April 2015 - cypherpunks - lists.cpunks.org

Invalidity of ODNI Statements
by Wilfred Guerin 22 Apr '15

22 Apr '15

With today's statistics from DNI and last month's "Privacy Statement" PDFs from *some* of the American "IC" (sans DEA, US Marshals Domestic Intelligence), you will notice some glaring exceptions: "experimental research and training" and "Oversight"... ALL NSA and sigint is offloaded to "Civil Liberties Infrastructure" to assure "Oversight" and mutual access to "Global Partners" , and, OIG units all feed FBI OIC "Office of Integrity and Compliance" whitch retains all data for exhaustive analysis with certain military partners without limitation nor "Oversight" -- typical of the mob who took over from Hoover in the 1970s. FBI OIC Kelley is uncle of Petraeus' mistress Jill Kelley, DNI CLPO Alexander Joel is grandson of Clarence Kelley. Oversight = absolute exploitation. Oh, and CIA analytics director Kelley ran Dell Computer Japan. Snowed in with Miranda, right? Nice to run the "Oversight" offices, eh Kelley? X-Ray that. "Experimental" (exhaustive) NSA returns findings to "Official Story" NSA and others.

1 0

Quantum Insert detection for everyone
by David Stainton 22 Apr '15

22 Apr '15

Greetings, Did you all see this Wired article about Quantum Insert detection? https://www.wired.com/2015/04/researchers-uncover-method-detect-nsa-quantum… These TCP injection attacks are used by various entities around the world (not just NSA!) to target individuals for surveillance or perhaps to add their computers to a botnet for other purposes. If you do not use a VPN or Tor you can run "Quantum Insert" detection on your computer and detect when you receive an attack attempt. However be advised that proper sandboxing is important here because intrusion detection and protocol anylsis tools are notoriously insecure and get pwned all the time. If you are a Tor exit relay operator you have the options of running detection software; However you should not publish the results publicly without mixing in some noise or your published data might make it possible for some adversaries to deanonymize Tor users. If your country has strict telecommunications laws then it might only be legal for you to perform this type of detection if you do not perform logging. For the past several months... in my free time I've been slowly developing a very comprehensive TCP injection attack detection tool called HoneyBadger: https://github.com/david415/HoneyBadger Quantum Insert is a NSA codeword for "TCP injection attack", however either of these terms are too vague. During my research I was able to classify 4 different types of TCP injection attack. When I say that HoneytBadger is comprehensive what I mean is that Honeybadger can detect ALL of these types of TCP injection attack types... I describe them briefly here: https://honeybadger.readthedocs.org/en/latest/ Here's the Fox-IT blog post about their Quantum Insert detection software: http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ I am going to work on writing a much more comprehensive blog post; it will be filled with gory technical details AND it will include information on how to use HoneyBadger. HoneyBadger has optional (off by default) full-take logging which could enable you to capture a zero-day payload from a TCP attack; you should then responsibly disclose to the software vendor or contact a malware analyst to help out! Sincerely, David Stainton

1 0

jump the paywall
by coderman 22 Apr '15

22 Apr '15

Jumping the Paywall: How to freely share research without being arrested. This workshop will identify and address two safety-critical problems permeating research today: lack of total free access to scholarship, and the looming threat of apprehension for trying to facilitate said free access. The workshop will hypothesize workable solutions to the stated problem sets by presenting actionable intelligence and exploring tactical modes of engagement in the on-going copyfight via the exploration of securing free access to scholarship (in the form of academic e-journal articles and e-books), and via developing avoidance strategies to forego existent and emergent threats of apprehension resulting from participation in the practices of free access. Topics covered will include: --> Content access procurement --> Operational security during field deployment --> Watermark, metadata and content-protection identification and removal --> Content distribution Huh? Ever try to view a journal article only to slam into an extortionate paywall? Then you should stop by. Where? PSH (NAB) 314 Goldsmiths, University of London https://www.gold.ac.uk/find-us/ When? Date: Friday, 24 April 2015 Time: 15.00-17.00

4 3

Finally Barbie became clever the new "hello Barbie"
by dans＠openmailbox.org 22 Apr '15

22 Apr '15

Hi everybody. Have you seen the next Barbie Doll called 'hello Barbie. It has a microphone and wi-fi conection, when the kids talk to 'her' the talking is sent to a server where the answers of Barbie are written and improved. Of course there'll be an app for the parents to later listen the chats of their kids with Barbie. I think is not necessary to point out the implications of the subject

8 9

cryptography@metzdowd.com
by grarpamp 22 Apr '15

22 Apr '15

http://gizmodo.com/dhs-secretary-begs-silicon-valley-to-stop-the-encryptio-… "DHS has a specific agenda, which is to push back on the call for encryption" "help the government have more access to unencrypted data" "new DHS outpost is part of a much larger agenda" "attracting engineers away from the private sector" "Voluntary" Information" "Sharing" "We need your help to find the solution." Choose your own response: A) I'm a sheep. B) Sorry bruh, ain't happenin.

3 2

Raspberry pi safe?
by Edd thompson 21 Apr '15

21 Apr '15

I am saving my pennies to build my pc that will be relatively secure and private. Raspberry pi b+ Cell shield add on for above Prepaid sim (paid in cash) Bluetooth stick Wifi stick (looking for one with least security issues but they all seem to be in bed with Al-Shaitain) Lcd screen Sdr transceiver Punch the security holes that you see or possibly give me better substitutes Thanks for your time TTFN

8 16

New Jersey Police Officer Caught Selling Bitcoin Mining Equipment
by L0R3NZ 5Z4B0 21 Apr '15

21 Apr '15

I have a long-time fascination for all things LE & military. One of the most intriguing ideas is LE or military “operators” switching sides from “good to bad" – be it in real-life or in fiction. Of course getting older (and less naive I guess) I realise it is not about switching sides: it is about all things being grey instead of black vs white separated by a thin blue line. (My favourite examples are gang members infiltrating the US military and of course the Los Zetas founded by former members of the Mexican army: the "most technologically advanced, sophisticated, and dangerous cartel operating in Mexico.” Current examples that got my attention: no.1 Teresa Shea, James Shea, DRS Signal Solutions and Oplnet LLC and no.2 Carl Mark Force IV.) Now, this little story below: New Jersey Police Officer Caught Selling Bitcoin Mining Equipment. I believe we will read a lot about such in coming months and years. Interesting times for Cypherpunks and Crypto Anarchists… – BizDevCon ### New Jersey Police Officer Caught Selling Bitcoin Mining Equipment http://www.newsbtc.com/2015/04/21/new-jersey-police-officer-caught-selling-… A New Jersey cop Vincent Saggesse, 32, who works for the Plainfield PD and is a member of the Union County SWAT Team, has been caught selling stolen Bitcoin mining equipment in an undercover sting operation. Somerset County Prosecutor Geoffrey Soriano revealed that the disgraced police officer met twice with an undercover agent to work out a sale agreement of the hot KnCMiner Neptune units. However, it is yet to be discovered whether the cop had a clear idea of what he was selling. Soriano also desisted from disclosing the source of the units. The dishonest law enforcement officers seem to be warming up to Bitcoin for their personal gains. Just three weeks back, two former federal agents were convicted of stealing Bitcoins during the federal investigations of the online black market Silk Road. The reason for police officers dirtying their hands by illegal Bitcoin activities may be that since the government is not yet fully interested in the cryptocurrency, they hope to find an easy escape route. Saggesse’s boss and Plainfield police director Carl Riley said, “I, of course, am very disappointed regarding the circumstances, and I’m sure his colleagues are disappointed as well.” The police department has taken strong action against Vincent – charged him with Official Misconduct 2nd Degree and Receiving Stolen Property 3rd Degree – and suspended him without pay, pending the disposition of the case. The charges of official misconduct were levied because Saggesse was involved in another crime – receiving $250 in bribe from the undercover agent in exchange for giving him certain details which included address of a license plate owner along with a photo. To this, the Somerset Prosecutor said, “Such information is available to law enforcement officers through various computer platforms that are to be used solely for law enforcement purposes.”

1 0

What Exactly Is Encryption?
by Robert Hettinga 21 Apr '15

21 Apr '15

http://www.wsj.com/articles/encryption-uncoded-a-consumers-guide-1429499476… What Exactly Is Encryption? Encryption turns messages into a string of unreadable characters. Photo: Getty Images By Elizabeth Dwoskin April 19, 2015 11:11 p.m. ET In times like these, it’s easy to be paranoid. Concerned by reports of hacking, data breaches and government spying, companies and consumers are looking for better ways to protect their data. Many are turning to encryption, a method of encoding messages that goes back millennia. Encryption is commonly used to secure online banking sessions and to protect credit-card data. But for the average computer user, it remains a mystery. Here’s a brief guide to help readers unlock its secrets. How does encryption work? If you saw the recent movie “The Imitation Game,” you’ve seen a rudimentary, by modern standards, form of encryption. During World War II, the Germans used a machine to turn military messages into coded strings of symbols. These days, computers running complex mathematical formulas can do the same thing much faster, and the codes are much harder to crack. What’s it used for? If you’ve ever done banking online, you may have noticed a “lock” icon in the address bar, or that the bar turned green. That means the browser session is encrypted by your bank. Consumers can download a growing crop of encryption tools for texting, browsing sessions and video and phone calls. Users usually must download an app or install software that scrambles messages as they are sent. (The recipient needs to be using the same app or software to unscramble the message.) Apple has started encrypting personal data on its latest mobile operating system, iOS 8. This means an outsider who hacks into a device or into Apple’s servers would see a string of unreadable characters instead of actual messages or FaceTime videos. Can I encrypt email messages? Yes, but it’s tricky. Sender and receiver must use the same type of encryption. If you have encryption switched on, but the friend you’re emailing doesn’t have it, he or she won’t be able to read your message. Since the revelations of former National Security Agency contractor Edward Snowden about electronic eavesdropping by the NSA, big tech companies have made moves to add encryption. Yahoo Inc. and Google Inc. both have announced plans to begin encrypting emails of users of their services, but the projects are moving slowly. Can encryption really protect me from getting hacked? ENLARGE Maybe. If a hacker obtains the encryption keys, or the formula that unlocks the code, all that encrypting was for naught. And that happens all the time in corporate data breaches, says Avivah Litan, a vice president and senior analyst focusing on security issues at market-research firm Gartner Inc. For example, as part of the 2007 breach at TJX Cos., hackers stole a TJX point-of-sale card-reader system and brought it home. The hackers were able to break the code used to encrypt card transactions and stole data from tens of millions of customer accounts. How can I get started? In addition to Apple’s built-in encryption in its new mobile devices, Android users can download WhatsApp, which encrypts text messages. WhatsApp, a company owned by Facebook Inc., says it is working on offering encryption for all communication sent between WhatsApp users, including images, audio and text. A number of vendors—including Voltage Security Inc., Protegrity and RSA Security, a unit of EMC Corp. —offer encryption of corporate data, including email and credit-card records. Silent Circle’s Blackphone is a phone for corporate users that can send encrypted voice calls, text, emails and other data—if both parties are using a Blackphone. Why isn’t everything encrypted? There are plenty of reasons. Encryption is time-consuming and difficult to implement. It’s hard to properly manage who has access to encryption keys, and it slows system performance. Ms. Dwoskin is a reporter in the San Francisco bureau of The Wall Street Journal.

3 2

Welcome to the FUTURE: US cops pay Bitcoin ransom to end office hostage drama
by Georgi Guninski 21 Apr '15

21 Apr '15

http://www.theregister.co.uk/2015/04/13/us_police_ransomware/ Welcome to the FUTURE: US cops pay Bitcoin ransom to end office hostage drama > After trying to restore the encrypted files for a couple of days, the > police in Maine decided to pay the $300 ransom in Bitcoins.

6 8

None
by Juan 20 Apr '15

20 Apr '15

How is this bullshit translated into plain english? http://www.forbes.com/sites/thomasbrewster/2015/04/17/darpa-nasa-and-partne…

6 5