August 2014 - cypherpunks - lists.cpunks.org

Gyroscopes in Android phones can be turned into always-on microphones
by Gutem 19 Aug '14

19 Aug '14

FYI: http://www.geek.com/android/gyroscopes-in-android-phones-can-be-turned-into…

4 4

How does the Hacking Team network malware work? How bad is it?
by Eric Mill 17 Aug '14

17 Aug '14

Hi, I've read the Intercept's writeup[1], and read through Citizen Lab's writeup[2]. I'm having trouble understanding the attack surface, and how widely applicable the vulnerability is. Are MS and Google targeted because of their ubiquity, or is there also something (besides not using HTTPS) that they did to make their services vulnerable? How can there be a remote code vulnerability so low in the stack that it can be injected at the packet level, but high enough that TLS encryption foils the attack? Does this affect Windows only? Through particular browsers? I'm certainly up for using this as an argument for how difficult it is to predict the severity and creativity of MITM attacks, but I would like to better understand the magnitude of the disclosure. Thanks, Eric [1] https://firstlook.org/theintercept/2014/08/15/cat-video-hack/ [2] https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/ -- https://konklone.com | https://twitter.com/konklone

2 1

Re: [cryptography] Question About Best Practices for Personal File Encryption
by Christopher Nielsen 17 Aug '14

17 Aug '14

On Aug 15, 2014 11:06 PM, "Mark Thomas" <mark00thomas(a)gmail.com> wrote: > > I have a question for the group, if I may ask it here and in this manner (?). > > What are you guys using to encrypt individual files and folders or even entire drives like a USB? > > I am thinking that: > > 1. any commercial product could be compromised and not completely secure. Like Apple’s FileVault2, which Apple has a key to. The comment about Apple is simply false. Apple does not have a key to FileVault2 unless you escrow your key with them. I know this because a dear friend recently passed, and his family was not able to gain access to his encrypted drives through Apple. That said, FileVault2 is susceptible to offline dictionary attacks on the password, or if you can get access while the drive is online, there are attacks on the Keychain. > 2. It is probably open source. What makes you think open source will save you? All the eyeballs looking at the code? That was proven a false sense of security when heartbleed was announced. > 3. It is probably implemented with the command line. > > Am I on the right track? If so does anyone know of a helpful guide to get started with OpenSSL on the command line besides the man pages? > > Regards, > > Mark > _______________________________________________ > cryptography mailing list >cryptography(a)randombit.net >http://lists.randombit.net/mailman/listinfo/cryptography

4 3

Re: [cryptography] Question About Best Practices for Personal File Encryption
by Tony Arcieri 17 Aug '14

17 Aug '14

On Fri, Aug 15, 2014 at 9:05 PM, Mark Thomas <mark00thomas(a)gmail.com> wrote: > any commercial product could be compromised and not completely secure. > Like Apple’s FileVault2, which Apple has a key to. There aren't known backdoors in FileVault2, or for that mater, Microsoft's Bitlocker. Apple, on the other hand, has been pretty forthcoming with law enforcement backdoors in iPhones (which, actually, seem fairly reasonable, IMO) Don't trust their encrypted filesystem? You better not trust the OS either, for that surely has access to all of the encryption keys you've ever put in main memory. tl;dr: if you don't trust proprietary encrypted filesystems, you better not trust the proprietary OSes they're built into either. -- Tony Arcieri

1 0

Lois Lerner's conveeeeeeeeeeniently-lost emails.
by jim bell 17 Aug '14

17 Aug '14

Note: I wonder what kind of email system would be: 1. Used by the Federal Government. 2. NOT be regularly backed-up. 3. Would lose up to two (2) years of emails in a crash. Jim Bell [article follows] http://news.yahoo.com/lawmakers-fume-over-lost-emails-irs-probe-080830845--… WASHINGTON (AP) — Congressional investigators are fuming over revelations that the Internal Revenue Service has lost a trove of emails to and from a central figure in the agency's tea party controversy. The IRS said Lois Lerner's computer crashed in 2011, wiping out an untold number of emails that were being sought by congressional investigators. The investigators want to see all of Lerner's emails from 2009 to 2013 as part of their probe into the way agents handled applications for tax-exempt status by tea party and other conservative groups. Lerner headed the IRS division that processes applications for tax-exempt status. The IRS acknowledged last year that agents had improperly scrutinized applications by some conservative groups. "Do they really expect the American people to believe that, after having withheld these emails for a year, they're just now realizing the most critical time period is missing?" said Rep. Darrell Issa, R-Calif., chairman of the House Oversight Committee. "If there wasn't nefarious conduct that went much higher than Lois Lerner in the IRS targeting scandal, why are they playing these games?" The Oversight Committee is one of three congressional committees investigating the IRS over its handling of tea party applications from 2010 to 2012. The Justice Department and the IRS inspector general are also investigating. Congressional investigators have shown that IRS officials in Washington were closely involved in the handling of tea party applications, many of which languished for more than a year without action. But so far, they have not publicly produced evidence that anyone outside the agency directed the targeting or even knew about it. If anyone in the Obama administration outside the agency was involved, investigators were hoping for clues in Lerner's emails. "The fact that I am just learning about this, over a year into the investigation, is completely unacceptable and now calls into question the credibility of the IRS' response to congressional inquiries," said Rep. Dave Camp, R-Mich., chairman of the House Ways and Means Committee. "There needs to be an immediate investigation and forensic audit by Department of Justice as well as the inspector general." The IRS said technicians went to great lengths trying to recover data from Lerner's computer in 2011. In emails provided by the IRS, technicians said they sent the computer to a forensic lab run by the agency's criminal investigations unit. But to no avail. The IRS was able to generate 24,000 Lerner emails from the 2009 to 2011 because Lerner had copied in other IRS employees. The agency said it pieced together the emails from the computers of 82 other IRS employees. But an untold number are gone. Camp's office said the missing emails are mainly ones to and from people outside the IRS, "such as the White House, Treasury, Department of Justice, FEC, or Democrat offices." Anti-tax advocate Grover Norquist called the episode "the worst attempt to blame technology in service of a cover-up since the infamous 18-minute gap" in former President Richard Nixon's Watergate tapes. The IRS said in a statement that more than 250 IRS employees have been working to assist congressional investigations, spending nearly $10 million to produce more than 750,000 documents. Overall, the IRS said it is producing a total of 67,000 emails to and from Lerner, covering the period from 2009 to 2013. "The IRS is committed to working with Congress," the IRS said in a statement. "The IRS has remained focused on being thorough and responding as quickly as possible to the wide-ranging requests from Congress while taking steps to protect underlying taxpayer information." Sen. Orrin Hatch of Utah, the top Republican on the Senate Finance Committee, called Friday's disclosure "an outrageous impediment" to the committee's investigation. "Even more egregious is the fact we are learning about this a full year after our initial request to provide the committee with any and all documents relating to our investigation," Hatch said. Lerner has emerged as a key figure in the tea party probe. In May 2013, she was the first IRS official to publicly acknowledge that agents had improperly scrutinized applications. About two weeks later, Lerner was subpoenaed to testify at a congressional hearing. But after making a brief statement in which she said she had done nothing wrong, Lerner refused to answer questions, invoking her constitutional right against self-incrimination. The IRS placed Lerner on administrative leave shortly after the congressional hearing. She retired last fall. In May, the House voted to hold Lerner in contempt of Congress. Her case has been turned over to the U.S. attorney for the District of Columbia.

8 10

fun games against skilled adversaries [was: shipment interdiction [was: BadBIOS forensics]]
by coderman 17 Aug '14

17 Aug '14

On 8/16/14, bluelotus(a)openmailbox.org <bluelotus(a)openmailbox.org> wrote: > Bryan Starbuck, I apologize for the delay in anwering your question. > Your suggestion of keeping profiles is excellent. You are probably > familiar with nonprofits being surveilled, harassed and hacked by former > NSA trained hackers. > ... > Before the above article was written, I wrote a discussion thread on > this. Readers are reluctant to concede that abusers hire private > investigators who hire hackers. the "security industry" as oriented toward the consumer public is focused on broad threats and general risks. the specialized particulars of targeted exploitation for whatever reason are the realm of nation state espionage, law enforcement technical surveillance, and high power corporate conflicts. individuals facing advanced attackers are left with nearly no avenues of reputable relief. the vagaries of how anyone might encounter "advanced attackers" are as myriad and expansive as the history of human kind itself. jilted lover, bruised ego, psychotic obsession, voyueristic thrills, the list goes well beyond the common corporate investigations and government espionage hijinx... > In these high tech times,private investigators hire black hat hackers > who are adept at picking locks, gaining physical access to computers and > external hard drives and disassemblying, implanting and infecting > computers. i find it amusing that the largest repository of black hats and malicious tech is employed by the United States Government itself. at least those tax dollars are some of the most effective put to use? ;) > My case is atypical. It was not the defendant's law firm that hired > private investigators. The defendant himself hired private investigators > who hired hackers. Who he hired are top notch professionals. The type > that law firms would hire and refer to other law firms and defendants. > The defendant acted on very good referrals. it is slow going digging into your gear; will report in a few weeks. as mentioned before, due to interdiction of shipment i don't expect much of interest. but never say never... best regards, dokermange; doing mah best to poke bears and burn vulns P.S. if you would like to participate in a weaponized-sploits-for-free program with coderman please provide a cell phone number and physical address in united states for delivery of honey tokens to trigger tips. not responsible for damaged or turned-malicious hardware in your vacinity or possession. special restrictions may apply. LIMITED TIME ONLY! #YOLO #RENDITIONCON #WTFBBQ

2 1

Fwd: [liberationtech] New Citizen Lab report
by coderman 17 Aug '14

17 Aug '14

---------- Forwarded message ---------- From: r.deibert(a)utoronto.ca Date: Fri, 15 Aug 2014 16:44:28 -0400 Subject: [liberationtech] New Citizen Lab report Dear LibTech I am pleased to announce a new Citizen Lab report published today, authored by Morgan Marquis-Boire and entitled "Schrodinger?s Cat Video and the Death of Clear-Text." The key findings are outlined below: ? Commercial network injection appliances are actively targeting Google?s YouTube and Microsoft?s Live services in order to install surveillance implants on targets across the globe. ? Documents indicate that a prototype for targeted surveillance network injection appliances sold to the governments of Oman and Turkmenistan was designed by CloudShield Technologies, a US Department of Defense contractor. ? This report reveals never before seen documentation on the operation of Network Injection appliances from both Hacking Team and FinFisher and provides source code for an early prototype of FinFisher?s FinFly ISP product. A link to the full report is here: https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/ The Washington Post has extensive coverage on the report, which can be found here: http://www.washingtonpost.com/blogs/the-switch/wp/2014/08/15/how-your-cat-v… Morgan Marquis-Boire has written an oped at The Intercept: https://firstlook.org/theintercept/2014/08/15/cat-video-hack/ Relatedly, my "Open Letter" on behalf of the Citizen Lab to Hacking Team was published last week: https://citizenlab.org/2014/08/open-letter-hacking-team/ Cheers Ron

2 1

Re: Re: [cryptography] Question About Best Practices for Personal File Encryption
by stef 16 Aug '14

16 Aug '14

On Sat, Aug 16, 2014 at 06:26:28PM -0500, Mark Thomas wrote: > Am I on the right track? If so does anyone know of a helpful guide to get started with OpenSSL on the command line besides the man pages? last time i checked openssl does no authenticated encryption on the command line. -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

1 0

Re: shipment interdiction [was: BadBIOS forensics]
by coderman 16 Aug '14

16 Aug '14

On Sat, Jul 19, 2014 at 5:20 PM, Bryan Starbuck <bryan(a)thestarbucks.com> wrote: > I like buying a computer in a surprise visit to an apple store or a store > that sells windows computers. agreed; on site ad-hoc cash purchases the best procurement technique. not infallible by any means, but at least avoids some known problems like this amusing scenario. (shipments from the Seattle Amazon warehouse to Kansas before delivery to Oregon was also funny.) repeat for emphasis: - keep chain of custody of sensitive hardware at all times - never procure or ship through mail. at one point, priority same day air would get a pass, but even this no longer suitable. best regards,

3 3

Interdiction of MIPS tablet
by bluelotus＠openmailbox.org 16 Aug '14

16 Aug '14

Last week, I purchased a MIPS tablet on ebay and a rooted Nooks Tablet with CyanogenMod. Nooks was shipped priority mail and arrived yesterday. Nooks tablet: http://www.ebay.com/itm/291214398900?_trksid=p2059210.m2749.l2649&ssPageNam… tracking info: https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=94055096999391405… MIPS tablet was shipped FedEx Smart Post. It was interdicted and being returned to shipper: MIPS tablet: http://www.ebay.com/itm/201145886170?_trksid=p2059210.m2749.l2649&ssPageNam… tracking info: https://www.fedex.com/fedextrack/html/index.html?tracknumbers=9797927122850… "Delivery exception" "Returning package to shipper. Incorrect address, unable to deliver - Returning package to shipper - Please contact shipper/merchant for details" I purchased a Nooks tablet solely because its OMAP4 CPU has mask ROM. http://www.reddit.com/r/Android/comments/2d8lni/mask_rom_prevents_bios_root… I purchased a MIPS tablet hoping BadBIOS doesn't infect MIPS and because MIPS hardware assisted virtualization is not as developed as ARM's Trustzone and Mobicore. I don't trust HAV. I wish local retailers sold them so I could have purchased them in person. I ordered a T5 Torx screwdriver to remove the screws in the Nook so I can air gap it. If the screws are glued, I will promptly sell or donate it. Another item that was apparently interdicted is media card reader. http://www.ebay.com/itm/281206663913?_trksid=p2059210.m2749.l2649&ssPageNam… I purchased it on 8/8/2014. Yet, post office does not give tracking information: https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=92748999964015553… Hackers have repeatedly stolen my media card readers, opened up and broken my media card readers and broke the write protection switch on three Digital Intelligence media card write blockers. They attempt to force me to use flashdrives. They haven't broken the write protection switch on my Kanguru flashblu write blocker. For some reason, flashdrives are easier to flash firmware or infect than micro SD cards.

2 2