March 2014 - cypherpunks - lists.cpunks.org

Jean-Jacques Quisquater on Alleged NSA-GCHQ Hack
by John Young 10 Mar '14

10 Mar '14

http://cryptome.org/2014/02/quisquater-comments.htm

2 1

Taint Review Team
by Rich Jones 10 Mar '14

10 Mar '14

Docs via MuckRock show internal DEA training manuals instructing for parallel construction based on classified / illegally obtained information, combined with an internal review board to shield that information from the public courts. https://www.muckrock.com/news/archives/2014/feb/03/dea-parallel-constructio… "Americans don't like it!" R

5 6

Re: [cryptography] Snowden Drop to Poitras and Greenwald Described
by coderman 10 Mar '14

10 Mar '14

On Sat, Feb 8, 2014 at 11:27 PM, ianG <iang(a)iang.org> wrote: > ... So what > British Intelligence did was to switch gears and harass his operations > to make them as difficult as possible. Instead of trying to necessarily > stop the bombs, they pushed gear across that made bomb making risky, and > aggressively clamped down on 'safe' gear where they could. In effect, > making unstable explosives and detonators available, and controlling the > market for the quality stuff. > > So the bomb maker was forced into employing ever more risky techniques ... > > This tactic of harassing the enemy to make mistakes more likely is > rather well known. In war as in business. And it can and is applied to > the media. if you haven't observed this in the information security domain, you're not paying attention, of you're incompetent.

1 0

A Surprisingly Easy Tool for Encrypting Email, Courtesy of an Ex-NSA Employee
by Gutem 10 Mar '14

10 Mar '14

Encrypting for the masses? http://motherboard.vice.com/blog/a-surprisingly-easy-tool-for-encrypting-em… Att, - Gutem ------------------------------------------------------------------------------------------- Registered Linux User: 562142

5 4

Gox dox'ed
by coderman 10 Mar '14

10 Mar '14

it seems the answer is here: http://blog.magicaltux.net/wp-content/uploads/2014/03/MtGox2014Leak.zip http://89.248.171.30/MtGox2014Leak.zip https://mega.co.nz/#!0VliDQBA!4Ontdi2MsLD4J5dV1-sr7pAgEYTSMi8rNeEMBikEhAs http://burnbit.com/download/280433/MtGox2014Leak_zip let me know if you're still short a mirror... On Thu, Feb 27, 2014 at 10:16 PM, Juan Garofalo <juan.g71(a)gmail.com> wrote: > > > --On Thursday, February 27, 2014 11:12 PM -0600 Troy Benjegerdes > <hozer(a)hozed.org> wrote: > >> >> I'd argue that centralized systems provide, on averge, a larger anonymity >> set and privacy in the majority of cases than decentralized ones. In >> particular exchanges that everyone believes are 'incompetent' are a >> wonderful place to get a lot of cheap plausible deniability by making >> everyone else that uses it pay for it when the house of cards falls down. > > > In the case of something like mtgox, how did it provide privacy? Or > plausible deniality? Users have to send IDs, bank account details, > everything is logged, etc etc. What am I missing? > > > >> >> >> >> -- >> ------------------------------------------------------------------------- >> --- Troy Benjegerdes 'da hozer' >> hozer(a)hozed.org 7 elements >> earth::water::air::fire::mind::spirit::soul grid.coop >> >> Never pick a fight with someone who buys ink by the barrel, >> nor try buy a hacker who makes money by the megahash >> >> > >

2 1

Inferring the NSA's MO from a short clip of Joel Brenner on BBC
by Jen Savage 10 Mar '14

10 Mar '14

I want to preface this message with a disclaimer: I am in no way defending the actions of the NSA. I am merely attempting analysis of their motivations and their MO. https://www.youtube.com/watch?v=H33r2weM6Zc Joel Brenner says, "There is in all the intelligence agencies a tension between doing offense better and doing defense better" ...and, "but unless you think 0days are finite" Ok let's talk about this issue for a moment. - In the CTF world, it has been widely accepted that given a red team and a blue team of equal abilities, the red team always wins. - Academics say there is no way to create provably secure software. - Developers have a phrase, "there is no such thing as bug free software." - CISOs are using the term "risk" to describe pen test findings: a recognition that pen tests have become a measure of the risk that someone will find an exploitable flaw. Suppose that the NSA gave up on securing software because they view it as impossible. In fact, we know they view it as impossible because they have called it a Sisyphean Task. If there are diminishing returns from reporting software vulnerabilities to the vendor, then doing so is a losing battle. I hear people say that the NSA undermines the security of software by not releasing the vulnerabilities, but we know that historically companies have been very bad at actually fixing the vulnerabilities they are given. In some cases, a new product is released before a vulnerability is even looked into, thus rendering the effort useless. So, is defense dead? Is that an accepted fact these days? If offense is a type of defense, is the NSA perhaps aiming to use 0day for their offensive capabilities to effect a kind of defense? How would they accomplish this? Have any of you been to the Berlin Unterwelten? It is a tour of revision after revision of nuclear bomb shelters that could never possibly save the population they are tasked with saving. We are living in an age where there is an entire set of strategies that deal with war in a world with weapons so strong that no walls can possibly defend against them. Although the reach of nuclear weapons historically has been further reaching than so-called "cyber" weapons, that is changing. Despite the very many warnings from the infosec industry, that is changing. (Sometimes I think my Home Invasion 2.0 talk fell on deaf ears because smart home appliances are proliferating.) And in the future of smart homes, smart cities, even smart bodies, when everything is internet connected: everyone is vulnerable. Imagine cities that can be invaded without physical armies. If you were the NSA, and you believed these things to be true, what would you be doing? -Jen

3 2

chip vulns [was: Snowden and Compilers]
by coderman 10 Mar '14

10 Mar '14

On Tue, Feb 11, 2014 at 1:47 PM, Kelly John Rose <iam(a)kjro.se> wrote: > I could see them more easily subverting chip designs themselves then trying > to subvert the entire compiler ecosystem. ^ this. so,... how 'bout that malay crash?

1 0

Get offa my lawn. (was Re: [Cryptography] BitCoin bug reported)
by Robert Hettinga 10 Mar '14

10 Mar '14

On Feb 16, 2014, at 10:40 PM, Lucky Green <shamrock(a)cypherpunks.to> wrote: > I say, let them and all of Bitcoin burn to dust. Dang kids. Get offa my lawn. It’s been interesting, I’ll say that much. I have people on their honeymoon here in .ai asking to see me, buy me and Mrs. RAH $30 hamburgers at Viceroy, etc. Or “prove”, “stylometrically", on various Bitcoin fora, that I'm Satoshi. Heh. I’ll never get tired of braggin’ about *that* one. :-) I expect others here know where the stylistic clues came from, but I think Grigg has the right approach to that question. Leave well enough alone. Being, even now, generally optimistic about the future, if not my own in particular, I can’t help thinking there’s a pony in there somewhere. I *do* find it annoying that the only time people wanna talk to me about this stuff is at the top of a bubble. I expect that it may be a hint from the Almighty I should pay attention to. At the moment, PayPal, which we all looked down the nose at back then, is still, um, printing money, and a cypherpunk gave me some BTC a little while ago, a kind of eating-the-dog food exercise for old time’s sake. Or something. The price has since fallen 40%, but it’s bouncing back, and will probably be fine. “You have to be *this* tall to take this ride”, as another friend said about Bitcoin prices last week. Meanwhile I can’t think of anything I want to spend it on anyway. Even in its current form, Bitcoin makes rather short work of those speed bumps Mr. May used to tell us about, which *may* be the real point to the exercise. Having to file several kinds of forms to get paid for a small consulting job as US citizen outside the US was enough to make me foreswear getting paid for much of anything anymore, anything small at least, and BTC solves several problems there quite handily, push ever came to shove. Besides, my passport is stamped “Employment Prohibited”, which, apparently, I’m evidently honoring even in the breach. So, I think BTC, or something like it, would make a nice numeraire, temporary or otherwise, having gnawed at the edges of *that* problem when most of the Bitcoinners were, as Marc notes, in short-pants. Yes, even in its current volatile state. And contrary to the opinions of people who know better than I do about these things. It wasn't quite what Dr. Fama got the Nobel for, but New Monetary Economics might be as good once as it ever was, and Bitcoin might be the camel’s nose under that particular tent, and given that it is the ultimate fiat currency that’s quite an assertion. As someone whose stated goal, back in the day, was to securitize *everything*, debt, equity, cash, services, title to assets in storage, transit, or just sitting there with a house on it, cats, dogs, mass hysteria -- and all derivatives thereof -- using bearer-transaction financial cryptography protocols on a ubiquitous geodesic public internetwork, Bitcoin *is* a bit, oh, please let me say it, self-referent as a solution. I saw it blow by here on this list, said, “meh”, shortly had the magic smoke go out of most of my internet presence by a power-spike in a hurricane, and never got around to paying attention to either Bitcoin, or the internet, very much at all until various people frog-marched my attention back into focus recently with me muttering variously about being too old for this shit anymore... So, Bitcoin, if it survives, makes a *nice* hack, by solving, what Barnes, and ultimately everyone else, called the “loading problem”. And, so far at least, it solves the “and then you go to jail” part of the book-entry transaction error-handler, something Barnes was also noted for saying. That, too, only if Bitcoin survives. "...any [network] architecture that can survive a nuclear attack can survive withdrawal of government subsidy...” Godwin said on Cyberia, long ago. I’ve jokingly called it his Second Law. I suppose the Strong Form of that hypothesis, speaking of Dr. Fama, is surviving not mere withdrawal of the implicit subsidy of monopolistic contract enforcement, and all transfer-priced assets and “externalities” appertaining thereto, but also active attack from the ostensible contract enforcer itself. I hear of others, well, gnawing around the edges, actually, of securitizing other stuff with variants of the Bitcoin protocol, but, like predicting the end of the world, expanding the blockchain to other assets "has not been found agreeable to experience.” So far as I can see. Meanwhile, Chris Odom, aka, “Fellow Traveller”, aka, “Lovedrop” (yes, *that* “Lovedrop”), is banging away on something called Open Transactions, which inserts an actual transaction protocol, among other much more interesting things, into the works to glue Bitcoin and other stuff onto, for starters, Wagner Blinding, using, for starters, Ben Laurie’s lucre code. I haven’t seen a code-stoke like the one I see Chris with, well, since the old days. Which is nice. Very nice. Big grins all around, down here in the elbow of the Caribbean. Apparently, like me, he noticed that he was delivering instantly-usable product now, and getting paid later, too much later usually. I discovered cypherpunks in late spring of 1994 looking for a solution to something Barnes (again) called the “latency” problem. Chriss bumped into the gold-silver-crypto list, I think, about 10 years later. Mr. Odom has been been kind enough to involve me in testing OT a bit, and, ultimately, I’ve more-or-less bailed on iterative break-it-and-fix-it. Mostly because I don’t have the patience for testing — much less writing — code, if I ever really did. But here’s the rub, I also I have no *idea* what I, personally, would do with Open Transactions these days even if I could get it running in production. I have lots of ideas in *general*, you understand, but they’re mostly of the “let’s you and him fight” variety. Many more people than *I* would have to be involved, they, and I, would risk much more than money, and, ultimately, I’m not sure any of it would work. It’s a drag to think that most of what I’m interested in doing requires the dissolution, or at least dissipation, of The World’s Only Remaining Superpower to happen. As someone who still, barely, calls himself mostly an anarcho-capitalist but still a patriot, that’s about the only thing worse than only being interesting to other people during the top of a bubble. Yup. A Mass of Contradictions, as usual. "Let’s you and him fight" is only two or three steps removed from Mr. Briceno’s original observation, I figure. Hell, even “set here next to the rockin' chair, sonny, and I’ll tell ya a story”, is, ultimately, not much more help than “get off my lawn”, when you get right down to it... Cheers, RAH

2 2

CIA Project CHAOS/MHCHAOS
by Gregory Foster 10 Mar '14

10 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Document Exploitation (Feb 26) - "Confirmed: The CIA Destroyed Its Noam Chomsky File and Thousands More on Other U.S. Citizens": http://www.docexblog.com/2014/02/confirmed-cia-destroyed-its-noam.html > The file [scheduled for destruction] contains 7840 of a total of > 8,328 folders on individual U.S. persons (citizens, resident > aliens) and 2,196 volumes consisting of official and "soft" subject > files and so-called sensitive files (i.e., > organizations/activities), individual documents, and the index > related to these collections which were established under project > CHAOS during the period 1967-1974. The files were opened to > maintain information bearing on possible foreign Communist > exploitation of dissention in the United States, primarily > concerning the Vietnam War. Subjects of the folders were U.S. > citizens and organizations involved in dissident activities in the > United States. Now about that alleged CIA/FBI line between foreign and domestic surveillance... Also interesting as a historical precedent for why the NSA should be required to retain records in its databases which otherwise would be (allegedly) automatically purged on schedule: they are evidence of crimes helpful for active lawsuits. https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCgQqQ… HT the invaluable @saftergood, gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTDrP6AAoJEMaAACmjGtgj2IsP/1P4Xc/ZBmm7TImxGrsVxjJQ Nu0HU+YltOAS68NbDfCKo/yQhYnDkvbjjuEO6WiTmEtf9C6sr1f0Xitr2n7PZEft BC397hkp02i8xZGeny5dn3JENe/8DNromdGfO+v5/oQ3ZNURNX+S8aIWxAVHL2ws ebxuR5CrlWFFhbg9H9YAMDe0DtXc54vWoEXC36rEpvKLpTWC5LZl8QuikbtuIC9m xW8LhwQMKUDT/mZFQ+W0W6KAFWlWHMEWRC2mEL2aKucbf2rfND7FX/pgYyeRjUeF iLrI8orHqJKDtddeFNO0agTz21v2+4D88hFk/4FjRdrUAFNHcAy7XrF9zwDP/Kzm jqcWFIFjEbPTDxRR4tXlA5aMnkqose+N77LRXk4YKACgfmK+cPaYkVaPCgJ4D7uO pOZSRnduRkdI6VPdvVww8AvHYGhkbwDUBGc7CQN1WMiBtyLSHsnji7stxDsIMVze ervt8ZkjGWJWT/BgFsJYUE/MH8TCMd0m3y2jmQG9nVwyYURCz8fn+AiOMgv2rynB +aSA6SqCQiXKpAT6GGbRvijUmmVY9Bx3jUzqh72jGp3ANRq53E+ySS4z6TPXe3e5 P6QvCvNegnTEhdgy4zc5Q9buwdShQEZRVC/7YetmodloT3czjBX3me/nTGvpFxwy jAoQVJ2hSDA1L5jCBLyI =L5rJ -----END PGP SIGNATURE-----

2 1

Test #1
by Cypher 10 Mar '14

10 Mar '14

This is a test to validate if I am properly receiving list email. I've not seen anything in a few days. Cypher

8 9