March 2021 - cypherpunks - lists.cpunks.org

Most powerful computer 2021
by jim bell 11 Mar '21

11 Mar '21

ZDNet: The world's most powerful supercomputer is now up and running. https://www.zdnet.com/article/the-worlds-most-powerful-supercomputer-is-now…

1 0

VICE: The US Definition of ‘Broadband’ Is a Joke
by jim bell 10 Mar '21

10 Mar '21

VICE: The US Definition of ‘Broadband’ Is a Joke. https://www.vice.com/en/article/k7av3n/the-us-definition-of-broadband-is-a-…

1 0

US cyberattack in Strasbourg
by Punk-BatSoup-Stasi 2.0 10 Mar '21

10 Mar '21

"OVH data centre destroyed by fire in Strasbourg" https://www.theregister.com/2021/03/10/ovh_strasbourg_fire/ "In December 2010, French Gizmodo edition revealed that WikiLeaks selected OVH as its new hosting provider, following Amazon's refusal to host it"

2 1

Tesla (TSLA), Cloudfare (NET) Breached in Verkada Security Camera Hack
by jim bell 10 Mar '21

10 Mar '21

Bloomberg: Tesla (TSLA), Cloudfare (NET) Breached in Verkada Security Camera Hack. https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jai…

1 0

Hacked security camera
by jim bell 10 Mar '21

10 Mar '21

Hackers breached security company Verkada to access 150,000 cameras https://mol.im/a/9344335 via http://dailym.ai/android

2 1

Pathetic loser, John Young, is now back on the same page as Wikileaks!
by professor rat 10 Mar '21

10 Mar '21

JULIAN " the most dangerous facilitator of totalitarianism we have ever seen. The internet is a threat to human civilization " ASSANGE 2012 Here's one real easy way to avoid the ever proliferating boondoggle, John... GET OFF THE INTERNET!

1 0

Teh 'crypto' 'market'
by Punk-BatSoup-Stasi 2.0 09 Mar '21

09 Mar '21

It is unclear what 'satoshi' tried to achieve with his 'bitcoin', but what is clear is that bitcoin is a pretty fucked up surveillance tool, like any other public, so called 'blockchain'. Now, there's a short list of 'cryptocurrencies' that aren't as fucked as bitcoin, privacy-wise, and the biggest one of them is monero. So one wonders what the 'free market' valuation of monero looks like? Turns out that in the last few months monero has gone from being in the #10 position, ranked by market share, to being #26. Bitcoin has lost a fair amount of market share too, and the funny thing is of course, that it hasn't lost it to better options like monero. No, both bitcoin and monero are being outcompeted by various shitcoins. So yeah, that's teh 'all knowing' 'free market' that fake libertarians and true technofascists love so much.

1 0

The FBI Should Stop Attacking Encryption and Tell Congress About All the Encrypted Phones It's Already Hacking Into
by jim bell 09 Mar '21

09 Mar '21

https://www.eff.org/deeplinks/2021/03/fbi-should-stop-attacking-encryption-…

2 1

Exploits: AMD - TakeAWay, Intel - CSME
by grarpamp 09 Mar '21

09 Mar '21

https://mlq.me/download/takeaway.pdf https://www.amd.com/en/corporate/product-security https://thehackernews.com/2020/03/intel-csme-vulnerability.html https://thehackernews.com/2020/03/amd-processors-vulnerability.html 1.5+ YEARS, lol at responsible disclosure (irresponsible suppression) 9 Years of AMD Processors Vulnerable to 2 New Side-Channel Attacks March 09, 2020 Ravie Lakshmanan amd processor vulnerability AMD processors from as early as 2011 to 2019 carry previously undisclosed vulnerabilities that open them to two new different side-channel attacks, according to a freshly published research. Known as "Take A Way," the new potential attack vectors leverage the L1 data (L1D) cache way predictor in AMD's Bulldozer microarchitecture to leak sensitive data from the processors and compromise the security by recovering the secret key used during encryption. The research was published by a group of academics from the Graz University of Technology and Research Institute of Computer Science and Random Systems (IRISA), who responsibly disclosed the vulnerabilities to AMD back in August 2019. "We are aware of a new white paper that claims potential security exploits in AMD CPUs, whereby a malicious actor could manipulate a cache-related feature to potentially transmit user data in an unintended way," AMD said in an advisory posted on its website over the weekend. "The researchers then pair this data path with known and mitigated software or speculative execution side-channel vulnerabilities. AMD believes these are not new speculation-based attacks." While the notification doesn't go into specifics about mitigating the attack, Vedad Hadžić, one of the key researchers on the paper, said the vulnerability is still open to active exploitation. With Intel coming under scrutiny for a string of flaws in its CPUs — from Meltdown, Spectre, ZombieLoad to the recent unpatchable CSME firmware flaw — the research is a reminder that no processor architecture is fully secure. It's worth noting that some of the co-authors listed in the study were also behind uncovering the Meltdown, Spectre, and ZombieLoad vulnerabilities. Collide+Probe and Load+Reload Attacks Like the Intel Spectre attack, the pair of exploits — dubbed Collide+Probe and Load+Reload — manipulate the aforementioned L1D cache predictor in order to access data that should otherwise be secure and inaccessible. "With Collide+Probe, an attacker can monitor a victim's memory accesses without knowledge of physical addresses or shared memory when time-sharing a logical core," the researchers outlined. "With Load+Reload, we exploit the way predictor to obtain highly-accurate memory-access traces of victims on the same physical core." L1D cache way predictor is an optimization mechanism that aims to reduce the power consumption associated with accessing cached data in memory: "The predictor computes a μTag using an undocumented hash function on the virtual address. This μTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only one way instead of all possible ways, reducing the power consumption." The newly discovered cache attacks work by reverse-engineering this hashing function to track memory accesses from an L1D cache. While Collide+Probe exploits μTag collisions in AMD's L1D cache way predictor, Load+Reload takes advantage of the way predictor's handling of aliased addresses in the memory. In other words, the two attack techniques can be employed to exfiltrate sensitive data from another process, sharing the same memory as the attacker or a process that's running on a different logical core of the CPU. To demonstrate the impact of the side-channel attacks, the researchers established a cache-based covert channel that exfiltrated data from a process running on the AMD CPU to another stealthy process, achieving a maximum transmission rate of 588.9kB/s using 80 channels in parallel on the AMD Ryzen Threadripper 1920X processor. With AMD's EPYC processors being embraced by popular cloud platforms such as Amazon, Google, and Microsoft, the fact that these attacks can be carried out in a cloud setting poses significant concerns. Furthermore, the security researchers were able to successfully stage a Collide+Probe attack on some common browsers, namely Chrome and Firefox, by bypassing address space layout randomization (ASLR) in browsers, thereby reducing the entropy, and retrieving address information. ASLR is a security implementation that's used to randomize and mask the exact locations of code and key data areas inside a CPU's memory. Put another way, it hinders a potential attacker from guessing target addresses and jumping to specific sections in the memory. "In Firefox, we are able to reduce the entropy by 15 bits with a success rate of 98% and an average run time of 2.33 s (σ=0.03s, n=1000)," the researchers noted. "With Chrome, we can correctly reduce the bits with a success rate of 86.1% and an average run time of 2.90s (σ=0.25s, n=1000)." Subsequently, the researchers used the same Collide+Probe attack to leak kernel memory data and even recover the encryption key from a T-table implementation that stores intermediate results of cryptographic operations using the AES cipher. Mitigating the Attack The good news is that the twin attacks can be mitigated through a variety of hardware-only, hardware and software changes, and software-only solutions — including designing the processor in a way that allows for dynamically disabling the way predictor temporarily and clearing the state of the way predictor when switching between kernel mode and user mode. This is not the first time AMD processors have been found to be vulnerable to CPU attacks, including Spectre, forcing the company to release a slew of patches. It remains to be seen if AMD will fix the flaws highlighted in the new research. We've reached out to AMD for comment and will update the story if we hear back. "

1 0

Cryptocurrency: FedCoin - #1 Shitcoin
by grarpamp 09 Mar '21

09 Mar '21

" Fedcoin: A Central Bank Digital Currency The Fedcoin has bipartisan support. Jay Powell, appointed as Federal Reserve Chairman by President Trump, said in October that the Federal Reserve is conducting research into issuing a digital currency, on its own and also in partnership with other central banks and the Bank for International Settlements. Janet Yellen, appointed as Fed Chair by President Obama, said last week, “It makes sense for central banks to be looking at issuing sovereign digital currencies.” They give different stated reasons. Powell is more conservative, and his focus is on addressing the potential competitive threat of bitcoin and digital currencies from countries such as China. However, if he really wanted to make the dollar more competitive against the yuan, then he would just abuse the Fed’s credit less. Yellen nods to a progressive idea, saying that a Fedcoin, “could help address hurdles to financial inclusion in the U.S. among low-income households.” However, if she really wanted the “unbankables” to be able to open accounts, then she would just repeal anti money laundering and other regulations that penalize a bank for crimes committed by its clients. Both Powell’s and Yellen’s statements are disingenuous. A Fedcoin is coming, because it’s necessary. Allow us to explain the two real reasons. The first is sinister. The second is more pernicious. Why Fedcoin? Two Real Reasons The first reason is the pathological fall of interest rates over the last four decades. Interest in the US dollar has not gone negative yet, though it has in the Swiss franc, the euro, the pound, and the yen. Interest will continue to fall. When the rate goes negative enough, the banks will not be able to hold the line on paying zero interest in deposit accounts. They will be forced to pass through their pain to depositors. This will provide the first incentive to withdraw cash from the banks—thus pulling out capital—since the 1930’s. The paper dollar bill has zero yield. People will prefer zero to negative yield. Free is better than paying to hold your money. The central banks have three ways to try to fight this. One, they could try to impose losses on dollar bills. They could create an algorithm that deducts from the face value, based on serial number. If they roll this out to point-of-sale devices, then every merchant will know the legal tender value of your cash. That “twenty” could actually be worth $19.93. But this seems impractical and confusing. Two, they can demonetize cash. People are given until a certain date to turn in their cash for a credit to their bank accounts. After that, the paper will have no legal tender value. But, as Yellen noted, many people are kept out of the banking system. Or, three, they could issue a Fedcoin and force everyone to trade their paper cash for Fedcoins. Fedcoin would be nothing like bitcoin. Fedcoin would be programmed to erode at a rate to match the Fed’s negative interest rates. Thus, it would not provide a haven to anyone seeking to hold cash to avoid the erosion of bank balances. They will have you totally trapped. This is an extension of the same idea behind banning gold in 1933. The people were disenfranchised, unable to opt out of the government’s debt. The most conservative saver was forced to hold government bonds, rather than gold. Indeed, after that, the definition of risk-free asset is the government bond. After 1975, you can hold gold. But now, it’s not a dollar balance. It has dollar price volatility. Hence, it’s unsuitable for many conservative savers (and financial institutions). If you have a billion dollars of cash, and a liability to pay a billion dollars in two months, then you cannot take the risk on gold. As we write this, the price of gold has dropped $244 dollars since the start of 2021, or about 13% in about two months. An individual may be able to escape the system by buying gold (or bitcoin), however the dollars are trapped in the system. The seller of the gold (or bitcoin) is the new owner of those dollars. And faces the same awful choice of the tiger or the tiger. The Fedcoin will be designed to further tighten the noose. Even cash will become entirely electronic, and subject to slow confiscation. Not by inflation. But by negative interest rates that reduce the account balance. " ... and by inflation, tax theft, bail-ins, bail-outs, war bonds, govt paychecks, debt, etc.

1 0