March 2014 - cypherpunks - lists.cpunks.org

fractional reserves (was Re: Gox)
by dan＠geer.org 22 Mar '14

22 Mar '14

It was quoted: > "Injections in coin are most useful (enough to run the exchange) but > some cash is also needed to not run a fractional reserve" Those who find BitCoin interesting and wish it was more like world class banking will perhaps also be interested in this (de-html-ized) description of what that means: 21stcenturywire.com/2014/03/21/the-latest-heist-us-quietly-snatches-the-ukr… The Latest Heist: US Quietly Snatches the Ukraine's Gold Reserves March 21, 2014 As the dust settles in Kiev, another money trail has been revealed... According to reports out of Kiev (see links below), the US has quietly transfers 33 tons of Ukrainian gold out of the country and back to vaults in the US. Presumably, this sovereign wealth transfer would be counted as partial "collateral" for a fresh round of IMF, US FED, and ECB paper debt that is currently being organised for dumping into the Ukraine's economic black hole. Multiple inquiries to US Federal Reserve administrators into the location of the Ukraine's gold have been met with the proverbial `pass the buck', making tracking and tracking the final resting place of these 33 tonnes very difficult indeed - but one can expect that the NY Fed is probably the institution who has masterminded this financial heist. Note how gold flows into New York, but has difficulty flowing out of US private banking hands as is the case with the `confiscation' of Germany's gold. Numerous attempts by Bundesbank to repatriate its gold reserves have been met with a brick wall, and to date, Germany has only recovered a miniscule 5 tonnes directly from the NY Fed - out of the total 674 tonnes (an additional 32 tonnes were recovered via French central bank). It's worth pointing out here that when NATO sacked Libya in 2011, one of the first items that came into question was the gold in Libya's state-run central bank. Prior to the NATO takeover of that country, Libya had one of the highest per capita gold reserves in the world, alongside Lebanon, giving Libya a distinct advantage should it carry out former Libyan leader Muammar Muhammad al-Gaddafi's long-term financial transition to a gold-backed Libyan Dinar. As you can imagine, this is no longer the case in Tripoli. Additionally, like Libya, both Syria and Iran are two of the world's last remaining nation states who both have state-run central banks and gold reserves which fall outside of the world's private central banking syndicate. Needless to say, you can see an obvious pattern emerging here. And the story continues... The Big Lie + What Happened To Ukraine's Gold? By PM Fund Manager Dave Kranzler Investment Research Dynamics The Big Lie is that Central Banks don't care about gold. Nothing could be further from the truth. Ben Bernanke, more than once, claimed that he didn't understand gold. When Ron Paul asked Bernanke in front of Congress why Central Banks own gold if it's irrelevant, Bernanke flippantly suggested that it was out of tradition. In both cases Bernanke was lying and he knew it. In comparison, Greenspan seemed to have some respect for the laws of economics and - at least that I can recall - never would outright state that gold was not an economic factor. Greenspan lied as much as Bernanke did about everything else but he never committed himself to lie about gold. Most of you have probably read Greenspan's 1966 essay, "Gold and Economic Freedom" (linked). I have read it several times because it explains as well as anything out there why gold works as a currency and why Government-issued fiat currency does not. What I find amazing about The Big Lie about Central Banks and gold is that if gold really is considered to be irrelevant, the how come Central Banks - especially the Fed - are so secretive about their gold storage and trading activities? What's even more amazing is that no one other than Ron Paul and GATA asks them about this. Think about it. GATA spent a lot of money on legal fees attempting to get the Fed to publicly disclose its records related to the Fed's gold activities. The Fed spent even more money denying GATA's quest. And how come the Fed won't submit to a public, independent audit of its gold vaults? This brings me to the issue of the Ukraine's gold. According to public records, the Government of Ukraine owns 33 tonnes of gold that was being safekept in Ukraine. Last week a Ukrainian newspaper reported that acting PM Arseny Yatsenyuk ordered the transfer of that gold to the United States. The actual report is here: LINK. Jesse's Cafe Americain provided a translated version here: LINK. On the assumption that the report is true, and so far I have not seen any commentary or articles suggesting it is not true, the biggest question is, how come the U.S. has absolutely no problem loading up and transporting 33 tonnes of gold from Ukraine to the U.S. but seems to have difficulty loading up and transporting any of Germany's gold from New York to Berlin? And how come the U.S. and Ukraine seem to care about that gold at all, if indeed gold is irrelevant? It would seem that it would be a lot less expensive and logistically complicated just to have the U.S. military post a few armed guards around the gold if they're worried about theft. On the other hand, I'm sure Putin would be happy to buy the gold from Ukraine. What makes the story even more interesting is that GATA's Chris Powell has spent considerable time trying to get an answer to the question of whether or not the U.S. has taken custody of Ukraine's gold. When he queried the NY Fed, they responded with: "A spokesman for the New York Fed said simply: "Any inquiry regarding gold accounts should be directed to the account holder. You may want to contact the National Bank of Ukraine to discuss this report" (LINK). After trying for two days to get an answer from the U.S. State Department, they finally responded by referring him to the NY Fed (LINK). The final piece in verifying that the report is true is deflection from Ukraine. Mr. Powell has queried the National Bank of Ukraine, the Ukrainian Embassy in DC, and the Ukrainian mission to the UN in NYC. Crickets. As Chris states the case: "The difficulty in getting a straight answer here is pretty good evidence that the Ukrainian gold indeed has been sent to the United States." Unfortunately, it is likely that the citizens of Ukraine will end up paying the same price for allowing the U.S. to "safekeep" their sovereign gold. That price is the comforting knowledge that their gold has been delivered safely to vaults in China under U.S./UK bullion bank contractual delivery obligations, where it will be locked away for centuries.

1 0

Using some crypto to make gov't dataset identifiers better
by Eric Mill 22 Mar '14

22 Mar '14

So this is a little different from the usual fare here, but my colleague Tom Lee at the Sunlight Foundation has been thinking about using basic cryptographic concepts to convince governments to publish more unique identifiers in their datasets -- even when the identifiers they have in their *databases* is sensitive (like SSNs). The problem of anonymizing unique data is in some senses easier than others here, because in some gov't contexts, making things personally identifiable isn't the problem -- the *intent* is to publish personally identifiable, connect-able information, like for campaign donors and lobbyists. So the Mosaic Effect (de-anonymizing Netflix data) is less of a concern. Depends on the problem, though. After talking about it on a couple<https://groups.google.com/forum/#!topic/sunlightlabs/CdCdB_0TCgc>of lists<https://mailman.stanford.edu/pipermail/liberationtech/2014-February/012834.…>, Tom blogged it up: http://sunlightfoundation.com/blog/2014/03/20/a-little-math-could-make-iden… Your feedback would be very welcome, either here or in public fora. Of course, convincing government agencies to actually do this sort of thing might be a challenge, but there's a lot of levels and branches of government out there - you never know who might lead the way. -- Eric -- konklone.com | @konklone <https://twitter.com/konklone>

2 1

"I hunt sysadmins"
by coderman 22 Mar '14

22 Mar '14

can such a tasking pass my PCI PA-DSS audit for me?? "Imagine a master list of all admins of all networks on earth..." 'Inside the NSA's Secret Efforts to Hunt and Hack System Administrators' - https://firstlook.org/theintercept/article/2014/03/20/inside-nsa-secret-eff… also, slides: https://s3.amazonaws.com/s3.documentcloud.org/documents/1094387/i-hunt-sys-… """ Across the world, people who work as system administrators keep computer networks in order - and this has turned them into unwitting targets of the National Security Agency for simply doing their jobs. According to a secret document provided by NSA whistleblower Edward Snowden, the agency tracks down the private email and Facebook accounts of system administrators (or sys admins, as they are often called), before hacking their computers to gain access to the networks they control. The document consists of several posts - one of them is titled "I hunt sys admins" - that were published in 2012 on an internal discussion board hosted on the agency's classified servers. They were written by an NSA official involved in the agency's effort to break into foreign network routers, the devices that connect computer networks and transport data across the Internet. By infiltrating the computers of system administrators who work for foreign phone and Internet companies, the NSA can gain access to the calls and emails that flow over their networks. The classified posts reveal how the NSA official aspired to create a database that would function as an international hit list of sys admins to potentially target. Yet the document makes clear that the admins are not suspected of any criminal activity - they are targeted only because they control access to networks the agency wants to infiltrate. "Who better to target than the person that already has the 'keys to the kingdom'?" one of the posts says. The NSA wants more than just passwords. The document includes a list of other data that can be harvested from computers belonging to sys admins, including network maps, customer lists, business correspondence and, the author jokes, "pictures of cats in funny poses with amusing captions." The posts, boastful and casual in tone, contain hacker jargon (pwn, skillz, zomg, internetz) and are punctuated with expressions of mischief. "Current mood: devious," reads one, while another signs off, "Current mood: scheming." The author of the posts, whose name is being withheld by The Intercept, is a network specialist in the agency's Signals Intelligence Directorate, according to other NSA documents. The same author wrote secret presentations related to the NSA's controversial program to identify users of the Tor browser - a privacy-enhancing tool that allows people to browse the Internet anonymously. The network specialist, who served as a private contractor prior to joining the NSA, shows little respect for hackers who do not work for the government. One post expresses disdain for the quality of presentations at Blackhat and Defcon, the computer world's premier security and hacker conferences: It is unclear how precise the NSA's hacking attacks are or how the agency ensures that it excludes Americans from the intrusions. The author explains in one post that the NSA scours the Internet to find people it deems "probable" administrators, suggesting a lack of certainty in the process and implying that the wrong person could be targeted. It is illegal for the NSA to deliberately target Americans for surveillance without explicit prior authorization. But the employee's posts make no mention of any measures that might be taken to prevent hacking the computers of Americans who work as sys admins for foreign networks. Without such measures, Americans who work on such networks could potentially fall victim to an NSA infiltration attempt. The NSA declined to answer questions about its efforts to hack system administrators or explain how it ensures Americans are not mistakenly targeted. Agency spokeswoman Vanee' Vines said in an email statement: "A key part of the protections that apply to both U.S. persons and citizens of other countries is the mandate that information be in support of a valid foreign intelligence requirement, and comply with U.S. Attorney General-approved procedures to protect privacy rights." As The Intercept revealed last week, clandestine hacking has become central to the NSA's mission in the past decade. The agency is working to aggressively scale its ability to break into computers to perform what it calls "computer network exploitation," or CNE: the collection of intelligence from covertly infiltrated computer systems. Hacking into the computers of sys admins is particularly controversial because unlike conventional targets - people who are regarded as threats - sys admins are not suspected of any wrongdoing. In a post calling sys admins "a means to an end," the NSA employee writes, "Up front, sys admins generally are not my end target. My end target is the extremist/terrorist or government official that happens to be using the network some admin takes care of." The first step, according to the posts, is to collect IP addresses that are believed to be linked to a network's sys admin. An IP address is a series of numbers allocated to every computer that connects to the Internet. Using this identifier, the NSA can then run an IP address through the vast amount of signals intelligence data, or SIGINT, that it collects every day, trying to match the IP address to personal accounts. "What we'd really like is a personal webmail or Facebook account to target," one of the posts explains, presumably because, whereas IP addresses can be shared by multiple people, "alternative selectors" like a webmail or Facebook account can be linked to a particular target. You can "dumpster-dive for alternate selectors in the big SIGINT trash can" the author suggests. Or "pull out your wicked Google-fu" (slang for efficient Googling) to search for any "official and non-official e-mails" that the targets may have posted online. Once the agency believes it has identified a sys admin's personal accounts, according to the posts, it can target them with its so-called QUANTUM hacking techniques. The Snowden files reveal that the QUANTUM methods have been used to secretly inject surveillance malware into a Facebook page by sending malicious NSA data packets that appear to originate from a genuine Facebook server. This method tricks a target's computer into accepting the malicious packets, allowing the NSA to infect the targeted computer with a malware "implant" and gain unfettered access to the data stored on its hard drive. "Just pull those selectors, queue them up for QUANTUM, and proceed with the pwnage," the author of the posts writes. ("Pwnage," short for "pure ownage," is gamer-speak for defeating opponents.) The author adds, triumphantly, "Yay! /throws confetti in the air." In one case, these tactics were used by the NSA's British counterpart, Government Communications Headquarters, or GCHQ, to infiltrate the Belgian telecommunications company Belgacom. As Der Speigel revealed last year, Belgacom's network engineers were targeted by GCHQ in a QUANTUM mission named "Operation Socialist" - with the British agency hacking into the company's systems in an effort to monitor smartphones. While targeting innocent sys admins may be surprising on its own, the "hunt sys admins" document reveals how the NSA network specialist secretly discussed building a "master list" of sys admins across the world, which would enable an attack to be initiated on one of them the moment their network was thought to be used by a person of interest. One post outlines how this process would make it easier for the NSA's specialist hacking unit, Tailored Access Operations (TAO), to infiltrate networks and begin collecting, or "tasking," data: Aside from offering up thoughts on covert hacking tactics, the author of these posts also provides a glimpse into internal employee complaints at the NSA. The posts describe how the agency's spies gripe about having "dismal infrastructure" and a "Big Data Problem" because of the massive volume of information being collected by NSA surveillance systems. For the author, however, the vast data troves are actually something to be enthusiastic about. "Our ability to pull bits out of random places of the Internet, bring them back to the mother-base to evaluate and build intelligence off of is just plain awesome!" the author writes. "One of the coolest things about it is how much data we have at our fingertips." """

5 6

Re: [cryptography] Compromised Sys Admin Hunters and Tor
by Stephan Neuhaus 22 Mar '14

22 Mar '14

On 2014-03-22, 04:28, Nico Williams wrote: > Insiders are always your biggest threat. I'm always interested in empirical evidence for the things that we believe to be true. Do you have any? Fun, Stephan

1 0

anyone have libtech archives?
by Adam Back 21 Mar '14

21 Mar '14

For old cpunks, who may have been subscribed to libtech: I am curious to lookup some discussion around b-money, bit-gold those parts which were not posted on cpunks at the time. This would be like 1997-2005 say. (I believe it is different to, or an earlier incarnation of the libertech list, at least the archives on that list dont go back that far.) (Presuming that it was not a private/invite only list! If so offlist doc drop:) Adam

1 0

Dynasty of Compromised Comsec and Legal Protection
by John Young 21 Mar '14

21 Mar '14

The marriage of flexible legal protections and malleable comsec is a venerable dynasty of compromise.

1 0

Re: DEFCON On The Mat
by coderman 20 Mar '14

20 Mar '14

"Odinn Cyberguerrilla" <odinn.cyberguerrilla(a)riseup.net> wrote: > > DEFCON On The Mat at what point should you decide to, and to what number, do parrallel'ize the mats? [ i have a conjecture to test during peak mat traffic, congested singleton mat may skew results ... ] best regards, good luck :)

1 0

Re: FD mailing list died. Time for new one (or something better!)
by coderman 20 Mar '14

20 Mar '14

On Thu, Mar 20, 2014 at 3:18 AM, coderman <coderman(a)gmail.com> wrote: > a modest and proportionate proposal, >... > finding someone with strong reputation and good judgement to publicly > validate and speak to the efforts of the equally reputable but > absolutely anonymous service operator? > ... now that's a hard sell ... *grin* if finding said operators for a dedicated service is hard then finding a quorum to run mixmasterminions as intake to hidden list likely just as peril fraught. note that a local only (hidden only) mailer would be easy enough to extend to link to incoming mix messages, if/when desired, in addition to Usenet intake, as also mentioned. a persistent and available store of disclosures (late comers seeking archives) is a critical requirement. your threat model is the nation state intelligence community tailored operations teams. [see also: malware list DoS on orig Stuxnet payload xmit, belgian cyptographers blowing up bullruns, etc.] - every other adversary is a cake walk in comparison.** --- in a sense, the robust full-disclosure replacement problem is fundamentally the secure whistleblower leak site problem is fundamentally the "user friendly, fails safe, default always anon" communication problem. "this is a global problem" "you are the firefighters", "..." --- ** so, what happened at DEF CON 22 was, ...

1 1

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 20 Mar '14

20 Mar '14

---------- Forwarded message ---------- Date: Thu, Mar 20, 2014 at 8:38 AM specifically you are building hardened, reproducible pkgs/isos from snapshots of - live Qubes OS for baremetal layer - tails, whonix, kali, arch, ramfsonly variants, exotics per all reqs - ENTROPY DONE RIGHT, END TO END, FROM DEVELOPER COMMITS TO RUNTIME GUESTS ^this is capitalized because after decades of seeding crypto laughbly wrong, we're still routinely making laughably wrong seeds, everywhere... i am getting desperate! ,see also: http://blog.cryptographyengineering.com/2014/03/how-do-you-know-if-rng-is-w… - the bootstrap client is built for native platforms to retrieve over various means for linux32, linux64, osx32, osx64, win32, win64, android, iOS, windows mobile which deploys the hardened bare metal systems with scrutinized builds above OH: "duuuuude, don't do it. no. don't. no no no." 'cmon, :) how long have you wanted to see a nice weaponized pre-auth ssl+escalate drop? :) :) :)' "not funny! these are operations nightmares you fucker!" Q: "I heard infosec is dead. the citation was infosuck as definitive. #oldtimers and stuff" A: i don't know shit, but one thing i do know is: if your hacker peer group is this bad and/or one of the 1:4 malicious entrapping snitches and/or ALL got v8nd doing stupid shit while high on stupid shit making stupid judgement calls and/or otherwise failed to be decent humans - then you're doing it wrong! good news it is not too late to make good friends and get over your bullshit ;) [in all seriousness, it's an amazing time to be alive! the unappreciated work that is being done is everywhere if you make an effort to seek it out.] Q: "How big could such a bounty/bet get?" A: if i was the CIA i would take the snowden docs that are eventually after 42 years or so disseminated in full and dump them to the hidden fuller disclosure. drop a few TAO 0day expected to lose utility on the list as false flag. use it to grind some axes through SUBQUANTUMSQUIRRELMESH cover and use pilfered bounty to bet against the opers driving "perceived risk of running hidden site" to level 'wutsohigh'. then i'd use black funds stoking social media fire storm, the righteous furor pre-disposing the public to zero sympathy for what follows. nulling the meatbags simple as identities strategically leaked for hidden disclosure service operators to "lower american clandestine chemical cleaners" for prompt chemical dissolution. the subsequent narco pulp tie up bolsters pre-seeded notions that said "criminal hacker terrorists working for foreign intelligence services conspiring to kill americans with logic bombs thrown from darknet intertubes" deserved righteous death by sword clearly, if not for this narco deal then surely for <insert 3-5 favorite fad horsewomen here for straw beating>. finally, having driven the bounty on the hidden disclosure service to an absurd level twice the GDP of china, i would dump and mix the coins to a hidden wallet and disappear into history, never to be seen or heard from again. TL;DR: the pot could be twice the GDP of china if the CIA is playing the game with us and feeling extra dirty. [ 35 yrs later: the fact this was an exceptionally compartmentalized black op is quietly noted along with a few hundred thousand other arcane dumps no once cares about anymore... also un-noted: this operation was 100% sucessful in scaring all the fear cowed whitehats, grayhats, blackhats and inbetween from ever thinking about operating a truly fully disclosing forum for communication in the modern world. times have changed you hacker punks! ] Q: "When I asked if this could get any further off-topic, I was lamenting - not challenging!" A: hey, i'm not the one who is slacking on the disclosure of the hidden disclosure service! i just expand the anonymity set here... FIN: really done on this subject. if you're actually curious and willing to volunteer time and testing, go off-list and on-crypto :) https://peertech.org/files/0x65A847E7C2B9380C-pub.txt current OTR 157B7040 4339EFCA D83EF33D 7064F401 843A7E98 https://peertech.org/files/otr.txt

1 0

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 20 Mar '14

20 Mar '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Thu, Mar 20, 2014 at 7:22 AM Q: "Onions are fragile and sporadically un-available." A: that's not a question ;) see also <lots of Tor trac numbers here> Q: ".. How do faster soliderer onions?" A: glad you asked, earth human! for a limited time only!! [ ... shipping and handling not included, ... ] + with consensus, namecoin to a set of consistent or rotating onion URIs + concurrent hidden service endpoints to map addresses aggressively + concurrent ipv4 or ipv6 addrspaces to hidden web services on TCP/DNS + including those discussed built on multi-homed stream transports to the mapped endpoints Q: "How do you trust shady ipv4, ipv6, openssl, zlib, libevent, http, smtp, wtfp web attack surface?" A: clearly you should not. a legit op accrues pwn pot as show of good faith... [swelling pool of shadydogecoins for great justice!] Q: "Where is it?" A: ,, hah! almost got me! .. i know nothing. [ i hear the gruqq awaits to check your opsec at the subscreen? i was hallucinating. there were squirrels... ] Q: "Can this veer any further off-topic?" A: you're no exile from zeroed list, are you :P PS: the sooner someone leaks the bootstrap to hidden fuller disclosure the sooner i can take this tangent back apropos *grin* Q: "If I show you my digests will you show me yours teehee?" A: sure; builds ~200-500min - afford your patience accordingly. (builders shamelessly solicited) --- > a modest and proportionate proposal, > > fuller-disclosure:...

1 0