March 2014 - cypherpunks - lists.cpunks.org

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 20 Mar '14

20 Mar '14

over on the OSS list i have been venting some bullshit friction over the full-disclosure cave in and closure. for shame! see also thread on more better mixmasters, ---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Thu, Mar 20, 2014 at 3:18 AM Subject: Re: FD mailing list died. Time for new one (or something better!) To: oss-security(a)lists.openwall.com a modest and proportionate proposal, fuller-disclosure: - a hidden list (local accts only, no clearnet linkage) - a hidden daily digest (per mod prefs, see below) - a hidden xmpp (otr required - plaintext abused) - a hidden web archive (of the list traffic, read-only) - a hidden public chat (group xmpp+/|ircd, no clearnet linkage) - a hidden pastebin with or without simple nonce auth - a advogato reputation sys to stack rank and put below the fold (for list digest content, public chat, web archive, and public pastes) use case A: "JerkVendor is Jerk" - more accomodating disclosure fails, good faith and gratis effort returned with bile. - bugtraq drama ensues, takedowns. - "Hey, the advisory is still up here! -> fullerd.onion/..." use case B: "The Hot Drop" - *whispers* 'remember the Athens Affair? i'd rather not Opt-Out to report' - BREAKING NEWS: "Anonymous russian hackers drop dox on spyhack to darknet fullerd.onion..." use case C: "It's my party and I'll..." - 'so how it happened was, , i coaxed pre-auth SSL cert parsefail remote exec with escalate to system' - "Hey DEF CON! fuck that full-disclosure closure drama, let's get this party started!" - DEF CON XX official start and group xmpp/ircd distributes nonce for 0day to thousands of hidden participants simultaneously. [ remainder of distribution happens over sneakernet at con due to unexplained outage across entire Tor network for all users... ] not a concern at all, ever: - "HOLY SHIT TAKE THAT DOWN NOW!!!" legal motions - "HOLY SHIT TAKE THAT DOWN NOW!!!" supporter/peer pressure - "HOLY SHIT TAKE THAT DOWN NOW!!!" matters of national security - "HOLY SHIT TAKE THAT DOWN NOW!!!" hint in datagram at 100Gbps [ the inverse is use case D: "99.44% Peace of Mind" ] i don't see the point in anything less; other technologies filling existing roles fine, while the truly necessary drops have zero outlet. . . . finding someone with strong reputation and good judgement to publicly validate and speak to the efforts of the equally reputable but absolutely anonymous service operator? ... now that's a hard sell ... *grin*

1 0

targeted attack authorizations and oversight
by coderman 20 Mar '14

20 Mar '14

> "... to go for the end points [requires?] a constitutional, more carefully > overseeing sort of intelligence gathering model." having observed domestic LE (inc. FBI) in action and military systems in action, they usually have distinct and different characteristics: LE specific and narrow and by the book and for the record, this is a specific focus they give attention. Military any-and-all-means-to-the-end less discriminating, brute strength ground out the solution by force majeure method. anomaly: the DC 19 rogue base stations DITU DRT technique was in-discriminant (until it had to be :) and yet the DC 20 NSA TAO/QUANTUM*.* style "in the towers" absurd over kill attacks were also absolutely precise - if your "selector"(phone) was not on the list you'd never know [without some fancy watching close to target, perhaps?]. if you were indeed on the shitlist, every sensor, stored byte, and key material got compromised instantly; your airplane mode is funny cute. ... presumably "anything in range of the Rio and our multiwatt amps" they argued was targeted and limited. as for had to be discriminating, if you want to load test spook gear just figure out what drives their automation and then jam the fuck to 11 on that signal. [where signal is anything that feeds the weird machine; take all advantages inherent in attacker perspective! fork bombs and kernel panics equally disruptive] anomaly reloaded: DC 21: nobody playing? you're still watching; fair is fair! ...

1 1

Skype and Crypto Pushed by Snowden a Ploy?
by John Young 20 Mar '14

20 Mar '14

In connection with using "encrypted, secure connection" Skype for Snowden's imagery at SXSW and TED, as well as encrypted comms with journalists and event organizers, what has led these comsec advisors to believe that all too vulnerable Skype is secure, as well as all too vulnerable popular crypto pushed for journalists? Is there any indication Snowden has deployed less vulnerable protections which have not been disclosed as backing for his encouragement to trust encryption and to allow Skype to finger his location and leak his comms? To be sure, many of his remarks seem to be carefully scripted for low-brow consumption characteristic of journalism. So there may be a secure back-channel being used with Skype and pop crypto as diversion. The low-brow slides, clips, short docs, redactions released by the media point to a deception of some sort yet to be disclosed until 25 years has passed. Hyperventilating press accounts of the releases suggest either deception, inexperience or technical ignorance or all. Still, that kind of misleading comsec deception would be commonplace security measures characterisitic of NSA and wizards -- to induce the flock to churn massive amount publicity about encrypted comms -- and Skype -- to camouflage the Tor, blacker and deeper comms, not to say the even blacker and deeper tools not seen by Snowden or not yet released. More sopisticated would be to use the small amount of NSA releases to cloak far greater distribution (a method used by WikiLeaks and the black market as well as the spy industry). That too would closer to what the big boys and girls do, and therefore would be exactly what they are watching for. Including watching for ploys to hide ploys. .

3 2

Fwd: A new Mixmaster is in the works!
by Cypher 20 Mar '14

20 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A few of us have decided to take a crack at updating Mixmaster. The announcement is below. Feedback is welcomed. Anthony - -------- Original Message -------- Subject: A new Mixmaster is in the works! Date: Wed, 19 Mar 2014 20:36:51 -0500 From: Crypto <crypto(a)jpunix.net> Hello Everyone! Today Lance Cottrell (the original author of Mixmaster) myself, (chief Mixmaster Alpha tester and contributor) and Anthony Papillion (Cypher) had a meeting on Jitsi to discuss the current status of Mixmaster and remailers in general. We have decided that we are going to investigate updating to a new Mixmaster that will fill the weaknesses and issues that are present in the current version of Mixmaster (Mixmaster 3.0). The first issue will address the 1024-bit key length. We will be looking at the development code currently available on the Internet. The first thing we will do is to implement a 4096-bit key structure. More features are under discussion. We would like your input on what features you would like to see. Please keep in mind that we are looking at functionality first. Secondly we are looking at introducing a desktop GUI for major operating systems. Lastly we want to make using remailers and encryption as seamless as possible. Your thoughts and suggestions are welcome but please remember that it is just the three of us so let's keep the "exotic" stuff to the end of the project. -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCgAGBQJTKkdjAAoJEFuutbL6JoJr9bIP+wXcbDdBjBaA27/rBu0M54D8 4ghwgpbcmCo6iKZzBJphwuV0cDbEqqlNUBslJVmOqRBftWkpN9t4v4rggWmzSs4S RNZVMPm5ad6DcW9eJTvnuldW/BL95arrolSLja0jLv5CaFLdaGo3PnBThoRQFxT9 82mTx5Fzdc+s+OVSIuO/FGeVFWhCZsru9nUlUT82rnrbNYeTnuR9iQUNltFlkM1S yDS2sAaP+0fKJQUo4lsRO8dCxKRvLln0yJDNLdZvH3Am8sBIgbBg4DvF++ZRx6nz V3mAPmmDXU37w+0GLdad1Euuge+Wj74Wha/zKTeCRs2fKwBffIAdepVLzVd/X2fX dI+lO2MIKkp6xvJIqMy9O+g26YJfNx1hYLdA9glCflpVioEQqiMsy7ech7Fltgbv wAtZfLrkl+FMUTQUy7lwMLv7gAPIW4qc1WZBJiB9cMqxQvNW0gOazLvWD0fsg7/d i6RRmqik7cQyyW9MOy3agnC3tLvdYwIV2yMAyB5WRrNl0QaDPEb7J7bzRSZOFosB DcbH7ZuuGjvRhSsyEu/lT8Ad6GJ+OYKO3C/ODO8jyok9Cxv03YoZeVoj3xbFVWrL zpETZGPDMjQ1m3SrQiU+kaJY2vns3XRFEao+/sz+7YxmS3kDA+OZguoRVkek0+im FwAuh/nO85QZAnGL2Q2O =aj0r -----END PGP SIGNATURE-----

1 0

usual or desperate call for white papers?
by Cari Machet 20 Mar '14

20 Mar '14

'Air Force Research Laboratory Information Directorate (AFRL/RI) is soliciting white papers for various scientific studies, investigations, and experiments to increase our knowledge, understanding and capability in order to expand cyber operations technologies within the Department of Defense (DoD).' https://www.fbo.gov/index?s=opportunity&mode=form&id=0daa017bdb65a7d810e377… -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

4 6

SHA-7 crypto patented by Italian Postal Service
by Fabio Pietrosanti (naif) 20 Mar '14

20 Mar '14

LOL - LOL - LOL - LOL - LOL On italian government "innovation portal" it has been published a patent by the "Italian Postal Service" of SHA-7 : "The encryption SHA-7 allows to generate a unique “message digest” " LOL reading on http://italiainnovatori.gov.it/en/innovations/sha-7-2/ -naif

3 2

MH370 in hangar at Diego Garcia, detainees already rendered
by Anonymous Remailer (austria) 19 Mar '14

19 Mar '14

The flight was hijacked by a non secured flightplan upload to the flight management system. It was then flown to Diego Garcia, where the passengers were disembarked by force, the selectees from the passenger list are in one of the US navy brig ships anchored since 9/11 at Diego Garcia, "chatting" with CIA interrogators. Disposition of the other detainees passengers NOT known at the present. The statement released by the malaysian gov is false. They know where the detainees are. The adsb xmissions aboard the 777 are handled by an older subsystem and are NOT so easily silenced from the cockpit. By the same token the flight management system flight plan upload capability aboard boeing planes has been shown to be insecure and vunerable by security researchers since the B737. The worst part of all is that the "simulators" for the FMS are a windows based program that is linked with the libraries either representing the windows environment of the simulator OR thet are linked with the "production" libraries to produce the FMS firmware for use on the aircraft itself. Thing about programming in a windows environment? ALL the fucking calls are unique to the Microsoft windows environment and NOT portable at all to other runtime environments, UNLESS that runtime is windows based.. say like windows mobile(big flop) or a proposed hypothetical environment I am going to call Windows PLANE. Windows PLANE would have inherited the same crappy programming environment that caused the US Navy to do an abrupt 180 turnaround prom putting its firecontrol and navigation systems under control of windows after a near disaster in the mid alantic caused by windows domain failuresa Windows PLANE would have all the same flaws as the crappy laptop you like to lug around Fucking Boeing, all of those windows development asshats that did this need killin' for putting their personal profit ahead of the lives of millions who fly.

11 18

telesnowden selected excerpts
by coderman 19 Mar '14

19 Mar '14

a few things i found interesting, per http://blog.inside.com/blog/2014/3/10/edward-snowden-sxsw-full-transcriptio… (better script and transcode?) --- emphasis on attacks against crypto systems by targeting the random number generator(s): "typically it is the random number generators that are attacked as opposed to the encryption algorithms" "... encryption does work.... a basic protection[,] it is a defense against the dark arts for the digital realm. This is something we all need to be not only implementing but actively researching and improving on an academic level. The grad students of today and tomorrow need to keep today's threat on online to inform tomorrows. We need all those brilliant Belgian cryptographers to go alright we know that these encryption algorithms we are using today work typically it is the random number generators that are attacked as opposed to the encryption algorithms themselves. How can we make them ____ how can we test them? This is _____ it is not going to go away tomorrow, but it is the steps we take today. The moral commitment. The philosophical commitment, the commercial commitment to protect and enforce our liberties through technical standards to allow us to reclaim the open and trusted." --- "By doing end to end encryption you force what they are called ... global passive adversaries to go for the end points that is the... computers. And the result of that is a constitutional, more carefully overseeing sort of intelligence gathering model. Where if they want to gather somebody's communications they have to target them specifically. They can't just target everybody all the time and then when they want to read your stuff they go back in a time machine and say what did they say you know in 2006. They can't pitch exploits in every computer in the world without getting caught. That is the value of end to end encryption and that is what we need to be thinking about." the targeted attacks under a different authorization and more restrict controls? would like details on "constraints" and "authorizations" and specific projectnames. :) ---- "The NSA the sort of global mass surveillance that is occurring in all of these countries. Not just the US it is important to remember that this is a global issue. They are setting fire to the future of the internet." this is a global problem. somehow, with decades of growth nurtured and shaped and guided along flawed trajectories, we looked around and found everyone and everything bathed in surveillance and privacy invasion, myriad motives across state/corporate/professional boundaries coopted in blissful or willful ignorance as was chosen. --- "Let me embrace thee, sour adversity, for wise men say it is the wisest course." - William Shakespeare

1 0

cyberwarfare by lawyers
by Cari Machet 19 Mar '14

19 Mar '14

'The Jerusalem Post recently interviewed Col. Sharon Afek, formerly deputy head of the IDF's legal division, who wrote a 149-page treatise on cyber warfare law - the first treatise of that comprehensiveness by a military lawyer of his rank and stature.' http://www.jpost.com/Defense/Analysis-How-Israel-is-dealing-with-cyber-warf… 'Many are also asking more strongly than ever: "Is international law still relevant?" Afek, who views his treatise also as a "bridge" between the pre- and post-cyber world of war, answers with a resounding "yes," but then goes further to try to resolve some of the questions of how and where it applies. One debate in the new wild west of cyberwarfare law is between two schools of thought about where to draw the line of which cyber operations should be declared illegal under international law.' http://www.jpost.com/Features/Front-Lines/A-revolution-in-war-339962 -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

7 9

Re: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi
by Aaron Zauner 19 Mar '14

19 Mar '14

cates From Trust, Stores References: <5328EE7F.9070503(a)azet.org> <5328F7FC.5060802(a)iang.org> In-Reply-To: <5328F7FC.5060802(a)iang.org> X-Enigmail-Version: 1.2.3 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig2D2852BFD85FEBF952C9CE4C" Cc: cpunks <cypherpunks(a)cpunks.org> X-BeenThere: cypherpunks(a)cpunks.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: The Cypherpunks Mailing List <cypherpunks.cpunks.org> List-Unsubscribe: <https://cpunks.org/mailman/options/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=unsubscribe> List-Archive: <http://cpunks.org/pipermail/cypherpunks/> List-Post: <mailto:cypherpunks@cpunks.org> List-Help: <mailto:cypherpunks-request@cpunks.org?subject=help> List-Subscribe: <https://cpunks.org/mailman/listinfo/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=subscribe> X-List-Received-Date: Wed, 19 Mar 2014 03:52:41 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Ian, ianG wrote: > Nice! Now, if they could package up a plugin or a new root list such > that we could write in 2 lines what busy sysadms had to do, I'd say it > would make a great recommendation. >=20 > What I'm trying to get away from is the notion that we should put a > simply list in the doc and say "oh, and strip these out! You know > how, vi is your friend..." Yea. That won't work at all, there's no clear authority [sic!] on who can decide a CA is not trustworthy. Experience has to show that, and in that case a lot of the big CAs will fail an evaluation. If you ask me, it's pretty easy, my list of trusted CAs is empty. Automated generation of lists of CAs that are simply unused is just the first step. I think certificate-transparency is a good way to do that, the rest is basically automation. For example: one can provide chef, puppet, ansible recipies for linux and mac clients, a similar solution for windows and mobile devices should also be doable. Aaron --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJTKRQqAAoJEOTbZJL9ubXVB2cQAMCC6nlPTgUn86bCXi8ny+uk noYKI7XXHq0Hzl/f3Hd67oAXEX9wNh1znSBRYJ3sfSd5dgeyTfhn6NIITjdzqGc1 +1yAmyIn7Q8/+lDgSEPdsTDKFXqiTtQj9iK6t+/Ul6/l34movetvYBBI85f9yO96 4swk7obaqpRqkziVoUt0K2lopYrCxXHK7hVkXmwXgt1UlyccODHy2fWO3QWl8SWw xmrQlCJ+BGuYiV2mNFZe9w5etLwGX7wiR4xpaAHXoYZL6Kt2f//fmdb+pWnq8lE/ /NxmAQlDboPBB39uPhhsUtbrwOUS/4ZFqiA3tUSgcYZMGxYPWoUkkJpuccpWhYMf psaWrZmhz0CoL9FPiKngscv9DNAMIHfOOa0Ynku4RfBvO2Q/4F1JrW4epwCJuQiK kxKDjD2+pQ/UdIlIWSdylskaVZV+qsKWBa+4oBbGQYz9DXLgYwaPh7p6QzRcZGvA sP3p6t+aluUqCtc11cgiKfCfLs8uezTNQUYrrlu4E1G3IXkMPMmSOuheiwu+sRCJ BSlP/ys/FihB6J6EsC4i7AkLK8Ws1vfarCZDdycA++lr63Uoj0LEYv8/nTgg/GNj ZaDmuGO1sBMwEEH0nTyBDk2fJryOFjiGzzdzmEuk7fAWD6tY16mqYUptqlDmphz/ 79u6Uftx8nNa3u099JBL =7ty+ -----END PGP SIGNATURE----- --------------enig2D2852BFD85FEBF952C9CE4C--

2 1