September 2014 - cypherpunks - lists.cpunks.org

bashing your head against nation-state social engineering
by Troy Benjegerdes 28 Sep '14

28 Sep '14

the recent bash exploit seems to have all the hallmarks of a sophisticated nation-state attempt to insert backdoors into debian and lots of embedded devices. Any thoughts? How do you defend against an adversary that uses social engineering and psychology to convince developers to add a new feature to an 'essential' package that can then be exploited? To any of you in the NSA and NNSA with clearances, here's a question for you: how many US government systems have bash installed, and can your admins running the world's largest supercomputers run them without having a pre-loaded exploit train pre-installed? This is like the mother-of-all advanced persistent threats, so it would be a good idea to figure out a way for those of you might know, but can't publicly disclose to figure out how to let the rest of us know how to defend against this. Maybe DARPA will post some interesting new RFPs? -- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer(a)hozed.org 7 elements earth::water::air::fire::mind::spirit::soul grid.coop Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash

4 6

Torrent of Cryptome archive 2014-06-02 (22GB)
by ban＠unseen.is 27 Sep '14

27 Sep '14

https://thepiratebay.se/torrent/11113511/Cryptome_archive_2014-06-02 # Cryptome Archive from 2 June 2014 magnet:?xt=urn:btih:F5763EB5C5FFD8B40B9047CF72350D320A59BDAC&dn=cryptome-archive-2014-06-02&tr=udp%3a%2f%2ftracker.istole.it%3a80 https://zoink.it/torrent/F5763EB5C5FFD8B40B9047CF72350D320A59BDAC.torrent #Donate to John from Cryptome.org for collecting this files: http://www.cryptome.org/donations.htm #This is the Cryptome Archive as provided by coderman on a Tor hidden service: The three wikileaks files mentioned in the post are included in the USB-2.rar #Verify with GnuGPG: The files Update-13-1231.rar, USB-1.rar and USB-2.rar have a *.sig file which can be used to verify the files. That key 0xb650572b8b3bf75c is published on http://www.cryptome.org/#Cryptome%20PK and is available on keyservers like http://pgpkeys.eu:11371/pks/lookup?op=vindex&search=0xb650572b8b3bf75c #Torrent of old Cryptome Archive from 2011: https://thepiratebay.se/torrent/7919294/Cryptome_Archive_2011_Unverified magnet:?xt=urn:btih:ba401110a60ad844a09d4219e5f95a46385f7410&dn=Cryptome+Archive+2011+Unverified&tr=udp%3A%2F%2Ftracker.istole.it%3A80

1 0

Informing the user they have the wrong key
by Tony Arcieri 27 Sep '14

27 Sep '14

If we build fancy systems to detect things like misadvertised keys or MitM attacks, how can we reasonably inform an end user what is amiss in an actionable way that won't confuse them with too many false positives to avoid taking action when something bad actually happens? I recently went to SOUPS and saw a number of presentations on the general difficulty of communicating security-actionable information to users. From what I saw I'd say the problem is twofold: 1) How does the system provide a high confidence level that when it tries to communicate a security-actionable event, it's fairly certain it's not a false positive? False positives condition users to ignore security warnings 2) How do you express what's happening to the user in such a way that they will actually take action on it and not just click-through dismiss it? Given the wide-ranging number of scenarios, the answer will of course be contextual, and I'd be curious to hear any replies about how systems try to solve the "right key" user experience problem in general. That said, the messaging use-case (in conjunction with a "key directory" system) is particularly interesting to me. If an end-to-end encrypted messaging system which relies on a centrally-managed key directory (e.g. iMessage) were to by coersion or compromise publish a poison key to their directory to facilitate a MitM attack, but the system creators wanted to make such action obvious to their users, how can the systems reasonably detect and reflect this in such a way that such users aren't conditioned to ignore such alerts for routine events (e.g. the SSH "SOMETHING NASTY" message) and actually feel compelled to take action on that knowledge? And then what? How can we help someone who is a victim of an attack like this actually compile all of the necessary information for someone to figure out what actually happened? How can encryption tools compile incident reports that experts can scrutinize to determine what happened? -- Tony Arcieri

1 0

Re: GoldBug SF projects [was: Bittorrent Bleep]
by grarpamp 24 Sep '14

24 Sep '14

On Tue, Sep 23, 2014 at 4:50 PM, Dmitrij D. Czarkoff <czarkoff(a)gmail.com> wrote: > Hi! > >> Attn czarkoff: Background threads for reference in your wikipedia work >> https://cpunks.org/pipermail/cypherpunks/2014-September/thread.html >> https://cpunks.org/pipermail/cypherpunks/2014-September/005505.html >> >> keywords: goldbug messenger, firefloo communicator, lib spot-on, echo >> protocol, cassiopeia bitmail, dooble web browser, interface social >> network > > I am not sure how I can help here. In those threads and links following from the above are people showing that these 'goldbug' related projects have serious trust issues and may be some form of malware/crapware. Read the linked threads for more info. If you search around wikipedia for these projects and look at their edit, talk and contributor histories you can find their edit trails there. Bogus listings is their way of free advertising and luring gullible users to them. I don't know much about how these things are handled within wikipedia community. But I have seen articles that have 'Controversy' sections in them. So if I were an editor I'd add exactly such a controversy section to all the pages... that some people see big issues with these projects. And back it up with links out to these threads on the cpunks, gnupg, and tor lists. At least that way it's on wikipedia history for people to see. http://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/GoldBug_(softw… http://en.wikipedia.org/wiki/Draft:GoldBug_(software) http://en.wikipedia.org/wiki/GoldBug_(Instant_Messenger) http://en.wikipedia.org/wiki/Echo_(communications_protocol) Saw your arguments on the deletion page and figured you would like to be aware of these issues as well.

3 2

Where's a human-like randomizer?
by Douglas Lucas 23 Sep '14

23 Sep '14

I've an odd question. Is there a program that will generate passwords that imitate the badness with which humans armed with pen and paper only would generate randomness? No, not a program that spits out "password" over and over, that contemptible most frequently used password; I'm imagining an English speaker of above average intelligence who has some familiarity with best practices for coming up with passwords, but who's no mathematical crypto wizard or anything. Imagine a human who wants to generate an alphanumeric passphrase with both upper- and lowercase, and he's in a jail cell with just pen and paper. So he has a set of 62 characters to work with, and he tries to write out a truly random password. But maybe he puts "M" in the password too often for it to be truly random, because his name is Mario, so he thinks about "M" unusually often; or maybe his writing surface is shaped such that it incentivizes long downstrokes, so he pens the letter "l" too often for true randomness. Now, has anyone created a computer program to MIMIC what that human would come up with? Is such a thing possible? Obviously I could simply do it myself as a human being by, you know, qrMt8x3, but I want a program that will create that for an x-long, say, 80,000 character-long, string.

2 1

SENTER Sandman: Using Intel TXT to Attack BIOSes - request for slides / transcript
by coderman 23 Sep '14

23 Sep '14

anyone have details on: SENTER Sandman: Using Intel TXT to Attack BIOSes - http://2014.hack.lu/index.php/List#Xeno_Kovah.2C_Corey_Kallenberg.2C_John_B… """ At CanSecWest 2014 we presented the first prototype of Copernicus 2, a trustworthy BIOS capture system. It was undertaken specifically to combat our “Smite’em the Stealthy” PoC which can forge the BIOS collection results from all other systems (including our own Copernicus 1, the open source Flashrom, Intel Chipsec, etc). Copernicus 2 makes use of the open source Flicker project from Jon McCune of CMU which utilizes Intel Trusted Execution Technology in order to build a trustworthy environment from which to run our BIOS measurement code. We specifically chose TXT because it has the ability to disable System Management Interrupts (SMIs) effectively putting the SMM MitM, Smite’em, to sleep. But if you’ve been following our work (specifically “Defeating Signed BIOS Enforcement” and “Setup for Failure: Defeating UEFI SecureBoot”) you will have seen that we have two other attacks where we leverage the ability to suppress SMIs to break into some BIOSes. Thus the Sandman cometh! We will explain how we could implement the PoC Sandman attack using the same infrastructure as Copernicus 2. We will also explain what can be done against this kind of attack, and how the latest Copernicus 2 attempts to prevent opening the door to the Sandman. We will also cover how Copernicus 1 and 2 can check for the problems with BIOSes that make SMI-suppression attacks feasible, how to tell if you’re vulnerable, and what you may be able to do about it. """

1 0

RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
by coderman 22 Sep '14

22 Sep '14

first and foremost: WPA2 does NOT prevent an adversary able to inject packets at you from downgrading crypto to flawed RC4. due to odd forgotten legacy protocol bits, every implementation of WPA2 that i have tested is vulnerable to an active downgrade to TKIP/RC4 while still being "WPA2" and still showing all signs of using strongest security settings. let me re-iterate: _WPA2 only_ as a setting on router or client device does not prevent an active RC4 downgrade when using WPA2. AES-CCMP must be explicitly checked for, and this is not straightforward in end-user configuration or management utilities. RECOMMENDATION: use a wireless packet capture utility to specifically check for and alert on the presence of TKIP in a WPA2 session. this never happens under legitimate circumstances. [if you know of one, please tell me!] TKIP in WPA2 == Active injection attack by "well funded" adversary[0] --- i missed the renewed speculation that periodically swirls around RC4, e.g. "I feel but cannot prove that the day is coming when we learn that everything we ever encrypted with RC4 is very practical to decrypt" - https://twitter.com/marshray/status/505586082461655040 "Kind of annoyed SHA-1 is a "crypto emergency" when most of the web was encrypted with RC4 last year and almost no one cared" - https://twitter.com/bascule/status/509239990216163330 "This attack also applies directly to WPA/TKIP, with similar success rates, because of its use of per-packet keys for RC4. Here, the particular structure of WPA/TKIP keys means that a different set of biases are obtained in the first 256 bytes of RC4 keystream... For WPA/TKIP, the only reasonable countermeasure is to upgrade to WPA2." - http://www.isg.rhul.ac.uk/tls/ --- i have an advisory pending to full-disclosure with details on this WPA2 force downgrade to TKIP attack and a rant about Kaminsky's DEF CON 22 talk. advisory includes timeline indicating "in the wild" discovery of this technique late 2013. any earlier indications welcome! to be clear, this issue is with backwards compatibility in WPA2, and the manner in which a local attacker (8 miles or more with power and directional emission) can force the WPA2 protected session to use TKIP/RC4 while appearing to both client and network management equipment to be using WPA2 and best security configuration. (not WEP, not WPA) this is not about how RC4 is broken; i have no idea about the nature of the RC4 weaknesses enabling decryption, and this as yet unknown attack is certainly more effective than the attack described in CVE-2013-2566: "The attacks can only be carried out by a determined attacker who can generate sufficient sessions for the attacks. They recover a limited amount of plaintext. In this sense, the attacks do not pose a significant danger to ordinary users of TLS or WPA/TKIP in their current form. However, it is a truism that attacks only get better with time, and we anticipate significant further improvements to our attacks." the attacks observed in the wild did not rely on any additional or excessive packet creation to reach effectiveness. best regards, 0. About TKIP with WPA2... some tools know that TKIP is backwards compatible in WPA2, having written to spec. E.g. airodump-ng: "Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2." in my testing i have never seen a device that could do WPA2 but not AES-CCMP. if you find one i'd like to know about it! if you ever see a device+router pair that used to speak AES-CCMP over WPA2 suddenly using TKIP you are under active attack. finally, i mention "advanced attacker" because utilizing this downgrade also means applying an as yet unknown attack on the RC4 cipher to decrypt.

2 4

Re: [tor-talk] Article: Best Alternatives to Tor
by grarpamp 22 Sep '14

22 Sep '14

On Mon, Sep 22, 2014 at 7:45 AM, Colin Mahns <colinmahns(a)riseup.net> wrote: > I like how a couple of the alternatives to "Tor" in this article are > Tails and Whonix. What do they use for anonymity again? Oh yeah, Tor... > > They also list Disconnect and Tox as an alternative, and then quickly > say they aren't alternatives. I'd say this writer was hoping for clickbait. >>> http://www.idigitaltimes.com/best-alternatives-tor-12-programs-use-nsa-hack… As mostly a list of OS wrappers around things, the entries include the usual list of apps: Tor, I2P, Freenet, JonDo, Tox, Pond, etc. The list of OS wrappers is typical, but includes one unique entry... from US Air Force: Anti-Tamper - Software Protection Initiative: LPS - Lightweight Portable Security http://www.spi.dod.mil/lipose.htm There are some crypto tools and docs on the SPI site and you can even watch the SPI Show (in Letterman style)... http://spi.dod.mil/docs/Top_Ten_640x360.wmv

1 0

salty axolotl
by stef 22 Sep '14

22 Sep '14

you might like to use this, or you might want to improve on it, or enjoy ridiculing me for it and its bugs: axolotl ratched implemented with libsodium and scrypt (maybe the latter has been over-used a bit): https://github.com/stef/saxolotl -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

3 4

GoldBug SF projects [was: Bittorrent Bleep]
by grarpamp 22 Sep '14

22 Sep '14

1 1