July 2015 - cypherpunks - lists.cpunks.org

Quantum Cryptography
by Chris Magistrado 24 Jul '15

24 Jul '15

I've been lurking for awhile, but haven't seen too much on this subject. There's this DC talk that I was thinking of attending. https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Aumasson Thoughts, references or white papers<3 ?

1 0

Hackers Remotely Kill a Jeep on the Highway
by Georgi Guninski 24 Jul '15

24 Jul '15

Not sure if this is true: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ <quote> I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. ... Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass. ... The result of their work was a hacking technique—what the security industry calls a zero-day exploit—that can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. ... I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission. Immediately my accelerator stopped working. </quote>

4 4

an ominous comment
by dan＠geer.org 24 Jul '15

24 Jul '15

Discussing security policy post-OPM debacle in a setting to which I have access (sorry to be oblique), it was said by a CxO "We have to prepare for the day when no software we depend on is run on premises." I did not handle this well (think sputtering as an alternative to white rage). At the same time, I am probably in a bubble in that I suspect that nearly everyone I see with a computer (of any form factor) is already in that situation or, save for Javascript piped in from the cloud to run locally, soon will be -- denizens of this list and a few others excepted. Echoing Lenin echoing Chernyshevsky, "What is to be done?" or, perhaps, "Is anything to be done?" --dan

29 112

(no subject)
by coderman 23 Jul '15

23 Jul '15

joined the twitters recently, noticed that many of my posts attract "favorite'ers" who are honey pots. E.g.: - https://twitter.com/AudreySykestfm - https://twitter.com/EvelynHarri0pp - https://twitter.com/PenelopeRosap8 - https://twitter.com/AdalynEsteskul - https://twitter.com/PazhetnykhMiss - https://twitter.com/helensmithusacc - https://twitter.com/RubyFlemingdy5 - https://twitter.com/KaelynMorenm2g - https://twitter.com/PeytonKanee97 - https://twitter.com/LilyArnoldvkm maybe social research, or ... ? i guess they think i've got a type :P best regards, not interested codermange

5 6

HORNET: High-speed Onion Routing at the Network Layer
by Rich Jones 23 Jul '15

23 Jul '15

No PoC published yet, but interesting work on a new high speed router based anonymity network. "We present HORNET, a system that enables high-speed end-to-end anonymous channels by leveraging next generation network archi-tectures. HORNET is designed as a low-latency onion routing system that operates at the network layer thus enabling a wide ra nge of applications. Our system uses only symmetric cryptography for data forwarding yet requires no per-flow state on intermediate nodes. This design enables HORNET nodes to process anonymous traffic at over 93 Gb/s. HORNET can also scale as required, adding minimal processing overhead per additional anonymous channel. We discuss design and implementation details, as well as a performance and security evaluation." http://arxiv.org/pdf/1507.05724v1.pdf Another subtle but slightly interesting tweak to the threat model in post-Snowden anonymity papers - increased difficultly of upholding a global political conspiracy is now explicitly mentioned as layer of defense (7.3). R

1 0

interwebs trivia
by Juan 23 Jul '15

23 Jul '15

"2.13.1. "What is Crypto Anarchy?" - Some of us believe various forms of strong cryptography will cause the power of the state to decline, perhaps even collapse fairly abruptly. We believe the expansion into cyberspace, with secure communications, digital money, anonymity and pseudonymity, and other crypto-mediated interactions, will profoundly change the nature of economies and social interactions." TM ----------------------- "The world is not sliding, but galloping into a new transnational dystopia. This development has not been properly recognized outside of national security circles. It has been hidden by secrecy, complexity and scale. The internet, our greatest tool of emancipation, has been transformed into the most dangerous facilitator of totalitarianism we have ever seen. The internet is a threat to human civilization." JA

1 0

Re:
by coderman 22 Jul '15

22 Jul '15

does this taper off? or just a constant stream of noise...

6 6

Welcome to the future JYA! cryptome TLS enabled...
by coderman 22 Jul '15

22 Jul '15

https://cryptome.org/ is even EV special! :P also gets decent B grade on https://www.ssllabs.com/ssltest/analyze.html?d=cryptome.org&latest [ expected for a hosting provider, but always good to check... ] best regards,

4 3

Internet Scale Forensic Traffic Correlation
by Rich Jones 22 Jul '15

22 Jul '15

Have we seen any evidence of the ability of the NSA/FIVEEYES to do internet or national scale retroactive traffic correlation? Not just for Tor exit nodes, but for any arbitrary connection. For instance, if I upload a 64.32Kb exploit to a server, and they know forensically that the exploit arrived at 12:01:01PM, do they have the capability to see all connections, internet-wide, which sent ~64.32Kb of data within the previous, say, ~500-2000ms? (A useful capability for anybody trying van paedos behind 7 proxies, but bad news for hackers, junkies and other weirdos.) Technical details around this capability would be very useful for designing high-latency and chaff-based anonymity tools. Ex, a global chaff network to cover a given byte-size range, steganographic proxies, etc. Another one to add to the list of "if you happen to have access access to the Snowden cache, please set this information free" requests (along with any info compiler backdoors, KH-13, operating system backdoors, transit cards, cryptocurrencies, burners, advertising industry partners, Oracle, Narus, etc etc etc..). Pretty please, massa Greenwald? R

1 0

Re: an ominous comment - duality of earth human existence
by coderman 22 Jul '15

22 Jul '15

On 7/20/15, Stephen D. Williams <sdw(a)lig.net> wrote: >> >> It has people who say that the NSA does good things (coderman) > > They don't? defensive mission vs. offensive like the duality of existence, good and bad, bad and good; polemic extremes always. gotta learn offensive to know how to defend. then defender uses to advance attacks? we're fighting this front in many contexts. all the easy lines are drawn, and the problems left hard to impossible. --- i don't know if you have good or bad intentions, Juan. but i hope you know what i like about NSA is their defensive support, and i miss the days when they weren't raving drunk with offensive addiction pointed domestically... [ and funny enough, their offensive addiction led to leaks which led to mass adoption of crypto in ways i never imagined could happen. so might even say a BAD NSA is good for privacy. ] --- best regards and intentions, even to Juan ;P

3 4