July 2013 - cypherpunks - lists.cpunks.org

Max Blumenthal on Security Forum
by Eugen Leitl 30 Jul '13

30 Jul '13

(it's Alternet, so caveat lector) http://www.alternet.org/tea-party-and-right/shocking-extermination-fantasie… Shocking 'Extermination' Fantasies By the People Running America's Empire on Full Display at Aspen Summit Security Forum participants expressed total confidence in American empire, but could not contain their panic at the mention of Snowden. July 25, 2013 | Seated on a stool before an audience packed with spooks, lawmakers, lawyers and mercenaries, CNN’s Wolf Blitzer introduced recently retired CENTCOM chief General James Mattis. “I’ve worked with him and I’ve worked with his predecessors,” Blitzer said of Mattis. “I know how hard it is to run an operation like this.” Reminding the crowd that CENTCOM is “really, really important,” Blitzer urged them to celebrate Mattis: “Let’s give the general a round of applause.” Following the gales of cheering that resounded from the room, Mattis, the gruff 40-year Marine veteran who once volunteered his opinion that “it’s fun to shoot some people,” outlined the challenge ahead. The “war on terror” that began on 9/11 has no discernable end, he said, likening it to the “the constant skirmishing between [the US cavalry] and the Indians” during the genocidal Indian Wars of the 19th century. “The skirmishing will go on likely for a generation,” Mattis declared. Mattis’ remarks, made beside a cable news personality who acted more like a sidekick than a journalist, set the tone for the entire 2013 Aspen Security Forum this July. A project of the Aspen Institute, the Security Forum brought together the key figures behind America’s vast national security state, from military chieftains like Mattis to embattled National Security Agency Chief General Keith Alexander to top FBI and CIA officials, along with the bookish functionaries attempting to establish legal groundwork for expanding the war on terror. Partisan lines and ideological disagreements faded away inside the darkened conference hall, as a parade of American securitocrats from administrations both past and present appeared on stage to defend endless global warfare and total information awareness while uniting in a single voice of condemnation against a single whistleblower bunkered inside the waiting room of Moscow International Airport: Edward Snowden. With perhaps one notable exception, none of the high-flying reporters junketed to Aspen to act as interlocutors seemed terribly interested in interrogating the logic of the war on terror. The spectacle was a perfect window into the world of access journalism, with media professionals brown-nosing national security elites committed to secrecy and surveillance, avoiding overly adversarial questions but making sure to ask the requisite question about how much Snowden has caused terrorists to change their behavior. Jeff Harris, the communications director for the Aspen Institute, did not respond to questions I submitted about whether the journalists who participated in the Security Forum accepted fees. (It is likely that all relied on Aspen to at least cover lodging and travel costs). CNN sponsored the forum through a special new website called CNN Security Clearance, promoting the event through Twitter and specially commissioned op-eds from participating national security figures like former CIA director John McLaughlin. Another forum sponsor was Academi, the private mercenary corporation formerly known as Blackwater. In fact, Academi is Blackwater’s third incarnation (it was first renamed “Xe”) since revelations of widespread human rights abuses and possible war crimes in Iraq and Afghanistan threw the mercenary firm into full damage control mode. The Aspen Institute did not respond to my questions about whether accepting sponsorship from such an unsavory entity fit within its ethical guidelines. 'Exterminating People' John Ashcroft, the former Attorney General who prosecuted the war on terror under the administration of George W. Bush, appeared at Aspen as a board member of Academi. Responding to a question about U.S. over-reliance on the “kinetic” approach of drone strikes and special forces, Ashcroft reminded the audience that the U.S. also likes to torture terror suspects, not just “exterminate” them. “It's not true that we have relied solely on the kinetic option,” Ashcroft insisted. “We wouldn't have so many detainees if we'd relied on the ability to exterminate people…We've had a blended and nuanced approach and for the guy who's on the other end of a Hellfire missile he doesn't see that as a nuance.” Hearty laughs erupted from the crowd and fellow panelists. With a broad smile on her face, moderator Catherine Herridge of Fox News joked to Ashcroft, “You have a way with words.” But Ashcroft was not done. He proceeded to boast about the pain inflicted on detainees during long CIA torture sessions: “And maybe there are people who wish they were on the end of one of those missiles.” Competing with Ashcroft for the High Authoritarian prize was former NSA chief Michael Hayden, who emphasized the importance of Obama’s drone assassinations, at least in countries the U.S. has deemed to be Al Qaeda havens. “Here's the strategic question,” Hayden said. “People in Pakistan? I think that's very clear. Kill 'em. People in Yemen? The same. Kill 'em.” “We don’t smoke [drug] cartel leaders but personally I’d support it,” remarked Philip Mudd, the former deputy director of Bush’s Counterterrorism Center, earning more guffaws from his fellow panelists and from Herridge. Ironically, Mudd was attempting to argue that counter-terror should no longer be a top U.S. security priority because it poses less of a threat to Americans than synthetic drugs and child obesity. Reflection was not on the agenda for most of the Security Forum’s participants. When asked by a former US ambassador to Denmark the seminal question “This is a great country, why are we always the bad guy?,” Mudd replied, “They think that anything the U.S. does [in the Middle East], even though we helped Muslim communities in Bosnia and Kuwait, everything is rewritten to make us the bad guys.” The clamoring about U.S. invasions, drone strikes, bankrolling of Israel’s occupation, and general political meddling, could all be written off as fevered anti-Americanism borne from the desert canyons of the paranoid Arab mind. And the wars could go on. Delusions of Empire Throughout the three days of the Security Forum, the almost uniformly white cast of speakers were called on to discuss recent geopolitical developments, from "Eye-rak" and "Eye-ran" to Egypt, where a military coup had just toppled the first elected government in the country’s history. Mattis carefully toed the line of the Obama administration, describing the overthrow of Egypt’s government not as a coup, but as “military muscle saddled on top of this popular uprising.” Warning that using terms like “coup” could lead to a reduction in U.S. aid to Egypt, where the military controls about one-third of the country’s economy, Mattis warned, “We have to be very careful about passing laws with certain words when the reality of the world won’t allow you to.” Wolf Blitzer mentioned that Egypt’s new military-imposed foreign minister, Nabil Fahmy, had been a fixture in Washington during the Mubarak days. “These are people the West knows, the U.S. knows,” he said of the new cabinet in Cairo. “I assume from the U.S. perspective, the United States is so much more happy with this.” Later, one of the few Arab participants in the forum, Al Jazeera DC bureau chief Abderrahim Foukara, claimed that the Arab revolts were inspired by the U.S. invasion of Iraq. “The iconic image of Saddam being pulled out of a hole did something to the dynamic between ruler and ruled in the Arab world,” Foukara claimed. With the revolts blurring the old boundaries imposed on the Arab world during the late colonial era, former CIA director John McLaughlin rose from the audience to call for the U.S. to form a secret, Sikes-Picot-style commission to draw up a new set of borders. “The American government should now have such a group asking how we should manage those lines and what should those lines be,” McLaughlin told the panelists, who dismissed the idea of a new Great Game even as they discussed tactics for preserving U.S. dominance in the Middle East. ABC’s Chris Isham asked Jim Jeffrey, the former U.S. ambassador to Iraq, why, with a recession on its hands and Middle Eastern societies spiraling out of control, should the U.S. remain militarily involved in the region. Without hesitation, Jeffrey rattled off the reasons: Saudi Arabia, Turkey, Israel, and “world oil markets.” “What could we have done better?” Isham asked the ambassador. “Probably not too much.” NSA Heroes, Saving Lives of Potential Consumers While participants in the Security Forum expressed total confidence in American empire, they could not contain their panic, outrage, and fear at the mere mention of Snowden. “Make no mistake about it: These are great people who we’re slamming and tarnishing and it’s wrong. They’re the heroes, not this other and these leakers!” NSA chief General Keith Alexander proclaimed, earning raucous applause from the crowd. Snowden’s leaks had prompted a rare public appearance from Alexander, forcing the normally imperious spy chief into the spotlight to defend his agency’s Panopticon-style programs and its dubious mechanisms of legal review. Fortunately for him, NBC’s Pete Williams offered him the opportunity to lash out at Snowden and the media that reported the leaks, asking whether the "terrorists” (who presumably already knew they were being spied on) had changed their behavior as a result of the leaks. “We have concrete proof that terrorists are taking action, making changes, and it’s gonna make our job harder,” Alexander declared, offering nothing to support his claim. Alexander appeared in full military regalia, with colorful decorations and medallions covering his left breast. Casting himself as a stern but caring father who has the best interests of all Americans at heart, even if he can't fully disclose his methods, he turned to the crowd and explained, “The bad guys…hide amongst us to kill our people. Our job is to stop them without impacting your civil liberties and privacy and these programs are set up to do that.” “The reason we use secrecy is not to hide it from the American people, but to hide it from the people who walk among you and are trying to kill you,” Alexander insisted. Corporations like AT&T, Google and Microsoft that had been compelled to hand over customer data to the NSA “know that we’re saving lives,” the general claimed. With a straight face, he continued, “And that’s good for business because there’s more people out there who can buy their products.” Self-Reporting So who were the "bad guys” who “walk among us,” and how could Americans be sure they had not been ensnared by the NSA’s all-encompassing spying regime, either inadvertently or intentionally? Nearly all the Security Forum participants involved in domestic surveillance responded to this question by insisting that the NSA had the world’s most rigorous program of oversight, pointing to Congress and the Foreign Intelligence Surveillance Act (FISA) courts as the best and only means of ensuring that “mistakes” are corrected. “We have more oversight on this [PRISM] program than any other program in any government that I’m aware of,” Alexander proclaimed, ramming home a talking point repeated throughout the forum. “I can assure these are some of the judges who are renowned for holding the government to a very high standard,” John Carlin, the Assistant US Attorney General for National Security, stated. But in the last year, FISA courts received 1,856 applications for surveillance from the government. In 100 percent of cases, they were approved. As for Congress, only two senators, Ron Wyden and Mark Udall, demanded the NSA explain why PRISM was necessary or questioned its legality. Despite the fact that the entire regime of oversight was a rubber stamp, or perhaps because of it, none of those who appeared at the Security Forum to defend it were willing to consider any forum of independent civilian review. “You have to do [domestic surveillance] within a closed bubble in order to do it effectively,” Dennis Blair, the director of National Intelligence conceded under sustained grilling from the Washington Post’s Barton Gellman, one of the reporters who broke Snowden’s leaks and perhaps the only journalist at the Security Forum who subjected participants to tough scrutiny. When Gellman reminded Alexander that none of the oversight mechanisms currently in place could determine if the NSA had improperly targeted American citizens with no involvement in terror-related activity, the general declared, “we self-report those mistakes.” “It can't be, let's just stop doing it, cause we know, that doesn't work,” Alexander maintained. “We've got to have some program like [PRISM].” The wars would go on, and so would the spying. Reinstituting Public Confidence During a panel on inter-agency coordination of counter-terror efforts, Mike Leiter, the former director of the National Counterterrorism Center (NCC), suggested that one of the best means of preserving America’s vast and constantly expanding spying apparatus was “by reinstituting faith among the public in our oversight.” Even as current NCC director Matthew Olsen conceded, “There really are limits in how transparent we can be,” Leiter demanded that the government “give the public confidence that there’s oversight. Since leaving the NCC, Leiter has become the senior counsel of Palantir Technologies, a private security contractor that conducts espionage on behalf of the FBI, CIA, financial institutions, the LAPD and the NYPD, among others. In 2011, Palantir spearheaded a dirty tricks campaign against critics of the U.S. Chamber of Commerce, including journalists, compiling electronic dossiers intended to smear them. Palantir’s target list included progressive groups like Think Progress, SEIU and U.S. Chamber Watch. In the friendly confines of the Aspen Institute’s Security Forum, Leiter did his best to burnish his company’s tarnished image, and do some damage control on behalf of the national security apparatus it depends on for contracts. Like most other participants, Leiter appeared in smart casual dress, with an open collar, loafers, a loose-fitting jacket and slacks. “Just seeing us here,” he said, “that inspires [public] confidence, because we’re not a bunch of ogres.” Max Blumenthal is the author of Republican Gomorrah (Basic/Nation Books, 2009). Twitter at @MaxBlumenthal.

1 0

Re: [bitcoin-list] [Bitcoin-development] BitMail - p2p Email 0.1. beta
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from Mike Hearn <mike(a)plan99.net> ----- Date: Tue, 30 Jul 2013 14:12:51 +0200 From: Mike Hearn <mike(a)plan99.net> To: Wendell <w(a)grabhive.com> Cc: Bitcoin Dev <bitcoin-development(a)lists.sourceforge.net>, Gregory Maxwell <gmaxwell(a)gmail.com>, bitcoin-list(a)lists.sourceforge.net Subject: Re: [bitcoin-list] [Bitcoin-development] BitMail - p2p Email 0.1. beta The TPM is a piece of secure* hardware that provides various cryptographic services to the host system. It is important to understand that it is not a crypto accelerator. It is a place to store keys and small pieces of data (like hashes, counters) where it's difficult for someone to extract them even if they have physical access. The TPM is designed to support trusted computing, a rather splendid set of extensions to the x86 architecture that let you do remote attestation, software sealing and other things. Or at least it would be splendid if it had been really finished off and pushed to completion by the designers. Unfortunately due to various political issues it exists in a quasi-finished, semi-broken state which only experts can use. Without a doubt you have never run any software in a TC environment. As part of that role, the TPM provides some permanent storage in the form of NVRAM. Because the TPM is designed to be as cheap as possible, it has a limited number of write cycles. Normally you're meant to store Intel TXT launch control policies and sealed keys there, but Pond uses it in a different way by storing keys there that it encrypts local data with. By erasing the key in the TPM chips memory area, the data on disk is effectively destroyed too. This is useful because modern "disks" are often SSD drives, or physical metal disks that use log structured file systems. Because flash memory has a limited number of write cycles per cell, internally SSDs have firmware that remap writes from logical addresses to different physical addresses, the goal is to avoid wearing down the drive and extend its useful life. Normally it doesn't matter, but if you want to delete data such that it's really really gone, it obviously poses a problem. Using TPM NVRAM solves it, albiet, at a high usability cost. *note: actual tamper resistance of real-world TPM chips is not something that seems to have been studied much On Tue, Jul 30, 2013 at 1:27 PM, Wendell <w(a)grabhive.com> wrote: > Can you explain this process for those of us not too familiar with TPM > chips? > > -wendell > > grabhive.com | twitter.com/grabhive | gpg: 6C0C9411 > > On Jul 30, 2013, at 10:40 AM, Mike Hearn wrote: > > > As a testament to the seriousness with which Pond takes forward > security, it can use the NVRAM in a TPM chip to reliably destroy keys for > data that an SSD device might have otherwise made un-erasable. > ------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

ZeroReserve -- a friend 2 friend payment scheme and Bitcoin exchange
by Eugen Leitl 30 Jul '13

30 Jul '13

Implemented as a RetroShare plugin. https://github.com/zeroreserve/ZeroReserve ZeroReserve Friend 2 Friend Payment and Bitcoin exchange Prerequisite for building is a successful RetroShare build and sqlite3. To build, checkout the sources to the plugins directory of Retroshare and build with $ qmake && make clean && make To install on Windows, drop the resulting DLL into the %APPDATA%\Retroshare\extensions directory. To install on Linux, drop the resulting shared object into ~/.retroshare/extensions

1 0

[cryptography] evidence for threat modelling -- street-sold hardware has been compromised
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from ianG <iang(a)iang.org> ----- Date: Tue, 30 Jul 2013 14:07:44 +0300 From: ianG <iang(a)iang.org> To: Crypto discussion list <cryptography(a)randombit.net> Subject: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 It might be important to get this into the record for threat modelling. The suggestion that normally-purchased hardware has been compromised by the bogeyman is often poo-pooed, and paying attention to this is often thought to be too black-helicopterish to be serious. E.g., recent discussions on the possibility of perversion of on-chip RNGs. This doesn't tell us how big the threat is, but it does raise it to the level of 'evidenced'. http://www.afr.com/p/technology/spy_agencies_ban_lenovo_pcs_on_security_HVg… Computers manufactured by the world’s biggest personal computer maker, Lenovo, have been banned from the “secret” and ‘‘top secret” networks of the intelligence and defence services of Australia, the US, Britain, Canada, and New Zealand, because of concerns they are vulnerable to being hacked. Multiple intelligence and defence sources in Britain and Australia confirmed there is a written ban on computers made by the Chinese company being used in “classified” networks. The ban was introduced in the mid-2000s after intensive laboratory testing of its equipment allegedly documented “back-door” hardware and “firmware” vulnerabilities in Lenovo chips. ... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [bitcoin-list] [Bitcoin-development] BitMail - p2p Email 0.1. beta
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from Mike Hearn <mike(a)plan99.net> ----- Date: Tue, 30 Jul 2013 10:40:45 +0200 From: Mike Hearn <mike(a)plan99.net> To: Gregory Maxwell <gmaxwell(a)gmail.com> Cc: Bitcoin Dev <bitcoin-development(a)lists.sourceforge.net>, bitcoin-list(a)lists.sourceforge.net Subject: Re: [bitcoin-list] [Bitcoin-development] BitMail - p2p Email 0.1. beta For people who are interested in such technologies, I recommend looking at Pond: https://pond.imperialviolet.org/ It is written by Adam Langley, so it comes with some serious credentials behind it. It provides asynchronous email-like messaging that's forward secure, resistant to traffic analysis and the whole thing runs over Tor. Messages are stored for a week and are strictly limited in size. There's no spam because nobody has an address - instead you have to grant someone the ability to message you by giving them a small file. So, not really intended as an email competitor convenience wise, but it has many interesting ideas and a reasonable GUI. As a testament to the seriousness with which Pond takes forward security, it can use the NVRAM in a TPM chip to reliably destroy keys for data that an SSD device might have otherwise made un-erasable. The main downside - it's written in Go :) On Tue, Jul 30, 2013 at 8:50 AM, Gregory Maxwell <gmaxwell(a)gmail.com> wrote: > On Mon, Jul 29, 2013 at 10:01 PM, Randolph D. <rdohm321(a)gmail.com> wrote: > > Secure P2P Email from Friend to Friend without relying on a central > server. > > Key- / Repleo-Exchange. > > Full decentral Email-Network using the Echo Protocol. > > Store Email for Offline-Friends in the P2P Network. > > Chat and Instant Messaging is build in. Define & Add your friends. > > Strong e2e Multi-Encryption (PGP-kind/AES over SSL: using libgcrypt). > > Libspoton Integration. > > Additional Security Layer with the GB-Feature for Emails. > > Preventing Data Retention (VDS). WoT-less. > > HTTP & HTTPS Connections. > > Open Source. BSD License. > > > > anyone with a Server? Key? > > Keep safe everyone: > > A number of apparent sock accounts has been posting about what appears > to be the same software under the name "goldbug" for a couple days > now: > > e.g. > https://lists.torproject.org/pipermail/tor-talk/2013-July/029107.html > https://lists.torproject.org/pipermail/tor-talk/2013-July/029125.html > http://lists.gnupg.org/pipermail/gnupg-users/2013-July/047137.html > > > ------------------------------------------------------------------------------ > Get your SQL database under version control now! > Version control is standard for application code, but databases havent > caught up. So what steps can you take to put your SQL databases under > version control? Why should you start doing it? Read more to find out. > http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development(a)lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > ------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[bitcoin-list] BitMail - p2p Email 0.1. beta
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from "Randolph D." <rdohm321(a)gmail.com> ----- Date: Tue, 30 Jul 2013 07:01:02 +0200 From: "Randolph D." <rdohm321(a)gmail.com> To: bitcoin-development(a)lists.sourceforge.net, bitcoin-list(a)lists.sourceforge.net Subject: [bitcoin-list] BitMail - p2p Email 0.1. beta http://bitmail.sourceforge.net/ - Secure P2P Email from Friend to Friend without relying on a central server. - Key- / Repleo-Exchange. - Full decentral Email-Network using the Echo Protocol. - Store Email for Offline-Friends in the P2P Network. - Chat and Instant Messaging is build in. Define & Add your friends. - Strong e2e Multi-Encryption (PGP-kind/AES over SSL: using libgcrypt<http://www.gnu.org/software/libgcrypt/>). - Libspoton Integration. - Additional Security Layer with the GB-Feature for Emails. - Preventing Data Retention (VDS). WoT-less. - HTTP & HTTPS Connections. - Open Source. BSD License. anyone with a Server? Key? ------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Moscow Metro says new tracking system is to find stolen phones; no one believes them
by Eugen Leitl 30 Jul '13

30 Jul '13

http://arstechnica.com/tech-policy/2013/07/moscow-metro-says-new-tracking-s… Moscow Metro says new tracking system is to find stolen phones; no one believes them Experts: Russians are probably using fake cell tower devices for surveillance. by Cyrus Farivar - July 29 2013, 11:10pm +0200 On Monday, a major Russian newspaper reported that Moscow’s metro system is planning what appears to be a mobile phone tracking device in its metro stations—ostensibly to search for stolen phones. According to Izvestia (Google Translate), Andrey Mokhov, the operations chief of the Moscow Metro system’s police department, said that the system will have a range of five meters (16 feet). “If the [SIM] card is wanted, the system automatically creates a route of its movement and passes that information to the station attendant,” Mokhov said. Many outside experts, both in and outside Russia, though, believe that what local authorities are actually deploying is a “stingray,” or “IMSI catcher”—a device that can fool a phone and SIM into reading from a fake mobile phone tower. (IMSI, or an International Mobile Subscriber Identity number, is a 15-digit unique number that sits on every SIM card.) Such devices can be used as a simple way to see what phone numbers are being used in a given area or even to intercept the audio of voice calls. The Moscow Metro did not immediately respond to our request for comment. “Many surveillance technologies are created and deployed with legitimate aims in mind, however the deploying of IMSI catchers sniffing mobile phones en masse is neither proportionate nor necessary for the stated aims of identifying stolen phones,” Eric King of Privacy International told Ars. “Likewise the legal loophole they claim to be using to legitimize the practice—distinguishing between tracking a person from a SIM card—is nonsensical and unjustifiable. It's surprising it's being discussed so openly, given in many countries like the United Kingdom, they refuse to even acknowledge the existence of IMSI catchers, and any government use of the technology is strictly national security exempted.” These devices are in use, typically by law enforcement agencies worldwide, including some in the United States. Portable, commercial IMSI catchers are made by Swiss and British companies, among others, but in 2010, security researcher Chris Paget announced that he built his own IMSI catcher for only $1,500. Still, mobile security remains spy-versus-spy to some degree, each measure matched by a countermeasure. In December 2011, Karsten Nohl, another noted mobile security researcher, released "Catcher Catcher"—a piece of software that monitors network traffic and looks at the likelihood an IMSI catcher is in use. Keir Giles, of the Conflict Studies Research Centre, an Oxford-based Russian think tank, told Ars that Russian authorities are claiming a legal technicality. "They are claiming that although they are legally prohibited from indiscriminate surveillance of people, the fact that they are following SIM cards which are the property of the mobile phone operators rather than the individuals carrying those SIM cards makes the tracking plans perfectly legal," he said, adding that this reasoning is "weaselly and ridiculous." The Russian newspaper also quoted Alexander Ivanchenko, executive director of the Russian Security Industry Association, who pointed out that even to be effective, such a system would need these devices every 10 meters (32 feet). “It is obvious that the cost of the system is not commensurate with the value of all the stolen phones,” he said. “Also, effective anti-theft technology is already known: in the US, for example, the owner of the stolen phone knows enough to call the operator—and the stolen device stops working, even if another SIM-card is inserted.” Two major Russian mobile providers, Beeline and Megafon, have told Russian media (Google Translate) that they are unaware of this supposed anti-theft measure. On the other hand, BBC Russian reports (Google Translate) that the system is due to come online in late 2013 or early 2014.

1 0

[Cryonet_AP] Lawyers in Thailand ban Bitcoin
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from John de Rivaz <John(a)deRivaz.com> ----- Date: Tue, 30 Jul 2013 09:07:32 +0100 From: John de Rivaz <John(a)deRivaz.com> To: Cryonet_AP(a)yahoogroups.com Subject: [Cryonet_AP] Lawyers in Thailand ban Bitcoin X-Mailer: Microsoft Windows Live Mail 16.4.3505.912 Reply-To: Cryonet_AP(a)yahoogroups.com Thailand has become the first country to ban bitcoins after the central bank ruled it is not a currency. In a statement on its website , Bitcoin said it had given a presentation to the Bank of Thailand about how the currency works in a bid to operate in the country. However, at the end of the meeting, "senior members of the Foreign Exchange Administration and Policy Department advised that due to lack of existing applicable laws, capital controls and the fact that Bitcoin straddles multiple financial facets... Bitcoin activities are illegal in Thailand". more on http://uk.finance.yahoo.com/news/bitcoins-banned-thailand-203840004.html -- Sincerely, John de Rivaz: http://John.deRivaz.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

NSA Utah Data Center Cabling, Emanations and Bizarre Planning
by John Young 29 Jul '13

29 Jul '13

Not much publicly available on the cabling and emanations protection of the NSA Utah Data Center. Surely highly advanced measures are being applied. Google Earth shows a couple of stages of construction, Bing Maps a couple more. AP has published a dozen or so hi-rez photos of construction. A lot of earthwork was done to create a flat site on a mountain side (preceded by a small air field). No indication of underground construction except pits and trenches under the buildngs. With none on the surface there must be trenches for power and signal cable. No antenna have appeared on the site for transceiving data like those of other of its data centers, so presumably it is done by UG fiber optic (or antenna are hidden or remote). Photos of construction progress of the two data buildings show windowless envelopes made of panels and flat roofs without various rooftop ductwork, grilles, piping and the like which appear on roofs of other NSA and TLA facilities which might emanate signal although not likely. (Some are littered with the stuff which might be decoy.) Steel structural framing is shown at Utah despite its known transmittal of inadvertent signal, compared to say, reinforced concrete, metalized fabric or synthetics. although are ample countermeasures available. The pairing of structures at Utah, two of each type, data center, generator, AC, fuel tanks, etc., show redundancy also not seen elsewhere. Not much to see of protection against missiles and aerial attack but that is the same at other NSA facilities. Wonder what supports that confidence. The odd bent shape of the site plan, with buildings not parallel to one another is intriguing. Could be aesthetic but may have another role, say to disperse richochet of inadvertent emanations. Quite a few recent government buildings avoid the traditional rectilinear site planning of buildings long considered to be most cost effective and authoritarian. Some like NGA HQ, NSA Utah and several at Ft. Meade look almost byzantine in layout, if not a shrewd design to limit echo, amplification, richochet, or best, to befuddle satellite peepers.

3 2

Re: [p2p-hackers] Dealing with malicious nodes in decentralized p2p network
by Eugen Leitl 29 Jul '13

29 Jul '13

----- Forwarded message from Michael Rogers <michael(a)briarproject.org> ----- Date: Mon, 29 Jul 2013 16:46:35 +0100 From: Michael Rogers <michael(a)briarproject.org> To: theory and practice of decentralized computer networks <p2p-hackers(a)lists.zooko.com> Subject: Re: [p2p-hackers] Dealing with malicious nodes in decentralized p2p network User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 Reply-To: theory and practice of decentralized computer networks <p2p-hackers(a)lists.zooko.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm not sure whether your message just came through to the list or whether I just noticed it. Either way, I hope it's not too late to reply. The following papers describe attacks that can be carried out by malicious nodes in structured P2P networks: E. Sit and R. Morris. Security considerations for peer-to-peer distributed hash tables. 1st International Workshop on Peer-to-Peer Systems (IPTPS ?02), Cambridge, MA, USA, March 2002. http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.11.7175 M. Castro, P. Druschel, A. Ganesh, A. Rowstron, and D.S. Wallach. Secure routing for structured peer-to-peer overlay networks. 5th Symposium on Operating Systems Design and Implementation, Boston, MA, USA, December 2002. http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.118.1870 I'd recommend checking out the papers that cite those papers, some of which propose solutions to some of the attacks. Cheers, Michael On 13/03/13 05:44, offbynull wrote: > Hi, > > Does anyone know of any strategies to prevent, identify, or > work-around malicious nodes in a structured overlay? I'm > specifically interested in Chord's ring overlay. It seems like > there are a lot of things a malicious node could to to interfere > with normal operations (e.g. routing / lookup / etc..), or to > bypass certain regions of the ring. > > Examples of things that a malicious node could do ... > > 1. Imagine someone wanted to prevent others from accessing a > key-value pair. That person would create a malicious node with an > id of hash(key), ensuring that queries for that key would end up at > the malicious node. When the malicious node receives queries for > that key, it simply ignores them or responds that the key was never > set. > > 2. This is similar to the one above. Imagine someone wanted to > prevent others from accessing a key-value pair, but a legitimate > node already existed with an id of hash(key). That person would > create a malicious node with an id of hash(key) - 1. When other > nodes ask the malicious node to be routed to that key, the > malicious node would respond with a node other than it's successor, > ensuring that the request never gets routed to its true > destination. > > 3. Imagine someone wanted to cut out a portion of the nodes in the > overlay. That person would create a malicious node that has its > finger table set to skip over a bunch of existing nodes in front of > it. > > > Are there strategies to deal with this, or is this just something > that's expected with Chord's design (as in peers can't be untrusted > nodes)? > > _______________________________________________ p2p-hackers mailing > list p2p-hackers(a)lists.zooko.com > http://lists.zooko.com/mailman/listinfo/p2p-hackers > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJR9o5bAAoJEBEET9GfxSfMj0AIALZ+lSnA7GDh+Y3iifdVotwK YXdjGjv+qJcvOIO/rHtTEyPMzp7yqz0X0VxeiC8XIjXP6rwvFGOXuClqd0NAjFW9 lHYtO9tHBkCV/LOU5hHrD3510Ry6gYkuDnyDeWBlwQ2i/zUU160PqGr+Esd1IpNP zu5JKSHHq61wr5GisXOB+pWOxrKEEKtQAtv3ibFNBDXhGyJwg+U/LCe9Q14V9Q4t BiOKgce8xHhbytY8B/5t3HW6cCavQAq/TR0CfjpWRtz823hs0lTdepJJXPnKVYIo HD0u+cwnCGr7LNF5szMvkvdEkyXsbXGLYX+2cK7aHBPO4kGoXw5DrNAhS2Gkh+g= =xMmD -----END PGP SIGNATURE----- _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0