November 2014 - cypherpunks - lists.cpunks.org

BitLocker, OneDrive, PRISM
by rysiek 05 Nov '14

05 Nov '14

Hi there, WTF am I reading? http://cryptome.org/2014/11/ms-onedrive-nsa-prism.htm "... because the [BitLocker] recovery key is automatically stored in SkyDrive for you." -- Pozdr rysiek

3 2

What NSA Is Doing to Improve Security Post-Snowden
by George W. Maschke 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 NSA Director Mike Rogers spoke at Stanford University's Hoover Institute this past weekend, and a faculty member asked him what the NSA is doing with regards to personnel security to stop another incident like Edward Snowden's release of classified documents. Interestingly, the first and primary measure that the NSA director mentioned was polygraph testing. It's interesting because polygraphy is a thoroughly discredited pseuodoscience. It depends on the person being "tested" being ignorant of the trickery on which the procedure relies. How ironic that America's most technologically sophisticated intelligence agency relies on early 20th century pseudoscience as the keystone of its personnel security program. For additional commentary, see "NSA Director Mike Rogers on Polygraph Screening" on the AntiPolygraph.org blog: https://antipolygraph.org/blog/2014/11/04/nsa-director-mike-rogers-on-polyg… George Maschke PGP Public Key: 316A947C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUWf25AAoJEEYqwKuPDNWqPMgP/3QDCJH5epob6MKlYYTAH30A gYQBfIkIa93Wufhmt+Od2zlbQSxkshEnD/mNnujqih/bybrvj+OSLR2ejCwzoaL1 PMoR07E1kJRjKw0wEIbxnf0SLVGJedOHhUsu6/WUJ9DWYZ7mCiSyVgH+AOIhaQDy SUFoi9Nl3dZvUBN8FqRPeL4tHp0LG6QIV3N0pZZddOw68qIeI53HQ8Rv14VAFgix oAIzHJ77Y+0gcyp1WIxFyopVfnioezf15YVSl3hC0z+m1V/lRFUullHJWWbG4nm9 xenuqWwVF5T6wj4Lstep5seKBoKobr1+haGPkVfggNcfOMAY4PCjolzmA4j8yOci Sn8vx7U1eVGAwdPkppT33ug+GWzj5yXMVCjH95U+JyO6My4cY97YOhtQe5fUn0ep vhbPMRy+Q1lvtRYd9lZI/ZLRVOUp1652IqjhgCmIMCCR3ZtSPWq3RQmreepf6XgA tCU2u6SkpgK7N2+NvMMFe+lrcBUIxO6MTBW61xl6CHmw3WIsPTUfstwGwcUkm2Im jjnQuLNqE+IMEsaZ0202r9791DnohXOtbg7epGSayk35oBA4xvCZm0/A4vStgCSO Dt8jSht5ULJZJ1jqnSkkAzfXrKHxlCFRlRkrNWn7qcTKGm2Iza0DCA5513cU80xj AD3rPiQBA0/r6N78GYaY =9xb+ -----END PGP SIGNATURE-----

3 3

Wind River Security Features and Cryptography Libraries
by John Young 05 Nov '14

05 Nov '14

Wind River Security Features and Cryptography Libraries (which appear to be the basis of the $750,000 fine by BIS) http://cryptome.org/2014/11/wind-river-security-crypto.pdf

2 1

Crypto War Redux
by John Young 04 Nov '14

04 Nov '14

USG enforcing crypto export controls: "Intel Subsidiary Agrees to $750,000 Penalty for Unauthorized Encryption Exports" (Oct 8) http://www.bis.doc.gov/index.php/about-bis/newsroom/press-releases/107-abou… A story to go with that: "Software Companies Now on Notice That Encryption Exports May Be Treated More Seriously: $750,000 Fine Against Intel Subsidiary" (Oct 15) http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/10… My source: http://www.reddit.com/r/snowden/comments/2l5fnm/software_companies_now_on_n… (posted by "platypusmusic", who often has very good posts on Reddit, especially in the /r/snowden: http://www.reddit.com/r/snowden/ ) ----- Contraband crypto welcomed: cryptome(a)earthlink.net

3 2

Privacy has always been a fight against rulers and funders
by John Young 04 Nov '14

04 Nov '14

Verifying US-UK concordance, with FBI head, Director of NSA said much the same as GCHQ to the US Chamber of Commerce on October 28, 2014: https://www.nsa.gov/public_info/speeches_testimonies/28oct14_dirnsa.shtml These heads of spy and LE agencies are proposing that companies and citizens continue to serve and become spies, agents, informers, coverts in mirroring their enemies of their security states. And not only are asking for patriotic volunteers by sticks of fear and aiding the enemy but contracting for services by carrots of privileged briefings, access, profits and tax write-offs. No wonder oligarchs are increasing and are rushing to aid and abet spies in all countries. Will First Look's Racket magazine come to life to join The Intercept, so buzzworthily named to fit what they do: front for First Look Media's invention and distribution of comsec products which if true to the ancients' practice will spy on the populace with everylasting panoptic look. This is hardly new, indeed is as old as governments and their precursor "lawful" rulers of the populace which cannot be trusted with anarchic self-rule, much less armed with treasonous cryptoanarchy for absolute right to privacy from rulers. Even this list of rogues was founded and struggles to survive on its impossible mission to resist this ancient history and current fervor of duplicity and dual-use of the ever growing family of securities -- personal, home, clan, region, nation, global, religion, ideology -- deployed to simultaneously attack and protect the populace by declaring who is insider and who is outsider, take your pick, save your life. Us or them. Divide and conquer. Praise and smear. Lop heads and drone. Imprison and exile. Significantly for this clan, comsec remains an essential tool for attacking and protecting. It annoys the masters of comsec no end for rogues to mess with their command and control communications and ubiquitous civic spying operations. It requires recruitment of comsec rogues to mess with rogues, as amply demonstrated here and other security fora where coders and hackers are prime candidates for quietly switching sides, remaining in place, covertly informing, sabotaging, implanting, faulting, I/O erroring, pretending opposition to the state, stashing their fees, teaching cryptology, advising NGOs, counseling dissidents, whistling Dixie for media and audiences, advocating openness, disclosing shallow vulns to hide the deeper. This list goes on, as evidenced here and on the gobs of freedom of information outlets which have spread as widely as the Internet, black net, deep net, chats, OTRs, Tor, and now cellphone webs and swarms of earnest instigators indistinguishable from TLAs taking 100% and giving back at best 50%, with bountiful support from freedom-loving oligarchs, soliciting volunteers, paying overseers of volunteers, accruing profits by shifting taxation to the populace for their protection and spying on it to assure system security, oiled with bounties, bonuses and Sabu-grade walk-frees awards for whistleblowing on the whistleblowing, and not least, enduring legal fees for ACLU- grade justice tipped against oppostion to civil liberties racketeering aided and abetted by backdoored comsec also known as rule of law.

1 0

Fwd: [seL4 Announce] seL4-based "RefOS" released
by coderman 04 Nov '14

04 Nov '14

---------- Forwarded message ---------- From: Announcements about seL4 — low volume list <announce(a)sel4.systems> Date: Tue, 4 Nov 2014 06:12:54 +0000 Subject: [seL4 Announce] seL4-based "RefOS" released Today we announce the release of the RefOS project. RefOS is an OS personality that runs on seL4. RefOS stands for "Reference OS", the aspirational goal of the project, which is to provide a reference OS personality for seL4. RefOS is a student project built as a case study to explore more dynamic virtual memory (VM) management systems than the typical static systems architected on separation kernels. When compared to statically allocated systems, a key difference (and complexity) of dynamic VM management is relaxing the assumption that virtual memory (and memory objects) are managed by a single task upon the microkernel (or by the microkernel itself). RefOS has a distributed VM framework inspired by the Sawmill VM framework [1], though differing in the centralisation of some core book-keeping into a single server (mainly fault forwarding and mapping authorisation). An additional goal of the project was to create tension between user-level and kernel-level VM primitives to enable ongoing kernel experimentation in the area of higher-level VM abstractions. The current functionality of RefOS consists of processes, an in-memory boot-image file server, and console support. Additionally, some games and test applications have been ported to the system. RefOS is available at https://github.com/seL4/refos-manifest under a "BSD 2-Clause" license. [1] Mohit Aron, Jochen Liedtke, Kevin Elphinstone, Yoonho Park, Trent Jaeger, and Luke Deller. 2001. The sawmill framework for virtual memory diversity. In Proceedings of the 6th Australasian conference on Computer systems architecture (ACSAC '01). IEEE Computer Society, Washington, DC, USA, 3-10.

1 0

Privacy has never been “an absolute right”
by coderman 04 Nov '14

04 Nov '14

“To those of us who have to tackle the depressing end of intelligence community behaviour on the internet, it can seem that all governments, telcos, and computing companies are in denial about its misuse." [ paraphrased for relevance ] - http://www.theguardian.com/uk-news/2014/nov/03/privacy-gchq-spying-robert-h… --- GCHQ chief accuses US tech giants of becoming terrorists' 'networks of choice' New director of UK eavesdropping agency accuses US tech firms of becoming ‘networks of choice’ for terrorists Privacy has never been “an absolute right”, according to the new director of GCHQ, who has used his first public intervention since taking over at the helm of Britain’s surveillance agency to accuse US technology companies of becoming “the command and control networks of choice” for terrorists. Robert Hannigan said a new generation of freely available technology has helped groups like Islamic State (Isis) to hide from the security services and accuses major tech firms of being “in denial”, going further than his predecessor in seeking to claim that the leaks of Edward Snowden have aided terror networks. GCHQ and sister agencies including MI5 cannot tackle those challenges without greater support from the private sector, “including the largest US technology companies which dominate the web”, Hannigan argued in an opinion piece written for the Financial Times just days into his new job. Arguing that GCHQ needed to enter into the debate about privacy, Hannigan said: “I think we have a good story to tell. We need to show how we are accountable for the data we use to protect people, just as the private sector is increasingly under pressure to show how it filters and sells its customers’ data. “GCHQ is happy to be part of a mature debate on privacy in the digital age. But privacy has never been an absolute right and the debate about this should not become a reason for postponing urgent and difficult decisions.” Hannigan, who was born in Gloucestershire, not far from GCHQ’s base, has advised the prime minister on counter-terrorism, intelligence and security policy, goes on to take aim at the role of major technology companies. A senior Foreign Office official, Hannigan succeeded Sir Iain Lobban at the Cheltenham-based surveillance agency. While not naming any company in particular, the GCHQ director writes: “To those of us who have to tackle the depressing end of human behaviour on the internet, it can seem that some technology companies are in denial about its misuse. “I suspect most ordinary users of the internet are ahead of them: they have strong views on the ethics of companies, whether on taxation, child protection or privacy; they do not want the media platforms they use with their friends and families to facilitate murder or child abuse.” Hannigan asserts that the members of the public “know” the internet grew out of the values of western democracy and insists that customers of the technology firms he criticises would be “comfortable with a better, more sustainable relationship between the agencies and the technology companies.” Heading towards the 25th anniversary of the creation of the world wide web, he calls for a “new deal” between democratic governments and the technology companies in the area of protecting citizens. “It should be a deal rooted in the democratic values we share. That means addressing some uncomfortable truths. Better to do it now than in the aftermath of greater violence.” In the same piece, Hannigan says Isis differs from its predecessors in the security of its communications, presenting an even greater challenge to the security services. He writes: “Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. “Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are ‘Snowden approved’. There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.” Among the advocates of privacy protection who reacted to Hannigan’s comments, the deputy director of Privacy International, Eric King, said: “It’s disappointing to see GCHQ’s new director refer to the internet – the greatest tool for innovation, access to education and communication humankind has ever known – as a command-and-control network for terrorists.” King added: “Before he condemns the efforts of companies to protect the privacy of their users, perhaps he should reflect on why there has been so much criticism of GCHQ in the aftermath of the Snowden revelations. GCHQ’s dirty games – forcing companies to handover their customers’ data under secret orders, then secretly tapping the private fibre optic cables between the same companies’ data centres anyway – have lost GCHQ the trust of the public, and of the companies who services we use. Robert Hannigan is right, GCHQ does need to enter the public debate about privacy - but attacking the internet isn’t the right way to do it.” The Electronic Frontier Foundation (EFF) meanwhile rejected the notion that an agreement between companies and governments was needed. Jillian York, director of international free expression at EFF said: “A special “deal” between governments and companies isn’t necessary - law enforcement can conduct open source intelligence on publicly-posted content on social networks, and can already place legal requests with respect to users. Allowing governments special access to private content is not only a violation of privacy, it may also serve to drive terrorists underground, making the job of law enforcement even more difficult.” Welcoming Hannigan’s participation in the public debate, the Labour Party MP Tom Watson said it helped to map out where we should draw the line on privacy and helps the same agencies “to rebuild their legitimacy post-Snowden”. But he added: “I hope they do not confuse the use of public propaganda through social media by extremists with the use of the covert communications. It is illogical to say that because Isis use Twitter, all our metadata should be collected without warrant.” Hannigan’s comments come after the director of the FBI, James Comey, called for “a regulatory or legislative fix” for technology companies’ expanding use of encryption to protect user privacy. Reacting last month to the introduction of strong default encryption by Apple and Google on their latest mobile operating systems, Comey said “the post-Snowden pendulum has swung too far in one direction - in a direction of fear and mistrust.” “Justice may be denied because of a locked phone or an encrypted hard drive,” said Comey. Without a compromise, “homicide cases could be stalled, suspects could walk free, and child exploitation victims might not be identified or recovered.”

1 0

on list moderation of great justice [was: [oss-security] list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) ]
by coderman 04 Nov '14

04 Nov '14

> On Tue, Oct 14, 2014 at 10:48:00PM -0700, Walter Parker wrote: >> What is this list's policy on Full Disclosure? >... as one who enjoys a significant moderation delay on Full-Disclosure, i feel qualified to pontificate on this subject. [0] per the monthly statistics summarized at http://seclists.org/fulldisclosure/ one can easily see how the careful pruning of noise on this channel has resulted in double digit density goodness, e.g. Aug 2014 at 89 posts; a new record of brevity and decorum! i for one gladly await the day a more properly, more aggressively moderated full-disclosure reaches single digits and utmost conciseness. you can do it, Fyodor! On 10/15/14, Solar Designer <solar(a)openwall.com> wrote: > Looks like I need to comment on the specific questions on list policy: > ... > Whatever is sent to the list, if on-topic and otherwise appropriate > ... is posted with no artificial delay... the only difference from the > Full-Disclosure mailing list (as far as I understand how it's run) is > that oss-security is limited to / focused on Open Source. i for one agree with Full-Disclosure's policy that active monkey-in-the-middle attacks are of zero interest. spectrum hi jinx? how cross site... [ "The Internet Threat Model" finds your privacy not cost effective. sorry! ] given such undeniable logic, i must fully support the ongoing total moderation with infinite delay of coderman(a)gmail.com on the full-disclosure list. never again from coderman is too soon! finally, regarding other aspects of full-disclosure, i must disclose that i have nothing further to say on the conspiracy in the information security industry to assist various intelligence agencies, including Attrition.org collaboration with NSA TAO [1] and Fyodor's relationship with GCHQ's HACIENDA scanner [2]. best regards, 0. see "RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4" - moderated on F-D since Sept. , also "Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]][still confusing]" moderated days to Aug 4 post send on 1st. 1. "Tailored Access Operations ... Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host." - https://en.wikipedia.org/wiki/Tailored_Access_Operations#Virtual_locations 2. "GCHQ project HACIENDA [...] uses [nmap] port scanning to find vulnerable systems for Five Eyes intelligence agencies." - https://en.wikipedia.org/wiki/TCP_Stealth

1 0

RC4 still sucks in the year 2014 - A Practical Attack Against the HIVE Hidden Volume Encryption System
by coderman 03 Nov '14

03 Nov '14

""" A Practical Attack Against the HIVE Hidden Volume Encryption System Kenneth G. Paterson and Mario Strefler Abstract: The HIVE hidden volume encryption system was proposed by Blass et al. at ACM-CCS 2014. Even though HIVE has a security proof, this paper demonstrates an attack on its implementation that breaks the main security property claimed for the system by its authors, namely plausible hiding against arbitrary-access adversaries. Our attack is possible because of HIVE's reliance on the RC4 stream cipher to fill unused blocks with pseudorandom data. While the attack can be easily eliminated by using a better pseudorandom generator, it serves as an example of why RC4 should be avoided in all new applications and a reminder that one has to be careful when instantiating primitives. """ - http://eprint.iacr.org/2014/901

1 0

are USB floppies toxic?
by Eugen Leitl 03 Nov '14

03 Nov '14

We know USB flash is is Biosafety 4, what about other sneaker-net suitable storage media? USB floppies are still around, as well as media, which are write-protectable. How easy to hop the air gap with these?

9 10