October 2014 - cypherpunks - lists.cpunks.org

Retired NSA Technical Director Explains Snowden Docs
by John Young 06 Oct '14

06 Oct '14

Retired NSA Technical Director Explains Snowden Docs http://www.alexaobrien.com/secondsight/wb/binney.html Best account yet of the Snowden releases by a technically capable person. Eventually, perhaps, the other 96% will receive similar public disclosure to fully inform beyond opportunistic journalism.

6 8

Projects developed anonymously [was: goldbug, ref: btc]
by grarpamp 06 Oct '14

06 Oct '14

On Wed, Sep 24, 2014 at 3:38 AM, Fabio Pietrosanti (naif) <lists(a)infosecurity.ch> wrote: > The only way such "suspicious" projects will have to recover is by being > transparent on who they are, who pay them, what's their goal ;) There's nothing wrong with anonymous development itself, provided it meets high standards expected of crypto related applications. Goldbug and friends blackballed themselves with their actions, topic dodging speech, and non-reproducible binaries. Doubtful anyone will bother looking at their code given that. Satoshi did anonymous well regarding bitcoin. I2P had some anonymous large contributors I think. Truecrypt's anonymity had some mixed results (given the situation with their binaries). What other projects have been largely anonymous? Now that we have anonymous networks, it's likely that many more anonymous projects will appear that do pass muster.

1 0

dhcpd dhclient-script shell security
by grarpamp 06 Oct '14

06 Oct '14

> @ioerror says: > Has anyone written a captive portal aware, privilege separated, uid > zero free, security focused dhcp client in a type safe language? One could write/compile the script in any language, use sudo within or change the perms and/or syscall uid checks for read-writing the tap, 67/68 port binding, ifconfig, route, etc to permit any arbitrary uid, and run it all in a jail. Some capabilities already exist in OS's today. Portal awareness would be a different scope. Tails or OpenBSD might be interested, as would anyone really, in particular if the protocol sends arbitrary data/commands, which the client/script then fails to lint and passes out to exec/params... Also from twitter: http://www.codelabs.ch/adhcp/

2 1

first factorization of RSA-2048?
by coderman 06 Oct '14

06 Oct '14

"Prize: 700ml 18-year scotch. Topic: first factorization of RSA-2048. My bet: quantum algorithms. Antoine Joux's bet: non-quantum algorithms." - https://twitter.com/hashbreaker/status/494867301435318273 what origin scotch? if i am going to play for keeps, i want to know my skewing is cost effective... ;P best regards,

2 1

This Friday, 10-Oct-2014 - New York Film Fest Will World Premiere Laura Poitras’ Edward Snowden Docu ‘CITIZENFOUR’
by coderman 06 Oct '14

06 Oct '14

will John or another distinguished agitator be present to report and convey for this fine event? http://deadline.com/2014/09/new-york-film-fest-will-world-premiere-laura-po… """ New York Film Festival director Kent Jones said today that the Film Society of Lincoln Center has added the world premiere of Laura Poitras’ CITIZENFOUR to its Main Slate lineup. The presentation will run Friday, October 10 at 6 PM at Alice Tully Hall. Poitras will also participate in a free HBO Directors Dialogues the following day at 4 PM, at the Walter Reade Theater. The film, from RADiUS in association with Participant Media and HBO Documentary Films, opens theatrically October 24. According to the festival: In January 2013, Poitras was several years into the making of a film about abuses of national security in post-9/11 America when she started receiving encrypted e-mails from someone identifying himself as “citizen four,” who was ready to blow the whistle on the massive covert surveillance programs run by the NSA and other intelligence agencies. In June 2013, she and reporter Glenn Greenwald flew to Hong Kong for the first of many meetings with the man who turned out to be Snowden. She brought her camera with her. The film that resulted from this series of tense encounters is absolutely sui generis in the history of cinema: a 100% real-life thriller unfolding minute by minute before our eyes. """

1 0

Mu [was: How worse is the Shellshock bash bug than Heartbleed?]
by coderman 05 Oct '14

05 Oct '14

On 9/30/14, Georgi Guninski <guninski(a)guninski.com> wrote: > ... > I find this _much_ worse than the passive Heartbleed. > > How worse is the shellshock bash bug than Heartbleed? a simplistic "shellshock worse than heartbleed" is mis-characterization of the situation. first, this presents a vulnerability without context, by itself. in the real world, we care about vulnerability with respect to exploitation. usually many vulnerabilities are leveraged together in exploitation of notoriety. in the sense of best practice and conservative security posture, heartbleed could be worse by far. a strongly keyed, defense in depth surreptitiously bypassed via bleeding. e.g. bleed UDP DTLS VPN to access internal network, bleed intranet HTTPS for admin credentials to critical infrastructure services. the ability to send things to a bash shell, even restricted shell, even constrained behind application layers, was always seen as bad practice for security conscious configurations - insiders get shell, not untrusted inputs. last but not least, this is all bullshit speculation; risk is a perspective and shellshock or heartbleed is better or worse depending on what you're looking at. best regards, P.S. #langsec asked how long you earth humans will be exchanging risky bits with strangers. i channeled djb and bet on "Forever!". [c.f. http://cr.yp.to/talks/2014.07.10/slides-djb-20140710-a4.pdf "Making sure software stays insecure"]

2 6

properly timing FOIPA for best results [was: 1977 Justice Dept. Report on CIA (was: Rockefeller Commission Report)]
by coderman 05 Oct '14

05 Oct '14

as per, On 10/3/14, Gregory Foster <gfoster(a)entersection.org> wrote: >> "... it was standard procedure >> not to notify the object of a criminal investigation (think John Gotti) >> once it is completed and requested under FOIA. i have been pondering the question of when is the most effective time to file a FOIPA. presumably this would be after the statute of limitations, plus some delay, to ensure that completed/discarded investigations are included in the scope of the disclosure. does anyone have guidance on this timing? perhaps 6-8 years after initially coming under scrutiny? best regards,

2 1

Re: bashing your head against nation-state social engineering
by Stephan Neuhaus 04 Oct '14

04 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2014-10-03, 23:14, cyryl wrote: > On 29/09/14 08:58, Stephan Neuhaus wrote: >> On 2014-09-28 15:47, Subrosa.io wrote: >>> I think this vulnerability should have been discovered with any >>> kind of basic fuzzing. >> >> If I understand the vulnerability correctly, it occurs in very >> specific circumstances, namely trailing data at the end of a >> function definition that's transported in an environment >> variable. >> >> In that case, I'd venture that *no* kind of "basic fuzzing" could >> have uncovered this; the proportion of ShellShock-inducing >> environment variable definitions among all possible environment >> variables is simply too small. >> >> What you would need instead is very specific syntax-directed >> fuzzing, and even then I'm not sure that you have a decent chance >> of discovering this without knowing already that it's there. >> > > To uncover more vulns lcamtuf fed the fuzzer with the initial > state, but then left it there to do the work. > > http://lcamtuf.blogspot.nl/2014/10/bash-bug-how-we-finally-cracked.html Without > belittling the effort that's described in this article (after all, they found more vulnerabilities, which is good), I stand by my original point. If you want to fuzz the whole of bash, your chances of uncovering ShellShock are essentially nil. Once you know that function definitions transported in environment variables (a feature that I didn't even know existed, and I've been working with bash since the late 90's) are probably bug-ridden, your work becomes much, much easier. Fun, Stephan -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (Darwin) iQEcBAEBAgAGBQJUL5mlAAoJEE0T/LJL2oHTGxgIAKuBg2aFEesnrAd4qWiGEqfx 0E6SWWkJLkYEGD4gDcMQW5XVUUP45kJdINKZFd/rFY3Ep47VXHJ0zD89XrP4YVHH +ujQMH4lF7+GLiVZ/tNYZCQ0k/t/9LBUS2bcvjuqIUxlmkzZN8UFFsD1L3/t+HDD LBAmRi28Z4TOREOdHRga9BdpAKTHy7I4toHoiiA3x1psJxwkqr9WD8C7CLABWCeC j6Gs1U5gqhCTOg0nz9DV8owuUJG1XqyOwApqC6hf1LZFWzr9WAR0G9Y+Xot4mdlJ 8s9Dkf9iEuN5nJpOPH9Hunhpoaxu8/B/TNYFvRYjE7zac3Icd8Hj3mu0TUc6RwY= =8VXa -----END PGP SIGNATURE-----

1 0

Rockefeller Commission Report (RCR, Jun 30 1976)
by Gregory Foster 04 Oct '14

04 Oct '14

The James Bamford article sent along by coderman is excellent. The Intercept (Oct 2) - "The NSA and Me" by James Bamford [ @WashAuthor ]: https://firstlook.org/theintercept/2014/10/02/the-nsa-and-me/ I just noticed the article links to an interesting document. Rockefeller Commission Report (RCR, 1977) "REPORT ON INQUIRY INTO CIA-RELATED ELECTRONIC SURVEILLANCE ACTIVITIES" http://www.documentcloud.org/documents/1304974-report-on-inquiry-into-cia-r… > A 1977 Justice Department report, obtained by reporter James > Bamford in 1981 under the Freedom of Information Act, investigating > criminal surveillance operations conducted by the CIA and NSA. In 1975, the executive branch under President Gerald Ford initiated its own investigation of the CIA's and the NSA's activities in parallel with the larger committees in the legislature. The report Bamford shared is a (redacted) product of the President's Commission. http://en.wikipedia.org/wiki/United_States_President%27s_Commission_on_CIA_… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

NSA releases two documents on decrypting CIA KRYPTOS sculpture
by John Young 03 Oct '14

03 Oct '14

NSA releases two documents on decrypting CIA KRYPTOS sculpture, formerly classified FVEY//20320108 The CIA Kryptos Sculpture Slides https://www.nsa.gov/public_info/_files/cia_kryptos_sculpture/KRYPTOS_Slides… The CIA Kryptos Sculpture: A summary of Previous Work and New Revelations https://www.nsa.gov/public_info/_files/cia_kryptos_sculpture/KRYPTOS_Summar…

1 0