July 2015 - cypherpunks - lists.cpunks.org

How do cookies on Twitter give me "safer experience"?
by Georgi Guninski 27 Jul '15

27 Jul '15

With javascript and cookies disabled, go to https://twitter.com/ Orange CSS shit which can't be closed with the "X" suggests: > Cookies help personalize Twitter content ... and provide you with a > better, faster, safer Twitter experience. By using our services, you > agree to our Cookie Use. Me fails to see how browsing Twitter with cookies enabled makes me any any safer. How so?

3 2

Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway)
by wirelesswarrior＠Safe-mail.net 27 Jul '15

27 Jul '15

Peter and Jim, -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>, "wirelesswarrior(a)Safe-mail.net" <wirelesswarrior(a)Safe-mail.net> Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> Subject: Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway) Date: Mon, 27 Jul 2015 15:31:17 +0000 (UTC) From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wirelesswarrior(a)Safe-mail.net <wirelesswarrior(a)Safe-mail.net> writes: >>For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, .>>that not long ago were in the $10,000s. The HackRF (which some have >>complained is little more than an IF strip) effectively covering down to >>below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is >>not in the same league as the 16-bit USRPs). If some hardware hacker were to >>deliver a 14-16 bit ADC daughter board (there are afforadble chips offering >>up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it >>could substantially improve its use. >The problem with the HackRF (and other USB-based devices) is the bandwidth of >the USB connection, it's not that the HackRF hardware can't handle it, it's >that you can't get that much data to the PC. The HackRF contains a LPC4320 which has unused capacity for light DSP and other tasking. For any heavy DSP it could use a FPGA. It has an internal header for expansions like this (and/or a higher resolution ADC and its CPLD can be reflashed to accomodate such changes. >(I have a HackRF - I needed a cheap way to track down some odd RFI issues - >and it's a pretty cool piece of hardware for the money, but, as I mentioned >earlier, you do get what you're paying for. If I could make a wishlist, it'd >be nice to have a rev.2 with some work done on the front- end...). The HackRF, like all wideband, direct conversion, receivers, can suffer LNA saturation from nearby/very strong out-of-band signals (pagers and FM broadcasts). A cheap, simple, solution is a coax notch filter, in line with the antenna. I've been experimenting with these and they seem to work very well. From: jim bell <jdb10987(a)yahoo.com> Here's my idea for a probe for an RF device. The wavelength of a 2.45 GHz signal (WiFi) is about 12 cm. A quarter-wave antenna would be 3 cm. Or, that 3 cm could be in the form of a loop, at the end of a piece of.'hardline', or other coaxial cable. (hardline would be best, I think, because it is a small diameter. ) https://en.wikipedia.org/wiki/Coaxial_cable So, the diameter of the loop would be a bit more than 1 cm diameter, which is appropriate for finding tiny RF sources. One side of the loop would be connected to the center conductor of the coax, and the other side of the loop connected to the shield of the coax. Note: The coax should probably have many dissipative RF beads strung along its length, in order to prevent the cable itself from picking up RF, and delivering to the loop on the end, thereby to be detected. http://www.amidoncorp.com/small-ferrite-beads/ There are many different kinds of materials that such beads are made from; perhaps we can have an RF engineer chime in on the subject. He can also tell us if the loop is too-badly mismatched (RF impedence) to the coax to function well. Jim Bell Try it!

1 0

Re: Varoufakis claims had approval to plan parallel banking system for Greece
by Georgi Guninski 27 Jul '15

27 Jul '15

On Mon, Jul 27, 2015 at 01:11:51PM +0200, Jorge SoydelBierzo wrote: > > Varoufakis denies this info http://twitter.com/yanisvaroufakis/status/625336067831558144 > > Don't know what the truth is. >From TFA: === Recorded call You can find extracts from the conversation below. Varoufakis was advised that the call was being recorded when it began. === === Normal Lamont interrupts: "There are certainly others listening but they will not tell it to their friends." Varoufakis (laughing): "I know. I know they are. And even if they do I will deny I said it === > > El 27/7/2015, a las 12:34, Georgi Guninski <guninski(a)guninski.com> escribió: > > > >> On Sun, Jul 26, 2015 at 06:38:07PM -0400, John Young wrote: > >> Varoufakis claims had approval to plan parallel banking system for Greece > >> > >> http://www.ekathimerini.com/199945/article/ekathimerini/news/varoufakis-cla… > >> > >> Allegedly aided by Columbia University IT professor to design a > >> hack of existing taxation systems. > >> > >> Columbia Computer Science Faculty > >> > >> http://www.cs.columbia.edu/people/faculty > > > > From TFA (looking for the best, but expecting the worst): > > > > === > > “But let me give you an example. We were planning along a number fronts. > > I will just mention one. Take the case of the first few moments when the > > banks are shut, the ATMs don’t function and there has to be some > > parallel payment system by which to keep the economy going for a little > > while, to give the population the feel that the state is in control and > > that there is a plan.” > > === > > > > > >

1 0

SIGINT and improving wireless privacy at the PHY
by wirelesswarrior＠Safe-mail.net 27 Jul '15

27 Jul '15

I will be co-presenting a paper, with Ettus' Balint Seeber, at Defcon 23 (Balint will also be presenting a separate, coordinated, paper). http://www.wirelessvillage.ninja/speakersched.html WW

4 3

DMARC report mailing list subscriber address leaks
by Seth 25 Jul '15

25 Jul '15

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list. I can start posting them publicly if anyone's interested.

5 8

Re: Poitras joins Roark in pro se solidarity
by John Young 25 Jul '15

25 Jul '15

USG may use Poitras suit to try Snowden absentia as well as to suppress withholders of his slow dripping public dump. At 07:49 AM 7/25/2015, you wrote: >rules of the road: > http://cryptome.org/2015/07/poitras-003.pdf

2 1

Re: Hackers Remotely Kill a Jeep on the Highway
by Razer 25 Jul '15

25 Jul '15

From offlist: On 07/24/2015 01:24 PM, Peter Fairbrother wrote: > Fiat Chrysler recalls 1.4 million cars after Jeep hack > > http://www.bbc.co.uk/news/technology-33650491 Was just cruising twitter and noticed that @Uconnect is touting the patch for their Chrysler in-car entertainment system. I suspect the lack of 'firewall' between it and the car control circuitry was similar to the problem that caused a China-base Mattel contractor to send lead-painted toys to be included in (was it BK?) 'happy meals' for kids. The problem? What the toy was going to be used for simply wasn't mentioned in the specs delivered to the contractor so they never took it into consideration to use a non-toxic coating. In this case it looks like the in-car entertainment system manufacturer simply wasn't aware of the rest of the circuitry in the vehicle, and it wasn't mentioned by Chrysler, so they never even thought about it. RR

4 6

Poitras joins Roark in pro se solidarity
by coderman 25 Jul '15

25 Jul '15

rules of the road: http://cryptome.org/2015/07/poitras-003.pdf

1 0

Building a trustworthy computer OSCON talk by Matthew Garrett
by Seth 24 Jul '15

24 Jul '15

Not sure if anyone was attending OSCON today and caught this talk earlier, but if have audio or video please post. http://www.oscon.com/open-source-2015/public/schedule/detail/41536 Building a trustworthy computer Matthew Garrett (CoreOS) 11:10am–11:50am Friday, 07/24/2015 Protect D139/140 Tags: Open hardware, Tools and techniques, Geek life lifestyle Average rating: ***** (5.00, 1 rating) Rate This Session Slides: http://cdn.oreillystatic.com/en/assets/1/event/129/Building%20a%20trustwort… Prerequisite Knowledge Some knowledge of the major components of a modern computer and how they fit together, but no detailed knowledge of firmware or hardware design is required. Description The Snowden revelations demonstrated the lengths that government agencies were willing and able to go to in order to subvert computers. But these attacks aren’t limited to state-level actors – security researchers continue to demonstrate new vulnerabilities and weaknesses that would permit sophisticated criminals to achieve the same goals. In the face of these advanced attacks, what can we do to detect and mitigate them? How can we make use of existing security features, and what changes can we make to system design? In short, how can we ensure that a user can trust that their computer is acting in their interests rather than somebody else’s? This presentation will cover some of the existing security features and recent design changes in systems that can make it easier to detect attacks, and provide mechanisms for defending against them in the first place, along with simple design changes that would make it easier for users to ensure that components haven’t been backdoored. In addition it will discuss some of the remaining challenges that don’t have solid answers as yet. Topics covered will include: Firmware security Trusted platform modules, attestation, and associated privacy risks Hardware design to support offline verification Remaining components that could act against the interests of the hardware owner Photo of Matthew Garrett Matthew Garrett CoreOS Matthew Garrett is a security developer at CoreOS, specializing in the areas where software starts knowing a little more about hardware than you’d like. He implemented much of Linux’s support for UEFI Secure Boot, does things with TPMs and has found more bugs in system firmware than he’s entirely comfortable with.

1 0

Message of Concern re. CSIS action sent from Cryptostorm
by odinn 24 Jul '15

24 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, A tweet was sent out from Cryptostorm concerning one of their staff who was apparently taken away by the CSIS: https://twitter.com/cryptostorm_is/status/624070397219180544 The text of the tweet: "Core cryptostorm team member @grazestorm is currently held hostage by rogue CSIS agents. Not a joke. Deadly serious. Please copy/RT broadly." The tweet was timestamped 9:15 PM - 22 Jul 2015 For reference, the CSIS is the Canadian Security Intelligence Service. Please keep eyes on @cryptostorm_is twitter feed and provide them with moral and any other support you deem appropriate. Cryptostorm are good people. - -O - -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJVsHgzAAoJEGxwq/inSG8CCZYH/1g2n2d+Magp+N1zn41oMhOo UU//rIsLkx3Erjbdy1Q8k78vg5MePmOqX6DrvrIKpj+Uai6QSefVYhbwQU0inJ7w rcR6I7Sq7twSxc9vHUOOGLnshf4bVaKsjL4Q0PUneFNdF93EOAUUx/+0lIe4AcxK PZU51ZOsXaTBej6oi+MSLEQWCZ5RqBi8SKCeNVP7nQ6g75+zW/8MRQ1mHwJ3xz4/ 9I+vb2EwSJ/tI2A0OajTxyxezuOCzutBZyVQ5q5T04+IXvtFt/1TVNlQGAji4cA4 +DrSKfhnWbcFOTqDX35OckL1SGQCF8IgaisgVWxAsS3vcmXQVHqb9mMm0KHiGGk= =P2S0 -----END PGP SIGNATURE-----

4 5