May 2014 - cypherpunks - lists.cpunks.org

Re: "SIGINT tradecraftis very hands-on (l i terally!)"
by John Young 14 May '14

14 May '14

That would be quite useful. How would you crack it if used by an opponent? At 01:11 AM 5/14/2014, you wrote: >Alright, what I meant was this: The judge ordered that the >information be provided in electronically-readable form. He meant, >"not on paper", because if it were on paper, that would be very >difficult to actually USE. My idea was to put the information onto >pdf files, where if you view the pdf file, it would look like lines >of "captcha"-type data: Weird, warped characters, in various odd >colors, overlapping lines, >etc. <http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, >the free encyclopedia Specifically designed to NOT be >computer-identifiable. The essence of the presentation of the data >would be that it wouldn't be readable by 'computer' at all; it would >have to be decoded by human intervention...even though it was in >"electronically-readable form"!! > ><http://en.wikipedia.org/wiki/Captcha> >image > ><http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, the free >encyclopedia >A CAPTCHA (an acronym for "Completely Automated Public Turing test >to tell Computers and Humans Apart") is a type of challenge-respons... ><http://en.wikipedia.org/wiki/Captcha>View on en.wikipedia.org >Preview by Yahoo > Jim Bell

3 3

cypherpunks administrivia: no more reply-to header stripping
by Riad S. Wahby 14 May '14

14 May '14

Folks, Until now, mailman has been stripping Reply-To: headers from messages to the list. I've just turned this off. Some webmail services (notably, Yahoo!) set the Reply-To: header and include it in the headers signed with DKIM. Stripping Reply-To: thus breaks the DKIM signature. In the case of Yahoo! this signature breakage is especially problematic, because their DMARC policy is set to reject. (In other words, messages with yahoo.com in the From: header that fail both SPF and DKIM should be rejected by compliant mail services, e.g., AOL, Gmail, Hotmail, Yahoo!) Messages to the mailing list should pass SPF, since the envelope sender domain for list messages is cpunks.org and I publish an appropriate spf RR. However, any list subscriber who forwards mail to another account will have broken SPF and an invalid DKIM signature, which trips the DMARC policy and causes delivery failures. I realize that this might cause some inconvenience, but I would prefer to err on the side of successfully delivering messages whenever possible. If you're using procmail and prefer the old behavior, the following recipe should suffice: :0H * ^list-id.*cypherpunks.cpunks.org | formail -IReply-To -=rsw

1 0

Re: "SIGINT tradecraftis very hands-on (literally!)"
by John Young 14 May '14

14 May '14

We've seen the Greenwald book No Place to Hide, where are the promised gush of Snowden documents available? His publisher doesn't show a source. Surely not another marketing tease. Surely not snatched by the TLAs, tampered with, doctored, MTM'd, redacted, censored, cherry-picked, highlighted for dummies and fans, surely not handled like a disinfo spy op, heavy on narrative, suggestions of much more unreleasable, need for classified briefings and diligent vetting, that what we documents censors know we can't dare tell the public due to the public dupery by enemies of our interests. Dropboxes are honey pots, media is just that, governments are just that, opsec and comsec are just that. And do tell, what is this SIGINT forum psyoping? At 03:11 AM 5/13/2014, you wrote: >there's some new thing out, > > ... first shots from the peanut gallery? > >please report suspicious network behavior accessing Snowden documents >to the second hand exploit sale broker consortium for a reasonable >referral fee! > > >best regards,

6 5

Patented prime numbers
by Georgi Guninski 13 May '14

13 May '14

Probably this is well known. http://www.freepatentsonline.com/5373560.html http://mathworld.wolfram.com/PrimeNumber.html (check (3)) > Because of their importance in encryption algorithms such as RSA encryption, prime numbers can be important commercial commodities. In fact, R. Schlafly (1994) has obtained U.S. Patent 5373560 on the following two primes (expressed in hexadecimal notation): fuck, fuck, fuck.

6 10

Re: [p2p-hackers] How do BitTorrent block lists get created?
by grarpamp 13 May '14

13 May '14

On Mon, May 12, 2014 at 1:09 PM, David Barrett <dbarrett(a)quinthar.com> wrote: > connecting to everybody in a swarm, downloading one block, > and automatically sending out a takedown Beyond that (which few if any seem to be doing in the first place), they have to prove the content and custody chain of that block, etc. A difficult and costly bar for typical enforcement trolls. > effectively monitor and police all the top torrents out there Any torrent out there. > the enforcer would never send you a block of valid data They own it, they'll do whatever they want with it. You forget, the few random blocks they choose to send are worthless to them, yet scaring you into settling for serving them back out is pure profit. You're also confusing the lesser/non issue of downloading blocks with serving blocks. The latter is better known as the actual regulated infringing activity. > The only defense Bittorrent has is the "blocklist" Now the fun part... have you guys gone daft? Blocklists and VPN's as best defense against such 'enforcement', really? Really?!! Isn't it about time you all plugged your client in to some anonymous overlay network like I2P, Tor, Phantom, cjdns, whatever and just forget about the issue once and for all? Oh, yeah, I forgot, you have: - no patience and need your DL right fucking now. (anon 'swarms' are not really slow at all) - no money and so you leech bandwidth instead of buying clear bandwidth to support whatever anon overlay you're using. (rate limits on linux/bsd are actually easy) Have fun with your clearnet thing, you get what you asked for. > In a recent conversation about piracy and whether it could win Old school battles don't necessarily win the war, sometimes all it takes is lots of voices in anon yet visible protest.

2 1

"SIGINT tradecraft…is very hands-on (literally!)"
by coderman 13 May '14

13 May '14

there's some new thing out, ... first shots from the peanut gallery? please report suspicious network behavior accessing Snowden documents to the second hand exploit sale broker consortium for a reasonable referral fee! best regards,

4 3

Update: please remain vulnerable if the laws of your jurisdiction require it! [was: So You Like Pain and Vulnerability Management?]
by coderman 13 May '14

13 May '14

On Mon, May 12, 2014 at 8:47 PM, coderman <coderman(a)gmail.com> wrote: > ... > 1. "You can’t manage vulnerabilities in closed software any more than > you can manage tunnel construction in an ant nest." please note that my reply below is illegal to follow in some parts of the world: > this is not true. by actively managing the execution of all processes > on all your systems and the communication they make ... > blocking and altering shared library methods, system calls, and > network communication... a friend of mine was just arrested outside the Louvre for strace like behavior![0] best regards, 0. "Did you know? ... strace is banned in France, where it is classified as a cracking tool (it can trace plain-text I/O)." http://www.brendangregg.com/blog/2014-05-11/strace-wow-much-syscall.html P.S. no of course it was not Pete, and of course it was not my code.

1 0

Re: [FD] So You Like Pain and Vulnerability Management? New Article.
by coderman 13 May '14

13 May '14

On Mon, May 12, 2014 at 9:09 AM, Pete Herzog <lists(a)isecom.org> wrote: > "Hi, I’m your friend and security researcher, Pete Herzog. we're almost family Pete, no need to introduce yourself! ... was starting to wonder how you've been... you never call, you rarely write, regarding your piece published at: http://www.tripwire.com/state-of-security/vulnerability-management/so-you-l… this reply is a little long, as i took the time to respond in depth to each of the issues i observed in your piece; i hope you view this as the best of intentions and sincere desire for thoroughness it is. any criticism is entirely constructive. if you feel despondent or hopeless about the future where you have been so wrong and so ill equipped to secure digital systems, see the end of this thread for crisis hotline resources in your area. > But I’m here today to take a moment and talk to you about the pain of > neglect, isolation, abuse, and infection, better known as > “vulnerability management”. you might be interested in the other thread on treating addiction. my own empirical study linking INFOSEC/COMSEC responsibilities with ethanol abuse, clandestine chemical poisonings, and a rapidly escalating habit for high fiber lifestyle is progressing nicely, but not yet ready for publication. (DWDM not ingested fiber) > In many ways vulnerability management can > be part of a healthy system and over-all good security. agreed! i find it very helpful to find vulns first, use them for early signalling of adversary capabilities and interest, weaponize them for great justice, and distribute them in limited fashion toward end of life cycle to friends and peers, where again they serve as useful feedback on third party OPSEC and integrity. > That's how my new article starts. 5 points on the pain of > vulnerability management and how to make it hurt less. unfortunately in previous private vulnerability assessments all social media platforms failed to survive our common criteria for credible computing contract services. at least you're not paying for them? ... i will however provide my feedback via this medium: 0. "how to make it hurt less" first off, you may be interested in my research on the best synth routes for clandestine medicating and near term memory cleansing with common chemicals or seedy suppliers. this information was cultivated during my research into INFOSEC/COMSEC professional who are clearly exceptionally capable in this domain. 1. "You can’t manage vulnerabilities in closed software any more than you can manage tunnel construction in an ant nest." this is not true. by actively managing the execution of all processes on all your systems and the communication they make between each other and remote (networked or bus connected services) peers. blocking and altering shared library methods, system calls, and network communication is effective against open source, closed source, promiscuous source, and other development practices. 2. "Managing vulnerabilities will not get you security. Especially since patched vulnerabilities is a subset of found vulnerabilities which is assumed (for far too many) to be a subset of having security." this is why it is critical to find as many vulnerabilities as possible in the systems you use before others do. use the vulnerabilities you find as a model of class of weakness upon which to defend in depth. more to do after this, but for another discussion... ;) 3. "But if you wanted to have all the domesticated animals on your new arc you can’t do it by only looking house pets as that would exclude goats, cows, horses, yetis, and many animals maybe you don’t know or didn’t consider. So when scanning for vulnerabilities you can only, at best, find the vulnerabilities the scanner knows about." i for one wish they omitted the goats. they make great work on the blackberry bushes, but the pasture fences are challenge and escalating war of attrition they so far show no difficulty defeating with clever goat skillz. more to the point above, this is why it is critical to employ not just all existing scanners, fuzzers, frameworks, and toolsets but also to improve them internally while also developing your own infrastructure for vulnerability discovery, defense, and weaponization. (this is called "big vuln" or "big vuln dev" by our team for lack of a better allegory) 4. "It Can Feel a Lot Like Doing Dishes. Vulnerability management is an endless race that can’t be won." so true! however, this is why complete and continuous automation is mandatory at the moment of analyst discovery or developer prototype. thus the repetitiveness is delegated to the machines who do our bidding without tire or negligence. 5. "when you manage operational controls as part of vulnerability management you can actually take yourself out of the rat race of patch vs. exploit. That’s huge!" patch vs. exploit is a false dichotomy. if you're not solving for both concurrently you're doing it wrong. (don't feel bad, this is a common failure.) 6. "Filling a Hole Has Never Been So Dirty ... We think vulnerability management is straight-forward: there’s a hole and you fill it and the hole is gone." who are these "we" you speak of? the last time i saw that mindset in play was a sales associate for a security consulting firm hawking some weird devops / continuous integration like thing i don't remember too well. anyone who thinks vulnerability management is easy is unaware of their ignorance, risk, and update latencies in their organization. 7. "In the end, playing dirty is the only way most vulnerability managers can keep their heads above water. But let’s just call that a risk decision." what you call "playing dirty" is just decision making in the midst of a series of one crises after another in an endless procession. crisis mitigation and resolution should not be cast in a negative air of "playing dirty". rather, take this as opportunity to find the exceptionally rare operations crew who runs a ship so tight there are no crises, only prioritized opportunities for even further improvement. 8. "closely followed by NATO, NIST, FBI, NASA, NSA, all branches of armed forces, and the White House." this is just awefull! i suffered through a number of years with a stalker intent on making me into a skin cover for a realdoll in some psychotic delusion he was compelled by. i know the unease and fear and stress that a malicious stalker can have on the psyche. i presume you've looked into local resources to prosecute or order to be restrained. if they're unable or unwilling to resolve the issue, contact me off list for more extreme methods to handle this. i got your back Pete; and we'll get these rogue's off your back one way or another! 9. "don’t forget to see me in Richmond, VA from June 4 – 6 at RVAse" sorry Pete, i quit going east of the mississippi given the fallout that inevitably follows. as a US tax payer, i try to limit the resources expended to violate my privacy and presume a threat where none exists. and frankly it diminishes the intimacy of my memories knowing that they've surveiled my masturbatory sessions in remote locales. i am taking this moment to segue into one last observation in your piece, but it deals with adult subject matter that may not be appropriate for all audiences. if you are not mature enough for the discussion below, please don't read it! . . . - this break intentionally inserted for decency - . . . Z. "... the adult film star process which pretty much gets you from film star to adult film star by doing just one thing on film." i don't often discuss my personal past in these lists or online in general. for a while i had a career in INFOSEC but came to a realization that there must other line of work supporting a upper middle class salary which were not so terribly detrimental to my mental and physical health. i transitioned into gonzo group gay porn which met the cost of living requirements but still had above average physical demands even if a great improvement over the dark INFOSEC years. after five years building a library of over 1,782 different scenes stretching to 12 days of continuous copulation my career in porn was ended in a crippling accident while testing a prototype manbian machine fucking investment that was my doom rather than return on investment. don't write me, the rights have already been sold for a moving drama with A list cast. my point is that i published a greatest "best-of coderass at 1.75 FPS, abridged" anthology as career end salute on a 180 minute collector s edition BluRay paid for by the sale of creative rights mentioned above. this video release rocketed to the top of all the best seller lists and made me a household name and continues to feed me a torrent of franchise fees, recurring profit share, and ongoing royalties which can only be described as obscene and ridiculous. for some reason every other effort was just not enough to bump me up above obscure D list status... it's a funny world. TL;DR: my adult film star process required 1,782 scenes, 45,000 minutes of film, and spanned 73%* of known sex acts possible to act out between two or more humans but less than twenty humans at once. this is as far removed from "doing just one thing" as i can imagine, and frankly it disrespects the strenuous effort and creative acting myself and other sex workers practice in mostly thankless service to others. you should be ashamed! [* automatic identification and categorization of sex acts is surprisingly complicated! the corresponding language theoretic effort to map 1 to 20 human bodies in movement for 15 minutes or less into a formal language to exhaustively delineate all the possible perversions possible to commit under the sun was gargantuan in terms of earth human hours and the resulting corpus. we are close to proving that not everything which can be done has been. if you would be interested in performing a provably unique sex act for a large sum of money and only modest surgical modification, please get in touch] P.P.S. some people ask me what i do now for a living since confined to robotic wheelchair and bed rest. the truth is, i could never turn my back entirely on the INFOSEC community in which i started my first career and sojourn into the great world alone. so now i am busking at conferences doing INFOSEC comedy routines, selling nerdcore rap put to chiptunes on independent labels, and manning the crisis hotlines for substance abuse and domestic violence victims, who strangely enough overlap to a non trivial degree with the set of self confessed INFOSEC professionals. my time spent replying to INFOSEC threads on mailing lists is gratis, as no one pays me for it, and no one like what i say enough to tip me. "have you hugged your data spill incident responder today?" best regards, friend of Pete and former pr0n star, codermange

2 1

### Two Open Source Apps for data protection ###
by Jose Damico 12 May '14

12 May '14

Hi All, I've developed 2 small/simple/open-source Android apps that can be useful for data protection in mobile devices: ============= Yapea: Yet Another Picture Encryption Application https://play.google.com/store/apps/details?id=org.jdamico.yapea https://github.com/damico/yapea ============= SecNote: Encrypted Notepad for Android https://play.google.com/store/apps/details?id=org.jdamico.secnote https://github.com/damico/SecNote ============= Both applications, has these features: * Encryption Algorithms: Symetric encryption: AES (CBC/PKCS5Padding) Blowfish (CFB/NoPadding) The Initialization Vectors are generated based on unique data from the smartphone. * Type of encryption key: Length: 256 bits Generated through key derivation (from user-defined password) with PBKF2 algorithm. The salt are generated based on unique data from the smartphone. The key is stored inside a configuration file, at smartphone file system. This file is used for password verification at first time of application use. After that the key is encripted and stored inside smartphone memory (cache). But at anytime the user can choose to delete the encrypted key from memory (Clear cache). * Application reset: At anytime the user can choose to dump ALL application data, including encrypted images and configuration. * Panic password: A password that can be used to delete all encrypted images. In a case where user is forced to give its key. (If you're traveling overseas, across borders or anywhere you're afraid your smartphone might be tampered with or examined). * Languages: English and Portuguese ============= Best Regards, Damico

3 3

Cryptome Archive Over 71,000 Files
by John Young 09 May '14

09 May '14

Donate for the Cryptome Archive of over 71,000 files from June 1996 to 6 May 2014 on 1 USB (23.8GB): <http://t.co/zbsl0nmvRE>http://cryptome.org/donations.htm

1 0