January 2014 - cypherpunks - lists.cpunks.org

Re: [Cryptography] The crypto behind the blackphone
by grarpamp 02 Feb '14

02 Feb '14

On Mon, Jan 27, 2014 at 4:10 PM, Jon Callas <jon(a)callas.org> wrote: > My truest personal goal for Blackphone is read an Android hardening guide sometime in the future that will give a list of the things you should do to lock down your Android phone, and at the end it will say, "Or you could just buy a Blackphone." I want it to come out of the box the way that serious people like us on this list would want it. > It will also have a set of software and services that people like us would like to have, which is part of the hardening, in my opinion. How would this be any different than what the guardian (and other phone SW projects) are developing, other than shipment of a phone preloaded with your flavor of Android OS? (And perhaps also offering IMEI/SIM cell service?) As opposed to the user flashing Android-ROM-OS into any compatible phone and choosing their service. Thus, save that convenience, why? This question shouldn't imply such products aren't needed. Note some open phone HW projects are selling hardware to which you apply your droid SW rom. Though we're likely at least a handful of years away from seeing a genuinely 'open design' baseband HW layer in a phone, they are talking about approaching it.

2 3

Fw: Jim Bell's Email crash
by jim bell 31 Jan '14

31 Jan '14

My email provider, the idiots at Yahoo.com, crashed my email address account 'jamesdbell8(a)yahoo.com' last Sunday. I have lost my email addresses, as well as all emails. For now, I will have to operate on a new email address, 'jamesdbell9(a)yahoo.com'. At this point, Yahoo is my #1 enemy, and I expect them to be "The first against the wall when the revolution comes". Jim Bell

11 13

{}coin: good enough for election politics?
by Troy Benjegerdes 31 Jan '14

31 Jan '14

I may be a fool, but I'm not fool enough to play with Assassination politcs. I am, however, stupid enough to go do something provacative like attempt to prove that code is speech, money is code, and someone better figure out a better way to deal with campaign finance or we are all screwed. So I present {}coin, the broken cryptocurrency, neutered of all the privacy I can strip out of it, for broken election systems. https://bitbucket.org/dahozer/-- Could a good anonoperson cipherpunk tack on higher-level layers that are actually anonymous, as opposed too what I see being proposed for Bitcoin? Probably. >From the techno-political-economic angle, it looks like overlaying distributed high-frequency futures trading would provide more than enough noise on top of fully-surveillable {}coin to provide a sufficient anonymity set, while actually providing a usefull value to us farmers, who could actually see who's on the other side of a trade. The experts at stealth, redirection, misdirection, and over-all dirty tricks (aka Wall Street) could simply move up a few layers and continue their anonymous game-of-thrones ( I mean game of CEO), and hide in plain sight in huge volumes of trades, and then so could anyone else. But then **I** don't have to pay to be someone else's anonymity set, and I could make money if I wanted to play that game, and take money from those who want to hide, instead of having value siphoned off by thousands of economic vampires hiding under regulatory capture of our current finance system. Does this sound anywhere near possible, or am I just an optimistic hashcash fool?

12 35

NSA Redactions Fail, Fail and Fail Again
by John Young 30 Jan '14

30 Jan '14

Humorous Snowden media inept infosec redactions: NSA Redactions Fail, Fail and Fail Again: http://cryptome.org/2014/01/nsa-redaction-fails.pdf

2 1

MaidSafe: p2p encrypted anonymous drivesharing homedir network?
by grarpamp 30 Jan '14

30 Jan '14

Lots of unknown popups making bold claims lately that should be looked into... discuss? ---------- Forwarded message ---------- From: David Irvine <david.irvine(a)maidsafe.net> Date: Sun, Jan 26, 2014 at 10:51 AM Subject: [bitcoin-list] Meeting place to discuss 'the decentralised internet' projects To: bitcoin-list(a)lists.sourceforge.net Hi sorry for barging in, but with all of the projects now based around decentralisation, I thought a common place to exchange ideas would be good. I have created a subreddit http://www.reddit.com/r/decentralisedinternet as a place for as many projects to collaborate and share experiences, research and general comments. I am hoping to make this an open environment for discussion and technical debate, but not a place of project wars. This is essential and to that end I would like to engage with you and have you all sign up to the subreddit. I believe as we recodnise more projects then at least one person from each project should be a moderator. This should add stability and ensure that each project is protected as they all have their own path to follow. I suggest each project puts forward an admin and I will add them immediately. I believe there is enough of a push now to decentralise services and working together to achieve all of our goals can only be a good thing. Below is the sidebar text as it stands, this is all open for debate. ######################## This is a reddit of logic and not emotion, please base all debate on logic. We do not want project wars here, so no vim/emacs type debate between projects. Keep focussed and logical if at all possible. Whilst people will prefer one project over another, the point of this subreddit is to find the technically best solutions to the miriad of issues and share technology and discussion between projects. Advertising is not a goal of this subreddit, although new information about projects is encouraged. Submissions that are mostly about some other server based solutions belong elsewhere. Please avoid repetition — /r/decentralisedinternet is a subreddit devoted to new information and discussion about decentralisation of the Internet. New projects are welcome to announce themselves via this reddit, but after those have been announced they are no longer news and should not be re-posted. New news will be accepted. Aside from new project announcements, those interested in advertising to our audience should consider Reddit's self-serve advertising system. Projects so far (please request to be added by posting a link to your project, if it is upvoted and agreed by redditors to be accepted it will be added here) Freenet Tahoe bitcoin MaidSafe bitcloud twister ########################## I am sending this message to each of the projects mentioned and any others that should be included as we progress. -- David Irvine maidsafe.net <http://www.maidsafe.net/> twitter: @metaquestions blog: http://metaquestions.me ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list

2 1

facial mesh tracking and subsitution
by gwen hastings 30 Jan '14

30 Jan '14

https://github.com/auduno/clmtrackr -- Tentacle #99 ecc public key curve p25519(pcp 0.15) 1l0$WoM5C8z=yeZG7?$]f^Uu8.g>4rf#t^6mfW9(rr910 Governments are instituted among men, deriving their just powers from the consent of the governed, that whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it, and to institute new government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their safety and happiness.’ https://github.com/TLINDEN/pcp.git to get pcp(curve25519 cli) https://github.com/stef/pbp.git (curve 25519 python based cli)

1 0

Fwd: [Dailydave] Understanding BIOS & SMM
by coderman 29 Jan '14

29 Jan '14

---------- Forwarded message ---------- From: Xeno Kovah <xsk.dailydave(a)gmail.com> Date: Sun, Jan 26, 2014 at 7:45 AM Subject: [Dailydave] Understanding BIOS & SMM Our research team at MITRE has been looking into BIOS security for the past couple years and starting to publish our results in the last year. We described BIOS exploits and an in-BIOS defensive system called BIOS Chronomancy at venues like BlackHat and ACM CCS. We also released a free tool called Copernicus[1] which lets you detect if a BIOS is writable, and dump the contents of the BIOS from a Windows system (which makes enterprise-wide configuration and integrity checking possible.) But the question is, let's say you have a BIOS dump and it shows differences. How are you going to interpret those differences? How do you distinguish natural changes from malicious ones? We wanted to get a basic inspection capability out there, but we recognized that people were going to need to know a lot more about system internals, hardware quirks, and UEFI before they'd be able to make full use of it. So we made a class to help bootstrap people faster. Currently the class is scheduled for CanSecWest[2] and Syscan[3] (and the prices are going up starting Feb 1). It would be nice if people wanted to understand how the deep system architecture worked for it's own sake, because we of course think it's super interesting and fulfilling to know things others don't. But hopefully the news of the past couple months has made people realize that "out of sight, out of mind" isn't a great strategy for BIOS security. First there was #badBIOS (which was kicked off by Dragos experimenting with Copernicus[4]). Then there was NSA's defensive side saying they had caught the Chinese making BIOS bricking attacks[5]. Then there was NSA's offensive side being caught having their own BIOS backdoor capabilities[6]. And of course there were a whole lot of people letting their FUD flags fly around all of it. So if you'd like to get a more technical and quantitative view of what the BIOS/SMM security landscape looks like, you should check out our classes and watch for talks by Corey Kallenberg, John Butterworth, and myself over the next 6 months where we'll be describing 2 new BIOS memory-corruption-to-reflash exploits, 2 new SecureBoot-breaking tricks, and trustworthy computing extensions to Copernicus that will counter many classes of attacks against BIOS dumping software that would let an attacker hide his BIOS presence. Xeno [1]http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-bl… [2]https://cansecwest.com/dojo.html [3]http://syscan.org/index.php/sg/training [4]https://plus.google.com/103470457057356043365/posts/exuXRz5C3L3 [5]http://www.cbsnews.com/news/nsa-speaks-out-on-snowden-spying/ [6]http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html

2 1

Re: Al-qaeda.net deprecated (was: Note to new-ish subscribers)
by Bill Stewart 28 Jan '14

28 Jan '14

At 03:38 PM 1/19/2014, Shawn K. Quinn wrote: >On Sun, Jan 19, 2014, at 02:45 PM, John Young wrote: > > What happened to cypherpunks.org? Who owns it? It's > > registration is hidden behind GoDaddy. Listed Servers: > > > > Name Server:NS.CYPHERPUNKS.TO > > Name Server:ASTERIA.DEBIAN.OR.AT > > > > http://www.cypherpunks.to/ list familiar > > people. >The "webmaster" mailbox at the domain appears to work, so maybe just >asking them will give you useful info. Cypherpunks.to is Lucky Green and friends; looks like it's based at/near xs4all.nl.

6 16

format transforming encryption with regular expressions (FTE)
by coderman 28 Jan '14

28 Jan '14

https://kpdyer.com/publications/ccs2013-fte.pdf and https://fteproxy.org/about """ Format-Transforming Encryption (FTE) is a novel cryptographic primitive that extends traditional encryption... FTE takes a key, message and format (a compact set descriptor) as input and outputs a ciphertext in the format set. As an example, a format may describe the set of valid HTTP messages. fteproxy bootstraps FTE to relay arbitrary data streams. In turn, this enables fteproxy to use a regular expression that captures an uncensored protocol (e.g., HTTP), then employ fteproxy to tunnel a censored protocol (e.g., Tor, TLS, SSH, etc.) To the network monitor, traffic looks like HTTP, even though it's actually a censored protocol. """ git clone https://github.com/kpdyer/fteproxy.git fteproxy-unstable cd fteproxy-unstable make ./bin/fteproxy

2 1

BitInstant CEO / BTCKing Indicted for Money Laundering
by Rich Jones 28 Jan '14

28 Jan '14

http://www.justice.gov/usao/nys/pressreleases/January14/SchremFaiellaCharge… I'm considering starting a slightly-higher-than-market rate cloud mining operation to allow people to avoid the exchanges and mine their own coins to avoid situations like this.. R Manhattan U.S. Attorney Announces Charges Against Bitcoin Exchangers, Including Ceo Of Bitcoin Exchange Company, For Scheme To Sell And Launder Over $1 Million In Bitcoins Related To Silk Road Drug Trafficking *FOR IMMEDIATE RELEASE* Monday, January 27, 2014 *Defendants Sold Bitcoins to be Used to Buy and Sell Illegal Drugs Anonymously on the Silk Road Drug Trafficking Website* Preet Bharara, the United States Attorney for the Southern District of New York, James J. Hunt, the Acting Special-Agent-in-Charge of the New York Field Division of the Drug Enforcement Administration (“DEA”), and Toni Weirauch, the Special Agent-in-Charge of the New York Field Office of the Internal Revenue Service, Criminal Investigation (“IRS-CI”), announced the unsealing of criminal charges in Manhattan federal court against ROBERT M. FAIELLA, a/k/a “BTCKing,” an underground Bitcoin exchanger, and CHARLIE SHREM, the Chief Executive Officer and Compliance Officer of a Bitcoin exchange company, for engaging in a scheme to sell over $1 million in Bitcoins to users of “Silk Road,” the underground website that enabled its users to buy and sell illegal drugs anonymously and beyond the reach of law enforcement. Each defendant is charged with conspiring to commit money laundering, and operating an unlicensed money transmitting business. SHREM is also charged with willfully failing to file any suspicious activity report regarding FAIELLA’s illegal transactions through the Company, in violation of the Bank Secrecy Act. SCHREM was arrested yesterday at John F. Kennedy International Airport in New York, and is expected to be presented in Manhattan federal court later today before U.S. Magistrate Judge Henry Pitman. FAIELLA was arrested today at his residence in Cape Coral, Florida, and is expected to be presented in federal court in the Middle District of Florida. Manhattan U.S. Attorney Preet Bharara said: “As alleged, Robert Faiella and Charlie Shrem schemed to sell over $1 million in Bitcoins to criminals bent on trafficking narcotics on the dark web drug site, Silk Road. Truly innovative business models don’t need to resort to old-fashioned law-breaking, and when Bitcoins, like any traditional currency, are laundered and used to fuel criminal activity, law enforcement has no choice but to act. We will aggressively pursue those who would coopt new forms of currency for illicit purposes.” DEA Acting Special-Agent-in-Charge James J. Hunt said: “The charges announced today depict law enforcement's commitment to identifying those who promote the sale of illegal drugs throughout the world. Hiding behind their computers, both defendants are charged with knowingly contributing to and facilitating anonymous drug sales, earning substantial profits along the way. Drug law enforcement's job is to investigate and identify those who abet the illicit drug trade at all levels of production and distribution including those lining their own pockets by feigning ignorance of any wrong doing and turning a blind eye.” IRS Special-Agent-in-Charge Toni Weirauch said: “The government has been successful in swiftly identifying those responsible for the design and operation of the ‘Silk Road’ website, as well as those who helped ‘Silk Road’ customers conduct their illegal transactions by facilitating the conversion of their dollars into Bitcoins. This is yet another example of the New York Organized Crime Drug Enforcement Strike Force’s proficiency in applying financial investigative resources to the fight against illegal drugs.” According to the allegations contained in the Criminal Complaint unsealed today in Manhattan federal court: >From about December 2011 to October 2013, FAIELLA ran an underground Bitcoin exchange on the Silk Road website, a website that served as a sprawling and anonymous black market bazaar where illegal drugs of virtually every variety were bought and sold regularly by the site’s users. Operating under the username “BTCKing,” FAIELLA sold Bitcoins – the only form of payment accepted on Silk Road – to users seeking to buy illegal drugs on the site. Upon receiving orders for Bitcoins from Silk Road users, he filled the orders through a company based in New York, New York (the “Company”). The Company was designed to enable customers to exchange cash for Bitcoins anonymously, that is, without providing any personal identifying information, and it charged a fee for its service. FAIELLA obtained Bitcoins with the Company’s assistance, and then sold the Bitcoins to Silk Road users at a markup. SHREM is the Chief Executive Officer of the Company, and from about August 2011 until about July 2013, when the Company ceased operating, he was also its Compliance Officer, in charge of ensuring the Company’s compliance with federal and other anti-money laundering (“AML”) laws. SHREM is also the Vice Chairman of a foundation dedicated to promoting the Bitcoin virtual currency system. SHREM, who personally bought drugs on Silk Road, was fully aware that Silk Road was a drug-trafficking website, and through his communications with FAIELLA, SHREM also knew that FAIELLA was operating a Bitcoin exchange service for Silk Road users. Nevertheless, SHREM knowingly facilitated FAIELLA’s business with the Company in order to maintain FAIELLA’s business as a lucrative source of Company revenue. SHREM knowingly allowed FAIELLA to use the Company’s services to buy Bitcoins for his Silk Road customers; personally processed FAIELLA’s orders; gave FAIELLA discounts on his high-volume transactions; failed to file a single suspicious activity report with the United States Treasury Department about FAIELLA’s illicit activity, as he was otherwise required to do in his role as the Company’s Compliance Officer; and deliberately helped FAIELLA circumvent the Company’s AML restrictions, even though it was SHREM’s job to enforce them and even though the Company had registered with the Treasury Department as a money services business. Working together, SHREM and FAIELLA exchanged over $1 million in cash for Bitcoins for the benefit of Silk Road users, so that the users could, in turn, make illegal purchases on Silk Road. In late 2012, when the Company stopped accepting cash payments, FAIELLA ceased doing business with the Company and temporarily shut down his illegal Bitcoin exchange service on Silk Road. FAIELLA resumed operating on Silk Road in April 2013 without the Company’s assistance, and continued to exchange tens of thousands of dollars a week in Bitcoins until the Silk Road website was shut down by law enforcement in October 2013. * * * FAIELLA, 52, of Cape Coral, Florida, and SHREM, 24, of New York, New York, are each charged with one count of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison, and one count of operating an unlicensed money transmitting business, which carries a maximum sentence of five years in prison. SHREM is also charged with one count of willful failure to file a suspicious activity report, which carries a maximum sentence of five years in prison. Mr. Bharara praised the outstanding investigative work of the DEA’s New York Organized Crime Drug Enforcement Strike Force, which is comprised of agents and officers of the U. S. Drug Enforcement Administration, the New York City Police Department, Immigration and Customs Enforcement - Homeland Security Investigations, the New York State Police, the U. S. Internal Revenue Service Criminal Investigation Division, the Federal Bureau of Investigation, the Bureau of Alcohol, Tobacco, Firearms and Explosives, U.S. Secret Service, the U.S. Marshal Service, New York National Guard, Office of Foreign Assets Control and the New York Department of Taxation and Finance. Mr. Bharara also thanked the FBI’s New York Field Office. Mr. Bharara also noted that the investigation remains ongoing. The prosecution of this case is being handled by the Office’s Complex Frauds Unit. Assistant United States Attorney Serrin Turner is in charge of the prosecution, and Assistant United States Attorney Andrew Adams of the Asset Forfeiture Unit is in charge of the forfeiture aspects of the case. The charges contained in the Complaint are merely accusations, and the defendants are presumed innocent unless and until proven guilty. 14-024

2 4