February 2015 - cypherpunks - lists.cpunks.org

Obama believes in strong encryption
by grarpamp 19 Feb '15

19 Feb '15

http://recode.net/2015/02/13/obama-theres-no-scenario-in-which-we-dont-want… https://www.youtube.com/watch?v=yaylQmnXztU http://it.slashdot.org/story/15/02/17/2230257/obama-says-hes-a-strong-belie… Contrast with many recent US administration and agency statements all on the record as well. Is this a mindshift, or a case of FUD then false savior?

3 2

Disastrous privacy consequences of Canada's terrorism bill
by grarpamp 19 Feb '15

19 Feb '15

http://yro.slashdot.org/story/15/02/19/1633223/the-disastrous-privacy-conse… http://www.michaelgeist.ca/2015/02/total-information-awareness-disastrous-p… http://www.parl.gc.ca/HousePublications/Publication.aspx?Language=E&Mode=1&…

2 1

[liberationtech] At Stanford on Friday, Feb. 20 -- Vitalik Buterin: Ethereum & Cryptoeconomic Mechanisms & Security
by Eugen Leitl 19 Feb '15

19 Feb '15

----- Forwarded message from Yosem Companys <companys(a)stanford.edu> ----- Date: Mon, 16 Feb 2015 12:27:19 -0800 From: Yosem Companys <companys(a)stanford.edu> To: Liberationtech Events <liberationtech-events(a)lists.stanford.edu>, Liberation Technologies <liberationtech(a)mailman.stanford.edu> Subject: [liberationtech] At Stanford on Friday, Feb. 20 -- Vitalik Buterin: Ethereum & Cryptoeconomic Mechanisms & Security Message-ID: <CANhci9E+pmyHwS_ya7giPFXuzbzYQfGWr9rcnHCWuCjsA65sBw(a)mail.gmail.com> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> From: David Wu <dwu4(a)cs.stanford.edu> via security-seminar(a)lists.stanford.edu at https://mailman.stanford.edu/mailman/listinfo/security-seminar Introduction to Ethereum, and Cryptoeconomic Mechanisms and Security Vitalik Buterin Friday, February 20, 2015 Talk at 4:15pm Gates 463 Abstract: The presentation will provide an introduction to the Ethereum protocol from a technical perspective, including the high-level operation of the blockchain protocol, contract calling and gas mechanics, use of Patricia Merkle trees and other cryptography and light client proofs. I will then discuss some of the interplay between economics/game theory and cryptography both in consensus algorithm design (eg. proof of work, proof of stake) as well higher-level protocols like sidechains, challenge-response protocols and SchellingCoin, and will attempt to define and dissect different interpretations of the concept of "cryptoeconomic assurance". -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message -----

1 0

Twitter v. DOJ-FBI, Google to FBI
by grarpamp 19 Feb '15

19 Feb '15

https://freedom.press/blog/2015/02/our-brief-support-twitters-lawsuit-again… https://gigaom.com/2015/02/18/tech-and-media-firms-join-twitter-in-key-test… http://www.nationaljournal.com/tech/google-calls-fbi-s-plan-to-expand-hacki…

1 0

Re: [Cryptography] trojans in the firmware
by grarpamp 18 Feb '15

18 Feb '15

On Wed, Feb 18, 2015 at 5:16 PM, Tom Mitchell <mitch(a)niftyegg.com> wrote: > The critical stage is the boot ROM (BIOS) and the boot device. > Once Linux has booted a lot is possible but too much has already taken > place. > A BIOS that allows booting from a Flash memory card must be trusted. > > Virtual machines may help or hinder. > > The VM is sitting where the man in the middle wants to be and if it wants > can protect or expose > the OSs that it hosts. A VM can protect a hard drive from being infected > by blocking vendor > codes that might try to update or corrupt modern disks of boot flash memory. Afaik, all vm's today simply pass through all drive commands. It seems a move all the BSD's and Linux could make today, without waiting on untrustable hardware vendors to roll out signature verification in hardware, is to simply kernel block all commands unnecessary to actual production use of the disk. Permit only from a list of READ, WRITE, ERASE, INQ, TUR, RST, and so on. Thus every other command component, including firmware update, vendor specific, and binary fuzzing, gets dropped and logged. It could be done as a securelevel, or compiled in. It's definitely not bulletproof, but it does force adversaries to add that much more exploit code and effort to get root and go around the driver interface to access the hardware directly. Defense in depth. Similar tactics could be applied to other areas where firmware and vendor/fuzzable opcodes are involved... usb, bios and cpu.

1 0

Fwd: [tor-talk] Call for Participation – ACM SigComm2015 – Workshop on Ethics in Networked Systems Research
by grarpamp 18 Feb '15

18 Feb '15

---------- Forwarded message ---------- From: Bendert Zevenbergen <bendert.zevenbergen(a)oii.ox.ac.uk> Date: Wed, Feb 18, 2015 at 6:20 AM Subject: [tor-talk] Call for Participation – ACM SigComm2015 – Workshop on Ethics in Networked Systems Research Call for Participation – ACM SigComm2015 – Workshop on Ethics in Networked Systems Research Co-located with ACM SIGCOMM’15<http://conferences.sigcomm.org/sigcomm/2015/> August 21st 2015 London, UK A full day workshop titled “Ethics in Networked Systems Research” will be held at the ACM SIGCOMM 2015 in London. This multidisciplinary workshop will bring together two distinct groups of researchers: - Computer scientists, network scientists and other technical researchers who are interested in the ethical and legal aspects of their work; - Researchers studying the various ethical, social scientific and legal aspects of data-driven projects in the field of computer and data communication networks. This workshop seeks 1 to 4 page summaries, focussing on ethical considerations of papers, publications and projects from the two disciplines, for example: - Technical research in the field of computer and data communication networks that either operates in an ethical grey zone, collects and processes personal data/personal identifiable information, or has been rejected from another venue on ethical grounds; - Ethical, social scientific or legal research that reflects on – or aims to guide – technical research and projects in the field of computer and data communication networks, especially an analysis to minimise the potential harm whilst enabling a broad range of Internet research to be conducted. Selected authors and invited speakers will present their work, which will be followed by a structured discussion. The workshop will also facilitate an interactive session in which participants will split into multidisciplinary groups and address emerging ethical dilemmas in Internet measurement and information controls research, partly based on the submitted summaries. This session will be informed by a website (currently under development), that presents ethical guidelines for the fields of Internet measurement and information control. Papers submitted to this workshop will not be archived in the formal sense, so authors can submit papers elsewhere, or submit summaries of previously accepted papers. Important Dates Paper submission deadline – March 31st, 2015 Paper acceptance notification – April 30th, 2015 Organisers Prof. Ian Brown – Oxford Internet Institute Dr. Joss Wright – Oxford Internet Institute Bendert Zevenbergen – Oxford Internet Institute Erin Kenneally – University of California San Diego, Center for Applied Internet Research & Elchemy, Inc. Dr. Malavika Jayaram – Berkman Center for Internet & Society, Harvard + Centre for Internet & Society, India Allen Gunn – Aspiration Tech Meredith Whittaker – Measurement Lab Christopher Wilson – the engine room Stuart Schechter – Microsoft Research Please email papers to bendert.zevenbergen(a)oii.ox.ac.uk<mailto:bendert.zevenbergen@oii.ox.ac.uk> Workshop website: http://conferences.sigcomm.org/sigcomm/2015/netethics.php -- https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Extracting Equation Group's malware from hard drives
by Alfie John 18 Feb '15

18 Feb '15

Hi lists, Does anyone know of any tools to extract the Equation Group's malware from hard drive firmware? Also, are there any public registries online to report and view infections? Alfie -- Alfie John alfiej(a)fastmail.fm

5 5

[qubes-users] Persistent firmware backdoors possible across major hard drive brands
by Eugen Leitl 18 Feb '15

18 Feb '15

----- Forwarded message from Axon <axon(a)openmailbox.org> ----- Date: Tue, 17 Feb 2015 14:44:30 +0000 From: Axon <axon(a)openmailbox.org> To: "qubes-users(a)googlegroups.com" <qubes-users(a)googlegroups.com> Subject: [qubes-users] Persistent firmware backdoors possible across major hard drive brands Message-ID: <54E353CE.7040202(a)openmailbox.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2015-02-16, Kaspersky Lab announced[1]: > GReAT has been able to recover two modules which allow > reprogramming of the hard drive firmware of more than a dozen of > the popular HDD brands. This is perhaps the most powerful tool in > the Equation group’s arsenal and the first known malware capable of > infecting the hard drives. > > By reprogramming the hard drive firmware (i.e. rewriting the hard > drive’s operating system), the group achieves two purposes: > > 1. An extreme level of persistence that helps to survive disk > formatting and OS reinstallation. If the malware gets into the > firmware, it is available to “resurrect” itself forever. It may > prevent the deletion of a certain disk sector or substitute it with > a malicious one during system boot. “Another dangerous thing is > that once the hard drive gets infected with this malicious payload, > it is impossible to scan its firmware. To put it simply: for most > hard drives there are functions to write into the hardware firmware > area, but there are no functions to read it back. It means that we > are practically blind, and cannot detect hard drives that have > been infected by this malware” warns Costin Raiu, Director of the > Global Research and Analysis Team at Kaspersky Lab. > > 2. The ability to create an invisible, persistent area hidden > inside the hard drive. It is used to save exfiltrated information > which can be later retrieved by the attackers. Also, in some cases > it may help the group to crack the encryption: “Taking into account > the fact that their GrayFish implant is active from the very boot > of the system, they have the ability to capture the encryption > password and save it into this hidden area,” explains Costin Raiu. Affected HDD brands include[2] (but are probably not limited to): * Western Digital * Maxtor * Seagate * Hitachi * Micron * OCZ * OWC * Corsair * Mushkin * Samsung * Toshiba This is bad news for everyone, including Qubes users, since there's nothing we can really do at the OS/software level to protect ourselves from this kind of persistent HDD firmware infection (or compromised firmware and hardware in general). Measures like AEM don't help if the drives are already infected before we even purchase them. If we want freedom and safety in the future, our best bet is probably to (continue to) push for open-source firmware and hardware. [1]http://www.kaspersky.com/about/news/virus/2015/equation-group-the-crown-c… [2]https://securelist.com/files/2015/02/Equation_group_questions_and_answers… -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU41O4AAoJEJh4Btx1RPV85wcP/RK7mPG3HhdPpFt19yNTKE0c ETJ+93S7iRg7VZV+f8okFzQWn+ER6+OY0bl2shzwBJKXhxqneVYctXBJJLGk2KLd NuqIURNwDgISXhtjtNK2eeCRDeMdyAUtWceG+kxwZqXN8jXkZvBW0DrN7UEaPb8s Zib8GfsqvOr1HSkw67P4z48pU7sdN7gF4rLTcA7el/JH98m0ltlIHmurbma4XLgp RGnJSgsFwoViD4BgOHk4gmavgctoiBUgDuKjJ3O2nFaCFIlUT6hF/6TB7MsIqOZh 0OrsSr3OsXkKGlIxbjoDt4mlo7FC64diKq5JzRd9KS+68zmU9V7ocaq7ehfIJjq3 xyXX85Ly7MgREwwPf4uQEgLqNew77prG3pNYeAhBVmcsr2cJeBrpvT+i56hvTkcS 07anQjf2C2o0NW0UAqpzNTHuLhl4Jdts9ra/k6oiy05fj8EdU8WQYW4iaznEFu4V IkYS5tF7EPjyBmtqwVuWPQMNjW5rKUOq4KRWY2fXXeV+lYExpqfuZoCh8SNE/eYz WtTDVnxS5hTOq4Fy74GA4qpGYjYl0VhdM0EYpHBrn9xiI2HDYN6/L9R4TI+M5vCI fF3BkjvvzJgYjBAZx133n+WWdPlyykeyQahKfHUgT0qXGN2TD6Lo8sWZE1+NBJbo GlihcbnDLrcUtul23CrE =ugr/ -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscribe(a)googlegroups.com. To post to this group, send email to qubes-users(a)googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/54E353CE.7040202%40openmailbo…. For more options, visit https://groups.google.com/d/optout. ----- End forwarded message -----

2 1

Re: [cryptography] [Cryptography] Equation Group Multiple Malware Program, NSA Implicated
by grarpamp 18 Feb '15

18 Feb '15

>>>> Here's an interesting comparison. Most academic cryptographers believe >>>> that the NSA has lost its lead: While for years they were the only ones >>>> doing cryptography, and were decades ahead of anyone on the outside, but >>>> now we have so many good people on the outside that we've caught up to, >>>> and perhaps even surpassed, the NSA. I've always found this reasoning a >>>> bit too pat. But getting actual evidence has been impossible. >>> >> What evidence is there for this? > > Snowden saying "encryption works." This is probably quite true... from his particular vantage/access point and social network. Yet however much we may know about that side being relatively open and shary and the capabilities there, it is not an exclusive answer to the crypto question. None of the Snowden docs to date are or show any real details about the crypto side of the house. He either had no interest (unlikely), had no time, found it too risky (whether to pull off without being caught, or over concern about some element of grave damage), or simply had no access. > FBI complaining about going dark, we need backdoors - they only ever > complain at that level as proxy for NSA, and same complaint is repeated in > rapid succession in UK, DE. These sort of things may be important indicators. Yet to prove them as such you'd also have to analyse the history of FUD making, grab attempts and so on to interpret. It could be that selective crypto is not dark, but merely expensive to scale into being "see all" as desired with the old in clear. So you would have to analyse the costs there. Electricity, rainbow disk storage, real estate, cooling. How do you know the disk makers and their suppliers do not have black wing budgets. Or that there is not a multi billion fab lab buried under some mountain powered by a ground radiator / aquifer cooled nuke reactor? > This is exactly how organizations win over smart individuals: > They build a database of expertise over many years, and they are > patient and can keep at it indefinitely. Yes, that's one... who is tracking where all the brilliant maths and others go after high school? The student names in known friendly colleges and programs? The ones that seem to drop from the public scene? What media is publishing interviews with them? Where are known adversary retirees that may have something to say when invited? >> It's not that I have evidence the other way. We just don't know. > At one level, this all comes down to your model of science. > ... > thinking of the question as a murder investigation - clues, hypotheses, > correlations, etc. To know the adversary you must continual analyse all potential aspects, and not just aspect itself but their inputs, dependencies and output/result chains. Then maybe you can answer some questions. After all, the adversary is doing analysis upon you. > Right. I'm surprised Android sells any phones in USA market. It's surprising that maybe no one has yet reverse engineered the binary blobs/drivers in android to provide a fully open software stack there. And although more difficult, same goes for the firmware blobs. Regardless of effectiveness, it would show market demand. >> New models for large >> corporations only started to arise in the late 1960's, with the development >> of so-called "knowledge organizations". Knowledge, and knowledge dichotomy within capacity of biology as a whole to adapt evenly, seems quite a potential for scary outcomes... http://yro.slashdot.org/story/15/02/17/2229240/oregon-residents-riled-over-… http://science.slashdot.org/story/15/02/17/030208/game-theory-calls-coopera… http://yro.slashdot.org/story/15/02/17/0025237/att-to-match-google-fiber-in… http://tech.slashdot.org/story/15/02/16/2332217/the-software-revolution >>> In sum, I'd say they are ahead in the pure math, but you'd be hard >>> pressed to find an area where it mattered. >> >> Maybe. It's really impossible to say. Two days ago, I would probably >> have agreed with you. Now ... I'm not so sure. As with Google, they hire a lot of Maths and others, and have been at it for decades longer. Even generations of maths born into now. There is too much silence from these workers. Especially when society could probably get along just as well without so many organizational level secrets everywhere (wars), and now potentially against peoples if you believe that sort of thing. More Snowdens Please.

2 2

Face Recognition Breakthrough - Why develop nukes?
by grarpamp 18 Feb '15

18 Feb '15

http://tech.slashdot.org/story/15/02/18/0024203/breakthrough-in-face-recogn… Face recognition software underwent a revolution in 2001 with the creation of the Viola-Jones algorithm. Now, the field looks set to dramatically improve once again: computer scientists from Stanford and Yahoo Labs have published a new, simple approach that can find faces turned at an angle and those that are partially blocked by something else. The researchers "capitalize on the advances made in recent years on a type of machine learning known as a deep convolutional neural network. The idea is to train a many-layered neural network using a vast database of annotated examples, in this case pictures of faces from many angles. To that end, Farfade and co created a database of 200,000 images that included faces at various angles and orientations and a further 20 million images without faces. They then trained their neural net in batches of 128 images over 50,000 iterations. ... What's more, their algorithm is significantly better at spotting faces when upside down, something other approaches haven't perfected." ... Why, like nukes, does society insist on developing tech whose primary purpose upon analysis seems only to be destructive, or of control, or in removing rights from individuals and groups, or just plain [ab]using them for profit? What possible quantifiable significant individualized benefit would a single human have from such things, when in fact they are pointed at them, instead of being wielded in their own hands? This isn't crypto or a weapon a human can also use to protect themselves beforehand. Do you really need to facial recognize your friends, your boss, doctor, or even to seek justice [aka: revenge] after someone's already done damage to you? Do you really care if another face has your name so long as if the cops come, society, laws and process are done right such that you are declared as innocent error and formally expunged from all db's and news and even compensated? Where is the FR in your hands? For that matter, do any individuals in your network really need to FR you either? In individual paired contexts, FR seems pointless. And any benefit when used to say hunt in a group seems thoroughly washed out by negatives on balance. When the camera comes to your face, instinct tells to put a mask to protect yourself. So there's something obviously wrong with the "picture" being developed here. Maybe it is the developers that need more cameras in their face to get a feel for the more likely uses.

2 1