July 2015 - cypherpunks - lists.cpunks.org

first annual I2Pcon in Toronto August 15-16 #I2PCon #I2PToronto
by Seth 29 Jul '15

29 Jul '15

I2P Meetup Hacklab.to Saturday, 15 August 2015 at 2:00 PM - Sunday, 16 August 2015 at 11:30 PM (EDT) Toronto, Ontario https://www.eventbrite.ca/e/i2p-meetup-tickets-17773984466 I should also mention that I2P's budget contains 0% government funding. https://twitter.com/GetI2P/status/583731852504133633 If you have long term concerns (like me) about the Tor project's funded-by-the-adversary-slopping-at-the-government-blood-money-trough funding model, maybe you can (like me) put your money where your mouth is and kick some Bitcoin down to a mixnet privacy project that does suffer from this compromise.

1 0

another google nugget
by Juan 29 Jul '15

29 Jul '15

Yep. I've forgotten about this one. Just the thing for all the list's neocunts. https://en.wikipedia.org/wiki/Boston_Dynamics "don't be evil"

10 10

"Stagefright" text attack to Android.
by jim bell 29 Jul '15

29 Jul '15

http://www.theinquirer.net/inquirer/news/2419531/text-based-android-stagefr… "A MOBILE SECURITY RESEARCHER has done his work and found a cluster of vulnerabilities in Android that, when combined, present a problem for 95 percent of the user base. This is bad stuff. Despite references to unicorns in the official information, there is also some goosebump-inducing wordplay. The official warning is that almost anyone with an Android mobile phone can be sent one text message and be plunged into security chaos. This threat package has been dubbed Stagefright by Joshua Drake from the security outfit Zimperium zLabs. "Gaining remote code execution privileges merely by having access to the mobile number? Enter Stagefright. The targets for this kind of attack can be anyone from prime ministers, government officials, company executives, security officers to IT managers," said the firm in a blog post. "[We] dived into the deepest corners of Android code and discovered what we believe to be the worst Android vulnerabilities discovered to date. These issues in Stagefright code critically expose 95 percent of Android devices, an estimated 950 million devices." If this does not have you standing on a chair pushing your phone away with a broomstick, then get ready for this. Zimperium said that Stagefright is worse than Heartbleed - and we all know how that worked out."

1 0

Re: Re: SIGINT and improving wireless privacy at the PHY
by wirelesswarrior＠Safe-mail.net 29 Jul '15

29 Jul '15

Probably the result of DDoS and other exploit attacks against the site. > On Sun, Jul 26, 2015 at 09:01:22PM -0700, Jason McVetta wrote: > > The server at www.wirelessvillage.ninja sez: "Chances are, if you got this > > page, that means the server doesn't like something about you. You may be > > using an invalid HTTP option, or an evil browser string, or maybe just from > > a country we are leery of." > > same from some random tor exitnode. the ops seem to hate freedom or at least > anon visitors > > -- > otr fp: https://www.ctrlc.hu/~stef/otr.txt

4 3

Re: Hackers Remotely Kill a Jeep on the Highway
by Shelley 28 Jul '15

28 Jul '15

On July 24, 2015 5:13:46 AM Georgi Guninski <guninski(a)guninski.com> wrote: > Not sure if this is true: > > http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ > <quote> > I was driving 70 mph on the edge of downtown St. Louis when the exploit > began to take hold. > ... > Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee > started blasting cold air at the maximum setting, chilling the sweat on > my back through the in-seat climate control system. Next the radio > switched to the local hip hop station and began blaring Skee-lo at full > volume. I spun the control knob left and hit the power button, to no > avail. Then the windshield wipers turned on, and wiper fluid blurred the > glass. > ... > The result of their work was a hacking technique—what the security > industry calls a zero-day exploit—that can target Jeep Cherokees and > give the attacker wireless control, via the Internet, to any of > thousands of vehicles. > ... > I mentally congratulated myself on my courage under pressure. That’s > when they cut the transmission. > > Immediately my accelerator stopped working. > </quote> > It's true. This isn't the first time these guys have demonstrated this kind of exploit. I heard an interview with Greenberg on NPR earlier in the week. Fascinating and terrifying! -S

17 28

Fwd: [liberationtech] Introducing SeeOnce
by Razer 28 Jul '15

28 Jul '15

-------- Forwarded Message -------- Subject: Introducing SeeOnce Date: Mon, 27 Jul 2015 17:40:55 -0500 From: Francisco Ruiz <ruiz(AT)iit.edu> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> To: liberationtech <liberationtech(a)lists.stanford.edu> Newsgroups: gmane.technology.liberationtech Hello LiberationTech subscribers, SeeOnce is a new web app that encrypts text and files with forward secrecy. This is achieved by changing keys with every message rather than using a server to store keys or encrypted material. SeeOnce consists of a single, relatively small html document, which doesn't connect to any servers. It is based on a javascript implementation of TweetNaCl, plus WiseHash, a dictionary-based key entropy meter that adds a variable number of scrypt key stretching rounds for weaker keys. Forward secrecy is obtained through a protocol similar to OTR messaging, except that communications are expected to be asynchronous. SeeOnce connects to the browser's default email through conventional mailto and web links, so users don't need to install anything. Removal of ephemeral data can be done via a single button. Another important goal is to make key exchange transparent to the user, so that even complete novices can use it right away. Please take a look at SeeOnce and give us any suggestions you might think appropriate. The preferred way is by starting Issues at the project's GitHub page at: https://github.com/fruiz500/SeeOnce The app is directly downloadable from https://seeonce.net. A Chrome app, able to synchronize its data through Google servers, is available at:Â https://chrome.google.com/webstore/detail/seeonce-privacy/jbcllagadcpaafoek… Thank you very much. -- Francisco Ruiz Associate Professor MMAE department Illinois Institute of Technology PL22ezLok=gqqjw-pq3eu-sgzpp-j87cn-fh7ik-6kvmn-comx2-b4xfn-gihga-s46e4=PL22ezLok h**ps://www 'dot' youtube 'dot' com/watch?v=UOJXI8E0lKY get the PassLok privacy app at: https://passlok.com <http://passlok.com>

1 0

the LibGen situation
by Eugen Leitl 28 Jul '15

28 Jul '15

https://www.reddit.com/r/Scholar/comments/3bs1rm/meta_the_libgenscihub_thre…

1 0

Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway)
by wirelesswarrior＠Safe-mail.net 28 Jul '15

28 Jul '15

Jim, Only what I have read. The reviews by professionals have been very favorable given its price though not in the same league as pro equipment. Some use it often to take into the field while leaving their expensive gear safe on the bench. The software is also well reviewed though closed source, AFAIK. WW -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>, "wirelesswarrior(a)Safe-mail.net" <wirelesswarrior(a)Safe-mail.net> Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> Subject: Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway) Date: Tue, 28 Jul 2015 06:11:20 +0000 (UTC) > > > From: jim bell <jdb10987(a)yahoo.com> > From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> > > > > wirelesswarrior(a)Safe-mail.net <wirelesswarrior(a)Safe-mail.net> writes: > > > > >>For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, > .>>that not long ago were in the $10,000s. The HackRF (which some have > >>complained is little more than an IF strip) effectively covering down to > >>below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is > >>not in the same league as the 16-bit USRPs). If some hardware hacker were to > >>deliver a 14-16 bit ADC daughter board (there are afforadble chips offering > >>up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it > >>could substantially improve its use. > > >The problem with the HackRF (and other USB-based devices) is the bandwidth of > >the USB connection, it's not that the HackRF hardware can't handle it, it's > >that you can't get that much data to the PC. > > >(I have a HackRF - I needed a cheap way to track down some odd RFI issues - > >and it's a pretty cool piece of hardware for the money, but, as I mentioned > >earlier, you do get what you're paying for. If I could make a wishlist, it'd > >be nice to have a rev.2 with some work done on the front- end...). > > Do you know anything about this model: http://www.triarchytech.com/index.html 4, 6, 8, and 12 GHz units. > > Jim Bell > > > > > > > > > > > > > > > > > > > >

1 0

Intercept receivers (was Re: Hackers Remotely Kill a Jeep on the Highway)
by wirelesswarrior＠Safe-mail.net 28 Jul '15

28 Jul '15

-------- Original Message -------- From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Apparently from: cypherpunks-bounces(a)cpunks.org To: jdb10987(a)yahoo.com Cc: cypherpunks(a)cpunks.org Subject: Re: Hackers Remotely Kill a Jeep on the Highway Date: Sun, 26 Jul 2015 21:42:14 +1200 > jim bell <jdb10987(a)yahoo.com> writes: > > >There are some rather economical spectrum analyzers being sold today. > > You have to be careful with those, the straight USB-dongle ones are going to > be SDR-based, typically the RTL820T meant for DVB-T use (and re-purposed by > half the hacking world for all manner of other things), then you have the USB- > interface ones with more powerful SDRs, and finally you've got purpose-build > spectrum analysers. Compared to the real thing, you're going to run into > severely limited bandwidth (anything that spreads the signal across a wide > spectrum is going to be difficult to impossible to deal with), and not-so- > spectacular signal handling (there's a reason why the real thing costs > thousands of dollars). > > That's not to say that they're no good, just that you need to be aware that > you're getting what you pay for. If you've got a specific purpose in mind, > check first that whatever you're getting will be able to do the job. There's > quite a bit of material out there on this, google something like "sdr spectrum > analyzer" to find articles on it. > > Peter. Achieving receivers and spectrum analyzers with wide frequency coverage, high dynamic range and wide bandwidths (with very low noise circuitry, stable local oscillators, etc.) simultaneiously has, up till recently, demanded very high prices. That's why few outside of governments, corporations and well-funded professionals could afford them. However, with the rapid growth and falling prices of SDR this has and is changing. For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, that not long ago were in the $10,000s. The HackRF (which some have complained is little more than an IF strip) effectively covering down to below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is not in the same league as the 16-bit USRPs). If some hardware hacker were to deliver a 14-16 bit ADC daughter board (there are afforadble chips offering up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it could substantially improve its use. WW

3 3

Varoufakis claims had approval to plan parallel banking system for Greece
by John Young 28 Jul '15

28 Jul '15

Varoufakis claims had approval to plan parallel banking system for Greece http://www.ekathimerini.com/199945/article/ekathimerini/news/varoufakis-cla… Allegedly aided by Columbia University IT professor to design a hack of existing taxation systems. Columbia Computer Science Faculty http://www.cs.columbia.edu/people/faculty

3 6