February 2015 - cypherpunks - lists.cpunks.org

Firmware exploits summary
by grarpamp 18 Feb '15

18 Feb '15

http://spritesmods.com/?art=hddhack http://s3.eurecom.fr/~zaddach/ https://www.ibr.cs.tu-bs.de/users/kurmus/ https://www.schneier.com/blog/archives/2014/01/iratemonk_nsa_e.html http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and… https://srlabs.de/badusb/ https://en.wikipedia.org/wiki/NSA_ANT_catalog http://inertiawar.com/microcode/ https://wiki.archlinux.org/index.php/microcode http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-3… https://en.wikipedia.org/wiki/Intel_Active_Management_Technology http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Eq… http://arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-…

1 0

BitTorrent, VPS and no DMCA
by Virilha 18 Feb '15

18 Feb '15

just had found being able to run a torrent seed box (in a medium bandwidth VPS, cheap) without getting DMCA requests, restarting daemon every 240 seconds - new randomized port on each restart. Using Deluge as torrent program and 8 lines of bash script to do the restart job. i forgot the restart script once and, next day, DMCA arrived. didnt bothered to found the optimal value since 240 seconds is ok for my needs. any other experiences? -Virilha

1 0

Broad coalition pushes for Minnesota data privacy amendment
by grarpamp 18 Feb '15

18 Feb '15

A move to change the Minnesota Constitution to protect text messages, e-mails and other electronic data from warrantless searches is getting enthusiastic support from a broad coalition of lawmakers and privacy advocates, but could face roadblocks from key DFL Senate leaders. The “My Life, My Data” movement would make Minnesota the second state to amend its Constitution by adding the words “electronic communications and data” to Section 10 of the document, which guarantees “the right of the people to be secure in their persons, houses, papers and effects against unreasonable searches and seizures.” If approved, the amendment would appear on the November 2016 election ballot. A similar measure passed in Missouri last year with 75 percent of voter support... Continues at... http://www.startribune.com/politics/statelocal/292136831.html http://yro.slashdot.org/story/15/02/18/0046200/mn-legislature-introduces-am…

1 0

Encryption used to secure transports is used to hide data exfiltration
by John Young 16 Feb '15

16 Feb '15

"The very encryption used to secure transports is used to hide data exfiltration." http://46qasb3uw5yn639ko4bz2ptr8u.wpengine.netdna-cdn.com/files/2015/02/IMG… http://blog.kaspersky.com/kaspersky-security-analyst-summit-2015-the-live-b…

2 1

Equation Group Multiple Malware Program, NSA Implicated
by John Young 16 Feb '15

16 Feb '15

Kaspersky Q and A for Equation Group multiple malware program, in use early as 1996. NSA implicated. <https://t.co/bByx6d25YF>https://securelist.com/files/2015/02/Equation_group_questions_and_answers.p… Dan Goodin: How omnipotent hackers tied to NSA hid for 14 yearsand were found at last <http://t.co/0n1D05GOFN>http://ars.to/1EdOXWo

1 0

Hackers can’t solve Surveillance
by stef 15 Feb '15

15 Feb '15

i think this is related and relevant to recent discussions. src: http://www.dmytri.info/hackers-cant-solve-surveillance/ quoted in full for your convenience: > Hackers can’t solve Surveillance > > Médecins Sans Frontières (MSF), also known as Doctors without Borders, is > an organization that saves lives in war-torn and underdeveloped regions, > providing health care and training in over 70 different countries. MSF > saves lives. Yet, nobody thinks that doctors can “solve” healthcare. It’s > widely understood that healthcare is a social issue, and universal health > care can not be achieved by either the voluntary work of Doctors or by way > of donations and charity alone. > > Just as Doctors can’t solve healthcare, Hackers can’t solve surveillance. > Doctors can’t make human frailty disappear with some sort of clever medical > trick. They can help mitigate issues, fight emergencies, they can be > selfless, heroic. but they can’t, on their own, solve healthcare. > > One of the ways that Hackers can fight surveillance is to develop better > cryptographic communications tools, and train people how to use them.. This > is certainly critical work that hackers can contribute to, but we can’t, on > our own, solve surveillance. > > Nothing that Hackers can do on their own can eliminate surveillance. Just > as universal healthcare is only something that can be achieved by social > means, privacy respecting mass communications platforms can only be > achieved by social means. Safe mass communications platforms can not be > created by private interests, neither commercially, nor voluntarily. > > As we well know, private medical provisioning provides unequal health care. > The reason is obvious, health needs and the ability to pay are not usually > corelated. Private provisioning means that those who can’t pay, wont be > served by profit-driven institutions, and though this can be mitigated by > voluntarism and charity, it can’t be fully overcome. > > Likewise, mass communications that are built for the profit motive either > need to charge a fee, and thereby be exclusive, or be advertising > supported. Other options can exist for connected and technically savvy > users, but these will be niche by necessity. For the masses, the main > options available will always be well funded platforms with employees to do > support, development, and marketing, without wich, it’s impossible to > build-up a mass user base. > > The lucrativeness of advertising-based platforms, makes it difficult even > for fee-based systems to compete, since they don’t generally produce enough > revenue to invest significantly in support, development and marketing, > which makes them less attractive even to users who could or would pay, but > the major issue that kills such platforms is that the fee means that some > people will not be able to use it at all. > > Thus, commercial mass platforms tend to be advertising driven. This means > that the business of platforms operators is selling audience commodity. > Commodities are sold by measure and grade. You can buy 10lbs of Fancy Grade > Granny Smith Apples, or two dozen Grade A free range eggs. Or 2 million > clicks from age 18-35 white males. > > Audience commodity, the users of the platform, are sold to advertisers, by > measure of clicks or conversion, and by grade. For advertisers, audience is > graded by specifications that include age, sex, income level, family > composition, location, ethnicity, home or automobile ownership, credit card > status, etc. The Demographics, as they say. > > Since an advertising funded platform must grade audience commodity, it must > collect data on it’s users in order to grade them. This means that the one > thing such a platform can not offer its users is privacy. At least not > privacy from the platform operators and their advertisers. > > And so long as the platform operators collect such data, there is no way > that this data will not be made available to local and foreign intelligence > agencies. > > This hard reality has been hard to grapple with, especially for a hacker > community who saw the Internet as a new realm, as John Perry Barlow wrote > in the Declaration of the Independence of Cyberspace: “We are creating a > world where anyone, anywhere may express his or her beliefs, no matter how > singular, without fear of being coerced into silence or conformity.” His > colleague, John Gilmore, famously claimed “The Net interprets censorship as > damage and routes around it.” > > Those two quotations, born of the 90s hey-day of net.culture, contrast > starkly with what Adam Curtis describes in his BBC documentary All Watched > Over By Machines of Loving Grace: > > “The original promise of the Californian Ideology, was that the computers > would liberate us from all the old forms of political control, and we would > become Randian heroes, in control of our own destiny. Instead, today, we > feel the opposite, that we are helpless components in a global system, a > system that is controlled by a rigid logic that we are powerless to > challenge or to change” > > Oddly, the film doesn’t credit Richard Barbrook and Andy Cameron who coined > the term the “Californian Ideology” in there seminal 1995 text, which was > among the first to identify the libertarian ideology endemic in Silicon > Valley culture. > > The visions of a free, uncensorable cyberspace envisioned by Barlow, > Gilmore and others was incompatible with the needs of Capital, and thus the > libertarian impulses that drives Silicon valley caused a change in tune. > Cyberspace was no longer a new world, declared independent with its own > unalienable rights, it was now an untamed frontier, a wild-west where > spooks and cypherpunks do battle and your worth is measured by your crypto > slinging skills and operational security. Rather than united denizens of a > new terrain, we are now crypto individualists homesteading in hostile > territory. > > This, as Seda Gurses argues, leads to Responsibilization, “Information > systems that mediate communications in a way that also collects massive > amounts of personal information may be prone to externalizing some of the > risks associated with these systems onto the users.” > > Users themselves are responsible for their privacy and safety online. No > more unalienable rights, no more censorship resistant mass networks, no > more expressing beliefs without fear of being silenced. Hack or be hacked. > > Since libertarian ideology is often at odds with social solutions, holding > private enterprise as an ideal and viewing private provisioning as best, > the solutions presented are often pushing more entrepreneurship and > voluntarism and ever more responsibilization. We just need a new start-up, > or some new code, or some magical new business model! This is what Evgeny > Morozov calls Solutionism, the belief that all difficulties have benign > solutions, often of a technocratic nature. Morozov provides an example > “when a Silicon Valley company tries to solve the problem of obesity by > building a smart fork that will tell you that you’re eating too quickly, > this […] puts the onus for reform on the individual.” > > Karl Marx makes a similar argument in Eighteenth Brumaire of Louis > Bonaparte: > > “The proletariate […] gives up the task of revolutionizing the old world > with its own large collective weapons, and, on the contrary, seeks to bring > about its emancipation, behind the back of society, in private ways, within > the narrow bounds of its own class conditions, and, consequently, > inevitably fails.” > > Solutionism underestimates social costs and assumes that social issues can > be solved by individuals and private interests, and some may be, but where > universality, equality and fairness need to be provided regardless of skill > or wealth this is not the case. These sorts of things can only be provided > socially, as public goods. > > Many Hackers have always known this. In a excellent Journal of Peer > Production essay Maxigas quotes Simon Yiull: > > “The first hacklabs developed in Europe, often coming out of the traditions > of squatted social centres and community media labs. In Italy they have > been connected with the autonomist social centres, and in Spain, Germany, > and the Netherlands with anarchist squatting movements.” > > Early hacklabs didn’t view their role as being limited to solutionism, > though hackers have alway helped people understand how online > communications works and how to use it securely, hackers where embedded > within social movements, part of the struggle for a fairer society. Hacker > saw themselves as part of affinity groups fighting against privatization, > war, colonialism, austerity, inequality, patriarchy and capitalism, they > understood that this was the way to a new society, working shoulder to > shoulder with mass movements fighting for a new society, and that here > their knowledge of networks and communications systems could be of service > to these movements. > > Yet, as Maxigas goes on to argue,, “hackerspaces are not embedded in and > not consciously committed to an overtly political project or idea.” > > Instead, hackerspaces often focus on technological empowerment, which is > certainly beneficial and important, but like community health centers that > teach health maintenance practices are beneficial, they can’t solve larger > social issues, such each-one-teach-one projects can not, on their own, > solve social issues like privacy or health. > > Hackers need to understand that there is no business model for secure mass > communications. In order to achieve a society where we can expect privacy > we need more hackers and hackerspaces to embrace the broader political > challenges of building a more equal society.

4 8

Re: [tor-talk] REAL-ID Internet Access Coming Soon
by grarpamp 15 Feb '15

15 Feb '15

On Wed, Feb 11, 2015 at 5:00 PM, Yuri <yuri(a)rawbw.com> wrote: > > On 02/11/2015 13:17, goofyzrnssm(a)vfemail.net wrote: >> >> If a `REAL-ID Internet Access' law were to gain traction in the U.S., how >> would such a law be enforced exactly? Use your imagination. > Real ID enforcement would violate people's anonymity rights, which are very > well protected in US (https://en.wikipedia.org/wiki/Anonymity#United_States) We're not talking about books and soapboxing today, class. We're talking about "papers please" being required for everything you do. Including, among other things, your internet access at home, mobile, in the library, coffee shop and so on. Today you can somewhat preserve your right to be anonymous and bigdata free, by manipulating inputs to some of these things. If you haven't noticed, that's become steadily harder over time. > So there is no > chance of this happening in US. Hah! That's what you think. Pending some games in the Supreme Court (if there are any brave souls left), it's already done... https://en.wikipedia.org/wiki/REAL_ID_Act > The OP was primarily concerned about other countries. No. China and Facebook were referenced as two that were already doing a semantic equivalent of REAL-ID for certain usage contexts of the internet. And it was described what will happen if you don't act. (If you know anything about history, it should be clear that that applies to all places on the planet, and that failure to act gets you what they want, not what you want.) You can add Russia to the list now too... http://yro.slashdot.org/story/15/02/11/2245240/russia-seeking-to-ban-tor-vp…

3 2

Encrypted mailing lists and anonymous collaboration
by Mike Ingle 15 Feb '15

15 Feb '15

Confidant Mail now has a beta encrypted mailing list feature. It works like a normal mailing list in that you send a message to the listserv address and the message is remailed to all the recipients. Unlike regular mailing lists, access is controlled by public keys, so only a list of approved keys can send to the list. The messages are signed by the listserv's key, and by clicking Show Original you can also check the signature of the original sender. Large file attachments can be included in mailing list posts. Confidant Mail can operate through Tor or I2P, so anonymous participants can take part in a discussion without exposing their real-world identities. In addition to the mailing list feature, I have added a file server. You can send attachments to the file server, and they will be saved to a shared directory. Other users can send get requests to retrieve the files. There is an access control list, so specific public keys can be granted read-only, write, or overwrite access. Using the mailing list and file server, it is easy for a small group to collaborate on a project while some or all of them remain anonymous. Even the operator of the listserv can be anonymous behind Tor. Please email me if you want to help test this out. Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

1 0

Hackers CAN Solve Surveillance
by grarpamp 14 Feb '15

14 Feb '15

Hackers can't solve Surveillance? No, hack*ing* can't solve surveillance. Hacking is a bandaid that carries no political or legal weight whatsoever. All of it can be brushed aside with the simple stroke of a pen. Yet hack*ers* CAN solve surveillance. However currently, they simply are not doing anything useful there. Here's some examples of what hackers are doing in just the news from today... They're giggity about features... http://tech.slashdot.org/story/15/02/12/2323200/facebook-adds-legacy-contac… Trying to get hired at companies that have questionable loyalties to their users... http://apple.slashdot.org/story/15/02/13/2338234/apple-hiring-automotive-ex… Putting the wrong spin on their own inventions... http://it.slashdot.org/story/15/02/13/1548202/new-encryption-method-fights-… And masturbating over version numbers as usual... http://linux.slashdot.org/story/15/02/13/1341213/torvalds-polls-desire-for-… Meanwhile... Since hackers weren't speaking up as to what they wanted politically and steering the decisions there, Corp and Gov tired of waiting for their leadership and decided to come up with their own plans in the vacuum... http://yro.slashdot.org/story/15/02/13/1711225/tech-industry-in-search-of-l… Nations are now asking them for their "papers please"... http://tech.slashdot.org/story/15/02/13/1821249/eu-preparing-vast-air-passe… Figuring out more ways to collect and share your privates and rape your devices... http://tech.slashdot.org/story/15/02/13/141215/iowa-wants-to-let-you-carry-… And the whole world is conspiring to royally fuck them and their ideas... http://yro.slashdot.org/story/15/02/13/2259255/trans-pacific-partnership-en… Today's freedom score is, ZERO for you, and FOUR for them. Hackers among you... hacking is NOT just about what comes out of your keyboard while heads down staring at it. It is, and now must be, more about what comes out of your mouth while standing up in the political arena. Code is a byproduct of and requires the freedom to write and use it. Those freedoms are being ripped out from under you while you sleep off your last all night coding session. It's time to wake up and get out from behind your keyboards. No one is going to do it for you.

2 1

Re: Security/Privacy Tradeoff - Dave DeWalt of Mandiant
by John Young 14 Feb '15

14 Feb '15

Well, it has been a generation since this standard business practice was challenged. And then went to covert cooperation to placate consumer anger. Why would a new generation not do the same as their mentors? Even here, among hackers, in universities, in corporations, in government, hats change colors, as heads and wallets and guts fatten. Hellman has said he regrets releasing PKC, succumbing to a young man's and scholar's desire for publicity over bland government secrecy. Now thinks national security is bigger than individual desire. This is the arc of maturity, especially from those who did gain publicity early on and now welcome invitations to serve as official advisors. Our cpunk heros Whit Diffie and David Wagner are serving as reviewers for NSA best cybersecurity paper. Others are invited to NSA and Congress to provide counsel to policymakers. Others peddle crypto to governments and corporations as if RSA, Google, Apple, Facebook, Twitter, the AV hustlers are the required standard of duplicity demanded by investors. At 12:08 AM 2/14/2015, Travis Biehn wrote: > From the article > <http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca…>http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca… > >"Dave DeWalt, CEO of security firm Mandiant, a participant in >Friday's summit, hopes that fear of privacy invasion won't get in >the way of the work that needs to get done. He pointed to the way >the way public backlash to government surveillance programs revealed >by former NSA contractor Edward Snowden stymied previous efforts to >effectively open the lines of communication. > >"This balance between privacy and security ebbs and flows and >unfortunately that was a huge setback -- a setback to the tune of >several years," he said. >" > >This is the first that I've ever heard of a tradeoff between privacy >and security in the context of 'cyber security'. >It's interesting to see this common trope for justifying widespread >erosion of privacy in meatspace applied to 'cyber', where it is even >more egregiously wrong. > >Travis

1 0