July 2016 - cypherpunks - lists.cpunks.org

RE: [Cryptography] Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by Peter Gutmann 04 Jul '16

04 Jul '16

Jeffrey Schiller <jis(a)mit.edu> writes: >If you look at the exploit you will see it is a simple case of failing to >check array/string bounds. ... which is exactly what was exploited in the 2013 attack, alongside a whole boatload of other missing defensive features, no DEP, no ASLR, executable stack, strcpy()s all over the place, it was described at the time as a "hack like it's 1999" attack. As I said in the previous post, security is more than just a fancy name and a lot of marketing, you have to actually make an effort to make it secure. Oh, and given that this looks like a repeat of the same flaws from three years ago, patching your insecure code also helps. Peter.

1 0

RE: [Cryptography] Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by Peter Gutmann 04 Jul '16

04 Jul '16

Jerry Leichter <leichter(a)lrw.com> writes: >Lessons? Generality and power lead (to complexity, which is the enemy of >security. I think a more direct lesson here is that taking a security mechanism that consists of a bit flag used to tag a block of memory, defining any such tagged area as secure by executive fiat, and selling it as TrustZone, is no match for, you know, actually doing real security. It's not like this hasn't happened before, in 2013 Motorola cellphones got 0wned via attackers targeting the insecure TrustZone and attacking from inside that out to the (apparently) quite secure non-TrustZone code. Peter.

1 0

Re: DHS et al: Mass Transit Audio Spies
by Fulano Diego Perez 04 Jul '16

04 Jul '16

Subject: Re: DHS et al: Mass Transit Audio Spies Date: Sun, 3 Jul 2016 17:16:07 -0700 From: Jason McVetta <jason.mcvetta(a)gmail.com> To: cpunks <cypherpunks(a)cpunks.org> > Those who have nothing to say, have nothing to fear. > > On Sun, Jul 3, 2016 at 11:45 AM, grarpamp <grarpamp(a)gmail.com > <mailto:grarpamp@gmail.com>> wrote: > > http://www.csoonline.com/article/3090502/security/big-brother-is-listening-… > > https://audiofingerprint.openwpm.com/ This page tests browser-fingerprinting using the AudioContext and Canvas API. Using the AudioContext API to fingerprint does not collect sound played or recorded by your machine - an AudioContext fingerprint is a property of your machine's audio stack itself. If you choose to see your fingerprint, we will collect the fingerprint along with a randomly assigned identifier, your IP Address, and your User-Agent and store it in a private database so that we can analyze the effectiveness of the technique. We will not release the raw data publicly. A cookie will be set in your browser to help in our analysis. We also test a form of fingerprinting using Flash if you have Flash enabled. This page is a part of Princeton CITP's Web Transparency and Accountability Project. For questions or concerns email dreisman(a)princeton.edu and ste(a)cs.princeton.edu

1 0

Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by grarpamp 04 Jul '16

04 Jul '16

http://bits-please.blogspot.fr/2016/06/extracting-qualcomms-keymaster-keys.… https://github.com/laginimaineb/ExtractKeyMaster https://github.com/laginimaineb/android_fde_bruteforce https://github.com/laginimaineb?tab=repositories In this blog post, I'll demonstrate how TrustZone kernel code-execution can be used to effectively break Android's Full Disk Encryption (FDE) scheme. We'll also see some of the inherent issues stemming from the design of Android's FDE scheme, even without any TrustZone vulnerability. A couple of months ago the highly-publicised case of Apple vs. FBI brought attention to the topic of privacy - especially in the context of mobile devices... Full disk encryption is used world-wide, and can sometimes be instrumental to ensuring the privacy of people's most intimate pieces of information. As we've seen, the current encryption scheme... can be hacked by an adversary or even broken by the OEMs...

4 3

Journalists Fucked... by FBI, and by Themselves (via Appelbaum at CIJ Berlin)
by grarpamp 04 Jul '16

04 Jul '16

https://freedom.press/blog/2016/06/leaked-fbi-documents-reveal-secret-rules… The leaked rules The Intercept has published give us a revealing and startling look at how the FBI can conduct surveillance of journalists in complete secrecy and with no court oversight. https://www.youtube.com/watch?v=KJValv4YQcY I understand you think me your political enemy...

2 1

DHS et al: Mass Transit Audio Spies
by grarpamp 04 Jul '16

04 Jul '16

http://www.csoonline.com/article/3090502/security/big-brother-is-listening-…

2 1

[OT] Five Simple Rules
by Cecilia Tanaka 04 Jul '16

04 Jul '16

Most of all know about my love for fun subjects, like Law, comics, music, open data and Astronomy. Below, a small excerpt of Neil deGrasse Tyson's last speech in the new "Cosmos" series. It is really beautiful and inspiring not only for researchers, but for everybody who wants to search for truth. "How did we, tiny creatures living on that speck of dust, ever manage to figure out how to send spacecraft outer among the stars of the milky way? Only a few centuries ago, a mere second of the cosmic time. We knew nothing of where and when we were. Oblivious to the rest of the cosmos, we inhabited a kind of prison, a tiny universe bounded by a nutshell. How did we escape from the prison? It was the work of generation of searchers, who took 5 simple rules to heart. Question authority. No idea is true just because someone says so, including me. Think for yourself. Question yourself. Don't believe anything just because you want to. Believing something doesn't make it so. Test ideas, by the evidence gained from observation and experiment. If a favorite idea fails a well designed test, it's wrong. Get over it. Follow the evidence, were ever it leads. If you have no evidence, reserve judgement. And perhaps even the most important rule of all, remember you could be wrong. Even the best scientist have been wrong about somethings. Newton, Einstein, and ever other great scientist in history. They all made mistakes. Of course they did, their were human."

6 18

Report: US crypto regulation... flawed
by grarpamp 03 Jul '16

03 Jul '16

https://www.theguardian.com/technology/2016/jun/29/government-encryption-re… https://homeland.house.gov/wp-content/uploads/2016/06/Going-Dark-Going-Forw… US Republican congressional staff trying to find a middle ground on encryption have said previous efforts to regulate privacy technology were flawed and that lawmakers need to learn more about technology before trying to regulate it, according to a report released on Wednesday.

2 1

using gnupg with mutt
by Zenaan Harkness 03 Jul '16

03 Jul '16

Does anyone know how to have an automatic association between a pgp public key and a 'specified by me' email address? As in, some people create gpg keys which do not include their email address, and I would have thought it trivial for me, in my own keyring, to associate a public key I have received, with one or more email addresses of my choosing (and / or the person's name, as fair as I know the name etc). gpg --edit-key HASH brings up a prompt, and help gives things like trust and list, and there is a "notation" sub command which sounds perfect for the job, but can only operate on private keys, not public keys. This all does not make sense to me. When someone sends me an email, signed with their private key, and I get a copy of their public key, I should be able to associate their public key, with their email address, even if their own signing of their pub/sub public key does not include that particular (or any) email address. What gives? TIA

5 4

Tor... patented?
by grarpamp 02 Jul '16

02 Jul '16

For readers, since it was missing from the reply... The main patent of relavence as requested, and subsequently relegated via reply to 2) above... 6266704 Onion Routing Network For Securely Moving Data Through Communication Networks http://pimg-fpiw.uspto.gov/fdd/04/667/062/0.pdf http://www.google.com/patents/US6266704 http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p… Many interesting references... https://www.google.com/search?q=patent+6266704 http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2…

2 1