August 2014 - cypherpunks - lists.cpunks.org

Update on interdiction, secret GSM
by bluelotus＠openmailbox.org 29 Aug '14

29 Aug '14

I purchased the latest smartphone with a slider qwerty keyboard. A Motorola Droid 4 with CM11 and a T5 torx screwdriver from Ebay. The two T5 screws to the battery ribbon cable had been glued. I discarded the smartphone. http://www.reddit.com/r/privacy/comments/2e7lwl/of_mylar_bags_to_block_phon… Nook Tablet with CM 10 arrived DOA. I could not go past the CM welcome screen. Tablet wouldn't shut down or reboot. I returned it to the seller. MIPS tablet #1 didn't charge via USB port, was missing file manager, Adobe Reader, Skype and app installer, would not mount my SD card and bricked my 16 GB SD card. I tried to use tablet #1's micro USB port to copy my personal files but tablet's USB port would not function. http://www.reddit.com/r/badBIOS/comments/2ejydo/mips_processors_are_rare_mo… MIPS tablet #2 did charge via USB port, was missing app installer but had file manager, Adobe Reader, Skype and two games whereas tablet #1 did not have any games, mounted my SD card but bricked my 8 GB SD card. I was able to copy my personal files using the tablet's micro USB port. http://www.reddit.com/r/badBIOS/comments/2el93r/cannot_air_gap_mips_tablet/ aLogcat logs disclose secret GSM in MIPS tablet #2: http://www.reddit.com/r/badBIOS/comments/2eub37/secret_gsm_in_mips_tablet_i… Hours after posting the above thread yesterday, my MIPS tablet #2 was stolen from my room. Were my laptops implanted with GSM and infected with firmware rootkits when they were interdicted? I had assumed FM radio transceiver/beacon implants or badBIOS. Many of the linux /var/logs I was denied permission to read even though I had logged into the graphical desktop on my laptops. A few of the /var/logs were of unknown file type. The type was unknown to the file manager. Had the firmware rootkits not tampered with the /var/logs, GSM may have been reported in the logs. Military contractors getting special access to surveillance programs. https://www.youtube.com/watch?v=JyT7yzap1Wc Greenpeace loses lawsuit over being hacked by former NSA hackers hired by private investigators hired by corporation http://readersupportednews.org/opinion2/277-75/25479-focus-corporations-spy… "Last year, California’s Pacific Gas and Electric Company (PG&E) was required after an investigation to pay $390,000 to the state’s General Fund after it was discovered that they were spying on anti-smart meter activist groups." http://www.foxnews.com/us/2014/04/17/is-your-home-energy-meter-spying-on/

1 0

[tor-talk] New Announcement: Qubes + Whonix is now available!
by Eugen Leitl 29 Aug '14

29 Aug '14

----- Forwarded message from whonixqubes(a)mail2tor.com ----- Date: Fri, 29 Aug 2014 14:59:25 -0000 From: whonixqubes(a)mail2tor.com To: tor-talk(a)lists.torproject.org Subject: [tor-talk] New Announcement: Qubes + Whonix is now available! Message-ID: <070faaa2512fca0b48fd5427127ef917.squirrel(a)mail2tor2zyjdctd.onion> User-Agent: SquirrelMail/1.4.23 [SVN] Reply-To: tor-talk(a)lists.torproject.org For those interested in Tor, Security, Qubes, Whonix, etc... With the help of several kind people in the Whonix & Qubes communities, I have successfully integrated the Qubes + Whonix operating systems together. For those who would prefer Whonix as an alternative to TorVM in Qubes (for torifying your VM traffic), this option is now available to you. This initial Qubes + Whonix configuration is achived using current versions: - Qubes R2rc2 & Whonix 8.2 Qubes + Whonix currently exists as a customized dual HVM configuration: - Whonix-Gateway HVM + Whonix-Workstation HVM A simple networking setup for Qubes + Whonix would look like: - NetVM <- FirewallVM <- Whonix-Gateway <- Whonix-Workstation Where, for example, the Whonix-Gateway conceptually replaces TorVM as your Tor ProxyVM, and Whonix-Workstation conceptually replaces your standard AppVMs (AnonVMs). You can get the Qubes + Whonix step-by-step instructions and more info here: https://www.whonix.org/wiki/Qubes All suggestions and feedback are welcome! I look forward to helping make Qubes + Whonix integration even tighter and more seamless throughout the future. If you're interested in the future growth of the Qubes + Whonix platform, then please join in with us to actively further this goal. For example, when ProxyVM support is added to the Qubes Debian Template, we can take Qubes + Whonix beyond the current HVM limitation and utilize a naitive ProxyVM + AppVM setup for Whonix. Thank you again to everyone who helped me bring the first known successful Qubes + Whonix configuration to the world... Patrick, Joanna, Marek, Jason, Axon, cprise, and everyone else who has helped! Thank you! :) P.S. Qubes + Whonix 9 support is coming soon! -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message -----

1 0

Re: Columbia XRay web transparency project
by Subrosa.io 27 Aug '14

27 Aug '14

It would be useful for XRay to also attempt to counter information gathering by executing random, low-volume queries in the background. This is one of the only countermeasures to data mining, and when done responsibly (ie, low volume) it should still be able to have a significant effect on decreasing the accuracy and utility of the mined results without irresponsibly hogging resources.

1 0

I made a site to test SHA-1 vs SHA-2
by Eric Mill 25 Aug '14

25 Aug '14

Feedback welcome on the site, copy, and methods: https://shaaaaaaaaaaaaa.com I'm taking bug reports and requests on GitHub: https://github.com/konklone/shaaaaaaaaaaaaa/issues/ -- Eric -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

Columbia XRay web transparency project
by Gregory Foster 23 Aug '14

23 Aug '14

https://github.com/matlecu/xray > XRay is a research project from Columbia University that aims to improve transparency of data usage on the web. You can learn more on our website. http://xray.cs.columbia.edu/ > ...we developed XRay, a new tool that reveals which data in a web account, such as emails, searches, or viewed products, are being used to target which outputs, such as ads, recommended products, or prices. It can increase end-user awareness about what the services they use do with their data, and it can enable auditors and watchdogs with the necessary tools to keep the Web in check. > > Currently, XRay can reveal some forms of targeting for Gmail ads, Amazon product recommendations, and YouTube video recommendations. However, XRay's core mechanisms are largely service-agnostic, providing the necessary building blocks that we hope will enable a new generation of auditing tools that will help lift the curtain on how users' personal data is being used. > > Using our XRay Gmail prototype, we found some pretty interesting examples of data uses, such as a number of ads targeting depression, cancer, and other illnesses. We also saw quite a few subprime loan ads for used cars that targeted debt, loan, or borrow keywords in users' inboxes. YouTube (Aug 20) - "XRay: web transparency tool": https://www.youtube.com/watch?v=VxH20ey2d7k HT @kdnuggets: https://twitter.com/kdnuggets/status/503198576798089216 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

Gyroscope not only eavesdrop but also power line hack via VLF
by bluelotus＠openmailbox.org 21 Aug '14

21 Aug '14

http://www.reddit.com/r/badBIOS/comments/2e3yuv/badbios_transmits_ultrasoun…

1 0

New end to end encrypted IM/VOIP web app focused on ease of use
by Subrosa Team 21 Aug '14

21 Aug '14

Subrosa is an open source, end to end encrypted messaging / VOIP app focused on being easy to use for the general public. We made Subrosa in response to the mass surveillance revelations programs, and to address the difficulty of current tools for the average user. Oh, and it supports group video chats. Site, and hosted version to try it out: https://subrosa.io Why make something new? We've tried getting our non-techie contacts to use GPG/OTR/etc. Our personal experiences are that spending hours per person we want to talk to, teaching them how to use the tool, and helping them when they inevitably come across an issue (e.g. lose their keys) are just not practical. We think there's a place for an end to end encrypted messaging platform usable by *everyone*. Furthermore, not everyone cares about crypto. Subrosa is just as easy to use as making a Skype account, while key generation, etc are all performed behind the scenes. For end to end encryption to be widely adopted, it needs to convince people who don't care about it as well. And that means it can't be any harder, or more confusing than popular offerings. Subrosa does cryptography transparently, however we don't *hide* information such as fingerprints (so you can verify you're not being MITM attacked, by us). RSA keypairs are stored on our servers, with the private key being passed through PBKDF2 with the user password (not sent). Messages are encrypted using exchanged AES keys, with VOIP/video chats encrypted with SRTP. We know web crypto, when executing code from a remote server, has grave security implications. For ease of use, we do have a hosted version. Subrosa's client is fully open source however, and you can (and should!) run a local copy of the client. We use the ForgeJS library. http://github.com/subrosa-io/subrosa-client We're also fully committed to end to end encryption. We don't have any "gotchas" like iMessage being end to end for delivery, but storing the plaintext of messages in iCloud. We shouldn't have the ability to read any messages, in all circumstances (assuming local client). Please let us know what you think about Subrosa, and pick at this :)

7 9

Fwd: cpunk.us experiencing downtime
by Griffin Boyce 20 Aug '14

20 Aug '14

And xmpp user accounts were deleted in the process. See below: -------- Original Message -------- From: Cypher <cypher(a)cpunk.us> Sent: August 20, 2014 11:40:02 AM PDT To: liberationtech(a)lists.stanford.edu Subject: [liberationtech] Experiencing downtime Hello Everyone, Just wanted to let everyone know that the server that runs the Oklahoma anonymous remailer and the chat.cpunk.us XMPP service went down sometimes last night. Unfortunately, because a backup didn't fire off correctly, that also means that any accounts on chat.cpunk.us and all anonymous email in the mailq waiting to be delivered have been lost. I'll be working on getting a new server later tonight and we should be back up by 22:00 EST. If you had an XMPP account on chat.cpunk.us, you will need to recreate it after that time. Thanks for your patience, sorry for the inconvenience. Cypher -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. -- Sent from my tracking device. Please excuse brevity and cat photos.

1 0

Plausible deniability...
by J.R. Jones 20 Aug '14

20 Aug '14

So how do you all go about maintaining said deniability... Hidden volumes etc. Any way to use LUKS yet?

4 3

[Cryptography] GPU Farm
by Eugen Leitl 19 Aug '14

19 Aug '14

----- Forwarded message from Marco Streng <marco.streng(a)genesis-mining.com> ----- Date: Mon, 18 Aug 2014 18:26:49 +0200 From: Marco Streng <marco.streng(a)genesis-mining.com> To: cryptography(a)metzdowd.com Subject: [Cryptography] GPU Farm Message-ID: <53F22949.5020909(a)genesis-mining.com> User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 Hello Guys from metzdowd, I really like your mailing list and following it longer time now. Since I think the posts there are really of high quality and the people participating really know what they are talking about I would love to ask a specific question that could be really interesting for everyone there. I come from a company that is doing cryptocurrency mining in large scale and currently we are thinking about a use case for our 1300 high end GPU farm that is not necessarily profit oriented, but most importantly interesting and exciting. I asked a lot of people till now and also people from chaos computer club in germany, where I received especially ideas pointing to using the farm to decrypt emails or other decryption services. Also I was suggested to use it to decrypt the NSA_KEY, but that is obviously not doable in human time even if the farm would be 1000x bigger. Do you have any interesting idea what to do with the farm? If we like the project it we wouldn't hesitate to start directly! I would really appreciate if you could ask this to the mailing list and I am really excited about the answers. What do you think? Greetings, Marco -- Marco Streng www.genesis-mining.com CEO & Co Founder +491602482228 _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

3 2