- cypherpunks-legacy - lists.cpunks.org

[cryptography] Shared key in DPI device...
by Ben Laurie 06 Jul '18

06 Jul '18

I thought this might interest the list: Vulnerability in Cyberoam DPI devices [30 Jun 2012] (CVE-2012-3372) =================================================================== Cyberoam make a range of DPI devices (http://www.cyberoamworks.com/) which are capable of intercepting SSL connections. In common with all such devices, in order to intercept these connections without causing certificate warnings, the devices require that a certificate must be issued for the intercepted site by a CA browsers trust. There are two ways to achieve this - one is to persaude an existing trusted CA to issue a certificate for the site to be intecepted, or an intermediate CA that can then be used to generate new certificates on the fly. This latter behaviour recently got Trustwave in trouble. The second method is to have each willing victim[1] install a new trusted CA in their browser, and have that CA issue the fake certificates. This is, of course, the only legitimate way to use these devices and we are pleased to see that this is the approach Cyberoam reveal to the public. However, it is a little surprising that the Cyberoam devices appear to all use exactly the same CA. This can be seen to be so by looking at the support page describing how to avoid warnings: http://docs.cyberoam.com/default.asp?id=300. Examination of a certificate chain generated by a Cyberoam device shows that this CA is not used to sign an intermediate which is then used by the device, and so therefore all such devices share the same CA certificate and hence the same private key. It is therefore possible to intercept traffic from any victim of a Cyberoam device with any other Cyberoam device - or, indeed, to extract the key from the device and import it into other DPI devices, and use those for interception. Perhaps ones from more competent vendors. [1] In the corporate setting, willing victims are often known as "employees". Unwilling victims should not, of course, install the CA certificate, nor should they click through certificate warnings. Mitigation ========== Victims should uninstall the Cyberoam CA certificate from their browsers and decline to complete any connection which gives a certificate warning. Credit ====== This issue was discovered and analysed by Runa A. Sandvik of the Tor Project and Ben Laurie. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[fc] LNCS 1465 online
by R. Hirschfeld 06 Jul '18

06 Jul '18

Springer has informed me that the FC98 Proceedings have just been published online. They are available at: http://link.springer.de/link/service/series/0558/tocs/t1465.htm or http://link.springer-ny.com/link/service/series/0558/tocs/t1465.htm _______________________________________________ fc mailing list fc(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[cryptography] Shared key in DPI device...
by Ben Laurie 06 Jul '18

06 Jul '18

I thought this might interest the list: Vulnerability in Cyberoam DPI devices [30 Jun 2012] (CVE-2012-3372) =================================================================== Cyberoam make a range of DPI devices (http://www.cyberoamworks.com/) which are capable of intercepting SSL connections. In common with all such devices, in order to intercept these connections without causing certificate warnings, the devices require that a certificate must be issued for the intercepted site by a CA browsers trust. There are two ways to achieve this - one is to persaude an existing trusted CA to issue a certificate for the site to be intecepted, or an intermediate CA that can then be used to generate new certificates on the fly. This latter behaviour recently got Trustwave in trouble. The second method is to have each willing victim[1] install a new trusted CA in their browser, and have that CA issue the fake certificates. This is, of course, the only legitimate way to use these devices and we are pleased to see that this is the approach Cyberoam reveal to the public. However, it is a little surprising that the Cyberoam devices appear to all use exactly the same CA. This can be seen to be so by looking at the support page describing how to avoid warnings: http://docs.cyberoam.com/default.asp?id=300. Examination of a certificate chain generated by a Cyberoam device shows that this CA is not used to sign an intermediate which is then used by the device, and so therefore all such devices share the same CA certificate and hence the same private key. It is therefore possible to intercept traffic from any victim of a Cyberoam device with any other Cyberoam device - or, indeed, to extract the key from the device and import it into other DPI devices, and use those for interception. Perhaps ones from more competent vendors. [1] In the corporate setting, willing victims are often known as "employees". Unwilling victims should not, of course, install the CA certificate, nor should they click through certificate warnings. Mitigation ========== Victims should uninstall the Cyberoam CA certificate from their browsers and decline to complete any connection which gives a certificate warning. Credit ====== This issue was discovered and analysed by Runa A. Sandvik of the Tor Project and Ben Laurie. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Department of Photo Security--Redux
by Dave Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Department of Photo Security--Redux Date: Fri, 03 Mar 2006 15:06:31 -0500 From: Richard Forno <rforno(a)infowarrior.org> To: Blaster <rforno(a)infowarrior.org> CC: Dave Farber <dave(a)farber.net> Department of Photo Security--Redux http://blog.washingtonpost.com/rawfisher/ Last Sunday's column told the story of a Maryland woman who was stopped by police and questioned after commuters saw her taking photographs of the wrought-iron lampposts at the Odenton train station. Preety Gadhoke's experience, and her questions about whether she was stopped because she looked like a foreigner, have sparked a debate here on the blog and elsewhere. Preety and I appeared on C-SPAN's Washington Journal with Brian Lamb this morning to discuss the events, and Channel 9 reporter Dave Statter passes along this account of his own dogged and enlightening reporting on the inconsistent, illogical and sometimes downright idiotic efforts by the homeland security apparatus to fight the scourge of innocent photography of some of the world's most-photographed buildings: In 2004, and again in 2005, I sent two different, young, Caucasian, native-born, female interns around Washington armed with a disposable camera and a wireless microphone. Their instructions were to stand in a public place and shoot public buildings. While this was going on, I was with a photographer a half block down the street videotaping the interns actions and the reaction of various security guards and police. I can report that the one place where she wasn't hassled was the White House. But on sidewalks outside DOT, NASA, EPA, IRS, Washington Marine Barracks, Ronald Reagan Building, J. Edgar Hoover Building, Justice Department, a US Capitol Police roadblock and the FBI's Washington Field Office she was confronted by security or police. In most cases when the TV camera was spotted (we were out in the open), we were also confronted. I guess we should expect that security will legally attempt to find out the identity of anyone who is extensively photographing government buildings. But the misinformation and outright lies that were told to this "tourist" and to us were quite amazing. Here is a partial list: 1. It is illegal to photograph any government buildings. (EPA) 2. We arrested a man for drawing a picture of this building last week. (EPA) 3. You are not allowed to take pictures and I can confiscate your camera. (Marine Barracks) 4. You have to have permission from our public affairs officer to photograph this building. (NASA, Ronald Reagan Building) 5. We have a cabinet secretary in there so you can't shoot pictures of this building. (DOT both in 2004 and 2005) 6. The GSA rules printed on the front door show it is illegal to take pictures of this building. (At the Ronald Reagan Building, where the GSA rules on the door, often cited throughout the city, actually say just the opposite) 7. We stop terrorists all the time who take pictures. (US Capitol Police) 8. You can't take pictures of people going into and out of this building. (FBI WFO) Of course, there is nothing true about any of these statements. We later contacted officials with each organization, along with the Department of Homeland Security. Not one could cite any law or regulation that prohibits anyone standing in a public place from taking a picture of a building or anything else that is in public view. Each agency/organization (including the US Marines), except one, admitted to us that their people were in error and would do retraining. In fact, the Federal Protective Service, responsible for guarding government buildings all over the country, tell us they now use our stories in roll calls and training sessions for their officers. The one exception is the Department of Transportation on 7th Street, SW. Officials there refuse to acknowledge the right of the public or the press to take pictures of the building without DOT's permission. They also told me they saw no reason to retrain their guards. Take a walk with a camera outside the DOT building and watch what happens. I should also tell you that representatives at all the buildings and agencies tell us they will regularly try to legally find out who the picture taker is, but will not otherwise interfere with the picture taking. I guess we should expect that action, post 9/11. Now as far as railroads are concerned, there are a lot of people whose hobby is taking pictures of trains. Think of O. Winston Link's famous picture of the Norfolk and Western steam engine passing behind the plane on the drive-in movie screen in West Virginia. These people are being hassled out of a hobby. Your former Post colleague, Don Phillips, wrote a recent column in Trains magazine about the issue. One problem for Ms. Gadhoke is that apparently she was on "their" property when taking the pictures. That may have emboldened the officer to seize her film (I have heard from a number of people that the Pentagon police do this to the press and public who take pictures on Pentagon property without permission, but allegedly they don't seize film when you are on public property taking the pictures). New Jersey Transit's chief of police is one of the railroad people taking and encouraging a hard line approach with picture takers. NJT finally officially backed away from the policy in January after a lot of pressure (including the Trains magazine column). Here are some articles about NJT's short lived photography ban that some claim is still being enforced: http://www.nppa.org/news_and_events/news/2006/01/njt.html http://www.lightrailnow.org/news/n_newslog006.htm#NJ_20060215 (this one has a series of railroad related articles in chronological order ... check February 13 and February 6) A few months back I was with a Channel 9 photographer for about two hours of videotaping AMTRAK and CSX trains at Ivy City and then along the tracks at M Street Southeast. A heavenly assignment for two train buffs. At Ivy City an engineer called dispatch to report us to police (I was monitoring on the scanner). When we moved to M Street another engineer did the same. As we left M Street a CSX police officer pulled up. It turned out to be a guy who I had been a volunteer firefighter with 30 years ago. He apparently came down from the Baltimore area to answer the call. I got the impression he was the only CSX cop on duty in DC at the time (what does that say about rail security?). My friend said as long as we were off the track area and not on CSX property we can take all the pictures we want (his chief must not subscribe to NJT's policy). It's a mess out there, and the most unfortunate part of the situation is that the confusion and the contradictions only serve to undermine public confidence in our security and law enforcement agencies, while the efforts to halt photography of public places wastes valuable resources and persuades all too many Americans that our tax dollars are being diverted from security measures that might really protect us. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Department of Photo Security--Redux
by Dave Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Department of Photo Security--Redux Date: Fri, 03 Mar 2006 15:06:31 -0500 From: Richard Forno <rforno(a)infowarrior.org> To: Blaster <rforno(a)infowarrior.org> CC: Dave Farber <dave(a)farber.net> Department of Photo Security--Redux http://blog.washingtonpost.com/rawfisher/ Last Sunday's column told the story of a Maryland woman who was stopped by police and questioned after commuters saw her taking photographs of the wrought-iron lampposts at the Odenton train station. Preety Gadhoke's experience, and her questions about whether she was stopped because she looked like a foreigner, have sparked a debate here on the blog and elsewhere. Preety and I appeared on C-SPAN's Washington Journal with Brian Lamb this morning to discuss the events, and Channel 9 reporter Dave Statter passes along this account of his own dogged and enlightening reporting on the inconsistent, illogical and sometimes downright idiotic efforts by the homeland security apparatus to fight the scourge of innocent photography of some of the world's most-photographed buildings: In 2004, and again in 2005, I sent two different, young, Caucasian, native-born, female interns around Washington armed with a disposable camera and a wireless microphone. Their instructions were to stand in a public place and shoot public buildings. While this was going on, I was with a photographer a half block down the street videotaping the interns actions and the reaction of various security guards and police. I can report that the one place where she wasn't hassled was the White House. But on sidewalks outside DOT, NASA, EPA, IRS, Washington Marine Barracks, Ronald Reagan Building, J. Edgar Hoover Building, Justice Department, a US Capitol Police roadblock and the FBI's Washington Field Office she was confronted by security or police. In most cases when the TV camera was spotted (we were out in the open), we were also confronted. I guess we should expect that security will legally attempt to find out the identity of anyone who is extensively photographing government buildings. But the misinformation and outright lies that were told to this "tourist" and to us were quite amazing. Here is a partial list: 1. It is illegal to photograph any government buildings. (EPA) 2. We arrested a man for drawing a picture of this building last week. (EPA) 3. You are not allowed to take pictures and I can confiscate your camera. (Marine Barracks) 4. You have to have permission from our public affairs officer to photograph this building. (NASA, Ronald Reagan Building) 5. We have a cabinet secretary in there so you can't shoot pictures of this building. (DOT both in 2004 and 2005) 6. The GSA rules printed on the front door show it is illegal to take pictures of this building. (At the Ronald Reagan Building, where the GSA rules on the door, often cited throughout the city, actually say just the opposite) 7. We stop terrorists all the time who take pictures. (US Capitol Police) 8. You can't take pictures of people going into and out of this building. (FBI WFO) Of course, there is nothing true about any of these statements. We later contacted officials with each organization, along with the Department of Homeland Security. Not one could cite any law or regulation that prohibits anyone standing in a public place from taking a picture of a building or anything else that is in public view. Each agency/organization (including the US Marines), except one, admitted to us that their people were in error and would do retraining. In fact, the Federal Protective Service, responsible for guarding government buildings all over the country, tell us they now use our stories in roll calls and training sessions for their officers. The one exception is the Department of Transportation on 7th Street, SW. Officials there refuse to acknowledge the right of the public or the press to take pictures of the building without DOT's permission. They also told me they saw no reason to retrain their guards. Take a walk with a camera outside the DOT building and watch what happens. I should also tell you that representatives at all the buildings and agencies tell us they will regularly try to legally find out who the picture taker is, but will not otherwise interfere with the picture taking. I guess we should expect that action, post 9/11. Now as far as railroads are concerned, there are a lot of people whose hobby is taking pictures of trains. Think of O. Winston Link's famous picture of the Norfolk and Western steam engine passing behind the plane on the drive-in movie screen in West Virginia. These people are being hassled out of a hobby. Your former Post colleague, Don Phillips, wrote a recent column in Trains magazine about the issue. One problem for Ms. Gadhoke is that apparently she was on "their" property when taking the pictures. That may have emboldened the officer to seize her film (I have heard from a number of people that the Pentagon police do this to the press and public who take pictures on Pentagon property without permission, but allegedly they don't seize film when you are on public property taking the pictures). New Jersey Transit's chief of police is one of the railroad people taking and encouraging a hard line approach with picture takers. NJT finally officially backed away from the policy in January after a lot of pressure (including the Trains magazine column). Here are some articles about NJT's short lived photography ban that some claim is still being enforced: http://www.nppa.org/news_and_events/news/2006/01/njt.html http://www.lightrailnow.org/news/n_newslog006.htm#NJ_20060215 (this one has a series of railroad related articles in chronological order ... check February 13 and February 6) A few months back I was with a Channel 9 photographer for about two hours of videotaping AMTRAK and CSX trains at Ivy City and then along the tracks at M Street Southeast. A heavenly assignment for two train buffs. At Ivy City an engineer called dispatch to report us to police (I was monitoring on the scanner). When we moved to M Street another engineer did the same. As we left M Street a CSX police officer pulled up. It turned out to be a guy who I had been a volunteer firefighter with 30 years ago. He apparently came down from the Baltimore area to answer the call. I got the impression he was the only CSX cop on duty in DC at the time (what does that say about rail security?). My friend said as long as we were off the track area and not on CSX property we can take all the pictures we want (his chief must not subscribe to NJT's policy). It's a mess out there, and the most unfortunate part of the situation is that the confusion and the contradictions only serve to undermine public confidence in our security and law enforcement agencies, while the efforts to halt photography of public places wastes valuable resources and persuades all too many Americans that our tax dollars are being diverted from security measures that might really protect us. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] Pakistan drone report talk in Baltimore/D.C.?
by Yosem Companys 06 Jul '18

06 Jul '18

From: Max Obuszewski <mobuszewski(a)verizon.net> I imagine you have heard about the report on drone strikes in Pakistan put together by a team of law professors and students from NYU and Standford (http://livingunderdrones.org/report/) We invited a professor from NYU to talk at Hopkins about the report; she passed our invitation along to folks at Stanford. The leader of the investigation, Professor James Cavallaro, the Director of the International Human Rights and Conflict Resolution Clinic at Stanford, and a law student, Omar Shakir, who was on the team, are interested in coming. I'm wondering if there might be interest in organizing a talk in Washington at the same time, both to share the cost of bringing them and to make the trip more worth their while. Do you know anyone at Georgetown or elsewhere who might be interested? Take care, Joel -- Joel Andreas Associate Professor Department of Sociology Director East Asian Studies Program Johns Hopkins University 3400 N. Charles Street Baltimore, MD 21218 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [HacDC:Byzantium] byzantium-v0.3a-RC-20130129-1012
by The Doctor 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > How can I prove that the mesh is operating and that other nodes > are acceding to and seceding from the mesh? Associate a client of some kind, like another laptop or a smartphone, with the mesh. Ping it. Try to browse it. Plug the mesh node into a hardline and try to browse the Net with the client. Look at the network configuration of the client (IP address, DNSes, default gateway). > I would like to see some window that lists the nodes within range. Open a feature request at Github so it's on our radar. It'll get lost in the mailing list archives. > I would like to do something on one computer that I can see > mirrored on another computer within the mesh. Put multiple clients on the mesh. Run a web server on one (like XAMP) and try to browse it. There is nothing preventing clients from interacting with one another directly. > At this stage of development, I want to test the internal operation > of the mesh before connecting it to the Internet via a gateway. Ping? Traceroute? tcpdump? > From the casual user perspective it isn't obvious what Byzantium > is doing or offering. Did you look at the release notes (/RELEASE_NOTES.txt) or the Github page (https://github.com/Byzantium/Byzantium/blob/master/README.md)? "THIS IS ALSO A VERY SPECIAL RELEASE! We built this release in the days following Hurricane Sandy and deployed it in New York City. We've streamlined it a lot..." We built this release when we were in New York to serve a specific purpose: infrastructure. The community's goal was to restore connectivity and not specific services, so we removed a lot of things from this release to facilitate that. We took some features out - this helped us make layers 1-4 of the OSI model as robust as we possibly could while in the field. This release is meant to maintain momentum, and now that we have a robust platform to build on we can start adding things back at the higher layers in v0.4a. - -- The Doctor [412/724/301/703] [ZS|Media] Developer, Project Byzantium: http://project-byzantium.org/ PGP: 0x807B17C1 / 7960 1CDC 85C9 0B63 8D9F DD89 3BD8 FF2B 807B 17C1 WWW: https://drwho.virtadpt.net/ "Don't try to talk me out of it, Billy, we're going bowling!" - --Stetmeyer, _Misfits of Science_ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlEJV18ACgkQO9j/K4B7F8GtTACgwrPFxb4YROwxslL0mW3aq6TK kboAn05L8eeepovZA/Up0kvEZvpXy+0k =eaby -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "Project Byzantium (Emergency Mesh Networking)" group. To post to this group, send email to Byzantium(a)hacdc.org. To unsubscribe from this group, send email to Byzantium+unsubscribe(a)hacdc.org. For more options, visit this group at http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Secure erasing Info
by Richard Glaser 06 Jul '18

06 Jul '18

<MACENTERPRISE(a)LISTSERV.CUNY.EDU> FYI: Rendering Drives Completely Unreadable Can be Difficult ------------------------------------------------------- The National Association for Information Destruction has said it cannot endorse the use of wiping applications alone for ensuring that data have been effectively removed from hard drives. NAID executive director Bob Johnson said the only way to ensure that the data will be unreadable is to physically destroy the drives, and even that has to be done in certain ways to ensure its efficacy. Most major PC makers offer a drive destruction service for $20 or $30. Some hardware engineers say they understand why the drives have been created in a way that makes it hard to completely erase the data: customers demanded it because they were afraid of losing information they had stored on their drives. http://news.com.com/2102-1029_3-5676995.html?tag=st.util.print [Editor's Note (Pescatore): Cool, I want a "National Association for Information Destruction" tee shirt. How hard could it be to have an interlock feature - you can really, really clear the drive if you open the case, hold this button down while you delete? (Ranum): Peter Guttman, from New Zealand, did a terrific talk in 1997 at USENIX in which he showed electromicrographs of hard disk surfaces that had been "wiped" - you could still clearly see the 1s and 0s where the heads failed to line up perfectly on the track during the write/erase sequence. He also pointed out that you can tell more recently written data from less recently written data by the field strength in the area, which would actually make it much easier to tell what had been "wiped" versus what was persistent long-term store. The paper, minus the cool photos may be found at: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html Hard disks, I've found, make satisfying small arms targets.] Here is Mac OS X software called "SPX" that uses the "Guttman" method of securely deleting data off a hard disk. If you want to donate old HD's this might be the best method for protecting your data that was on the HD other than physically destroying the HD's. http://rixstep.com/4/0/spx/ -- Thanks: Richard Glaser University of Utah - Student Computing Labs richard(a)scl.utah.edu 801-585-8016 _____________________________________________________ Subscription Options and Archives http://listserv.cuny.edu/archives/macenterprise.html ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Tor security advisory: hidden services can be located quickly
by Roger Dingledine 06 Jul '18

06 Jul '18

Versions affected: all stable versions, and all experimental versions up through 0.1.1.10-alpha. Impact: If you offer a Tor hidden service, an adversary who can run a fast Tor server and who knows some basic statistics can find the location of your hidden service in a matter of minutes to hours. Solution: You have three options: 1) Upgrade to Tor 0.1.1.12-alpha from the Tor download page [1]. You're all set, though be aware that this is an alpha release so there may be other bugs. You may also want to look through the release notes [2]. 2) Turn off your hidden service until the final 0.1.1.x release is out. It may be several months. 3) Stick with Tor 0.1.0.16 and manually configure a half dozen EntryNodes. See the FAQ entry [3] for some hints about how to do this. The details: Tor researchers Lasse ?verlier and Paul Syverson have confirmed that a previously theoretical attack on Tor works very well in practice. Specifically, they found that a malicious Tor server can locate a hidden service more quickly than was previously believed. The attack is simple: access the hidden service repeatedly, and keep track of who builds circuits through you shortly after each access. Because you can induce your victim to build a new circuit on demand, eventually one of his circuits will start at your node. To slow this attack, our latest experimental release implements a new feature called "guard nodes": it automatically chooses a handful of entry nodes and sticks with them for all circuits. This idea is adapted from the "helper node" concept published by Wright et al [4], but with improved reliability: rather than picking a set of entry nodes and refusing to access the Tor network if they all become unreachable, Tor's design dynamically picks new guards as needed, yet switches back to the old ones when they become reachable again. Therefore Tor users still have the same level of robustness as before, but the chance of a successful attack by a limited adversary is greatly reduced. More details will be presented on January 14 at Shmoocon [5] and January 26 at Black Hat Federal [6]. --Roger [1] http://tor.eff.org/download [2] http://archives.seul.org/or/talk/Jan-2006/msg00024.html http://archives.seul.org/or/talk/Jan-2006/msg00026.html [3] http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ChooseEntryExit [4] http://freehaven.net/anonbib/#wright03 [5] http://www.shmoocon.org/speakers.html#overlier [6] http://www.blackhat.com/html/bh-federal-06/bh-fed-06-speakers.html#Syverson ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] Behind Blue Coat: An Update From Burma
by Ron Deibert 06 Jul '18

06 Jul '18

Behind Blue Coat: An update from Burma Background Citizen Lab research into the use of commercial filtering products in countries under the rule of authoritarian regimes has previously documented the use of devices manufactured by U.S.-based Blue Coat Systems in Syria and Burma. In Behind Blue Coat: Investigations of commercial filtering in Syria and Burma, we identified Blue Coat devices in Burma through the error messages, hostnames and filtering behaviour on Burmese Internet service provider (ISP) Yatanarpon Teleport. Since the publication of Behind Blue Coat, it has been reported that the U.S. Commerce Department has launched an investigation to determine if the company had prior knowledge that its equipment was being used by the Syrian government.1 This action was launched following a call from three U.S. Senators for an investigation into Blue Coat and NetApp, another U.S. company whose equipment has been implicated in surveillance activities by the Syrian government.2 Additional evidence gathered by the Citizen Lab from Burma since the publication of that report has provided further confirmation that Blue Coatbs devices are presently in use in the country. A message displayed to users by Yatanarpon Teleport references Blue Coat in the URL and is consistent with how Blue Coat devices display notification messages to users. Combined with the evidence presented in Behind Blue Coat, these new findings present a strong case that Blue Coatbs devices are actively in use in Burma. More here: http://citizenlab.org/2011/11/behind-blue-coat-an-update-from-burma/ Ronald J. Deibert Director, The Canada Centre for Global Security Studies and The Citizen Lab Munk School of Global Affairs University of Toronto r.deibert(a)utoronto.ca http://deibert.citizenlab.org/ twitter.com/citizenlab _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0