May 2017 - cypherpunks - lists.cpunks.org

Keylogger Found in Audio Driver of HP Laptops
by Razer 13 May '17

13 May '17

H/t @Liberationtech @twitter https://twitter.com/Liberationtech/status/862849917806661634 > > The audio driver installed on some HP laptops includes a feature that > could best be described as a keylogger, which records all the user's > keystrokes and saves the information to a local file, accessible to > anyone or any third-party software or malware that knows where to look. > > Swiss cyber-security firm modzero discovered the keylogger on April 28 > and made its findings public today. > Keylogger found in preinstalled audio driver > > According to researchers, the keylogger feature was discovered in the > Conexant HD Audio Driver Package version 1.0.0.46 and earlier. > > This is an audio driver that is preinstalled on HP laptops. One of the > files of this audio driver is MicTray64.exe > (C:\windows\system32\mictray64.exe). > > This file is registered to start via a Scheduled Task every time the > user logs into his computer. According to modzero researchers, the > file "monitors all keystrokes made by the user to capture and react to > functions such as microphone mute/unmute keys/hotkeys." > > This behavior, by itself, is not a problem, as many other apps work > this way. The problem is that this file writes all keystrokes to a > local file at: > > C:\users\public\MicTray.log > > Audio driver also exposes keystrokes in real-time via local API > > If the file doesn't exist or a registry key containing this file's > path does not exist or was corrupted, the audio driver will pass all > keystrokes to a local API, named the OutputDebugString API. > > The danger is that malicious software installed on the computer, or a > person with physical access to the computer, can copy the log file and > have access to historical keystroke data, from where he can extract > passwords, chat logs, visited URLs, source code, or any other > sensitive data. > > Furthermore, the OutputDebugString API provides a covert channel for > malware to record real-time keystrokes without using native Windows > functions, usually under the watchful eye of antivirus software. > Keylogger feature confirmed in HP laptops > > Modzero researchers said they found the Conexant HD Audio Driver > Package preinstalled on 28 HP laptop models. Other hardware that uses > this driver may also be affected, but investigators haven't officially > confirmed that the issue affects other manufacturers. > > HP EliteBook 820 G3 Notebook PC > HP EliteBook 828 G3 Notebook PC > HP EliteBook 840 G3 Notebook PC > HP EliteBook 848 G3 Notebook PC > HP EliteBook 850 G3 Notebook PC > HP ProBook 640 G2 Notebook PC > HP ProBook 650 G2 Notebook PC > HP ProBook 645 G2 Notebook PC > HP ProBook 655 G2 Notebook PC > HP ProBook 450 G3 Notebook PC > HP ProBook 430 G3 Notebook PC > HP ProBook 440 G3 Notebook PC > HP ProBook 446 G3 Notebook PC > HP ProBook 470 G3 Notebook PC > HP ProBook 455 G3 Notebook PC > HP EliteBook 725 G3 Notebook PC > HP EliteBook 745 G3 Notebook PC > HP EliteBook 755 G3 Notebook PC > HP EliteBook 1030 G1 Notebook PC > HP ZBook 15u G3 Mobile Workstation > HP Elite x2 1012 G1 Tablet > HP Elite x2 1012 G1 with Travel Keyboard > HP Elite x2 1012 G1 Advanced Keyboard > HP EliteBook Folio 1040 G3 Notebook PC > HP ZBook 17 G3 Mobile Workstation > HP ZBook 15 G3 Mobile Workstation > HP ZBook Studio G3 Mobile Workstation > HP EliteBook Folio G1 Notebook PC > > The Conexant HD Audio Driver Package has versions for the following > operating systems. > > Microsoft Windows 10 32-Bit > Microsoft Windows 10 64-Bit > Microsoft Windows 10 IOT Enterprise 32-Bit (x86) > Microsoft Windows 10 IOT Enterprise 64-Bit (x86) > Microsoft Windows 7 Enterprise 32 Edition > Microsoft Windows 7 Enterprise 64 Edition > Microsoft Windows 7 Home Basic 32 Edition > Microsoft Windows 7 Home Basic 64 Edition > Microsoft Windows 7 Home Premium 32 Edition > Microsoft Windows 7 Home Premium 64 Edition > Microsoft Windows 7 Professional 32 Edition > Microsoft Windows 7 Professional 64 Edition > Microsoft Windows 7 Starter 32 Edition > Microsoft Windows 7 Ultimate 32 Edition > Microsoft Windows 7 Ultimate 64 Edition > Microsoft Windows Embedded Standard 7 32 > Microsoft Windows Embedded Standard 7E 32-Bit > > HP did not respond to a request for comment from Bleeping Computer in > time for this article's publication. > > Here's how to Check for and Remove the HP MicTray64 Keylogger... > BleepingComputer: https://www.bleepingcomputer.com/news/security/keylogger-found-in-audio-dri…

3 4

Sharing... or Stealing: Claims Uber uses self-driving technology stolen from Google referred to US attorney
by Razer 13 May '17

13 May '17

The "sharing" biz in 'Merica has the ethics of a thief. Not that stealing form Google might be a bad thing, but the fact that BILLIONAIRE VENTURE CAPITALISTS allow to happen in companies they fund and sit on the boards of is telling about what they do to the financial markets they infest as well (Btc too!). Judge refers theft allegations against Uber to US Attorney http://www.mcclatchydc.com/news/politics-government/national-politics/artic… See: "Timeline: Bad news keep piling on for troubled Uber" > Uber has had a rough year, much of it its own making. > > There have been lawsuits, allegations of sexual harassment and a > federal investigation into claims that it has used a fake version of > its app to thwart authorities. Now, a federal judge in San Francisco > has referred allegations of trade secret theft to the U.S. Attorney's > office for investigation. > > Here's a timeline of some of Uber's troubles in recent months. > > — Feb. 2: Amid mounting pressure from employees and calls for boycott > from customers, Uber CEO Travis Kalanick quits President Donald > Trump's council of business leaders. > > — Feb. 19: A former Uber engineer, Susan Fowler, discloses a slew of > sexual harassment and sexism claims in a blog post about her year at > Uber. She wrote that on her first official day on her team at Uber, > her boss propositioned her in a string of messages on the company > chat, and higher-ups ignored her complaints. She outlined examples of > blatant sexism at Uber that was seemingly tolerated by the company. > Kalanick called what she described "abhorrent." > > — Feb. 23: Waymo, a self-driving car company spun off from Google, > sues Uber . Waymo alleges that Anthony Levandowski — a former top > manager for Google's self-driving car project and now the executive > running Uber's self-driving car division — stole pivotal technology > propelling Uber's effort to build autonomous vehicles. > > — Feb. 28: A video emerges of CEO Travis Kalanick arguing with a > driver. It includes yelling and profanity and ends with a combative > Kalanick dismissing the agitated driver's claims that sharp reductions > in fares forced him into bankruptcy. In the video, Kalanick shouts > that "some people don't like to take responsibility for their own > s---. They blame everything in their life on somebody else. Good > luck." He then slams the door. > > — March 3: A New York Times report reveals that the company has been > wielding a secret weapon to thwart authorities who have been trying to > curtail or shut down its ride-hailing service in cities around the > world. One project, called "Greyball," identified regulators who were > posing as riders while trying to collect evidence that Uber's service > was breaking local laws governing taxis. > > — March 19: Uber's president, Jeff Jones, resigns less than a year > after joining the company. He told the tech blog Recode that "the > beliefs and approach to leadership that have guided my career are > inconsistent with what I saw and experienced at Uber, and I can no > longer continue as president of the ride-sharing business." > > — April 12: Uber's head of communications, Rachel Whetstone, is the > latest to leave the company . > > — April 27: Levandowski announces he is stepping aside (though staying > at the company), while Uber defends itself against charges that he > provided Uber's self-driving project with technology stolen from Waymo. > > — May 5: Reports emerge of an audit report by the city of Portland, > Oregon, which reveals that the Justice Department is probing > allegations that Uber used the Greyball software to try to stymie > authorities. > > — May 11: A federal judge in San Francisco refers allegations that > Uber is using trade secrets stolen from Waymo autonomous car to the > U.S. Attorney's office for investigation. http://www.mcclatchydc.com/news/politics-government/national-politics/artic… Rr Ps to those who say "How WILL I get around without Uber?" Take a taxi... Meet someone whose not like you, schmuck.

2 1

The Visual Capitalist
by grarpamp 12 May '17

12 May '17

http://www.visualcapitalist.com/ http://money.visualcapitalist.com/

1 0

Fwd: [Cryptography] Big ugly security problem in post-2008 Intel chipsets.
by grarpamp 12 May '17

12 May '17

---------- Forwarded message ---------- From: iang <iang(a)iang.org> Date: Wed, May 10, 2017 at 10:25 AM Subject: Re: [Cryptography] Big ugly security problem in post-2008 Intel chipsets. To: cryptography(a)metzdowd.com On 07/05/2017 18:38, Peter Todd wrote: > On Sat, May 06, 2017 at 11:28:38PM -0400, iang wrote: >> >> On 01/05/2017 22:40, Ray Dillinger wrote: >> Unpopular opinions! I think there was an element of truth in all that, but >> two things changed - one was the evolution serious criminal gangs which >> industrialised the process. The second was the rise of cyberwar... although >> the jury's out as to whether this was caused by e.g. Obama's OLYMPICGAMES or >> as a natural evolution, a tit for tat. > > Cryptocurrencies have also forced cryptocurrency-related companies to adopt > vastly improved security because theives can directly steal money. Yes, this is why financial cryptography was always more fun. It has the tightest feedback loop - get it wrong and you get robbed. This tight feedback loop is mostly absent in other forms of cryptography such as privacy, retail commerce (aka SSL & passwords), political / natsec and military. Which means, in financial cryptography as opposed to the others, we learn the fastest, assuming we're capable of that. > Additionally theres a second, less-obivous effect of the above: > non-cryptocurrency-related companies are getting hacked by theives trying to > gain access to user data that in turn will let them hack other targets with > cryptocurrency holdings. For example, phone companies are frequently getting > social engineered to exploit their customers' 2FA setups, and in turn, exploit > cryptocurrency accounts at stuff like exchanges. Right. We always knew that the phones were an inadequate 2FA simply because they were relatively easy to attack. And once the stakes were high enough, they were attacked. Now, for online banking, this was sorta maybe ok because the online banks also had other security layers inside the banks, so using the phone was their cheapest widespread option. But this fell apart for cryptocurrencies which typically did not have other layers of protection (ok, they had verbal protections like multisig and and and). The interesting thing is that people wake up and blame the telco. But it was never the telco's threat model to protect bitcoin or online banking... iang _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

The Zen White Paper
by Joshua 12 May '17

12 May '17

The Zen White Paper https://www.scribd.com/document/347946086/Zen-White-Paper Currently as Bitcoin argues aspects of self-accumulation and distribution (the exact same issues fiat currencies face), other competitors have emerged. Many have began to realize the supply of internet money is endless and any project designed to capture more ground in the fight for digital self-determination is a righteous one. With the hybridization of cooperative blockchain projects and digital mints it is possible to build completely autonomous economic systems. In the near future these independent blockchain systems will become interoperable resulting in the overall decline of traditional economic systems and non-cooperative blockchain systems (such as Bitcoin). The ultimate success of these systems directly relies on the mutual usage and transfer of the token. Join us as we deprecate the economic institutions of today for a better tomorrow.

5 9

Re: What is the value of the State?
by Steven Schear 12 May '17

12 May '17

Those pushing the anthropomorphic climate change agenda never, AFAIK, ever admit that this view is ONLY consensus (based on data and models) but not independently verifiable via the Scientific Method, the gold standard for science. Warrant Canary creator On May 8, 2017 5:22 PM, "\0xDynamite" <dreamingforward(a)gmail.com> wrote: >> except for very token >> gestures. > > I don't think that the tens of billions of dollars that go to > special interests including of course the 'scientific' mafia > are a token gesture. There's aren't "tens of billions" of dollars spent to prove global warming except to counter-act the deniers. \x

3 5

Angry Good Germans demand reinstatement of Gestapo chief
by Razer 12 May '17

12 May '17

Angry "Good Germans" demand reinstatement of Gestapo chief James Comey at a "James Comey Is Fired Party" outside The White House. https://twitter.com/AuntieImperial/status/862651365801074688 The FBI is a Clear and Present Danger to 'American Democracy' (if such a thing exists at all) no matter which murderous creep runs it. They completely fabricate Terror Plots, including the planning, and logistics of supplying weapons and explosives, to frame innocent Muslims who would have never done such a thing without intense pressure from their operatives, and spy on US citizens for the NSA via their Data Intercept Technology Unit. They are the sole organization that investigates their own agent's murder of civilians. The FBI IS the American Gestapo, and 'Mericans are ANGRY their operations have been disturbed. Rr

3 3

[OT, really OT] [Just For Fun] 16 Batshit Space Conspiracy Theories That Will Freak You The Fuck Out
by Cecilia Tanaka 11 May '17

11 May '17

16 Batshit Space Conspiracy Theories That Will Freak You The Fuck Out https://www.buzzfeed.com/hilarywardle/in-space-only-italian-radio-operators… The truth is out there, and so are dead astronauts and 13,000-year-old satellites. PS: - I thought 'batshit' was a version of 'bullshit', but smaller... Google taught me it means "completely mad or crazy". Uh, unexpected! :P ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

3 2

the intercept - now FBI shills
by juan 11 May '17

11 May '17

https://theintercept.com/2017/05/10/why-was-james-comey-fired-donald-trump-… "Donald Trump fired James Comey...perhaps the greatest threat to his presidency" https://theintercept.com/2017/05/10/after-james-comeys-firing-who-will-stop… "After James Comey’s Firing, Who Will Stop Trump’s Tinpot Dictatorship? https://theintercept.com/2017/05/10/john-mccain-may-have-killed-an-anti-env… quoting criminal mccain “When you fire probably, arguably, the most respected person in America" - so the intercept now this is cute too : https://theintercept.com/2017/05/06/no-macron-leaks-politically-motivated-h… "There Are No “Macron Leaks” in France. Politically Motivated Hacking Is Not Whistleblowing"

1 0

Puerto Rico Bankruptcy
by grarpamp 10 May '17

10 May '17

https://theintercept.com/2017/05/09/puerto-ricos-123-billion-bankruptcy-is-… https://en.wikipedia.org/wiki/Debt-to-GDP_ratio "Federal lawmakers will either have to provide massive assistance to Puerto Rico, or they will have to move rapidly to change the island’s political and economic status. After a century of colonial rule by Washington and decades of predatory debt from Wall Street, the bill has come due." Cryptocurrencies rising.

2 1