April 2014 - cypherpunks - lists.cpunks.org

If not StartSSL, the next best CA for individuals?
by Eric Mill 12 Apr '14

12 Apr '14

(Setting aside how awful the CA system is generally...) For those who still have a need to participate in it, and for those angry at StartCom's refusal to waive[1][2] revocation fees for their free class 1 certs, what's the best CA for the job? Even if not free, I'm looking to recommend[3] something priced attractively for individuals and non-commercial uses. The friendlier the interface, and the more reliable and principled the customer service, the better. -- Eric [1] https://cv.exbit.io/emails/startssl_heartbeat.txt [2] https://twitter.com/startssl/status/453631038883758080 [3] https://konklone.com/post/switch-to-https-now-for-free -- konklone.com | @konklone

2 1

healthcare.gov vulnerability?
by jim bell 11 Apr '14

11 Apr '14

It occurred to me that I haven't heard much on the news about deliberate attacks on the healthcare.gov website, even though it is reputed to be extremely weak. Might somebody (potentially a supporter of Obama and/or Obamacare) have deliberately 'spammed' it with fake signups, simply to get the number of such signups increased? How vulnerable would it be to 'invented' names/addresses? How 'valid' would these names/addresses have to be to keep the system from finding out until some arbitrary stage in the process? If such an attack had been done, would the public ever find out, and when? Jim Bell

5 6

Police inventing fake crimes
by jim bell 11 Apr '14

11 Apr '14

The major flaw that I see with this case (and others like it) is that it presumes that the defendants actually BELIEVED the statements by the police, and RELIED ON them. From the article: "Still, undercover officers with the U.S. Secret Service and Miami Beach police told both clearly that they wanted to buy bitcoins with cash supposedly generated by the hacking of Target Corp. customer information. The undercover officers said during the secretly videotaped meetings that they planned to use the bitcoins to acquire still more stolen credit cards." I could 'clearly tell' somebody that the Sun orbited the Earth, but that doesn't mean that the statement was factual. Similarly, the fact that the police told these guys what the article claims they did, doesn't require that the defendants actually BELIEVED the allegations. My expectation is that these charges will be quietly dropped: The only ones actually committing the crime(s) are the police themselves: The police solicited money laundering, when there were no facts (actual underlying crimes) supporting the money laundering predicate. Jim Bell ======================================= http://news.yahoo.com/fla-bitcoin-case-tests-money-laundering-limits-152957… MIAMI BEACH, Fla. (AP) — Two police officers burst through a hotel room door with guns drawn, yelling "Police! Get Down!" just after an alleged money laundering transaction went down. But instead of briefcases stuffed with a drug dealer's cash, this exchange involved an undercover officer with supposedly stolen credit cards and the virtual currency bitcoin. The February arrests of Pascal Reid and Michell Espinoza marked the first time any state has brought money laundering charges involving bitcoins, according to Miami-Dade State Attorney Katherine Fernandez Rundle. And it's likely to be a closely-watched test of whether criminal law can adapt to new digital forms of payment. "These cybercriminals are way ahead of the rest of us in terms of trying to figure out ways they can launder dirty money," Rundle said. Investigators trolled through an online directory of bitcoin traders to find the 29-year-old Reid and 30-year-old Espinoza, setting up separate meetings with each of the men at restaurants and coffee shops. They were arrested at the same Miami Beach hotel on the same day, at different times. Defense attorneys said the men have no previous criminal records and were simply enthusiasts of the payment format that allows people to convert cash into digital money for online transactions. Still, undercover officers with the U.S. Secret Service and Miami Beach police told both clearly that they wanted to buy bitcoins with cash supposedly generated by the hacking of Target Corp. customer information. The undercover officers said during the secretly videotaped meetings that they planned to use the bitcoins to acquire still more stolen credit cards. "My client has never dealt in the area of stolen credit cards," said Espinoza's attorney, Rene Palomino Jr. "My client was simply selling a piece of personal property, which is what a bitcoin is. It has not been recognized as currency yet in the United States."Attorneys for Reid and Espinoza, both of whom have pleaded not guilty, say they will challenge the very legal foundations of the cases, which are being prosecuted separately. The arrest affidavits for both Reid and Espinoza refer to bitcoins as "electronic currency with no central authority." The Internal Revenue Service issued guidance last month concluding that bitcoins can only be taxed as property and are not legal tender. Federal law enforcement agencies are watching whether bitcoins are used increasingly in criminal activity, such as the now-defunct Silk Road illegal drug marketplace. "The idea that illicit actors might exploit the vulnerabilities of virtual currency to launder money is not merely theoretical," said Jennifer Shasky Calvery, director of Treasury's Financial Crimes Enforcement Network, in a recent Florida speech to bankers. Still, bitcoins have been gaining popularity among mainstream businesses. Overstock.com recently became the first major retailer to accept digital money and the NBA's Sacramento Kings in January announced the team would accept bitcoins, another first. They are increasingly used in restaurants, coffee shops and elsewhere. The Latin House Grill in Coral Gables is one of the first South Florida restaurants to accept bitcoins and has been hosting meetings to educate people.Bitcoin users exchange cash for digital money using online exchanges, then store it in a computer program that serves as a wallet. The program can transfer payments directly to merchants or individuals around the world, eliminating transaction fees and the need for bank or credit card information. "This technology can't go away. It's completely disrupted a lot of existing technology that's archaic, that hasn't evolved," said patron Andrew Barnard, who has been using bitcoins for a year. In the Florida criminal case, Reid and Espinoza each face up to 25 years in prison if convicted of money laundering and engaging in an unlicensed money services business. Reid is free on $100,000 bail but Espinoza has been unable so far to make bail. The transactions started small — one payment of $500 translated into about half a bitcoin — and eventually built to a proposed swap involving $30,000 in Reid's case. "Ice cold money. Ice cold cash. Right out of the freezer," the undercover agent, holding a plastic bag of cash tells Reid on the surveillance tape. Just after Reid accepts the bag, the undercover agent says, "We're cooking with gas," an apparent signal to the officers outside to come in. "You're a cop?" Reid is heard saying on the tape. "You're a cop?" Reid attorney Ron Lowy said the prosecution was manufactured. "The government is frightened of bitcoin. Apparently, they see it as an emerging, new type of economic medium of exchange, and they're worried that they're not regulating it close enough," Lowy said. "These facts do not constitute a crime." ___

1 0

Two possible vulnerabilities in OpenSSL?
by Peter Malone 11 Apr '14

11 Apr '14

Hey there, I was auditing OpenSSL last night. I looked at several files and found the following: https://github.com/openssl/openssl/blob/master/ssl/t1_lib.c#L2893 /* Determine if we need to see RI. Strictly speaking if we want to * avoid an attack we should *always* see RI even on initial server * hello because the client doesn't see any renegotiation during an * attack. However this would mean we could not connect to any server * which doesn't support RI so for the immediate future tolerate RI * absence on initial connect only. */ Well that's awful coding. Unless I'm mistaken, the following memcmp is vulnerable to a remote timing attack. https://github.com/openssl/openssl/blob/master/ssl/ssl_lib.c#L1974 static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b) { if (a->ssl_version != b->ssl_version) return(1); if (a->session_id_length != b->session_id_length) return(1); return(memcmp(a->session_id,b->session_id,a->session_id_length)); } I posted both of these findings to the full disclosure list last night. I figured someone on this list might find it interesting as well. Cheers, Peter.

3 3

Assange: Debian is Owned by the NSA
by rysiek 10 Apr '14

10 Apr '14

Hi there, so this has come to my attention. Whaddya guys and gals think? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by… In his Q&A to his keynote address at the World Hosting Days Global 2014 conference in April, the world’s largest hosting and cloud event, Julian Assange discussed encryption technology in the context of hosting systems. He discussed the cypherpunk credo of how encryption can level the playing field between powerful governments and people, and about 20 minutes into his address, he discussed how UNIX-like systems like Debian (which he mentioned by name) are engineered by nation-states with backdoors which are easily introduced as ‘bugs’, and how the Linux system depends on thousands of packages and libraries that may be compromised. I recommend watching his 36 minute Q&A in its entirety, keeping in mind my recent warnings about how GNU/Linux is almost entirely engineered by the government/military-affiliated Red Hat corporation. The Voice of Russia website has an article on Assange’s address with a few quotes: “To a degree this is a matter of national sovereignty. The news is all flush with talk about how Russia has annexed the Crimea, but the reality is, the Five Eyes intelligence alliance, principally the United States, have annexed the whole world as a result of annexing the computer systems and communications technology that is used to run the modern world,” stated Julian Assange in his keynote address… Don’t just read the short article, listen to the address yourself, because Assange goes into many areas, and the work being done in these fields. Assange mentions how Debian famously botched the SSL random number generator for years (which was clearly sabotaged – a known fact). Speaking of botched security affecting Red Hat, Debian, Ubuntu, Gentoo, SuSE, *BSD, and more, the nightmarish OpenSSL recently botched SSL again (very serious – updated comments on how a defense contractor in Finland outed the NSA here?) It’s very hard to believe this wasn’t deliberate, as botching the memory space of private keys is about as completely incompetent as you can get, as this area is ultra-critical to the whole system. As a result, many private keys, including of providers, were potentially compromised, and much private info of service users. Be sure to update your systems as this bug is now public knowledge. (For more on how OpenSSL is a nightmare, and why this bug is one among many that will never be found, listen to FreeBSD developer Poul-Heening Kamp’s excellent talk at the FOSDEM BSD conference.) From the start, my revelations on this blog about Red Hat’s deep control of Linux, along with their large corporate/government connections, hasn’t been just about spying, but about losing the distributed engineering quality of Linux, with Red Hat centralizing control. Yet as an ex-cypherpunk and crypto software developer, as soon as I started using Linux years ago, I noted that all the major distributions used watered-down encryption (to use stronger encryption in many areas, such as AES-loop, you needed to compile your own kernel and go to great lengths to manually bypass barriers they put in place to the use of genuinely strong encryption). This told me then that those who controlled distributions were deeply in the pockets of intelligence networks. So it comes as no surprise to me that they jumped on board systemd when told to, despite the mock choice publicized to users – there was never any option. A computer, and especially hosting services (which often run Linux), are powerful communication and broadcasting systems into today’s world. If you control and have unfettered access to such systems, you basically control the world. As Assange notes in the talk, encryption is only as strong as its endpoints. eg if you’re running a very secure protocol on a system with a compromised OS, you’re owned. As Assange observed: “The sharing of information, the communication of free peoples, across history and across geography, is something that creates, maintains, and disciplines laws [governments].” - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- Pozdr rysiek

2 1

OpenWTF
by rysiek 10 Apr '14

10 Apr '14

OHAI, So I suppose many of you have already seen this. Nonetheless... W: http://article.gmane.org/gmane.os.openbsd.misc/211963 T: http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf F: http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse To get you interested: > No. OpenSSL has exploit mitigation countermeasures to make sure it's > exploitable. -- Pozdr rysiek

1 0

Passwords problem
by jim bell 09 Apr '14

09 Apr '14

http://news.yahoo.com/passwords-vulnerable-security-flaw-found-222708914.ht… Passwords vulnerable after security flaw found By ANICK JESDANUN 6 hours ago * * * * * * * NEW YORK (AP) — Passwords, credit cards and other sensitive data are at risk after security researchers discovered a problem with an encryption technology used to securely transmit email, e-commerce transactions, social networking posts and other Web traffic. Related Stories * 'Heartbleed' bug in web technology seen as major threat to user data Reuters * Internet “Heartbleed” Bug Exposing Passwords To Hackers CBS Dallas Fort Worth (RSS) * What You Need to Know About Heartbleed, the New Security Bug Scaring the Internet The Atlantic Wire * 'Heartbleed' bug puts encrypted data in dangerAFP * Google, Microsoft Race to Assess Heartbleed Vulnerability The Wall Street Journal Security researchers say the threat, known as Heartbleed, is serious, partly because it remained undiscovered for more two years. Attackers can exploit the vulnerability without leaving any trace, so anything sent during that time has potentially been compromised. It's not known, though, whether anyone has actually used it to conduct an attack. Researchers are advising people to change all of their passwords. The flaw was discovered independently in recent days by researchers at Google Inc. and the Finnish security firm Codenomicon. The breach involves SSL/TLS, an encryption technology marked by the small, closed padlock and "https:" on Web browsers to signify that traffic is secure. With the Heartbleed flaw, traffic was subject to snooping even if the padlock had been closed. The problem affects only the variant of SSL/TLS known as OpenSSL, but that happens to be one of the most common on the Internet. Researchers at Codenomicon say that OpenSSL is used by two of the most widely used Web server software, Apache and nginx. That means many websites potentially have this security flaw. OpenSSL is also used to secure email, chats and virtual private networks, which are used by employees to connect securely with corporate networks. Despite the worries, Codenomicon said many large consumer sites don't have the problem because of their "conservative choice" of equipment and software. "Ironically smaller and more progressive services or those who have upgraded to (the) latest and best encryption will be affected most," the security firm added. A fix came out Monday, but affected websites and service providers must install the update. Yahoo's Tumblr blogging service uses OpenSSL. In a blog post Tuesday, officials at the service said they had no evidence of any breach and had immediately implemented the fix. "But this still means that the little lock icon (HTTPS) we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible to anyone who knew about the exploit," Tumblr's blog post read. "This might be a good day to call in sick and take some time to change your passwords everywhere — especially your high-security services like email, file storage, and banking, which may have been compromised by this bug." Yahoo Inc. said its other services, including email, Flickr and search, also have the vulnerability. The company said some of the systems have already been fixed, while work is being done on the rest of Yahoo's websites. The company reiterated its standard recommendation for people to change passwords regularly and to add a backup mobile number to the account. That number can be used to verify a user's identity if there are problems accessing the account because of hacking. ___ AP Technology Writer Michael Liedtke in San Francisco contributed to this report.

1 0

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL
by grarpamp 08 Apr '14

08 Apr '14

On Tue, Apr 8, 2014 at 2:02 PM, Joe Btfsplk <joebtfsplk(a)gmx.com> wrote: >> On 4/7/2014 6:14 PM, grarpamp wrote: >> http://heartbleed.com/ >> Patch your stuff. > Comments / suggestions from those w/ in depth knowledge in this area? How > users should proceed; how to check if sites used (banks, email, retail > sites, etc.) were / still are affected, so one knows if & when to change > passwords or other data? > > If the number of sites potentially affected is as large as indicated on > heartbleed.com, changing PW on even 60% of sites I use could take a long > time - even to do it once. > > It would do little good to change a password on a site that hasn't patched > this. > Or perhaps it would do some good, to change the password before logging out > of a site? Then when a site must be accessed again, change the password > again. > > Either way, this might not provide perfect safety, but might ? be better > than nothing. https://blog.torproject.org/ covers what to do for Tor things. For everything else on the net, fix the clients and servers you're responsible for. Then... You're right, there's a big gotcha in all this, users won't really know if the services they interact with have been fixed [1] because huge swaths of services simply don't publish what they do on their pages, they bury it to keep quiet and shiny happy sites. Only some banks, insurers, utilities, schools, etc will post "we're fixed" anywhere remotely prominent. So you have to trust they did [2], which is a reasonable assumption given regulation and liability of big institutional services. You should already have a regular password changing/logout/session management regimen, so inserting some extra instances of that along guesstimates of [2] should suffice with these classes of service. [2] Sometime during the falloff curve starting yesterday afternoon. The real user risk is likely on mid to small services, embedded things, shared platforms, legacy systems, services that didn't get the news, don't have the resources or knowledge to fix, etc. Again, consider some form of reasonable regimen. And there are all sorts of tools and site testing services coming out now for which a brave user might be completely warranted in using to determine [1 above] so they know when to utilize [regimen 2]. (Far better to use a testing service or email their help desks seeking a positive statement than risk being potentially considered an exploiter of things you don't own.) Partial list... http://s3.jspenguin.org/ssltest.py https://gist.github.com/takeshixx/10107280 https://github.com/FiloSottile/Heartbleed https://www.ssllabs.com/ssltest/index.html (Note, this is a TLS in process bug, so more than HTTP/S services are affected...) This bug will no doubt trigger some thinking, analysis and change in the services, security, infrastructure and user communites... that's a good thing.

1 0

Re: [Cryptography] [cryptography] Github Pages now supports SSL
by Eric Mill 08 Apr '14

08 Apr '14

Yeah, it's real terrific. -_____- @ITechGeek, my understanding was that SNI was handled at an OS level by WinXP, and no browser would work on it. I could be wrong, I haven't researched it myself. On Mon, Apr 7, 2014 at 10:31 PM, Bill Stewart <billstewart(a)pobox.com> wrote: > At 11:08 AM 4/4/2014, Eric Mill wrote: > >> I know most of the people on here have transcended the earthbound, >> maudlin Certificate Authority system, but as services-adopting-SSL-news >> goes, I'm particular excited about <https://twitter.com/benbalter/status/ >> 444555263195217920>Github Pages, which started quietly supporting SSL >> for *.<http://github.io>github.io domains a few weeks back. >> > > Well that was convenient timing, considering the OpenSSL "Change All Your > Certs and Keys Now" bug announcement that just hit the wires :-) > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography > -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

Should openssl accept weak DSA/DH keys with g = +/- 1 ?
by Georgi Guninski 08 Apr '14

08 Apr '14

I am a noob at crypto. IIRC similar attack was used against Tor several years ago. In DSA it is possible to force g=1 or g \equiv -1 \mod p. The first is unit and the second is of multiplicative order 2. This are clearly weak and insane choices, but this might have implications to MITM (might be wrong on this). For DH could generate key with g=1, though couldn't test it. Tested both 1 and -1 cases in DSA, the probability of successful connection was about 1/4 (or maybe 1/2), errors in the other cases. (for $1$ I would expect probability $1$). Attached are cacert.pem and cacert2.pem, the magic word is 1234. To test: $ openssl s_server -accept 8888 -www -cert cacert.pem $ openssl s_client -connect localhost:8888 -showcerts To examine $openssl x509 -text -in cacert2.pem $openssl dhparam -text -in dHParam.pem (not sure if dHParam.pem this is usable, forged generation). Firefox refuses connections, Konqueror works with same probability. Suspect this might be related to EC refusing the point at infinity. Might have MITM implications, don't have working exploit (If a MITM can forge $g=1$ in DH, the private keys are useless).

1 1