August 2016 - cypherpunks - lists.cpunks.org

[WAR] Al Qaeda - the USA's armed intermediary for fighting Russia
by Zenaan Harkness 04 Aug '16

04 Aug '16

US Foreign Policy Comes Full Circle As Qaeda Downs Russian Helicopters http://journal-neo.org/2016/08/03/us-foreign-policy-comes-full-circle-as-qa… " One wonders if this irony is lost on the American people, who have been asked to sacrifice so much in the name of fighting “terrorism,” only to have those who have done the asking to ally themselves with the very terrorists in a destructive proxy war in the distant lands of the Levant. "

1 0

Interesting AP-related fiction book
by jim bell 03 Aug '16

03 Aug '16

http://suvudu.com/2016/07/michael-byrnes-sci-fi-thriller-bounty-and-how-to-… In Michael Byrnes’ new dystopian science-fiction thrillerBounty, a string of high profile murders are connected to bounty4justice.com: a website that offers bounties for the assassinations of corrupt politicians, crooked bankers, and other targets seemingly above the law.While bounty4justice.com is fiction, it bears a very strong resemblance to a real-life kill-for-pay website first reported on in 2013. Only accessible through the Dark Web, the Assassination Market offered crowdsourced murder to the masses. The site, the creation of pseudonymous entrepreneur who went by the name Kuwabatake Sanjuro (taken from the Akira Kurosawa film Yojimbo), enabled anonymous users to submit a target for assassination along with a bounty in bitcoin for anyone who could get the job done. Users who might not have a target of their own in mind could contribute to bounties already established.Like bounty4justice.com, the Assassination Market specialized in high-ranking political figures and powerful businessmen: people like President Barack Obama and former Chairman of the Federal Reserve Ben Bernanke. In an interview with Forbes’ Andy Greenberg, Sanjuro, a self-described anarchist, said that his purpose in establishing the Assassination Market was to make risky for people to seek public officeSanjuro’s Assassination Market was not the first or only one of its kind. The inspiration for Sanjuro’s site, and many others, can be found in the essays of crypto-anarchist Jim Bell. Bell first outlined a model for crowdfunded political murder in a series of essays published in the mid-nineties. In Bell’s model, a group of activists would select a public figure and place “bets” on possible days he or she might die. With all of the crowdsourced funding up for grabs, all a potential assassin would need to do is murder the public figure and collect the funds. In theory, the other bettors would bear no criminal liability for the murder, as their wager was placed on a possible date of death and not how the person would die. In other words, a dead pool: a tasteless but legal game.[end of portion quoted]

1 0

Federal Data Centers.
by jim bell 03 Aug '16

03 Aug '16

Given that hard-disk capacity probably increases by 50%+ per year, this is not at all surprising. That huge Utah NSA data center was probably designed in 2000-2001. At that time, the typical hard drive as sold was probably 2-4 gigabytes. At that time, it would probably have only been able to store the metadata of all phone calls in the world. By the time Clapper's lie unearthed the facts, in 2013, the typical hard drive had increased to perhaps 1000x larger, or 2 terabytes. That would have allowed that data center to store the audio of every phone call in the world for a year, maybe much more.And 10-terabyte hard drives are now being made. Jim Bell http://fedscoop.com/white-house-gets-tougher-on-data-centers-in-new-policy White House gets tougher on data centers in new policy The Data Center Optimization Initiative will supersede 2010 Federal Data Center Consolidation Initiative, a foundational effort that led to the closure of 1,900 data centers since 2010. By Billy Mitchell AUGUST 1, 2016 5:30 PM BIO The White House finalized a policy Monday that forbids agencies from budgeting funds toward the creation or expansion of data centers, with few exceptions. The Office of Management and Budget implemented the Data Center Optimization Initiative, introduced as a draft plan in March, to supersede the 2010 Federal Data Center Consolidation Initiative, building on the previous policy's framework for making IT spending more efficient. The DCOI requires that agencies wishing to put resources toward the expansion or building of a data center must request approval from federal CIO Tony Scott and include an analysis of alternative options and how doing so would result in a net reduction of the agency's data center inventory. As set forth in the prior FDCCI policy, agencies must continue to reduce data center inventory to "essential enterprise levels." The new policy defines data centers as “rooms with at least one server, providing services (whether in a production test, staging, development, or any other environment) but not “rooms containing only print servers, routing equipment, switches, security devices (such as firewalls), or other telecommunications components.” Based on this definition, agencies must complete a review of their data center inventory by Aug. 31. Scott in a blog post touted the "enormous progress" the federal government has made reducing its data center footprint since 2010. "Agencies have closed over 1,900 data centers, reducing the real estate footprint of Federal data centers by more than 1.2 million square feet, and made significant strides toward optimizing existing data centers," he wrote. "These efforts have resulted in nearly $1 billion in savings and a Federal data center inventory that is more efficient, effective, and secure. " The new policy cites the Federal IT Acquisition Reform Act as a driving force, holding CIOs accountable for "implementing and measuring progress toward meeting the goals set forth in this memorandum." Particularly, the DCOI holds CIOs to meet stringent goals around consolidation and optimization. In the next three years, agencies must close at least 25 percent of their tiered data centers — centers with separate physical space, uninterruptible power supply, dedicated cooling systems and a backup generator — and 60 percent of non-tiered data centers, which are smaller systems, like server rooms and nodes. "This target will result in the closure of approximately 52% of the overall Federal data center inventory and a reduction of approximately 31% in the real estate footprint occupied by data centers Government-wide," Scott wrote. Likewise, the policy calls for agencies to reduce annual data center costs by at least 25 percent by fiscal year 2018, estimating a savings of $2.7 billion if achieved. Agencies must also achieve optimization targets in five other areas, according to Scott: "installation of energy metering to track power consumption; a power usage effectiveness (PUE) target to improve energy efficiency; virtualization and server utilization metrics to ensure IT equipment is being utilized efficiently; and a facility utilization metric to drive more efficient use of space in Federal data centers. To get there, OMB has called on the General Services Administration to provide a marketplace of shared services so that agencies of any size, with any budget can strive for these goals. GSA will provide a Data Center Infrastructure Management Tool Assessment to help agencies access tools "to monitor, measure, manage and/or control data center utilization and energy consumption of all IT-related equipment," and share other best practices to help agencies comply with the policy. "The marketplace will ensure an even playing field for customers to learn about and negotiate services with providers," GSA Administrator Denise Turner Roth said in a statement.

2 1

"Deleting WhatsApp chats doesn’t delete shit nothing."
by Rayzer 03 Aug '16

03 Aug '16

Apple’s iMessage too! ("Signal leaves virtually nothing.") Quote source @thegrugq, Twitter https://twitter.com/thegrugq/status/758833939020521472 WhatsApp Forensic Artifacts: Chats Aren’t Being Deleted Posted on July 28, 2016 Sorry, folks, while experts are saying the encryption checks out in WhatsApp, it looks like the latest version of the app tested leaves forensic trace of all of your chats, even after you’ve deleted, cleared, or archived them… even if you “Clear All Chats”. In fact, the only way to get rid of them appears to be to delete the app entirely. To test, I installed the app and started a few different threads. I then archived some, cleared, some, and deleted some threads. I made a second backup after running the “Clear All Chats” function in WhatsApp. None of these deletion or archival options made any difference in how deleted records were preserved. In all cases, the deleted SQLite records remained intact in the database. More, including 'How WhatsApp Can Fix This': http://www.zdziarski.com/blog/?p=6143

7 13

Three cheers for the NSA!
by jim bell 03 Aug '16

03 Aug '16

http://www.breitbart.com/jerusalem/2016/07/31/exclusive-nsa-architect-agenc… PHILADELPHIA – The National Security Agency (NSA) has “all” of Hillary Clinton’s deleted emails and the FBI could gain access to them if they so desired, William Binney, a former highly placed NSA official, declared in a radio interview broadcast on Sunday. Speaking as an analyst, Binney raised the possibility that the hack of the Democratic National Committee’s server was done not by Russia but by a disgruntled U.S. intelligence worker concerned about Clinton’s compromise of national security secrets via her personal email use. Binney was an architect of the NSA’s surveillance program. He became a famed whistleblower when he resigned on October 31, 2001, after spending more than 30 years with the agency. He was speaking on this reporter’s Sunday radio program, “Aaron Klein Investigative Radio,” broadcast on New York’s AM 970 The Answer and Philadelphia’s NewsTalk 990 AM. Binney referenced testimony before the Senate Judiciary Committee in March 2011 by then-FBI Director Robert S. Mueller in which Meuller spoke of the FBI’s ability to access various secretive databases “to track down known and suspected terrorists.” Stated Binney: “Now what he (Mueller) is talking about is going into the NSA database, which is shown of course in the (Edward) Snowden material released, which shows a direct access into the NSA database by the FBI and the CIA. Which there is no oversight of by the way. So that means that NSA and a number of agencies in the U.S. government also have those emails.” [end of portion quoted] Jim Bell "It's an ill wind that blows no one good" Oboe: "It's an ill woodwind that no one blows good".

1 0

metro
by rysiek 02 Aug '16

02 Aug '16

Hey, apparently this is the best way to get the trolls and discourse poisoners to come out of the woodwork around here. So hell, why not. Here's some code, have funzies: https://git.occrp.org/libre/metro tl;dr setting up IPsec is a pain in the arse, so by the power of way too many lines of Bash it has been made simpler. Comments, pull requests, criticism welcome. -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

10 27

Re: Scanning the Dark Web with Python (was Re: cypherpunks Digest, Vol 37, Issue 101)
by Cecilia Tanaka 02 Aug '16

02 Aug '16

Hi, Justin! :D Thank you very much for the nice answers! :D Sorry for being late, dear. Dramatic days, full of fury and sound, oh! I needed a dramatic pause for being coherent, haha!! ;) I loved Flipchan's message, but I don't feel secure enough for being creative or audacious when coding yet, sorry. I am so disastrous that, someday, I probably will summon Cthulhu while trying to learn Python decently, uh! Fear! :-/ Thank you again! Take care, keep coding and be happy. And if need something in case of eventual Brazilian crazy doubts or Cthulhu attacks, I'll be here, ok? :) Ceci On Jul 29, 2016 9:57 AM, "Justin Seitz" <justin.seitz(a)gmail.com> wrote: > Hey Ceci! > > No worries at all. > > You could do a multi-threaded curl process for sure, but I wanted to have > everything including the logic of handling newly discovered onions, when to > get a new Tor identity, and storing the data all to be handled so that you > can just run the script and walk away from it. > > Like many things in coding, you can do it a million different ways for > sure! > > Happy to answer any other questions you guys might have :) > > Justin > > On 2016-07-28 7:47 PM, Cecilia Tanaka wrote: > > Whoops, my bad! Wrong email address. Sorry everybody, Justin included! > :P > On Jul 28, 2016 10:34 PM, "Cecilia Tanaka" <cecilia.tanaka(a)gmail.com> > wrote: > >> Hi, Justin! Hope you are doing fine! :) >> >> I liked your project a lot and forwarded the message you had originally >> sent to the list "Data Driven Journalism and Open Data in Journalism" to >> two different lists. >> >> A Brazilian guy wants to talk with you about the project. He contacted >> me and I asked to talk directly to you. And, well, Flipchan sent this cute >> message now: >> >> === >> On Jul 28, 2016 9:45 PM, "Flipchan" <flipchan(a)riseup.net> wrote: >> > >> > Cant u scan tor in a simplier way?like generating .onion addresses then >> curl(ing) them with multiple threads in py?:) >> === >> >> Sorry, my programming is still a shame, even worst than my English. >> Please, may you answer to the questions? I am curious and will forward >> your answer to Python Brazil list too! :) >> >> Thank you very much! Good luck and success! <3 >> >> Ceci >> > > -- > Principal Consultant > Dark River Systems Inc. > Saskatoon, SK Canada > T: (855)-646-7468 > E: justin(a)automatingosint.com > @jms_dot_py <https://www.twitter.com/jms_dot_py> | OSINT Training > <https://register.automatingosint.com> | Hunchly <https://www.hunch.ly> >

2 2

Misc I2P / Tor
by grarpamp 02 Aug '16

02 Aug '16

https://bits.debian.org/2016/08/debian-and-tor-services-available-as-onion-… https://www.reddit.com/r/TOR/comments/4vifde/does_shari_steeles_husband_wor… https://geti2p.net/en/blog/post/2016/07/02/Summer-Dev-roundup-APIs HOPE XI Onion Uses https://www.youtube.com/watch?v=VmsFxBEN3fc

1 0

libsaxolotl
by stef 01 Aug '16

01 Aug '16

howdy, for those not sabotaging this list with noise, but wanting to hack on/with some crypto you might find this implementation of the axolotl protocol using nacl/libsodium entertaining: https://github.com/stef/libsaxolotl happy hacking,s -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

9 15

Cloudflare reCAPTCHA De-anonymizes Tor Users
by grarpamp 01 Aug '16

01 Aug '16

https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm 18 July 2016 Cloudflare reCAPTCHA De-anonymizes Tor Users A sends: Cloudflare's insistence on solving reCAPTCHA puzzles when visitors are coming from Tor exit nodes to one of the 2 million web sites that Cloudflare 'protects' can be very instrumental for traffic analysis and de-anonymizing of Tor users. This is how: The only non-public prerequisite for the de-anonymizing entity is the ability to monitor traffic between ISPs and Tor entry nodes, and traffic entering Cloudflare servers (no decryption required in either case). There are, of course, no 2 million Cloudflare servers, probably there is no more than few hundred. Each click on one of the images in the puzzle generates a total of about 50 packets between Tor user's computer and the Cloudflare's server (about half are requests and half are real-time responses from the server.) All this happens in less than a second, so eventual jitter introduced in onion mixing is immaterial. The packet group has predictable sizes and patterns, so all the adversary has to do is note the easily detectable signature of the "image click" event, and correlate it with the same on the Cloudflare side. Again, no decryption required. There likely are many simultaneous users (thousands), but they do not solve puzzles at the same time, and they do not click on the puzzle image at the same time. Simple math shows that disambiguating is trivial. If there is some ambiguity left, Cloudflare can conveniently serve few more images to specific users (or even random users, as long as within the same few seconds different users get different amount of 'correct' images.) This obvious opportunity is not the proof, but NSA would have to be utterly incompetent not to be exploiting it. No one is that incompetent.

3 2