October 2015 - cypherpunks - lists.cpunks.org

high stakes games :)
by coderman 12 Oct '15

12 Oct '15

"A perfect example of the perils faced by researchers was provided in a separate talk at Virus Bulletin by Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team. Raiu revealed that when he was involved in the analysis of Stuxnet a few years ago, someone broke into his house and left a rubber cube with the message “take a break” written on it." --- http://www.securityweek.com/long-term-strategy-needed-when-analyzing-apts-r… Long-Term Strategy Needed When Analyzing APTs: Researcher By Eduard Kovacs on October 07, 2015 Analyzing advanced persistent threats (APTs) is not just about collecting pieces of information, and companies that focus on APTs should accept the fact that they have become intelligence brokers. In a presentation last week at the Virus Bulletin conference in Prague, Juan Andres Guerrero-Saade, senior security researcher in Kaspersky Lab’s Global Research and Analysis Team, detailed the ethics and perils associated with APT research. Cyberattacks sponsored by nation states are increasingly investigated by both startups and well-established security companies. However, it appears that many firms involved in researching APTs lack long-term strategy and they’ve failed to consider the repercussions of their work. According to Guerrero-Saade, one of the main issues is that companies and researchers have failed to understand that cyberespionage is a part of classic espionage, and those analyzing such cyber operations have failed to accept their role as intelligence brokers. Intelligence agencies and private security firms involved in the analysis of cyber espionage campaigns follow similar procedural methodologies, but there are some noteworthy differences. In the case of intelligence agencies, they receive a request, they gather information, analyze it, and deliver it. But before delivering it, the resulting report is taken through a strategic filtering process that ensures the well-being of all involved parties. On the other hand, threat intelligence teams don’t necessarily need a delimiting request in order to begin analyzing a threat actor’s activities -- an investigation can start from a decontextualized sample or a vague request for incident response. Researchers collect malware samples, indicators of compromise, and data on command and control (C&C) infrastructure, but their analysis is oversimplified, their strategy for release of the information is often deferred to PR or sales departments. The resulting reports, which might not contain any actionable intelligence, are often released to the public in an effort to attract new customers and boost the company’s reputation, but without taking into account the potential consequences, Guerrero-Saade said. While intelligence agencies and security researchers follow similar procedural methodologies, there are major differences in the ethics and especially the perils they face. The Kaspersky Lab expert has pointed out that the activities of intelligence agencies are not considered suspicious by other governmental institutions, the employees of intelligence agencies enjoy legal protections, and their work is shielded from political blowback. In the case of threat intelligence teams, however, researchers don’t benefit from any cover for their actions, they don’t enjoy any legal protections, and the companies they work for can also suffer due to their actions. According to Guerrero-Saade, the list of perils faced by researchers includes subtle pressure, patriotic enlistment, bribery, compromise and blackmail, legal repercussions, threat to livelihood, threat to viability of life in the actor’s area of influence, threat of force, and even elimination. A perfect example of the perils faced by researchers was provided in a separate talk at Virus Bulletin by Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team. Raiu revealed that when he was involved in the analysis of Stuxnet a few years ago, someone broke into his house and left a rubber cube with the message “take a break” written on it. In the case of companies, they can face political, financial and regulatory repercussions, they can end up losing government contracts and partnerships, and they can become the target of rumors and smear campaigns if they don’t properly evaluate what they disclose and whom they disclose to. As for ethical concerns, the lack of malware diversification -- the fact that the same malware is used against both extremists and less “malicious” targets such as research institutions -- can cause researchers to question whether or not they should detect the malware. More precisely, if the malware is used against a legitimate organization, then it should be detected to protect such entities. On the other hand, if the malware is detected, it will also make it easier for extremists to protect themselves against cyber spying attempts. Another ethical issue is related to the fact that the researcher’s insight into the operation they are targeting is always superficial. At first glance, it might appear that the targeted entity is “innocent,” such as an academic or a journalist, but in reality they could be a radical academic or a terrorism-facilitating journalist. Guerrero-Saade told SecurityWeek in an interview that threat actors can plant false evidence to throw investigators off track -- these are known as “black flag” operations. One good example is the group known as “Wild Neutron” or “Morpho,” whose malware contains strings in both Russian and Romanian. Guerrero-Saade believes that the best way for threat intelligence teams to overcome the challenges is to accept their role as intelligence brokers and put more emphasis on strategy. The expert believes companies should hire a chief strategic officer or someone who is in charge of making decisions related to who gets what information, instead of leaving the task to PR and marketing departments. Companies should also focus on providing actionable intelligence. One negative example named by the researcher during his presentation at Virus Bulletin is a recent report from ThreatConnect and Defense Group that focuses on linking the APT group known as “Naikon” to a unit of the Chinese People’s Liberation Army. The problem, according to Guerrero-Saade, is that the connection made by researchers in the report focuses on the analysis of an alleged PLA officer’s personal postings on social media and provides little actionable intelligence. The Kaspersky researcher told SecurityWeek that this is equivalent to “doxing” someone you don’t like, just like members of the Anonymous hacktivist movement do when they get uncomfortable with another member. “The current threat intelligence market is in the midst of an identity crisis. As companies transition from plain IT security to intelligence production, the relevant methodology of intelligence brokerage must be embraced in order to stand a chance against the supernatural market tensions that are the product of meddling with the operations of diverse intelligence agencies and enraging their respective governments,” Guerrero-Saade said in a paper accompanying his presentation at Virus Bulletin. “The transition to intelligence brokerage proper is encouraged as a means of survival for threat intelligence producers facing escalating geopolitical tensions. By empowering the producers to strategically control their offerings, these tensions are relieved or entirely sidestepped and the market can flourish away from the limelight,” the expert added. The complete paper, titled "The ethics and perils of APT research: an unexpected transition into intelligence brokerage," is available for download from Kaspersky Lab.

2 2

Re: [cryptome] Re: [cryptome]
by Shelley 12 Oct '15

12 Oct '15

On October 12, 2015 4:09:39 AM Michael Best <themikebest(a)gmail.com> wrote: > This is weird, right? I feel like I'm in Zoolander, "taking crazy pills" I > didn't ask the list the right way but JYA lying/accusing gets nothing? Resistance is futile! It's far better to just walk away from an argument with Cari than to feel like you're losing your sanity. You'll never "win" or get your point across clearly, no matter how many times you repeat it. Her lack of punctuation and logic hurts my brain, please make it stop! -S > > On Mon, Oct 12, 2015 at 1:37 AM, Cari Machet <carimachet(a)gmail.com> wrote: > > > No i am talking about this list - this list is a community > > > > You did not ask this list for help that i can see ... prove me wrong > > > > You are saying jy did not admit ... you complain about it yet accept no > > critique of said by you > > > > Have a think about it go for a walk rest take a few days and get back to > > me after > > On Oct 11, 2015 7:38 PM, "Michael Best" <themikebest(a)gmail.com> wrote: > > > >> *Cari Machet* carimachet(a)gmail.com > >>> > >>> > <carimachet%40gmail.com?Subject=Re%3A%20%5Bcryptome%5D%20Re%3A%20%5Bcryptome%5D&In-Reply-To=%3CCAGRDzQWNCCe7AUOL%3D-YoFUdi5%2Bm2KPxsq30D3OJzgJjQUrMaCw%40mail.gmail.com%3E>*Sun > >>> Oct 11 12:25:43 EDT 2015* > >>> reveal was to protect the community (fr john) then why was that act > > >>> protecting the community > avoided by mike > >> > >> Plus no ask to the list but said asked the list and if the point of the > >>> > >> > >> First email asked for help, no reason the list was excluded from that > >> even though I explicitly asked John for help verifying it. Then I asked > >> open endedly on Twitter. > >> > >> Also, you seem to be confusing this list with the community of Cryptome's > >> visitors. There's overlap, sure, but they are *not* the same. > >> > >> Plus, John deleted the early emails I made to the Cryptome list, which is > >> more explicitly the mailing list that would be best identified as the > >> community you're referring to. > >> > >

3 4

Rabblerabblerabble! Enough rabble rousing about rabble rousing AKA STOP JTRIGing YOURSELVES
by Michael Best 12 Oct '15

12 Oct '15

Whatever you think of my motives, what's done is done and all that's left is to discuss the data and the slide. If ya'll wanna keep talking about me instead, I'm flattered that you think I'm so interesting but someone should probably setup a separate list for that. It's drowning out any chance for real discussion in the list, not just about the GCHQ slide but about anything else. Put those big beautiful brains of yours to work on the slide and other cypherpunk issues - but *I* am not one of them, AFAIK. I have a few more people I want to hear from on the slide issue, but I welcome actual constructive criticism, comments or technical input, whether for or against. Stay away from sentiments like "we can't figure that out!" You're better than that, I think, and when you reach your limits you know which experts to ping. Let's get away from witch hunts and troll bait. --Mike, who is not a troll but actually Shrek's less funny cousin

1 0

WHY might Coderman, tbiehn @ themikebest BE THE SAME PERSON
by Michael Best 12 Oct '15

12 Oct '15

You're an idiot. JOHN YOUNG and I are the same person. coderman is some other guy completely. OR IS HE? I am he As he is me And we are all together I am the eggman They are the eggmen I am the walrus Goo goo g' joob goo goo goo g' joob Expert texpert choking smokers Don't you think the joker laughs at you? (Ho ho ho! He he he! Ha ha ha!)

3 2

WHY might Coderman, tbiehn @ themikebest BE THE SAME PERSON
by Travis Biehn 12 Oct '15

12 Oct '15

Evidence: They all use gmail.com. Gmail.com allows free account creation. They COULD all be the same person. Lets prove this out once and for all. Discuss. -Travis -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

2 1

Re: [cryptome] Re: [cryptome]
by Michael Best 12 Oct '15

12 Oct '15

You can read through the emails for yourself, no doubt. Start with the original email about the GCHQ slide with redacted IPs, where I ask for verification/validation. On Sat, Oct 10, 2015 at 6:55 AM, Cari Machet <carimachet(a)gmail.com> wrote: > Show me the email where you called for help ... i have been traveling > heavy so missed it > > The type of work of forensics research is important and how ot is > conducted is as well > > Its not about my personal stamp of approval it is about community and > respecting of and embodiment of the community > > If anyone including john is being a fucker we need to account for that > On Oct 10, 2015 12:04 PM, "Michael Best" <themikebest(a)gmail.com> wrote: > >> The list had been involved since the first post about the GCHQ slide. The >> list was no help at all. >> >> Sorry you don't approve, Cari, but what's done is done. The list was >> consulted and no help. John Young refused to acknowledge the problem - *or >> fix it. *[sarcasm] But what's terribly wrong is that I reported it - >> *not* that John leaked it or lied it about it when he kept denying it or >> anything else. [/sarcasm] >> >> >>> *Cari Machet* carimachet(a)gmail.com >>> >>> <carimachet%40gmail.com?Subject=Re%3A%20%5Bcryptome%5D%20Re%3A%20%5Bcryptome%5D&In-Reply-To=%3CCAGRDzQX8MeKa3DuwLaNpW-jfTneECwos-oXhSxo0iCb5V%2BGsHA%40mail.gmail.com%3E> >>> *Sat Oct 10 04:51:59 EDT 2015*Still michael best you could have >>> consulted the list here That someone calls you a liar therefor you act is >>> an ego based mindset Answer why you decided to not consult this list that >>> has profoundly smart >>> beings on it You could have asked this list for help we are interested >>> in helping with >>> such matters i would say and you could have done so without revealing >>> info >>> ... did this never cross your mind ? If it never even crossed your mind >>> to consult us i find there is something >>> terribly wrong >> >> >> On Sat, Oct 10, 2015 at 12:01 AM, coderman <coderman(a)gmail.com> wrote: >> >>> On 10/9/15, Michael Best <themikebest(a)gmail.com> wrote: >>> > ... *they never would've been published. * >>> >>> i find it useful to think of voice. published yes, with little voice. >>> >>> now it's most certainly a loud something! >>> the published always was, however... >>> >> >>

9 18

How to go about sharing (was: one of a dozen threads about Cryptome)
by Michael Best 12 Oct '15

12 Oct '15

You deliberately took that out of context and cut out relevant text. Troll. What I meant was not having to deal with the copyright complaints myself, and you OH SO CONVENIENTLY left out the very next sentence " If it turns out there's a violation I missed, the item gets taken down - not the entire site or all the uploads. " Which referred to Cryptome getting taken down over one document (which ultimately was allowed to stay up anyway) > ------------------------------ > DUDE READ THEIR TOS! On 10/11/2015 07:11 PM, Michael Best wrote: > >* and not worry about copyright*

2 3

WHY make a fake GCHQ slide?
by Michael Best 12 Oct '15

12 Oct '15

Here's my preliminary list of potential reasons for faking a GCHQ slide. Not meant to be comprehensive, and not every possibility is highly likely. Some are included only for completeness, but I'm sure there are possibilities I missed. There have been a few incidents already where the slides have been challenged or at least partially debunked. The German prosecutor found a lack of evidence that the NSA was illegally monitoring their government and concluded that the alleged NSA order was a fake. Snowden has also accused The Independent of attributing slides to him that he never gave to them. The why depends on the who. Candidates include: - GCHQ - Snowden (included for completeness, but least likely. Why fake this particular slide among many apparently legitimate ones?) - Russian chekist agencies - Chinese intelligence agencies - The Intercept - Intel service X - If the GCHQ, then there are a few possible reasons: 1. Part of a proposal/demo 2. Disinfo to discourage visitors from going to Cryptome 3. Disinfo to create paranoia 4. Disinfo to discredit other slides (Snowden suggests something like that here http://www.theguardian.com/commentisfree/2013/aug/23/uk-government-independ… ) 5. Disinfo to convince a FIS (foreign intel service) that their capabilities are better/more complete than they are (or were better than they were at the time) If Snowden: 1. ??? 2. Makes no sense as an isolated incident, little evidence to the contrary 3. Would not necessarily recognize a fake slide, since he didn't examine all of the ones he passed on If Russian disinfo: 1. Discredit the GCHQ 2. Discredit western governments and undermine their intelligence agencies 3. Inflate the importance of Cryptome prior to attempting to use them to release disinfo If Chinese disinfo: 1. Smear British cyber operations as part of their ongoing cyberwar with the west and related cognitive warfare 2. Discredit the GCHQ 3. Discredit western governments and undermine their intelligence agencies 4. Inflate the importance of Cryptome prior to attempting to use them to release disinfo If The Intercept: 1. Fame 2. Money from being paid to publish a fake by any interested party 3. Financial compensation from media attention as suggested by Razer/Rayzer(a)riseup.net If Intel service x: 1. Any of the above *Juan* juan.g71(a)gmail.com > > <juan.g71%40gmail.com?Subject=Re%3A%20Why%20cryptome%20sold%20web%20logs%20to%20their%20paying%20customers%3F&In-Reply-To=%3C5619825d.361f8c0a.691ce.fffffe96%40mx.google.com%3E> > *Sat Oct 10 17:31:29 EDT 2015*>*I still don't get who would make such a > fake and why. *

9 28

[cryptome] Re: NatSecGeek
by Michael Best 12 Oct '15

12 Oct '15

> > His use of a sig with all his social networks is one of the reasons I > earlier said Best has some income-related motive, and that he's most > likely dealing in 'future rewards'. "All his social networks" being twitter? I have a LinkedIn somewhere, but I don't publicize that. I'm not sure what "sig" you mean. I don't have an email signature. On that1archive.neocities.org ? Yeah, I have my contact information posted. Of course, JYA also has his email and twitter posted there, but no accusations about a profit based motive against him. No double standard there.

1 0

Why cryptome sold web logs to their paying customers?
by Dr. J Feinstein 12 Oct '15

12 Oct '15

Resend–HTML email scrubbed Calling bullshit. Mirimirs right, this makes no sense. And JYA says netsol won't let him delete the logs but Netsol says logs are disabled by default[https://www.networksolutions.com/support/how-to-enable-download-the… and you have to turn them on. So how the fuckd this really happen? Mirimir <mirimir(a)riseup.net> Are you arguing that users could have found those logs? I almost can't imagine that. Logs are normally in /var/log/ somewhere, and I can't imagine making them searchable. And indeed, I can't imagine how Cryptome archives would have included anything from /var/log/, even after system restore from backups. <--SNIP--> > Should access logs be kept for that long? Absolutely not. From what I> have read in the email exchange that was posted, the log files were> included in a NetSol total restore. My guess is that John/Cryptome did> not intentionally keep these files, and did not realize these files were> included in the archive. But that's the thing. Logs should have been in /var/log/. And how would the "NetSol total restore" have changed that? > When I do incremental backups or updates on my own systems, I don't> usually go back and check the integrity of files I've already archived> in my closed system. I can see where this could be an honest mistake> that has gotten blown way out of proportion. It's a good lesson to be> more aware of these types of glitches. I still don't get how logs would have ended up in archives. Maybe JYA prepared a special set of archives for a collaborator. Maybe for someone helping him to understand what had happened. And then maybe he forgot about doing that. Hard to say.

10 33