October 2015 - cypherpunks - lists.cpunks.org

What is this "Weird garbled Windows 7 update"?
by Georgi Guninski 03 Oct '15

03 Oct '15

Looks like microsoft are owned. http://www.theregister.co.uk/2015/09/30/windows_update_glitch/ ---- Windows 7 users were left scratching their heads on Wednesday when a mysterious garbled patch appeared in Windows Update, origins unknown. ... Its description mostly contained garbled text. Links for more information, help, and support were filled in with gibberish URLs with ".gov," ".mil," and ".edu" domains. ... The Register poked Microsoft about the issue, and a spokesman told us: "We incorrectly published a test update and are in the process of removing it." ---- "test update" containing .gov,.mil and .edu URLs, lol...

4 5

Moderate Syrian Rebel Application Form
by Zenaan Harkness 03 Oct '15

03 Oct '15

http://russia-insider.com/en/politics/moderate-syrian-rebel-application-for… WASHINGTON (The Borowitz Report)—After announcing, on Thursday, that it would seek $500 million to help “train and equip appropriately vetted elements of the moderate Syrian armed opposition,” the White House today posted the following Moderate Syrian Rebel Application Form: Welcome to the United States’ Moderate Syrian Rebel Vetting Process. To see if you qualify for $500 million in American weapons, please choose an answer to the following questions: As a Syrian rebel, I think the word or phrase that best describes me is: A) Moderate B) Very moderate C) Crazy moderate D) Other I became a Syrian rebel because I believe in: A) Truth B) Justice C) The American Way D) Creating an Islamic caliphate If I were given a highly lethal automatic weapon by the United States, I would: A) Only kill exactly the people that the United States wanted me to kill B) Try to kill the right people, with the caveat that I have never used an automatic weapon before C) Kill people only after submitting them to a rigorous vetting process D) Immediately let the weapon fall into the wrong hands I have previously received weapons from: A) Al Qaeda B) The Taliban C) North Korea D) I did not receive weapons from any of them because after they vetted me I was deemed way too moderate I consider ISIS: A) An existential threat to Iraq B) An existential threat to Syria C) An existential threat to Iraq and Syria D) The people who will pick up my American weapon after I drop it and run away Complete the following sentence. “American weapons are…” A) Always a good thing to randomly add to any international hot spot B) Exactly what this raging civil war has been missing for the past three years C) Best when used moderately D) Super easy to resell online Thank you for completing the Moderate Syrian Rebel Application Form. We will process your application in the next one to two business days. Please indicate a current mailing address where you would like your weapons to be sent. If there is no one to sign for them we will leave them outside the front door.

1 0

Stealing Amazon cloud RSA keys cross VM
by Georgi Guninski 03 Oct '15

03 Oct '15

http://www.theregister.co.uk/2015/10/02/amazon_boards_windows_against_leet_… Amazon has patched a vulnerability that could have let users to steal the RSA keys of other co-located customers. The paper: https://eprint.iacr.org/2015/898.pdf

1 0

No MITM attack on Cryptome
by Michael Best 02 Oct '15

02 Oct '15

A week or two ago, a new Snowden was released that shows information about a visitor to Cryptome. James Atkinson looked at the slide and concluded that it was proof of a man in the middle (MITM) attack against Cryptome. He sent his concerns to John and Deborah who then posted them on Cryptome.org - https://cryptome.org/2015/09/gchq-illegal-spying-us.htm I'm doing a little bit of research on the slide and decided to compare notes with what had already been written about it, including Mr. Atkinson's post. While examining his remarks about the alleged MITM attack, I noticed that he seemed to be missing a piece of information that led him to a faulty conclusion. I've copied and pasted the relevant bits below. But here is the thing -- and this is crucial -- the address for Cryptome is > listed to be the location of a fiber optic cable junction in Sterling, VA > (next to an Amusement Machine company)... which is quite some distance away > from your location in NYC, and a considerable distance from your ISP who > hosts your file, and it is located away from any signal switching systems > use in the area, but it is virtually next door to fiber that goes to a > large NSA listening post nearby. The reason it is notable, is that someone at or near the location in > Sterling, VA is performing a MITM attack on Cryptome visitors, and this > image out of the slidedeck with the two GPS coordinates is the U.S. > Government performing a MITM attack against Cryptome and sharing the > collected intelligence with the Brits, or the U.S. Government giving the > British government backdoor access into the U.S. (illegal) collection > systems. This isn't a sign of a MITM attack, but rather of a misunderstanding. The Cryptome servers aren't located in New York at the address listed for Cryptome as a business. The servers are hosted by Network Solutions, which is who the IP address appears to belong to, as shown below. NetRange: 205.178.128.0 - 205.178.191.255 CIDR: 205.178.128.0/18 NetName: NTSL-01 NetHandle: NET-205-178-128-0-1 Parent: NET205 (NET-205-0-0-0-0) NetType: Direct Allocation OriginAS: AS14441, AS19871, AS6245 Organization: Network Solutions, LLC (NETWO-59) RegDate: 1999-02-09 Updated: 2012-03-02 Ref: http://whois.arin.net/rest/net/NET-205-178-128-0-1 A reverse DNS search shows that the IP address is used to host over 1,100 domains. I've attached two PDFs that include more detailed information showing that there is no indication of a MITM attack against Cryptome. Live versions of the PDFs can be found at http://www.iptodomain.com/ip-205-178-146-236.php and http://www.tcpiputils.com/browse/ip-address/205.178.146.236 I hope this will help soothe some fears and paranoia about this particular alleged MITM attack. Monitoring, almost certainly. Other MITM attacks at other times, perhaps. The GCHQ slide just isn't any sort of proof that there was a MITM attack on Cryptome.org during the times referenced by the slide.

1 0

Subject: Re: Bitnation system. Looks interesting.
by tigrutigru＠gmail.com 02 Oct '15

02 Oct '15

It seems like there's a confusion between contracts and cryotocontracts? > On 10 Sep 2015, at 7:19 am, cypherpunks-request(a)cpunks.org wrote: > > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: Bitnation system. Looks interesting. > (Lodewijk andré de la porte) > 2. Re: Bitnation system. Looks interesting. (Bryan Bishop) > 3. Re: Bitnation system. Looks interesting. (Martin Becze) > 4. Repbin release v0.0.2 (ryan.pear(a)ownbay.net) > 5. Re: Repbin release v0.0.2 (jim bell) > 6. Re: How Putin Controls the Internet and Popular Opinion in > Russia (rysiek) > 7. Re: How Putin Controls the Internet and Popular Opinion in > Russia (Juan) > 8. Re: Repbin release v0.0.2 (rysiek) > 9. Hostages for Sale on Telegram (Rich Jones) > 10. Re: Hostages for Sale on Telegram (Ben Mezger) > 11. John McAfee Runs For US President In 2016 Under Cyber Party > (grarpamp) > 12. Re: Hostages for Sale on Telegram (grarpamp) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Sep 2015 18:30:53 +0200 > From: Lodewijk andré de la porte <l(a)odewijk.nl> > To: Mirimir <mirimir(a)riseup.net> > Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> > Subject: Re: Bitnation system. Looks interesting. > Message-ID: > <CAHWD2r+C+NXJ3Q-W=Bt5T+9=3ncfUwjvQVmT7Gqdn56MDydvyA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > It's documentation is overly verbose, speculative, assuming and unclear. > > I love the idea of providing services that the government usually tends to. Everyone loves ideas that Bitnation put their brand on. > > I somewhat know what marriage before God means. I somewhat know what > marriage before the State means. I have no idea what marriage before the > Blockchain means. Probably no more than lovers' tree-carvings. Exactly. Proof-of-existence. I don't understand what it has to do with Bitnation brand. Someone just wants to look cool. What exactly Bitnationare building? > > Relationship to reality is the hardest part - it's also where things like > enforcement starts turning it's ugly head. > > I'd argue marriage before state is an artifact of the marriage between > church and state. Relationships, commitments, etc, these would be better > explained in contract. Yes. Obligations can be explained. Still people go to courts and dispute contracts. These are text. > Contracts can go onto a blockchain. Contracts which go on the blockchain have nothing to do with legal contracts. Parts of the text (legal) contracts can be hooked to a smart contract I guess. I guess if a married couple has a dispute over digital property or btc in a wallet, let's say a script can manage it, but how the script (smart contract) will know who in this particular dispute did what. Even with no details and subtleties involved. > Generic. Neat. > Unpretentious. > > Bitnation is fascinating, thought provoking, but it seems somewhat off. Ideas are nice. They're not necessarily coming from Bitnation. Proof of existence, or Blockchain ID for example were existing ideas which had functioning prototypes. They just don't make it sound grandiose. Bitnation has a claim to be a software project and afaik has a presale of a currency - either premined or non existent - I don't remember. I'm fine with that type of crowdfunding if there is some sort of product or a service behind it or an attempt to build it. I don't think that contemporary art project should pretend to be a software project or pretend that it can realistically offer serious services or replace existing ones. It's cool as a concept project. >

2 2

Qubes 3.0 out
by Eugen Leitl 02 Oct '15

02 Oct '15

http://blog.invisiblethings.org/2015/10/01/qubes-30.html Qubes 3.0 Oct 1, 2015 • Joanna Rutkowska About 5 months after the initial release of Qubes 3.0-rc1, we're now releasing the final 3.0 today! Let me quickly recap the main "killer features" of Qubes OS 3.0 compared to the Release 2: Qubes is now based on what we call Hypervisor Abstraction Layer (HAL), which decouples Qubes logic from the underlying hypervisor. This will allow us to easily switch the underlying hypervisors in the near future, perhaps even during the installation time, depending on the user needs (think tradeoffs between hardware compatibility and performance vs. security properties desired, such as e.g. reduction of covert channels between VMs, which might be of importance to some users). More philosophically-wise, this is a nice manifestation of how Qubes OS is really "not yet another virtualization system", but rather: a user of a virtualization system (such as Xen). We upgraded from Xen 4.1 to Xen 4.4 (now that was really easy thanks to HAL), which allowed for: 1) better hardware compatibility (e.g. UEFI coming soon in 3.1), 2) better performance (e.g. via Xen's libvchan that replaced our vchan). Also, new Qubes qrexec framework that has optimized performance for inter-VM services. We introduced officially supported Debian templates. And finally: we integrated Whonix templates, which optimize Tor workflows for Qubes. As explained in our Release Cycle Documentation (something we finally created and been polishing through this 3.0 branch development), there is almost no new features in 3.0 compared to 3.0-rc1, essentially only bugfixes, intermixed with a few minor improvements. But, while the 3.0 branch was "maturing", and getting bugfixes merged, most of our work has been focused on the 3.1 branch, which is adding a bunch of exciting new features, as indicated on our high-level roadmap, specifically: UEFI support (see this ticket for more info and test images). Live USB edition (preview for which we already released earlier this summer, now it will get merged into the master branch for 3.1) Management/pre-configuration stack: The Big Killer Feature of the upcoming 3.1 release, which will make it easy to provide out of the box configurations for things such as: out of the box Whonix/Tor, or Split GPG, or default USB sandboxing VM, which currently the user must do manually. We're planning to release the first candidate for 3.1 as early as the end of October, actually. But development of any serious project is not just adding new features, although that's admittedly the most exciting thing for any developer to do. In R3 we have finally started implementing this golden thought, and the first tangible outcome of this change of attitude is the automated testing framework which we have been using for all the releases in this 3.0 branch already. We hope this results in much more polished, stable code. Other things we've started to be increasingly prioritizing recently, and only plan to intensify in the coming year are: 1) making Qubes more accessible to people (think easier to get hardware that can run Qubes OS), and 2) easier to use (better UX and UI). I think this is also pretty exciting, actually. As previously announced earlier this summer, we have decided to dedicate this release of Qubes OS to the memory of Caspar Bowden: Caspar's dedication screenshot Caspar has been a proud user, supporter, and advocate for Qubes OS, and also a friend. I think he would have liked that dedication. The Qubes 3.0 ISO can be downloaded from here. We have also released another scheduled Qubes Canary today. I would like to thank all the people who have contributed to this huge effort of creating a new "reasonably secure" desktop OS. I believe we're making together an important and meaningful thing here. Let's keep this going!

1 0

Allegedly Volkswagen cheated to both governments and lusers
by Georgi Guninski 02 Oct '15

02 Oct '15

http://www.theregister.co.uk/2015/09/25/vw_pollution_just_the_tip_of_the_ic… <quote> Volkswagen is being rightly condemned from all directions, as its methods were particularly cynical: its engine software would sense when the car was in a test environment and cut back NO_x output temporarily. As soon as the car was no longer under test, the car would change mode and emit huge amounts of NO_x. This wasn't done for no reason – if a machine is allowed to generate NO_x freely, it can be very fuel-efficient – and thus, of course, its carbon emissions can be very low too. </quote> Comment: Probably best defense for VW lawyers is: "We got hacked and the hack made this. We take sickyouareity seriously"

5 13

Re: [tor-talk] KARMA POLICE
by Ryan Carboni 02 Oct '15

02 Oct '15

http://routersecurity.org/ It just simply doesn't matter. To have a modern lifestyle, depends upon having devices of dubious or poor security. The government has shown a willingness to accumulate dossiers (seemingly including IRC chats), and then leak them when it serves their own needs. Our Congress is criminally incompetent. The chairman of the House Oversight committee just had his secret service application leaked, and there is no threat of the the most powerful tools that Congress has: appropriations micromanagement (famously done in Congressional reconstruction) or impeachment. The same goes for Benghazi (which probably was a meeting with a rebel group that went sour). I think our government is more malicious and less competent than Hoover's FBI. For comparison: “Another early Bureau practice was to index names on lists when the list reflected possible association with a subversive group (e.g. Communist Party petitions or subscriptions to the Daily People's World), or where the names might have future reference value (American Legion contacts, loyalty forms). The heavy demands on staff time and resources, however, and the absence of substantial information about the individuals whose names appeared in the this context caused the Bureau to limit indexing in these areas. In 1949 the Executive Conference decided that names on Communist Party petitions and subscription lists to the Daily Worker and Daily People's World be indexed in the appropriate field office only.”

1 0

tox
by Juan 02 Oct '15

02 Oct '15

I've been playing with tox(thanks rysiek!) and it looks rather interesting. I noticed however that it's not listed here https://www.eff.org/secure-messaging-scorecard Maybe somebody who knows somebody at eff could drop them a message? Also, apart from retroshare (and tox), is there any other p2p messaging network?

9 22

Re: [tor-talk] KARMA POLICE
by Zenaan Harkness 01 Oct '15

01 Oct '15

On 10/1/15, Ryan Carboni <ryacko(a)gmail.com> wrote: > http://arstechnica.com/tech-policy/2013/06/exclusive-in-2009-ed-snowden-sai… > > https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-o… > > Yep. > > Time to create a massive donation drive for Tor. I applaud and share your enthusiasm and intention. But. The assumption that "enough money will solve the problem" is generally false. What is needed is a supra-tor or supra-"supplied by the govt/ isp" physical network layer - or at least enough nodes in a 'slightly new design' network which can use those nodes (assuming there are enough of them, which might be large number, I have no idea). That means individuals setting up their own links between them and their neighbors. Neighbors is a loose concept - wireless links can hop a fair distance. The principle is: - if you don't control it, if you did not physically set it up, it monitors you; - if you don't install and 'control' the software running on the hardware, it monitors you; - if your hardware is backdoored before you receive it (e.g. built in hidden other-than-wifi radio, keylogging cpu microcode, full hidden net sniffing computer in your ethernet port), notwithstanding the software you install on it, it monitors you. There is so much room for necessary improvement that the situation is depressingly grim. TBB/Tor is at least something - just be sure you understand what it is, and what it is not. Good luck and surf safe, Zenaan

1 0