $5bn for drones in the 2012 budget. Before retiring as air force chief of staff, General Norton Schwartz was reported as saying it "was 'conceivable' drone pilots in the air force would outnumber those in cockpits in the foreseeable future". That's not a brave new world, far from it. The encroachment of drones into the civilian realm is also gaining momentum. President Obama signed a federal law on 14 February 2012, allowing drones for a variety of commercial uses and for police law enforcement. The skies above may never be the same. As with most of America's darker elements, such as its gun culture, there's profit to be made b the market for drones is already valued at $5.9bn and is expected to double in 10 years. During my time in Afghanistan, drones were primarily supplied by the US as our drone capability was miniscule in comparison. The British military still relies on US support, only owning about five armed drones. They have been busy, though: as of May 2012, the Ministry of Defence confirmed these had flown a total of 34,750 hours, and fired 281 missiles and laser-guided bombs. With continued cuts to the British army's personnel levels, it isn't hard to envisage drones increasingly replacing boots on the ground. And since the UK already has the world's highest number of CCTV cameras, the intrusion of drones into surveillance Britain doesn't require much imagination. Technological advancements in warfare don't have a good track record in terms of unintended consequences. As Chris Hedges reveals in his book War is a Force That Gives Us Meaning, an estimated 62 million civilians perished in the 20th century's wars b "nearly 20 million more than the 43 million military personnel killed". Will the 21st century repeat such foolish tragedy? Many years still remain. I'd argue we should err on the side of caution and remain immensely wary of drones.

1 0

[liberationtech] Face recognition software prefers unsmiling humans
by Eugen Leitl 20 Sep '12

20 Sep '12

----- Forwarded message from Gregory Foster <gfoster(a)entersection.org> -----

1 0