August 2014 - cypherpunks - lists.cpunks.org

of possible interest
by dan＠geer.org 08 Aug '14

08 Aug '14

Given day before yesterday as this year's Black Hat keynote. Cybersecurity as Realpolitik http://geer.tinho.net/geer.blackhat.6viii14.txt While abuse is not sought, it is expected. ;-) --dan

1 0

Re: [tor-talk] Craigslist now blocking all Tor IPs? Template for anyone:
by grarpamp 08 Aug '14

08 Aug '14

On Thu, Aug 7, 2014 at 1:57 PM, Mirimir <mirimir(a)riseup.net> wrote: > Wrote BM-2cTjsegDfZQNGQWUQjSwro6jrWLC9B3MN3: >> The automated messages from Craiglist appear like this: >> This IP has been automatically blocked. If you have questions, please >> email: blocks-b1406984946068001(a)craigslist.org > Craigslist notoriously ignores such messages. ... yet they clearly and directly invite you to ask them about it. I quit believing Craigslist was honorable a long time ago. They are some kind of odd idealogues whose kind obviously doesn't include you. Will they ignore those of you who live in the Bay Area? Craigslist 1381 9th Ave / 222 Sutter St SF, CA, US As their user (perhaps even paying user), you certainly have customary ground to engage them in conversation. I wonder how they treat their paying customers? And what their fee structure is like? Or you could just deploy a better list/meme, steal their eyeballs and run them out of business. They suck pretty hard so there's lots of oppurtunity there. ps. They archive every single post, and likely every single image, email, and phone number... from inception... in perpetuity. Don't take my word, it's in their videos... a fucking privacy shame. In fact, at this very moment, they're probably fapping to your gerbil sex ad that you 'deleted' ten years ago. [Rant aside, people have a right to be forgotten, and those, like CL, who willfully disregard that right, without verbosely or obviously saying so in context (ie: mailing lists obviously have self-run, even public, archives... that you cannot 'delete'), ... need to be exposed.]

1 0

FinFisher hacked
by Eugen Leitl 07 Aug '14

07 Aug '14

http://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_international_leake… 40 GByte torrent https://netzpolitik.org/wp-upload/finfisher.torrent Moar: https://twitter.com/gammagrouppr https://github.com/FinFisher/FinFly-Web

6 5

Re: FinFisher hacked
by -John 06 Aug '14

06 Aug '14

On Aug 6, 2014 12:27 PM, rysiek <rysiek(a)hackerspace.pl> wrote: > > Dnia środa, 6 sierpnia 2014 18:03:47 Eugen Leitl pisze: > > http://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_international_leaked > > / > > > > 40 GByte torrent https://netzpolitik.org/wp-upload/finfisher.torrent > > > > Moar: https://twitter.com/gammagrouppr > > Whoa. > > > https://github.com/FinFisher/FinFly-Web > > GitHub taking this down in 3... 2... 1... > Github already did, but the torrent is everywhere already. > -- > Pozdr > rysiek

1 0

[tor-talk] Tor Weekly News — August 6th, 2014
by Eugen Leitl 06 Aug '14

06 Aug '14

----- Forwarded message from Lunar <lunar(a)torproject.org> ----- Date: Wed, 6 Aug 2014 14:00:57 +0200 From: Lunar <lunar(a)torproject.org> To: tor-news(a)lists.torproject.org, tor-talk(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — August 6th, 2014 Message-ID: <20140806120057.GB20092@loar> User-Agent: Mutt/1.5.23 (2014-03-12) Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News August 6th, 2014 ======================================================================== Welcome to the thirty-first issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community. Tor and the RELAY_EARLY traffic confirmation attack --------------------------------------------------- Roger Dingledine ended several months of concern and speculation in the Tor community with a security advisory posted to the tor-announce mailing list [1] and the Tor blog [2]. In it, he gave details of a five-month-long active attack on operators and users of Tor hidden services that involved a variant of the so-called “Sybil attack”: the attacker signed up “around 115 fast non-exit relays” (now removed from the Tor network), and configured them to inject a traffic header signal consisting of RELAY_EARLY cells to “tag” any hidden service descriptor requests received by malicious relays — a tag which could then be picked up by other bad nodes acting as entry guards [3], in the process identifying clients which requested information about a particular hidden service. The attack is suspected to be linked to a now-cancelled talk that was due to be delivered at the BlackHat security conference [4]. There have been several fruitful and positive research projects involving theoretical attacks on Tor’s security, but this was not among them. Not only were there problems with the process of responsible disclosure, but, as Roger wrote, “the attacker encoded the name of the hidden service in the injected signal (as opposed to, say, sending a random number and keeping a local list mapping random number to hidden service name)”, thereby “[putting] users at risk indefinitely into the future”. On the other hand, it is important to note that “while this particular variant of the traffic confirmation attack allows high-confidence and efficient correlation, the general class of passive (statistical) traffic confirmation attacks remains unsolved and would likely have worked just fine here”. In other words, the tagging mechanism used in this case is the innovation; the other element of the attack is a known weakness of low-latency anonymity systems, and defending against it is a much harder problem. “Users who operated or accessed hidden services from early February through July 4 should assume they were affected” and act accordingly; in the case of hidden service operators, this may mean changing the location of the service. Accompanying the advisory were two new releases for both the stable and alpha tor branches (0.2.4.23 and 0.2.5.6-alpha); both include a fix for the signal-injection issue that causes tor to drop circuits and give a warning if RELAY_EARLY cells are detected going in the wrong direction (towards the client), and both prepare the ground for clients to move to single entry guards (rather than sets of three) in the near future. Relay operators should be sure to upgrade; a point-release of the Tor Browser will offer the same fixes to ordinary users. Nusenu suggested [5] that relay operators regularly check their logs for the new warning, “even if the attack origin is not directly attributable from a relay’s point of view”. Be sure to read the full security advisory for a fuller explanation of the attack and its implications. [1]: https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html [2]: https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-… [3]: https://www.torproject.org/docs/faq#EntryGuards [4]: https://blog.torproject.org/blog/recent-black-hat-2014-talk-cancellation [5]: https://lists.torproject.org/pipermail/tor-relays/2014-August/005046.html Why is bad-relays a closed mailing list? ---------------------------------------- Damian Johnson and Philipp Winter have been working on improving the process of reporting bad relays [6]. The process starts by having users report odd behaviors to the bad-relays mailing list. Only a few trusted volunteers receive and review these reports. Nusenu started a discussion on tor-talk [7] advocating for more transparency. Nusenu argues that an open list would “likely get more confirm/can’t confirm feedback for a given badexit candidate”, and that it would allow worried users to act faster than operators of directory authorities. Despite being “usually on the side of transparency”, Roger Dingledine described [8] being “stuck” on the issue, “because the arms race is so lopsidedly against us”. Roger explains: “we can scan for whether exit relays handle certain websites poorly, but if the list that we scan for is public, then exit relays can mess with other websites and know they’ll get away with it. We can scan for incorrect behavior on various ports, but if the list of ports and the set of behavior we do is public, then again relays are free to mess with things we don’t look for.” A better future and more transparency probably lies in adaptive test systems run by multiple volunteer groups. Until they come to existence, as a small improvement, Philipp Winter wrote [9] it was probably safe to publish why relays were disabled, through “short sentence along the lines of ‘running HTTPS MitM’ or ‘running sslstrip’”. [6]: https://trac.torproject.org/projects/tor/wiki/doc/ReportingBadRelays [7]: https://lists.torproject.org/pipermail/tor-talk/2014-July/034198.html [8]: https://lists.torproject.org/pipermail/tor-talk/2014-July/034219.html [9]: https://lists.torproject.org/pipermail/tor-talk/2014-July/034216.html Monthly status reports for July 2014 ------------------------------------ Time for monthly reports from Tor project members. The July 2014 round was opened by Georg Koppen [10], followed by Philipp Winter [11], Sherief Alaa [12], Lunar [13], Nick Mathewson [14], Pearl Crescent [15], George Kadianakis [16], Matt Pagan [17], Isis Lovecruft [18], Griffin Boyce [19], Arthur Edelstein [20], and Karsten Loesing [21]. [10]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000598.html [11]: https://lists.torproject.org/pipermail/tor-reports/2014-July/000599.html [12]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000601.html [13]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000603.html [14]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000604.html [15]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000605.html [16]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000608.html [17]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000609.html [18]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000610.html [19]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000611.html [20]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000612.html [21]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000614.html Lunar reported on behalf of the help desk [22] and Mike Perry for the Tor Browser team [23]. [22]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000602.html [23]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000607.html Miscellaneous news ------------------ Anthony G. Basile announced a new release of tor-ramdisk, an i686 or x86_64 uClibc-based micro Linux distribution whose only purpose is to host a Tor server. Version 20140801 [24] updates Tor to version 0.2.4.23, and the kernel to 3.15.7 with Gentoo’s hardened patches. [24]: http://opensource.dyc.edu/pipermail/tor-ramdisk/2014-August/000132.html meejah has announced [25] a new command-line application. carml [26] is a versatile set of tools to “query and control a running Tor”. It can do things like “list and remove streams and circuits; monitor stream, circuit and address-map events; watch for any Tor event and print it (or many) out; monitor bandwidth; run any Tor control-protocol command; pipe through common Unix tools like grep, less, cut, etcetera; download TBB through Tor, with pinned certs and signature checking; and even spit out and run xplanet configs (with router/circuit markers)!” The application is written in Python and uses the txtorcon library [27]. meejah describes it as early-alpha and warns that it might contain “serious, anonymity-destroying bugs”. Watch out! [25]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007295.html [26]: https://github.com/meejah/carml [27]: https://txtorcon.readthedocs.org/ Only two weeks left for the Google Summer of Code students, and the last round of reports but one: Juha Nurmi on the ahmia.fi project [28], Marc Juarez on website fingerprinting defenses [29], Amogh Pradeep on Orbot and Orfox improvements [30], Zack Mullaly on the HTTPS Everywhere secure ruleset update mechanism [31], Israel Leiva on the GetTor revamp [32], Quinn Jarrell on the pluggable transport combiner [33], Daniel Martí on incremental updates to consensus documents [34], Noah Rahman on Stegotorus enhancements [35], and Sreenatha Bhatlapenumarthi on the Tor Weather rewrite [36]. [28]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000600.html [29]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000606.html [30]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007282.html [31]: https://lists.eff.org/pipermail/https-everywhere/2014-August/002199.html [32]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007284.html [33]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007285.html [34]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007287.html [35]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007288.html [36]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007293.html The Tails team is looking for testers to solve a possible incompatibility in one of the recommended installation procedures. If you have a running Tails system, a spare USB stick and some time, please help [37]. Don’t miss the recommended command-line options [38]! [37]: https://mailman.boum.org/pipermail/tails-testers/2014-July/000059.html [38]: https://mailman.boum.org/pipermail/tails-testers/2014-July/000060.html The Citizen Lab Summer Institute [39] took place at the University of Toronto from July 28 to 31. The event brought together policy and technology researchers who focus on Internet censorship and measurement. A lot of great work was presented including but not limited to a proposal to measure the chilling effect, ongoing work to deploy Telex [40], and several projects to measure censorship in different countries. Some Tor-related work was also presented: Researchers are working on understanding how the Tor network is used for political purposes. Another project makes use of TCP/IP side channels to measure the reachability of Tor relays from within China [41]. [39]: https://citizenlab.org/summerinstitute/2014.html [40]: http://freehaven.net/anonbib/cache/usenix11-telex.pdf [41]: https://arxiv.org/pdf/1312.5739.pdf The Electronic Frontier Foundation wrote two blog posts to show why Tor is important for universities and how universities can help the Tor network. The first part [42] explains why Tor matters, gives several examples of universities already contributing to the Tor network, and outlines a few reasons for hosting new Tor nodes. The second part [43] gives actual tips on where to start, and how to do it best. [42]: https://www.eff.org/deeplinks/2014/08/tor-campus-part-i-its-been-done-and-s… [43]: https://www.eff.org/deeplinks/2014/08/tor-campus-part-ii-icebreakers-and-ri… Tor help desk roundup --------------------- Users occasionally ask if there is any way to set Tor Browser as the default browser on their system. Currently this is not possible, although it may be possible in a future Tor Browser release [44]. In the mean time, Tails provides another way to prevent accidentally opening hyperlinks in a non-Tor browser. [44]: https://bugs.torproject.org/12763 Easy development tasks to get involved with ------------------------------------------- Tor Launcher is the Tor controller shipped with Tor Browser written in JavaScript. Starting with Firefox 14 the “nsILocalFile” interface has been deprecated and replaced with the “nsIFile” interface [45]. What we should do is replace all instances of “nsILocalFile” with “nsIFile” and see if anything else needs fixing to make Tor Launcher still work as expected. If you know a little bit about Firefox extensions and want to give this a try, clone the repository [46], make the necessary changes, run “make package”, and tell us whether something broke in interesting ways. [45]: https://bugs.torproject.org/10573 [46]: https://gitweb.torproject.org/tor-launcher.git Upcoming events --------------- Aug. 6 19:00 UTC | little-t tor development meeting | #tor-dev, irc.oftc.net | Aug. 11 18:00 UTC | Tor Browser online meeting | #tor-dev, irc.oftc.net | https://lists.torproject.org/pipermail/tbb-dev/2014-August/000100.html | August 18 | Roger @ FOCI ’14 | San Diego, California, USA | https://www.usenix.org/conference/foci14 | August 20-22 | Roger @ USENIX Security Symposium ’14 | San Diego, California, USA | https://www.usenix.org/conference/usenixsecurity14 This issue of Tor Weekly News has been assembled by Lunar, harmony, Matt Pagan, Philipp Winter, David Fifield, Karsten Loesing, and Roger Dingledine. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [47], write down your name and subscribe to the team mailing list [48] if you want to get involved! [47]: https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [48]: https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message -----

1 0

NGA's "Map of the World"
by Gregory Foster 06 Aug '14

06 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Defense Systems (Aug 4) - "NGA awards $335 million contract [to BAE Systems] for Map of the World project": http://defensesystems.com/Articles/2014/08/04/NGA-contract-BAE-Map-of-the-W… > [The National Geospatial Agency (NGA)] awarded BAE a contract worth > a maximum of $335 million for help in developing the collection, > maintenance and utilization of geospatial intelligence data and > products. The MoW project is expected to serve as the backbone for > the agency’s intelligence analysis and collection efforts, and > represents the agency’s move from static maps to dynamic ones. > > Expected to be finished by 2020, the project would eventually allow > NGA’s partners and customers to visualize and access integrated > intelligence information relative to geographic features of the > planet, according to a strategy document released by the agency. It's no surprise that BAE Systems won the $0.335B contract as they seem to lead the defense contractor pack in honing the practice of Activity Based Intelligence (ABI), previously called Pattern of Life Analysis. http://www.baesystems.com/article/BAES_162827/inside-activity-based-intelli… NSA is one of NGA's clients, and this project will solve their desire to visualize the physical infrastructure of the Internet in realtime. Here's an interview with former NGA Director Letitia Long, whom I believe initiated the project. Federal Computer Week (Apr 15) - "Long: NGA is moving toward 'immersive intelligence'": http://fcw.com/articles/2014/04/15/nga-moving-toward-immersive-intelligence… gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJT4ij8AAoJEMaAACmjGtgjcegP/1luWz8bWBt+KviBZD0PUPbT S+lj0bPjEsXURFGbn/Tr/Hr2Ls3C6XDBHMAINKp992cmDsKd4l2bHGb5ukbSPX4i Ln1Vbouv1EK1yao3uG6KOPnwFhywbfanz1tq4pPwgr5Zot6flUDGCpbnJh7PaBRu AbCNk7aUxM1GO/eH4tk7OMUSGc6WMsvbh2eQGM5equyWdYJf7/ZH6yAr2PxqtbIe uePlnjPd7yMkqKi3f4aUz7MscfOQAaMOHAr/WK3/QRsS/AZO0tqsiNbeVkL3rQ79 qcJ1MQTxY5CdWVOlNxuGmKXf8S0kHvJueOQIAaKbK7vSiYKD1kuSegpkRX+3DG3N r0mJCCHCgpG0Iv9xSzskQ7u0rzMcZWzKt+U82UEU0ONdU9LhZlFrjzzxWXIvkJfP VYqiupo5L+QuZbIn6Lav5yhII6vSjvHJCH9i3Lfn/L36NJDe73U9zmXmmB9MQ8QB MJWpdK8MZbdmzQAxxGWyGldefDz6VPeB/yiPgPQsBouvMEd/yaitCiCF/eQQl2us o6wbsDjoKMoCpBJvvq+Mz9FU+w661vBJ4DQuYywtyTXHPWzuqM5uYvKgjP/KJ6In fhK1hLU9seJMRkHKyUDtU5GMq0PLWbJw09zlWMOlDV1U+9jDtgkHTFJc3O9gjiTE 83i/TewTenQ8rvy14Fgm =E6e5 -----END PGP SIGNATURE-----

1 0

lowRISC -- fully open hardware systems
by Eugen Leitl 06 Aug '14

06 Aug '14

http://www.lowrisc.org/ lowRISC Open to the core lowRISC is producing fully open hardware systems. From the processor core to the development board, our goal is to create a completely open computing eco-system. Our open-source SoC (System-on-a-Chip) designs will be based on the 64-bit RISC-V instruction set architecture. Volume silicon manufacture is planned as is a low-cost development board. lowRISC is a not-for-profit organisation working closely with the University of Cambridge and the open-source community. To keep track of the project, follow @lowRISC or join our announcements list by entering your email below: Submit The Team Robert Mullins - Computer Laboratory, University of Cambridge, co-founder of Raspberry Pi Gavin Ferris - Dreamworks, Radioscape (co-founder), Aspect Capital (former CIO) Alex Bradbury - Computer Laboratory, University of Cambridge and Raspberry Pi Technical Advisory Board Krste Asanovic (UC Berkeley) Julius Baxter (OpenRISC) Bunnie Huang (Hacker) Michael Taylor (UCSD) Careers We are currently hiring. Two new positions are available at the Computer Laboratory, University of Cambridge. Contact us at info(a)lowrisc.org

1 0

Re: [Cryptography] You can't trust any of your hardware
by Eugen Leitl 05 Aug '14

05 Aug '14

----- Forwarded message from ianG <iang(a)iang.org> ----- Date: Mon, 04 Aug 2014 11:31:39 +0100 From: ianG <iang(a)iang.org> To: cryptography(a)metzdowd.com Cc: Jerry Leichter <leichter(a)lrw.com> Subject: Re: [Cryptography] You can't trust any of your hardware Message-ID: <53DF610B.6080601(a)iang.org> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 On 4/08/2014 03:28 am, Jerry Leichter wrote: > On Aug 2, 2014, at 8:54 PM, Nemo <nemo(a)self-evident.org> wrote: >>> How many USB devices have ever been patched after sale? ... > There are few sharp lines here, but there is a very broad, very heavily populated, set of "USB devices" that we commonly look at as having fixed functions based on code that will never be changed. USB memory sticks are extremely cheap and produced in the hundreds of millions. No one thinks of them as active devices. And yet ... they are. They contain significant processing power running non-trivial code - and that code can be replaced. That's the big message here. Yes, obvious in retrospect - but how much have *you* thought about defenses against legitimate memory sticks from major manufactures that have had their standard firmware replaced with attack code? In CAcert we used the USB memory sticks for sneaker-packets in key-signing ceremonys, and for later escrow. We use 2 for each. They are to be purchased at a random retail street store on the day. Those not escrowed are destroyed afterwards. We might need to rethink the approach, perhaps with open source designs? iang _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

1 0

Russian League for Internet Safety propose "pre-filtration of the Internet"
by Anton Nesterov 05 Aug '14

05 Aug '14

League for Internet Safety want "two-level filtration of the Internet" — by blacklists (what already works in Russia) and by content analysis system which can block a website if the content is prohibited by law. "We propose an Internet filtration system, which can automatically in real-time determine content of the webpage requested by the user", — said Denis Davidov, head of league. "The system evaluate content of webpage and determine a category to which that information relates. If the category if forbidden, the system automatically blocks a webpage." League for Internet Safety is a lobbyist organization for Internet censorship. First censorship law, https://en.wikipedia.org/wiki/Internet_Restriction_Bill , is their work. http://roem.ru/2014/08/05/addednews104613 (in Russian)

1 0

Re: Update your Tors - Tor security advisory: "relay early" traffic confirmation attack
by James York 05 Aug '14

05 Aug '14

On 2014-08-04 15:33, Cathal Garvey wrote: > A less controversial reading of the (US Govt Money) >>= Tor "thing" is that, while the Tor devs may be doing their best, Tor is ultimately an asset to the US Intelligence apparatus rather than a liability. The missing context here is that the NSA runs its own anonymity networks because it doesn't trust community-run infrastructure. Some things are useful to the intelligence community. Like phones. And cars. And the Internet. Why disregard a technology just because it might be used by spies?

2 1