March 2019 - cypherpunks - lists.cpunks.org

Documentary: Borderless and Farmlands (Lauren Southern)
by grarpamp 07 Mar '19

07 Mar '19

Documentary: Borderless https://www.youtube.com/watch?v=PxfUW6tqrhc https://www.youtube.com/watch?v=AFgD8os8VhU https://www.youtube.com/watch?v=K4XhLiiu0is http://borderless.movie/ Documentary: Farmlands https://www.youtube.com/watch?v=a_bDc7FfItk https://www.youtube.com/watch?v=mwH-sw_Z_i8 https://www.youtube.com/watch?v=5NUYeED-ZAQ https://www.youtube.com/results?search_query=lauren+southern https://www.youtube.com/channel/UCla6APLHX6W3FeNLc8PYuvg/videos https://laurensouthern.net/

1 0

Delete Never: The Digital Hoarders Who Collect Tumblrs, Medieval Manuscripts, and Terabytes of Text Files
by grarpamp 06 Mar '19

06 Mar '19

https://gizmodo.com/delete-never-the-digital-hoarders-who-collect-tumblrs-1… Online, you'll find people who use hashtags like "#digitalhoarder" and hang out in the 120,000-subscriber Reddit forum called /r/datahoarder, where they trade tips on building home data servers, share collections of rare files from video game manuals to ambient audio records, and discuss the best cloud services for backing up files. The often stereotyped hoarders letting heaps of physical items of questionable utility dominate their homes and lives often suffer social stigma and anxiety as a result. By contrast, many self-proclaimed digital hoarders say they enjoy their collections, can keep them contained in a relatively small amount of physical space, and often take pleasure in sharing them with other hobbyists or anyone who wants access to the same public data. [...] Many people active in the data hoarding community take pride in tracking down esoteric files of the kind that often quietly disappear from the internet -- manuals for older technologies that get taken down when manufacturers redesign their websites, obscure punk show flyers whose only physical copies have long since been pulled from telephone poles and thrown in the trash, or episodes of old TV shows too obscure for streaming services to bid on -- and making them available to those who want them.

1 0

BSD and Linux so easy to exploit that Zerodium pays just $50k for uid0
by grarpamp 06 Mar '19

06 Mar '19

https://zerodium.com/program.html "the research becomes the exclusive property of ZERODIUM and you are not allowed to re-sell, share, or report the research to any other person or entity." Opensource Unix Foundations should strongly consider forming open collaborative crowdfunding and paying similar to openly acquire and fix exploits thus keeping them from going into secret blackholes which are often used directly against their very own users requiring, and in, security sensitive environments (be they corp, gov, personal, edu, ngo, biz, research, journalism, etc...), reducing continued exploitation of the work, users, and infrastructures of Opensource Unix OS projects through using bounties to identify improving production, review, security, audit, coding, feedback models in same. "Many ... have bug bounty programs for those who want the exploit used for defensive purposes, ie fixed... but they pay orders of magnitude less. *This is a problem.*" -- Bruce Reassert and 0wn the problem.

1 0

Zerodium Paying $500K for Cloud Exploits, Crowd Prediction Market Coming
by grarpamp 06 Mar '19

06 Mar '19

https://www.zdnet.com/article/hide-yo-kids-hide-yo-clouds-zerodium-offering… NSA's / CIA's / In-Q-Tel's / FBI's / FVEY's partners... Zerodium, Vupen, Azimuth, and Crowdfense ... Predict and shift from this closed market to one openly in your favor instead. https://zerodium.com/program.html Exploit vendor Zerodium announced today plans to pay a whopping $500,000 for zero-days in popular cloud technologies like Microsoft's Hyper-V and (Dell) VMware's vSphere. More security news All Intel chips open to new Spoiler non-Spectre attack: Don't expect a quick fix Japanese police charge 13-year-old for sharing 'unclosable popup' prank online Phishing alert: One in 61 emails in your inbox now contains a malicious link Hide yo' kids, hide yo' clouds: Zerodium offering big bucks for cloud zero-days Both Hyper-V and vSphere are what experts call virtualization software, also called hypervisors --software that lets a single "host" server create and run one or more virtual "guest" operating systems. Virtualization software is often found in cloud-powered data centers. Hyper-V is the technology at the core of Microsoft's Azure cloud computing platform, while VMware's vSphere is used by Amazon Web Services and SAP. With cloud services growing in adoption, especially for hosting websites and crucial IT infrastructure, the importance of both technologies has been slowly increasing in recent years. This paradigm shift hasn't gone unnoticed in the exploit market, where Zerodium --a Washington, DC-based exploit vendor-- is by far the leading company. In a tweet earlier today, Zerodium has announced plans to pay up to $500,000 for fully-working zero-days in Hyper-V and vSphere that would allow an attacker to escape from the virtualized guest operating system to the host server's OS. "The exploits must work with default configs, be reliable, and lead to full access to the host," the company said on Twitter. This kind of tweet and offer isn't anything new from Zerodium. The company usually pays fixed prices for exploits and then hikes up payouts during so-called "exploit acquisition raids," when it's purposely looking to enhance its offering for certain types of exploit classes. Zerodium previously held acquisition raids for zero-days in iOS, instant messaging apps, the Tor Browser, Linux, Adobe Flash Player, routers, and USB thumb drives. These acquisition raids are normally limited to a few weeks, and after that payouts return to their normal pricing range. "Our new payout for hypervisors will last for a couple of months, and we'll then decide if we reduce it or keep it high, depending on the number of acquisitions we will make," Zerodium CEO Chaouki Bekrar told ZDNet via email. Previously to today's acquisition raid, Zerodium used to pay up to $200,000 for exploits in vSphere and Hyper-V, according to its price charts. The company's move to hike up hypervisor exploit payouts comes after Microsoft anted up payments for Hyper-V bugs last summer when it began paying up to $250,000 for similar exploits, outbidding Zerodium and all other exploit buyers. "Microsoft's bounty for Hyper-V exploits is very attractive for researchers, however, VMWare is not paying anything to zero-day hunters," Bekrar told ZDNet. "We have decided to fill this gap, and we've been paying $200,000 for such exploits, and we've acquired many of them so far," Bekrar said. "However, we've recently observed an increase in demand from customers, [and] we have decided to increase the bounty to $500,000 to outbid vendors and all existing buyers." The customers the company is referring are government and law enforcement agencies. Their increasing interest in cloud zero-days is only normal, seeing that AWS and Azure have been slowly cannibalizing the web hosting market, with fewer and fewer web hosting providers hosting their own data centers, and more of them choosing to rent cloud servers instead. With cyber-crime, malware, and APT operations being often hosted on cloud servers, it is only normal that these agencies would be more interested in taking over cloud servers hosting malicious infrastructure. According to previous statements, Zerodium describes itself as a vendor who buys zero-days from security researchers and sells the vulnerabilities to government and law enforcement agencies. While other exploit vendors have caught selling hacking tools to oppressive regimes, there have been no such reports, at the time of writing, about Zerodium.

1 0

FBI Slings Anti-Privacy FUD Against Encryption at RSA Conf
by grarpamp 06 Mar '19

06 Mar '19

https://www.cnet.com/news/fbi-director-christopher-wray-tells-cybersecurity… Encryption should have limits. That's the message FBI Director Christopher Wray had for cybersecurity experts Tuesday. The technology that scrambles up information so only intended recipients can read it is useful, he said, but it shouldn't provide a playground for criminals where law enforcement can't reach them. "It can't be a sustainable end state for there to be an entirely unfettered space that's utterly beyond law enforcement for criminals to hide," Wray said during a live interview at the RSA Conference, a major cybersecurity gathering in San Francisco. His comments are part of a back-and-forth between government agencies and security experts over the role of encryption technology in public safety. Agencies like the FBI have repeatedly voiced concerns like Wray's, saying encryption technology locks them out of communications between criminals. Cybersecurity experts say the technology is crucial for keeping data and critical computer systems safe from hackers. Letting law enforcement access encrypted information just creates a backdoor hackers will ultimately exploit for evil deeds, they say. Wray, a former assistant attorney general in the U.S. Department of Justice who counts among his biggest cases prosecutions against Enron officials, acknowledged Tuesday that encryption is "a provocative subject." As the leader of the nation's top law enforcement agency, though, he's focused on making sure the government can carry out criminal investigations. Hackers in other countries should expect more investigations and indictments, Wray said. "We're going to follow the facts wherever they lead, to whomever they lead, no matter who doesn't like it," he said. To applause, he added, "I don't really care what some foreign government has to say about it."

1 0

NSA GHIDRA Disassembler Vault7
by grarpamp 06 Mar '19

06 Mar '19

https://www.zdnet.com/article/nsa-release-ghidra-a-free-software-reverse-en… https://ghidra-sre.org/ At the RSA security conference this week, the National Security Agency released Ghidra, a free software reverse engineering tool that the agency had been using internally for well over a decade. The tool is ideal for software engineers, but will be especially useful for malware analysts first and foremost, being similar to other reverse engineering tools like IDA Pro, Hopper, HexRays, and others. The NSA's general plan was to release Ghidra so security researchers can get used to working with it before applying for positions at the NSA or other government intelligence agencies with which the NSA has previously shared Ghidra in private. Ghidra is currently available for download only through its official website, but the NSA also plans to release its source code under an open source license in the coming future.

1 0

gitgeist - git backed distributed social media 1st version "yes it can work" PoC
by Zenaan Harkness 06 Mar '19

06 Mar '19

If you don't control it, you don't own it, and it shall be used against you - witness Google, Facebook, Twitter, etc. Fully distributed "everything I've viewed or read, follow, and who follows me, is stored locally" social media is the first step to "social" media sanity. gitgeist is one (first, rough) attempt which seems to prove that a git backend implementation (for local storage and peer sync) makes technical sense. Nice to see tech folk finally starting to get irritated, that's for sure :D gitgeist: a git-based social network proof of concept https://www.karimyaghmour.com/blog/2019/02/gitgeist-a-git-based-social-netw… https://github.com/opersys/gitgeist-poc

1 0

The NSA Has Apparently Stopped the Domestic Surveillance Program Snowden Exposed - Hit & Run : Reason.com
by jim bell 06 Mar '19

06 Mar '19

https://reason.com/blog/2019/03/05/the-nsa-has-apparently-stopped-the-domes

4 3

Dropgangs, or the future of darknet markets
by Mirimir 06 Mar '19

06 Mar '19

Dropgangs, or the future of dark markets | Instead of using websites on the darknet, merchants are now | operating invite-only channels on widely available mobile | messaging systems like Telegram. | ... | The other major change is the use of “dead drops” instead | of the postal system which has proven vulnerable to tracking | and interception. | ... | Furthermore this method does not require for the customer | to give any personally identifiable information to the | merchant, which in turn doesn’t have to safeguard it | anymore. Less data means less risk for everyone. | ... | Instead of the flat hierarchies witnessed with darknet | markets, merchants today employ hierarchical structures | again. These consist of procurement layer, sales layer, | and distribution layer. The people constituting each layer | usually do not know the identity of the higher layers nor | are ever in personal contact with them. All interaction | is digital - messaging systems and cryptocurrencies again, | product moves only through dead drops. | ... | This concept of using messaging, cryptocurrency and dead | drops even within the merchant structure allows for the | members within each layer being completely isolated from | each other, and not knowing anything about higher layers | at all. There is no trace to follow if a distribution | layer member is captured while servicing a dead drop. | He will often not even be distinguishable from a regular | customer. This makes these structures extremely secure | against infiltration, takeover and capture. They are | inherently resilient. | ... | If members of such a structure are captured they usually | have no critical information to share, no information about | persons, places, times of meeting. No interaction that | would make this information necessary ever takes place. https://opaque.link/post/dropgang/ Nice. It's cool to see serious tradecraft applied to this stuff. Especially compartmentalization. And yes, using traditional shipping systems is a serious problem for old-school dark markets. I've thought off and on for several years about the potential for using dead drops with accurate GPS. I mean, geocaching. Many years ago, when I was dealing LSD, it was pretty common to use dead drops. But then, they were typically rental lockers in bus and train stations. I agree that ubiquitous surveillance is a problem. However, it's ~clueless customers and low-level distributors who'll most likely get pwned. And they won't know anything importnt about the operation overall. Anyway, time will tell.

8 28

Vermont Dumps Brokers List, Volvo Thinks Of Police State
by grarpamp 05 Mar '19

05 Mar '19

https://www.fastcompany.com/90302036/over-120-data-brokers-inch-out-of-the-… https://www.fastcompany.com/90310803/here-are-the-data-brokers-quietly-buyi… The Vermont law only covers third-party data firms which collect their own enormous piles of detailed personal data. It doesn't require data brokers to disclose who's in their databases, what data they collect, or who buys it. Nor does it require brokers to give consumers access to their own data or opt out of data collection. https://www.theguardian.com/business/2019/mar/04/volvo-speed-limit-cars-2020 Police vehicles will be exempt. It's worth doing if we can even save one life. We want to start a conversation about whether carmakers have the right or maybe even an obligation to install technology in cars that changes their driver's behavior.

1 0