January 2015 - cypherpunks - lists.cpunks.org

Re: [liberationtech] The Future of Security Journalism
by coderman 30 Jan '15

30 Jan '15

On 1/29/15, J.M. Porup <jm(a)porup.com> wrote: > ... If we don't wish to be serfs in the new feudal, digital > world, we need to re-disrupt the disruption, and invent new tools that > ensure human liberty and dignity. ... that time > is short, and the New Dark Age is nearly upon us. as one who is always fond of the question, "what's your threat model?" the implication appears to be two fold: 1. good security journalism, aka "activist journalism", begs forth selective and retributive prosecution through open-ended legislation (CFAA, et. al.) as cover. 2. technical sophistication pursuing these prosecutions is now, thanks to the cyber-industrial-complex, at a point where law enforcement uses techniques recently considered nation state intelligence caliber. thus to pursue "activist security journalism" that is not powers that be sanctioned "mainstream security regurgitation" journalism, your threat model is: securing yourself and your sources against nation state dragnet and targeted attacks, including tailored access and special collection. this is currently considered a "Hard Problem" (TM)(R) even with decades dedicated to the challenge. i do take hope in the fact that most earth humans are not coding to hard problems, but instead to easy, well paying ones. perhaps different incentives will play a bigger role for security?

1 0

Bill Gates is worried about artificial intelligence too
by Georgi Guninski 30 Jan '15

30 Jan '15

http://www.cnet.com/news/bill-gates-is-worried-about-artificial-intelligenc… Microsoft's co-founder and former CEO is the latest luminary from the world of technology and science to warn against the threat of smart machines. ===== My comments: I am worried about _any_ device using anything from M$. So if Gates (who has unorthodoxal opinion about complexity of factoring PRIMES) is _really_ worried about this, he MUST freeze all AI projects at M$. This reminds me of the quote: --- ``It would be fun some day, Turing, to listen to a discussion, say on the Fourth Programme, between two machines on why human beings think that they think! '' --Sir Geoffrey Jefferson (in: `Can Automatic Calculating Machines Be Said to Think?', by M.H.A. Newman et al., a BBC broadcast recorded 10 Jan. 1952, Turing Archives, reprinted in ch. 7 of `The Turing Test', S. Shieber, ed., MIT Press, 2004.) --- http://www.math.rutgers.edu/~zeilberg/quotes.html

1 0

Why Google made the NSA
by John Young 30 Jan '15

30 Jan '15

https://medium.com/@NafeezAhmed/why-google-made-the-nsa-2a80584c9c1 Part 2 of the Google TLA allegations.

2 1

What if GHOST was/is exploitable on sshd/openssl? ;)
by Georgi Guninski 29 Jan '15

29 Jan '15

Overflow in libc: http://www.theregister.co.uk/2015/01/28/ghost_linux_megavuln_analysis/ Allegedly exploitable on exim. Question to those who feared Hearth Bleed: If GHOST were slightly worse giving exploit on openssl, would it have been worse than HB? :P

2 1

Does Cypherpunk need a Church?
by grarpamp 29 Jan '15

29 Jan '15

Does Cypherpunk need a Church? If so, what should it look like? Who are its priests? What are its idols? What happens to alms? For whom is its mission? How does it go about things and/or serve its people in the famliar (or unfamiliar) ways of other churches? Is it purely internal or does it have political or other external elements? Etc... https://en.wikipedia.org/wiki/Missionary_Church_of_Kopimism https://en.wikipedia.org/wiki/Jediism https://en.wikipedia.org/wiki/Anonymous_(group) https://en.wikipedia.org/wiki/Raelism https://en.wikipedia.org/wiki/Religious_organization https://en.wikipedia.org/wiki/Classifications_of_religious_movements https://en.wikipedia.org/wiki/New_religious_movement https://en.wikipedia.org/wiki/List_of_new_religious_movements

14 27

Re: Barrett Brown precedent
by coderman 28 Jan '15

28 Jan '15

On 1/27/15, Cari Machet <carimachet(a)gmail.com> wrote: > Has this fucking list ever heard of barrett or... my two favorite take-aways from the BB sentencing farce: 1. idling in IRC is consent for all activity there, and carries legal culpability. (!!!) 2. reposting links from IRC is conspiracy, and adds aggravating factors to your crimes. (!!!) tried estimating my life sentences for #nottor on oftc but stopped counting after a dozen...

1 0

SilentCircle fail
by rysiek 28 Jan '15

28 Jan '15

So, this: http://blog.azimuthsecurity.com/2015/01/blackpwn-blackphone-silenttext-type… ------------------------ While exploring my recently purchased BlackPhone, I discovered that the messaging application contains a serious memory corruption vulnerability that can be triggered remotely by an attacker. If exploited successfully, this flaw could be used to gain remote arbitrary code execution on the target's handset. The code run by the attacker will have the privileges of the messaging application, which is a standard Android application with some additional privileges. Specifically, it is possible to: decrypt messages / commandeer SilentCircle account gather location information read contacts write to external storage run additional code of the attacker's choosing (such as a privilege escalation exploit aimed at gaining root or kernel-mode access, thus taking complete control of the phone) The only knowledge required by the attacker is the target's Silent Circle ID or phone number - the target does not need to be lured in to contacting the attacker (although the flaw is exploitable in this scenario as well). (...) By resetting the jctx->msg->msgType field with the "dh2" attribute at the end of the message, a type confusion vulnerability will occur where the seq fields supplied in the "data" message will be incorrectly interpreted as the pk field - a raw memory pointer. (In this case, the low two bytes have been set to 0x8080.) Note that by utilizing messages other than "data", we could arbitrarily modify the entire pointer (and the pkLen field, indicating how much data pk points to). Assuming that we are at the correct phase of protocol negotiation, sending this message results in the following crash: ]Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1), thread 17201 (com.silentcircl) I/DEBUG ( 9735): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 9735): Revision: '0' I/DEBUG ( 9735): pid: 15611, tid: 17201, name: com.silentcircl >>> com.silentcircle.silenttext <<< I/DEBUG ( 9735): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad I/DEBUG ( 9735): Abort message: 'invalid address or address of corrupt block 0x601b8078 passed to dlfree' (...) ....a raw memory pointer.... ....a raw memory pointer.... ....a raw memory pointer.... ....a raw memory pointer.... -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Re: [Cryptography] traffic analysis -> let's write an RFC?
by Eugen Leitl 28 Jan '15

28 Jan '15

----- Forwarded message from joe <joe(a)stsauver.com> ----- Date: Tue, 27 Jan 2015 22:37:18 -0500 (EST) From: joe <joe(a)stsauver.com> To: Stephen Farrell <stephen.farrell(a)cs.tcd.ie> Cc: Jerry Leichter <leichter(a)lrw.com>, Cryptography <cryptography(a)metzdowd.com>, Ben Laurie <benl(a)google.com>, John Gilmore <gnu(a)toad.com>, grarpamp <grarpamp(a)gmail.com> Subject: Re: [Cryptography] traffic analysis -> let's write an RFC? Message-ID: <alpine.BSO.2.11.1501272155210.19906(a)stsauver.com> User-Agent: Alpine 2.11 (BSO 23 2013-08-11) Hi, Stephen Farrell commented: > I think that traffic analysis mitigation is the next big area > we need to start trying hard to work. So far, we've (IETF) > gotten general padding capabilities added to protocols (HTTP/2.0 > for example, still in discussion for TLS1.3) on a case by > case basis, but we've not yet done anything systematic. I'd > love to see a WG chartered to try figure out how to most > effectively counter traffic analysis and then go write > protocol and/or BCPs as needed. While it's possible to talk about some fairly sophisticated anti-traffic analysis strategies, I believe the low hanging fruit for traffic analysis-resistance at the ISP level will likely involve a fairly simple (if ugly) recipe: -- Use crypto at L1 (e.g., optical transport crypto) and/or L2 (e.g., MACsec) to get what opacity you can there -- Use IPv4 with NAT/PAT (with many customer identiies comingled on each public IP; yes, I know that this is awful from an end-to-end transparency POV) -- Combine that with "short" IPv4 DHCP lease times -- Strive for minimal log retention (in reality, given the potential impact of preservation requests, there may need to be NO logging, and yes, that will be pretty bad when considered from an anti-abuse POV) Note: this assumes that non-logging is permitted by law where employed. To the best of my knowledge, there is no required log retention in the United States, and the European Data Retention Directive also got the chop from the European Court of Justice, see for example http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.… (however, as always, this is not legal advice and anyone contemplating this approach should consult their own counsel in picking a strategy) That's my bet for the Internet side, sort of a lightweight/first step for anti-traffic analysis, kin to the lightweight/first step protection that opportunistic encryption provides for SMTP traffic. Obviously this isn't a total solution, but it's a start. [Shame that bulk domestic collection of metadata makes it necessary to even talk about this sort of thing...] Oh yes: what about the cellular side? Let's not forget it, too. The best you may be able to get as an anti-traffic analysis strategy on the phone side may be to use frequently-replaced and infrequently- used simple prepaid cell phones purchased for cash (but note that an increasing number of countries do not even allow purchase and use of unregistered cell phones). Naturally, batteries must be out of cellular devices when the devices aren't actively in use. Yes, this is all a big pain. (But the whole metadata/traffic analysis issue is very difficult to definitively handle without at least some inconvenience, I think.) Regards, Joe St Sauver (joe(a)stsauver.com) https://www.stsauver.com/joe/ Disclaimer: all opinions strictly my own _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

1 0

Barrett Brown
by Cari Machet 28 Jan '15

28 Jan '15

Has this fucking list ever heard of barrett or like you're way too fucking parasiticly capitalistic and more interested in using your profound talents to dox workers on this list and press meaningless repetative buttons on a dirty keyboard and stare than actually functioning as a life form?

5 5

AWO text available
by brian carroll 28 Jan '15

28 Jan '15

Apple Watch Observations. 123pp, btc ---------------------------------------------------------------------- no copyright. redistribution & mirroring ok (see disclaimer) web-version: https://appleobservations.wordpress.com pdf-version: http://tinyurl.com/AWO-final-01-25-15 Critique of the Apple Watch concept in a good-bad-&-ugly scenario, accounting for app mania & the "apps apps apps" mantra preceding creation of the App Watch, standing in for the watch of the future. Thus proprietary apps, OS & ecosystem approach as a conceptual and ideological limit, though also in a context of hidden politics, exploitation of technology and rapidly developing police state. In this way dual-use blackbox devices, antagonistic electronics operating with competing value systems, human and antihuman, truth absent within computer data models, no structural basis for knowledge, the bit itself becomes 'the sign of truth', where $=bit (on=money, off=no-money) in terms of evaluating data, leading to slavery dynamics, censoring data by denying access via authoritarian control over culture, on behalf of tyrannical power politics of Big Daddy as state oppressor, not Big Brother. In this way - as an optimistic view - establishing new rights to data access via wearable technology, micro-data & -payments in surrounding pervasive wireless infrastructure, beyond the detached aristocratic mindset of Silicon Valley utopianism, developing tools for humanity, to support & secure freedom. /note: the gist for cypherpunks & crypto could involve an otherwise off-the-books threat model & related security issues in a real-world non-politically-correct analysis conveyed via plainspoken viewpoint/. 0.1 unveiling, cognitive dissonance, counterpoint, time = $$$ 1.1 device name, seitiroirp, technocracy, culture & fitness profiles 1.2 watch of the future, Achilles heel, risk and reward, App Watch 1.3 timing, SoC as movement, GPS, XU, OS-determinism, sans AI 1.4 apps, middle-mgmt, ecosystem, ideology, iPhone, autonomy 2.1 aesthetics, inside/outside, gap, data-model, utility & futility 2.2 moonshot, wrist computer, security threat, proprietization 3.1 consumerism, QC and QA, revolution, ideas and processing 3.2 calligraphy v. helveticization, interface as facade, core-rot 3.3 forced perspective, junk|joke, mirroring, mundanity of evil 4.1 watches {mechanical, electronic, computer} w/A&D display 4.2 lessons unlearned, display-battery issues, value, economy 4.3 snsrs, smartwatch {digital watch}; set {subset}, subset {set} 4.4 the heart, biorhythmic movement, fitness, ID maze, dystopia 4.5 jumping spider, true innovation, seed, wristwatch data orrery 4.6 aesthetic substance, 1984, inhuman technology, Dark Ages 2.0 5.1 space-time-place device, brain|mind, consciousness, AI, QvA 5.2 time signals, delay, accuracy, GPS & atomic clocks, Project Apollo 5.3 context+sensors+datalogging+networking < user case studies 6.1 malproduction, surveillance, antagonistic electronics, crazy ones 6.2 more: dual-use, weaponization, unreality, hidden politics, errors 6.3 blackbox, eg. flashdrive, A/B, corruption, NSA, police state, trap 6.4 control. transparency, covert infrastructure, Taylorism, insecurity 6.5 flds+sgnls, diagnostics, forbidden fruit, Abuse, sexuality & power 6.6 fear, donuts, aristocracy, slavery, OS plantation, clockwork-apple 6.7 fortune telling, $=bit, wysinwyg, invisible states, watching spies 6.8 ideals, Big Daddy, neg.dev, IoT, bubble, conceptual shareholders 7.1 data infrastructure, the grid, 1950s, security, public-private.dev 7.2 lifespan, jewelry.ext, adaptive+assistive, mission, snake eyes 7.3 hybrid [touch'e, hands]. OS highway & App store, data.access 7.4 variation, design styling, extroversion, net.watch, tiers, gold 7.5 radar, wi-fi infrastructure, micro-data development, freedom 7.6 direction, cultural RD&D, calculator v. computer, human future xtre: proposal for public email list to discuss & debate ideas... It is wondered if anyone would be interested in establishing an email discussion list related to general AWO themes as a beginning point for any such artifact/infrastructure/system issues, observations or analyses as the general framework. A proposed list name, 'net.watch-list', is keyed from the text, simultaneously referencing a potential Wi-Fi based wristwatch with public access to pervasive data services, though also the reality of being watched in surveillance-based global society, as this also relates to watching the watchers, everyone an eye as observations empirically correlate, find ground or fail to unify as this increases isolation, alienation, silence, self-censoring. The main concern with an open discussion (whether public or private) is institutional and-or legal support or backing to limit internal/external subversion or interference with list operation so that people can feel safe communicating in "free society." My vote would be for a public list connected to a University, where a lot of people are discussing the same realm of ideas, not limited of course to AWO or authorial perspective, though involving dynamics mentioned, hypotheses, many viewpoints. Any feedback or ideas on this appreciated. ~cc.nettime-l electromagnetize(a)gmail.com {The Internet Emporium}: related project http://internetemporium.wordpress.com/

1 0