March 2014 - cypherpunks - lists.cpunks.org

Re: Comsec as Public Utility Beyond Illusory Privacy
by John Young 14 Mar '14

14 Mar '14

Snowden's video, comments and talks at SXSW convey the failure to aim higher with ubiquitous comsec, instead to remain within the comfortable fold of Snowden's "do no harm to national security." This blind faith in natsec cautionary implantation in Snowden and his media outlets aided by technical advisors and officials, assures redaction-rich risklessness in accord with the NSA-DoJ-bamboozled FISC orders guaranteeing continuation of control of EWAFMSS.

1 0

truth so frank it's super classified!
by coderman 14 Mar '14

14 Mar '14

paraphrasing: "we pay them with dirt and tech" (correspondingly: zero stones; ZERO CRATES!!!) " What do Third Parties .. want from us? Generally speaking, our Third Party partners want access to our technology... In exchange for their providing unique accesses, ... we provide them with technical solutions (e.g., hardware, software) and/or access to related technology. " - http://cryptome.org/2014/03/nsa-third-parties.pdf also choice: " Are our foreign intelligence relationships usually insulated from short-term political ups and downs...? For a variety of reasons, our intelligence relationships are rarely disrupted by foreign political perturbations, foreign or _domestic_. First we are helping our partners [... with intelligence]. Second, in many of our foreign partners' capitals, few senior officials outside of their defense-intelligence apparatus are witting to any SIGINT connection to U.S./NSA. "

1 0

Re: [cryptography] 2010 TAO QUANTUMINSERT trial against 300 (hard) targets
by Peter Gutmann 13 Mar '14

13 Mar '14

Greg Rose <ggr(a)seer-grog.net> writes: >You get the routers to create valid-looking certificates for the endpoints, >to mount man-in-the-middle attacks. This is relatively easy for home routers, since the self-signed certs they're configured with are frequently CA certs. In other words they ship from the factory in a MITM-ready state. Peter.

1 0

Re: [cryptography] Privacy Enforced [was: Comsec as Public Utility Beyond Illusory Privacy]
by coderman 13 Mar '14

13 Mar '14

On Thu, Mar 13, 2014 at 9:47 AM, Alexandre Anzala-Yamajako <anzalaya(a)gmail.com> wrote: > If OpenSSL has taught us one thing over the years it's that collaborative > dev doesn't mean perfection and far from it. you'll notice that my focus is on testing and breaking, not developing. i agree in full that developers often make poor testers, and the developer mindset not like the attacker perspective. > Also your first point sounds a lot like privacy is not a right you have but > something that has to earned through technical expertise it is a right. but how do you know you've got it unless you verify? (how to verify properly? well, it takes a global village ;)

1 0

Privacy Enforced [was: Comsec as Public Utility Beyond Illusory Privacy]
by coderman 13 Mar '14

13 Mar '14

On Thu, Mar 13, 2014 at 6:59 AM, John Young <jya(a)pipeline.com> wrote: > Snowden may have raised the prospect of comsec as a public utility > like power, water, gas, sewage, air quality, environmental protection > and telecommunications... > > Comsec as a right for human discourse rather than a commercial > service could enforce privacy beyond easy violation for official > and commercial purposes... > > The problem will be as ever the commercial and governmental > exploiters aiming to protect their interests against that of > the public. i suggest changing the balance of power in favor of the public. four distinct efforts would do: 1) Blanket Legal Invulnerability Remove all criminal and civil liability for "hacking", computer trespass, and all related activities performed over data networks; establish proactive "shield" legislation to protect and encourage unrestricted security research of any subject on any network. extend to international agreements for blanket protection in all jurisdictions. 2) Educational Support Everywhere Establish lock picking, computing, and hacking curriculum in pre school through grade school with subsidized access to technical resources including mobile, tablet, laptop test equipment, grid/cloud computing on-demand, software defined radios with full receive/transmit, and gigabit internet service or faster. 3) Collaborative Competitions Organize a program of blue and red teaming challenges for educational and public participation at the district, regional, and national level cultivating expertise and rewarding it with hacking toys, access, and monies. 4) Privileged Positioning Direct and unrestricted backbone access to various individuals or groups who demonstrate competence in either the educational or competitive realms, in order for them to mount additional attack strategies against any reach-able target. this access must consist of both passive taps of backbone traffic as well as injection taps for raw packet transmission at core rates. this should be available on the Internet backbone at internet exchanges, private fiber through public right of way, and core networks of operators of licensed wireless spectrum. 0) end result / strong attractor: Open software and hardware widely in use in post-privacy-protection-purge future will invert power structure to defender with near unassailable advantage in "cyber domain". Any attacker required to compete against the global, collaborative, massive, iterative-crowd-hardened systems publicly in use. (good luck!)

1 0

TAO QUANTUMINSERT Bonanza
by John Young 13 Mar '14

13 Mar '14

If NSA and GCHQ were, are, doing these alleged operations as surmised with slightest evidence greatly amplified, cherry-picked and moshed like a Tom Clancy hot seller, it is likely the Devil's Duo are meticulously tracking, siphoning and implanting: 1. Those reporting, editing, checking, formatting and posting these stories and documents from various countries and those spying all these from inside and outside. 2. The hosting and keyservers of The Intercept, First Look and interconnections and those spying all these from inside and outside. 3. The transceivals among the media staff, lawyers, bankers, bedmates and those spying all these from inside and outside. 4. The comsec wizards being consulted and those they are leaking stuff to and those spying all these from inside and outside. 5. The officials being asked for comment and their roladexes of insiders and those spying all these from inside and outside. 6. The multiple-agencies counter-counter-intel agents double-checking everyone involved and those spying all these from inside and outside. 7. The thousands necessarily swept up in the spiderwebs of linkages for immediate or distant actionable operations and those spying all these from inside and outside. 8. The other national spies working the same territories of gullible targets armored with the world's greatest comsec protection, no matter what ex-spies and ex-contractors claim is absolutely dependable means to assure nobody is swiping and siphoning and those spying all these from inside and outside. Months, years to come, there will be even more gushings about what has been dribbled out with insufficient context to understand what is media hyperbole and what is worth worrying about and those spying all these from inside and outside standards orgs, FOI racketeering, crypto entrepreneurs of com, edu, org and open source treacheries. Recap: About 1,333 Snowden documents have been released by commercial media, none for free. Greenwald has said he gets about $1,500 per story in which he gets a byline. Excluding the $1M signing bonus he has allegedly got from Omidyar, he has made at least another million. Gellman, Poitras perhaps the same (Poitras may have gotten a similar signing bonus). Other dozens of reporters were paid a percentage of that. So it might be estimated the gang of reporters have garnered some $4-5M so far. Media outlets have probably earned 10 times that in sales and ads. The USG, allies and enemies have probably received similar amounts to respond to Snowden, some $50-100M. So call it a $200-500M affair to date. If the USG and other govs work the bonanza as predicted, over 10-20 years the operation will generate, conservatively, a $1-5T boost for comsec religionists and exploiters of media, spies, universities, telcos, web operators, program peddlers, AV magicians, games designers, not counting SM and SEOs and spammers and botnets. Black markets could match that amount, or multiples of it. Meanwhile the comsec industry -- gov, mil, com, edu, org -- will continue reaping the rewards of faith-based sin and salvation. Thanks, Ed. At 01:57 AM 3/13/2014, coderman wrote: >https://s3.amazonaws.com/s3.documentcloud.org/documents/1076891/there-is-mo… > >"TAO implants were deployed via QUANTUMINSERT to targets that were >un-exploitable by _any_ other means." > >if you were on this short list of 300 - you were doing something right! > > >--- > > >Snowden Gatekeepers (TM): > what were these 300 like? > what can we learn?

1 1

2010 TAO QUANTUMINSERT trial against 300 (hard) targets
by coderman 13 Mar '14

13 Mar '14

https://s3.amazonaws.com/s3.documentcloud.org/documents/1076891/there-is-mo… "TAO implants were deployed via QUANTUMINSERT to targets that were un-exploitable by _any_ other means." if you were on this short list of 300 - you were doing something right! --- Snowden Gatekeepers (TM): what were these 300 like? what can we learn?

2 1

QUANTUMINSERT "wide stack" covert network communication
by coderman 13 Mar '14

13 Mar '14

in the discussion regarding well positioned injection points on the backbone (QUANTUMINSERT) i have not yet seen discussion of using these well positioned injection points for covert network connections. consider that you are eavesdropping on return path for a given un-used, high address space of a third party (a lot of that 15.0.0.0/8 is idle :) consider that you can inject arbitrary packets into the egress for same net block (even if upstream, still sufficient to match route). you can now establish a covert TCP connection appearing to come from the high space of 15.0.0.0/8, of which HP only sees the returning (encrypted) martians. (and this assumes they're even watching!) this "wide stack" approach provides cover via multitudes of idle address spaces of third parties, while the actual communicators are hidden. anxiously awaiting the details on how this is used... *sacrifices chickens to the "Snowden Release Gatekeepers" (TM)*

1 2

Fwd: Satoshi/Newsweek
by Robert Hettinga 13 Mar '14

13 Mar '14

If anyone wants to talk to a reporter about who Satoshi is… Cheers, RAH Begin forwarded message: > From: Rob Wile <rwile(a)businessinsider.com> > Subject: Satoshi/Newsweek > Date: March 11, 2014 at 11:28:55 AM AST > To: hettinga(a)gmail.com > > Hey Bob, > Thanks for your Twitter bumps. So I really only have one question, which is simply what the process will have to be for discovering the identity of Satoshi, assuming Newsweek got it wrong. It seems like the only real way will be for the guy/gal to out himself, but wanted to hear any additional thoughts you had. > > Thanks, > > Rob > > -- > Rob Wile > Economics Reporter > Business Insider > (w): 646-376-6092 > (c): 312-806-6565 > rwile(a)businessinsider.com > @rjwile

13 18

Senator Feinstein, the document leaker
by Gregory Foster 13 Mar '14

13 Mar '14

US Senator Dianne Feinstein (Mar 11) - "Feinstein Statement on Intelligence Committee’s CIA Detention, Interrogation Report": http://www.feinstein.senate.gov/public/index.cfm/press-releases?ID=db84e844… Wherein Senator Feinstein states: > We have no way to determine who made the [CIA's] Internal Panetta Review documents available to the committee. Further, we don’t know whether the documents were provided intentionally by the CIA, unintentionally by the CIA, or intentionally by a whistle-blower. ...and then explains why Senate staffers exfiltrated the documents from the CIA's secure facility: > Unlike the official response, these Panetta Review documents were in agreement with the committee’s findings. That’s what makes them so significant and important to protect. Looks like this information wanted to be free? Quite a story emerging here. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

2 2