February 2022 - cypherpunks - lists.cpunks.org

Buttface Buterin doesn't know cryptoanarchy from a hole in the ground
by professor rat 06 Feb '22

06 Feb '22

And so as Fresh, Billionaire Prince Mark Z rots down so Fresh, Billionaire Prince Vitalik lurches up. What kind of FREAKIN’ moron ever quotes Murray Rothbard, 4-Chan and Peter Palantir Thiel approvingly!? Ohai Vitalik . . . https://mises.org/library/are-libertarians-anarchists

1 0

Cryptocurrency: Your Life Under CBDCs and GovCorp Coins
by grarpamp 06 Feb '22

06 Feb '22

In case you were wondering what life under a CBDC will look like... https://bombthrower.com/articles/gofundme-just-proved-bitcoins-use-case/ https://bombthrower.com/articles/nation-states-are-more-fragile-now-than-ev… https://bombthrower.com/articles/wait-why-is-the-fed-buying-my-biggest-comp… https://www.youtube.com/watch?v=m7YJgj57Css https://nypost.com/2020/06/25/blm-co-founder-describes-herself-as-trained-m… https://bombthrower.com/articles/get-used-to-living-under-subsidiarity-afte… https://bombthrower.com/articles/the-metaverse-is-a-scam/ https://archive.fo/A0Exy https://lpeproject.org/wp-content/uploads/2021/01/Peoples.Ledger.DRAFT_.pdf https://www.bankofcanada.ca/wp-content/uploads/2021/07/sdp2021-11.pdf By now, everybody is probably aware of the Canadian #FreedomConvoy and how GoFundMe, at the behest of the Mayor of Ottawa and Justin Trudeau, summarily closed their fundraiser, which had exceeded $10 million. They also announced that they would literally redistribute funds to other “approved charities”. Those those approved charities would presumably be those mentioned by name by the likes of Trudeau (like the avowedly Marxist BLM, who have fundraising issues of their own owing to lack of financial transparency). This kind of incident is a microcosm of exactly why the world needs Bitcoin, decentralized crypto-currencies and communications protocols. Because we now live in a world run by collectivist technocrats. They sincerely think that what they believe should be rules and what you or I believe should be thought crimes. On its own this would be merely annoying, having to perpetually deal with shrill, sanctimonious hysterics, perpetually shrieking in your face about things they want you to think and how they want you to live. But it’s a problem when these people congregate around the choke-points of a centralized, bureaucratic technocracy and impose their personal neuroses onto the rest of society. Not only as policy, but as official canon on what is truth itself. The final straw is when dissent is criminalized and plunder legitimized. When all actions against those dissenters are fair game, while any civil (and constitutionally protected) resistance is by definition reprobate, then we have arrived in dystopia. At the very least: authoritarianism. Reality will always intrude… The Fourth Turning people observe that the generational cycles oscillate between individuality and collectivism. By extension, right now we’re in a phase of peak collectivism. They’re not wrong, but I think that misses the overall progress of humanity. On a scale of individual autonomy and empowerment, the long term trajectory is always “up and to the right”. Anybody reading Rothbard or Hayek knows that the construct of The State is more accurately a racket whereby small cadres of self-anointed elites appoint themselves the overlords of the masses. Rigging society so that the vast bulk of wealth accrues to themselves and any attempts by the rabble to defend their own interests increasingly fall outside the scope of what is permissible. Slavery, let’s call it for what it is, became more subtle over the centuries. Physical slavery, the treatment of other people as property is now universally abhorred and those who undertake it regarded as criminals (except for everybody who fraternized with Jeff Epstein). In the industrial era slavery had evolved into economic slavery. Debt is what kept the underclass in line and the entire monetary system was designed to perpetuate it. The thin scab of elites that formed The Establishment were by and large Cantillionaires for whom the rules were specifically constructed to benefit at the expense of wider society. Via Wait, why is The Fed buying my largest competitors’ bonds? In the information era, the elites need a different type of slavery. It needed to be digitized. But their problem is that the inexorable push toward wider autonomy and freedom for all humanity threw them a curveball called “decentralization”. As described so presciently in the Holy Bible of Crypto, with digital communications technology and encryption, the fundamental architecture of power changed, irrevocably. Even though globalist elites convene at places like Davos to reimagine everybody else’s future, they are still thinking in terms of linear extrapolations the past. While they promise transhumanist utopias in a largely made-up metaverse to industrial era debt serfs, the actual action in human affairs is happening out here in The Real World. Cryptographically Secured Hard Money Changes Everything Elitist shills like Paul Krugman, et al, fail to successfully marginalize crypto using the same tired tropes (climate hysteria, criminals, right-wing, etc), thankfully to no real avail. When all else fails they finally adjust their blinders and fall back to “there’s no use case”, that Bitcoin “manages both to seem futuristic and to appeal to old-style goldbug fears that the government will inflate away your savings … So crypto has become a large asset class even though nobody can clearly explain what legitimate purpose it’s for.” Really? GoFundMe just showed us two elite-class aspirations in one fell swoop: Confiscation and redistribution. Needless to say Bitcoin fixes this. Today it is GoFundMe. In the future, when central banks roll out Central Bank Digital Currencies (CBDCs), it’ll be all economic activity that falls within the purview of national and Supra-national government and bureaucracy. When those days arrive, everybody who will be reliant on government economic entitlements will be enduring a type of neo-Fuedalism: veritably digital slavery. Those MMT-ers who are promising you a cost-free UBI maybe not even realize themselves what the trade-offs will be that will come with it (aside from skyrocketing debt levels and hyper-inflation). Those will be the social credit hooks which will invariably be built into the CBDCs (or maybe it’s not a trade-off but a feature). Biden’s failed nominee for Comptroller of the Currency authored a white paper called “The People’s Ledger” which called “[for] a comprehensive reform of the structure and systemic function of the Fed’s balance sheet as the basis for redesigning the core architecture of modern finance. In essence, it offers a blueprint for democratizing both access to money and control over financial flows in the nation’s economy.” Sounds benign, but what it really did was outline a blueprint for the complete takeover of the private banking system and would bake-in protocols for a compulsory investments and arbitrary deposits and withdrawals Omarova’s run at the position is finished. Don’t think for a second the sentiment behind her People’s Ledger is. But since we’re talking about Canada’s #FreedomConvoy, we can look at how the Bank of Canada’s white paper on CBDCs expresses enthusiasm around the same capabilities of “Smart contracts and the benefits of programmability”: Although still early in their development, smart contracts could enable entirely new digital economy applications with many potential benefits. To start, smart contracts could enable programmable money by adding certain attributes to it. For example, money could be programmed to gain or lose value over time, or it could be programmed to be used in transactions for only specific goods or services. Furthermore, smart contracts can enable programmable payments—automated payments that are executed after certain conditions are met. These can range from simple push payments to more complex ones. For instance, smart contracts could enable automatic routing of tax payments to authorities at the point of sale, pay-as-you-go insurance or payments that can support IoT applications. Sounds generic and non-biased enough. However take a look around. Those “certain attributes” and “certain conditions” may well end up being things like what Justin Trudeau, or whomever replaces zim thinks about your activities (or “unacceptable opinions”). Donating to #FreedomConvoy? Listening to Joe Rogan Experience? Those aren’t approved activities. That’ll cost you some demerits. You may not even know it’s happening, just that the GovCoin that hits your phone every month is not as much those other, more compliant, people. Or when you go to spend it, the prices adjust to different levels. That’s if your GovCoin app even allows you to complete the purchase, after evaluating it against a scorecard devised by woke ideologues who think you’re fringe. As for #GoFraudMe The company initially put the onus on those who donated to request a refund, and would thereafter redistribute the convoy’s money to other approved charities. Given the pushback (it’s basically theft), they have since announced they would refund all donations. Personally, I will never donate via GFM again, not out of some cancel-culture based spite, but because they are demonstrably unreliable and willing to change the game on-the-fly (something that can’t happen in crypto). >From now on whenever anybody asks to raise money via GFM just tell them you’ve love to help, but given their past actions you have no assurances that your donation would actually go to its stated purpose. Instead of going toward helping some child with her cancer treatment it may simply be confiscated and sent to Greta Thunberg instead. Offer to mail them a cheque directly or even better: send them some Bitcoin or other crypto.

1 0

Cryptocurrency: Bitcoin_Cash BCH Forging Ahead w Adoption First
by grarpamp 06 Feb '22

06 Feb '22

https://www.youtube.com/watch?v=5oHdOrVlqpM BCH Progressing https://pos.cash/ https://v.redd.it/29h621b4f3f81 https://github.com/Electron-Cash https://whybitcoincash.com/ https://play.google.com/store/apps/details?id=com.bitcoin.merchant.app Reaching any value requires adoption first. A successful cash can store value. A store that cannot be used is of no value. Privacy is an inherent thus needed aspect of human nature. Fermi estimates and free-market economics apply. Bitcoin-BTC may become the internal plaything of GovBankCorp's sooner than it becomes a few billion people's weekly tool for freedom. Look closely at adoption-first focused communities centered around simple cash-model privacy-capable non-printable high-tx-rate non-censorable coins such as BCH. And at coins doing similar and working on the storage space problem. And of course look at creating and deploying cross-coin distributed DEX to enable fluid coin migration to the future. Early days, have fun :)

2 1

Cryptocurrency: GoldBacks Offer Physical Gold Inside Private Voluntary Paper Currency
by grarpamp 06 Feb '22

06 Feb '22

GoFundMe just made the use case for Bitcoin undeniable to everybody. At the same time, they gave you a preview of what life will be like if you ever become reliant on Central Bank Digital Currencies (CBDCs), and non-privacy-capable cryptocurrencies. If you don't hold it, you don't own it. For those not following the physical space... New Private Currency Uses Bills Filled With Real Gold https://www.theepochtimes.com/new-private-currency-offering-money-for-the-a… https://goldback.com/history https://www.ithaca.com/ithaca-hours/collection_aa428dc2-65d5-11e0-850e-001c… https://www.berkshares.org/ https://www.appalachianhistory.net/2018/09/company-store-scrip.html https://techjury.net/blog/what-is-a-fiat-currency/ https://www.churchofjesuschrist.org/study/manual/gospel-topics/food-storage https://uspreppers.com/how-to-prep-like-a-mormon/ https://www.utahpreppers.com/ https://www.thesprucecrafts.com/norfed-liberty-dollar-coins-768362 https://www.forbes.com/sites/georgeleef/2014/12/09/protecting-us-from-a-ter… https://schiffgold.com/key-gold-news/nothaus-liberty-dollar-sentencing-013/ https://www.nysun.com/national/spectacular-trial-is-seen-in-case-of-liberty… https://www.youtube.com/watch?v=OVMeLfoch1M Modern currencies such as Bitcoin expect to find success in a more technological world, but a new currency known as Goldbacks might corner the post-apocalyptic currency market. Goldbacks in several different denominations In 2019, Goldback president Jeremy Cordon said he had a dream in which he saw people paying for groceries using golden bills. Cordon had previously worked for years trying to make gold into functional money, but the dream gave him a new idea: What if a bill small enough to buy groceries could include a tiny percentage of gold? “This felt like an epiphany because I saw people using gold as a regular money,” he said. “This fit into the vision that anyone anywhere could use gold as their currency of choice.” For thousands of years, anyone who wanted to buy goods with gold faced “the small coin problem,” Cordon told The Epoch Times. A 1-ounce gold coin, worth about $2,000, is far too expensive for everyday use, but a cheap gold coin is impractically small. “Gold is the best money, but it can’t buy a loaf of bread,” he said. To solve this problem, Cordon used new technology to create a bill that sandwiches a particle-thin gold layer between two layers of polymer—the Goldback. The result can be worth as little as $3.80. Be Prepared At a time when Bitcoin has devoured most of the private and local currency market, Goldbacks have arrived late to the private currency world. In the 1980s and ’90s, private currencies experienced a boom around the United States, according to University of Central Oklahoma professor and local currency expert Loren Gatch. But since then, they’ve been on the decline. “That’s something which [has] pretty much gone downhill in the last couple decades,” Gatch said. Cities such as Ithaca, New York, and Berkshire, Massachusetts; businesses such as coal mining camps; and political groups such as left-wing activists and libertarian anti-government enclaves have all used private currencies. But even amid a private currency decline, Goldback has $20 million of bills in circulation, according to Cordon. They’re recognized as legal tender in Utah and Wyoming and are legal for use in New Hampshire, Nevada, and South Dakota. This number puts Goldbacks at the top end of what private currencies have ever achieved. “It’s totally off the scale,” Gatch said. “$20 million is far greater than what I think any of the experiments that I’m familiar with—in the last quarter-century—have ever tried to do.” Gatch said the idea of filling bills with gold seems like a gimmick. Gold-backed currencies already work when the gold is in a vault, and people still must trust the banker at some point. “You’re basically not getting away from the problem of public credibility if you issue these currencies that claim to have a little bit of gold in it,” he said. “They could be gold, it could be something else. You have to establish the public’s confidence in it.” But a post-apocalyptic setting might make the gold inside the bills more valuable, according to Gatch. If all of society were to collapse, it would be better to have gold in hand than in a bank vault somewhere. Even so, Gatch doubted that people would need gold money after a societal collapse. “It’s true that if the world collapsed, the dollar probably wouldn’t be worth very much,” he said. “But, man, that’s the least of your worries.” Apocalypse Money If society collapses, Goldbacks are made of something that has remained valuable throughout human history, Cordon said. “You can barter with gold just about anywhere in the world. And that’s part of why people buy gold,” he said. “If it’s the apocalypse, if our electrical grid goes down, you don’t want Bitcoin or dollars.” Goldback director of sales and marketing Kevan Mills speculates that the dollar’s collapse into worthlessness grows closer every day. Studies show that no fiat currency has lasted for more than four generations. “We are just getting towards the end of the second generation, if we’re counting from when [President Richard] Nixon canceled the gold standard to now,” he said. According to tech website TechJury, the average fiat currency lasts 27 years, although some exceptions, such as the British pound, have lasted for centuries. A wallet filled with Goldbacks For now, it seems that Goldback is betting that such a collapse isn’t imminent. People can exchange dollars for Goldbacks, according to Mills. He noted that there’s value in owning a diverse pool of assets. “It also makes sense to have some assets and precious metal, just in case,” he said. For Cordon, who is a Mormon, preparedness is an article of faith. The Mormon church teaches that believers should have a three-month supply of food in their homes in case of disaster. “We encourage members worldwide to prepare for adversity in life by having a basic supply of food and water and some money in savings,” the Mormon Church’s website reads. Mormons have a reputation for being the first “preppers,” and Utah hosts apocalypse prepping conferences. Whatever their motives, most Goldbacks users appreciate the freedom, beauty, and security that gold offers, Cordon said. People from all political affiliations and walks of life want the new currency. “It’s really anybody that loves liberty,” he said. “I think the reason why gold has been money for thousands of years is that it’s just really beautiful.” A Goldback note. (Samira Bouaou/The Epoch Times) Gold in Hand According to Mills, Goldbacks practically advertise themselves as they spread through transactions. People are eager to use a currency when they know it’s gold. “This is the first company I’ve ever worked with where the product sells itself,” Mills said. “In 25 years of marketing, I’ve never been involved with a product where consistently in board meetings and executive meetings we’re saying, ‘What do we do to slow demand?’” Today, more than 200 Utah businesses advertise that they take Goldbacks. But for at least seven of those businesses, receiving Goldbacks from customers has mostly been a theoretical transaction. Only one of those business owners said he receives Goldbacks on a consistent basis. Skyler McCallson, owner of Utah’s Wok the Line restaurant, said Mills asked him to sign up as a business that accepts Goldbacks. “We probably see maybe 2 percent to 3 percent of our sales in Goldbacks,” McCallson said. “But you know, that’s 2 percent to 3 percent of sales we weren’t normally seeing, so we’ll take it.” He said he keeps the Goldbacks he gets paid. The rest of the contacted businesses say they’ve seen only one purchase in Goldbacks. Often, the purchaser was a representative from Goldback. Paul Mooney, owner of Utah’s Alien IT Services, has yet to receive a single purchase in Goldbacks, although he said he would accept them on principle. “You never know. I don’t know,” Mooney said. “I just have to see if anybody wants to go that route.” One real estate business owner said that he has agreed in theory to accept Goldbacks in payment for a house, but has never had anyone offer them to him for that purpose. However, the bills are a common sight in his community. “I have seen them used even in garage sales,” he said. In just a week, Mills said he paid a landscaper, grass seeder, and shed builder in Goldbacks for their services. Although none of these businesses had received Goldbacks before, they quickly accepted them. “Heck, yeah, I would! I’ve been collecting gold and silver coins for 30 years, I’d love to take payment in gold,” the planter told Mills. Making Money In a way, Goldbacks reverse many modern currency trends. From 1879 to 1933 dollars were effectively receipts for gold. Any American could exchange dollars for an equivalent amount in gold. Then President Franklin D. Roosevelt passed an executive order that made the practice illegal. President Richard Nixon continued this trend, taking America off the gold standard in 1971. But President Nixon separated the dollar’s value from gold. Today, dollars are a “fiat currency”—they’re worth what the federal government says they’re worth. As a result, fiat currencies often struggle with inflation. “It’s happened hundreds of times where a fiat currency can hyperinflate and lose all of its value,” Cordon said. But the Goldback is valuable because of its gold, making it “commodity money.” Business owners can rest assured that their Goldbacks are secure for several reasons, according to Cordon. In the eternal race between counterfeiters and currency-makers, the advanced technology used to make Goldbacks gives the currency a 15-year head start, he said. “You’re looking at about $10 million worth of equipment before you can counterfeit a Goldback. And you’re looking at about 10 years of expertise,” he said. Also, because the gold that backs each Goldback is in the bill itself, users don’t have to trust that Cordon’s business has enough precious metal to back each bill. All in the Name No matter their suitability for the apocalypse, Goldbacks face their biggest threat from the federal government. If private currencies too closely resemble U.S. currency, the federal government will prosecute its creators for counterfeiting. In 2009, Bernard von NotHaus, the creator of the Liberty Dollar, was arrested for counterfeiting. At its height, there were about $5 million in silver-backed Liberty Dollars in circulation. Unlike traditional counterfeiters, Von NotHaus was open about the money he manufactured, which didn’t resemble any bill or coin currently in circulation. But he used the word “dollar” and the phrase “Trust in God” on his coins. To the government, this constituted counterfeiting. Von NotHaus was also rampantly anti-government, according to Gatch. His company’s original name was the National Organization for the Repeal of the Federal Reserve Act and the Internal Revenue Code. “What you cannot do is pretend that your currency is U.S. dollars,” Gatch said. “Then that’s where the government gets mad at you.” The government confiscated Von NotHaus’ silver reserves when he was arrested, but returned them in 2014. The FBI also argued that the Liberty Dollar worked as a multi-level marketing scheme. Von NotHaus also sold Liberty Dollars for much more than the gold and silver in the coins plus the addition of coin minting costs. But compared to other small gold products, Goldbacks are impressively cheap, according to Max Hockley, a longtime gold collection expert. Cordon said his company has learned from the fate of the Liberty Dollar. He designed Goldbacks to be impossible to mistake for dollars. The bills feature lengthwise images, no dollar signs, and Bible verses that don’t appear on dollars. “We don’t want anybody thinking Goldbacks are dollars,” he said. “Their value is higher than dollars.”

1 0

Crypto's sexual revolution
by professor rat 05 Feb '22

05 Feb '22

Crypto-currencies are a lifeline for sex workers, like this former nurse who made $1.3 million last year https://www.cnbc.com/2022/02/05/bitcoin-a-lifeline-for-sex-workers-like-ex-… Crypto-anarchy treats govt-repression as damage and negates it. Viva la revolution!

1 0

the jews, also known as the jew-nazis
by Punk-BatSoup-Stasi 2.0 05 Feb '22

05 Feb '22

"Amnesty International has become the third major human rights organization to accuse Israel of committing the crime of apartheid against Palestinians in a new report released on Tuesday. Amnesty finds Israel’s system of apartheid dates back to the country’s founding in 1948 and has materialized in abuses including massive seizures of Palestinian land and property, unlawful killings, forcible transfer, drastic movement restrictions, and the denial of nationality and citizenship to Palestinians — all of which constitute apartheid under international law." the fucking jews are guilty of crimes against humanity - shocking!

1 0

Consistently Nazi-type views on Jews
by professor rat 05 Feb '22

05 Feb '22

All his rotted, miserable adult life http://marxwords.blogspot.com/2005_02_01_marxwords_archive.html Karl Marx, Capital, Volume One, Part II: The Transformation of Money and Capital CHAPTER FOUR: THE GENERAL FORMULA FOR CAPITAL: "The capitalist knows that all commodities, however scurvy they may look, or however badly they may smell, are in faith and in truth money, inwardly circumcised Jews . . . " All Marxists are antisemitic.

1 0

jim bell's nazi science and the 'aids' 'vaccine'
by Punk-BatSoup-Stasi 2.0 05 Feb '22

05 Feb '22

from kennedy's book " On October 2015, Gallo...announced the launch of Phase 1 human trials of his latest HIV vaccine candidate. A consortium led by the Bill & Melinda Gates Foundation gave $23.4 million to Gallo’s research on this vaccine. Other money came from Redfield’s pals in the US Military HIV Research Program. Gallo launched his clinical trial in collaboration with Profectus BioSciences, a biotech firm that he recently spun off from IHV to allow him to monetize the research he conducted with tax-deductible funding from Gates and taxpayer dollars from NIH and the military. Gallo had already been testing his new HIV vaccines on animals, and “The results in monkeys are interesting, but they’re not perfect.” Undeterred by the vaccine’s disappointing performance in macaques, Gallo was champing at the bit to test his concoction on some higher primates. “If we keep just using monkeys, we’re never going anywhere. We need for humans to respond.” In May 2020, I asked Gallo what had ever happened to this experimental vaccine. Gallo claimed, in what I suspected to be an evasive nonanswer, that he was still (after six years) testing it for an immune response" "In 2020, many of the Gates/Fauci HIV vaccine trials in Africa suddenly became COVID-19 vaccine trials, as the unprecedented tsunami of new COVID-19 plunder began flowing through Dr. Fauci to the same disciplined legions of the virology caste."

1 0

Cryptocurrency: Artist Drops $11M 410lb Gold Cube Coin
by grarpamp 05 Feb '22

05 Feb '22

At the current price of $0.44, dilution of value occurs if there will ever be more than 26967563 (27M) coins. An Artist Dropped An $11.7 Million, 410lb Gold Cube In Central Park For A Day This Week https://news.artnet.com/art-world/solid-gold-cube-central-park-2067281 For one day and one day only, an $11.7 million gold cube sat in the middle of Central Park, protected by its own security detail. The cube, called The Castello Cube, was the brainchild of German artist Niclas Castello, according to Artnet. It was made of 24-carat, 999.9 gold and weighed in at 410 pounds. Castello "is known largely for his sculptures and paintings partly inspired by artists like Jean-Michel Basquiat and Andy Warhol," Artnet wrote. It placed in Central Park for only one day this week, Wednesday. Castello told Arnet it was “a conceptual work of art in all its facets” and that he sought to “create something that is beyond our world—that is intangible.” And what would art be nowadays without tying it to a cryptocurrency? That's exactly what Castello did, launching The Castello Coin alongside his physical artwork. The coin is available for purchase at an initial price of €0.39 ($0.44), the report says. There will also be an NFT auction later in February. Viennese gallerist Lisa Kandlhofer told Artnet: “The cube can be seen as a sort of communiqué between an emerging 21st-century cultural ecosystem based on crypto and the ancient world where gold reigned supreme.” The art was custom cast at a foundry in Aarau, Switzerland and needed a custom kiln due to its size and the temperatures needed to melt it. After leaving Central Park, the cube made its way to a "private dinner on Wall Street", the report says.

1 0

Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
by zeynepaydogan 05 Feb '22

05 Feb '22

https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploi… Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra FacebookTwitterEmail In December 2021, through its Network Security Monitoring service, Volexity identified a series of targeted spear-phishing campaigns against one of its customers from a threat actor it tracks asTEMP_Heretic. Analysis of the emails from these spear phishing campaigns led to a discovery: the attacker was attempting to exploit a zero-day cross-site scripting (XSS) vulnerability in the Zimbra email platform. Zimbra is an open source email platform often used by organizations as an alternative to Microsoft Exchange. The campaigns came in multiple waves across two attack phases. The initial phase was aimed at reconnaissance and involved emails designed to simply track if a target received and opened the messages. The second phase came in several waves that contained email messages luring targets to click a malicious attacker-crafted link. For the attack to be successful, the target would have to visit the attacker's link while logged into the Zimbra webmail client from a web browser. The link itself, however, could be launched from an application to include a thick client, such as Thunderbird or Outlook. Successful exploitation results in the attacker being able to run arbitrary JavaScript in the context of the user's Zimbra session. Volexity observed the attacker attempting to load JavaScript to steal user mail data and attachments. An overview of the full attack is given in Figure 1: Figure 1. Overview of attack phases While Volexity only observed TEMP_Heretic attempting email and attachment theft, the vulnerability could easily allow an attacker to perform other actions in the context of the user's Zimbra webmail session, such as the following: - Exfiltrate cookies to allow persistent access to a mailbox. - Send further phishing messages to a user's contacts. - Present a prompt to download malware in the context of a trusted website. At the time of writing, this exploit has no available patch, nor has it been assigned a CVE (i.e., this is a zero-day vulnerability). Volexity can confirm and has tested that the most recent versions of Zimbra—8.8.15 P29 & P30—remain vulnerable; testing of version 9.0.0 indicates it is likely unaffected. Based on BinaryEdge data, approximately 33,000 servers are running the Zimbra email server, although the true number is likely to be higher. According to Zimbra, there are 200,000 businesses, and over a thousand government and financial institutions, using the software. Volexity has also been unable to attribute the observed activity to a previously known threat actor. However, based on a number of observed factors, Volexity believes the attacker is likely Chinese in origin. Volexity has observed TEMP_HERETIC targeting organizations in the following sectors: - European Government - Media Spear-phishing Campaigns Spear-phishing messages observed by Volexity were sent over a period of two weeks in December 2021 using 74 unique outlook.com email addresses created by the attacker. While there were variances, emails were frequently formatted as<firstname>_<lastname><numbers>@outlook.comor<firstname><lastname><numbers>@outlook.com. The attacker used names commonly used as feminine names for all the personas they created regardless of the email address, as observed from the email-friendly name field. The pattern of sending times suggests the attacker may have manually crafted content for each email before sending it, as they were often sent to consecutive recipients with gaps of a few minutes. Volexity was able to track all the messages TEMP_HERETIC sent and found the attacker conducted a single reconnaissance wave followed by multiple waves aimed at compromising email data. Reconnaissance The initial phase of the attack came in the form of spear-phishing campaign sent on December 14, 2021, UTC. It did not involve any type of social engineering lure outside of attempting to get the user to view or open the email. This first wave simply embedded remote images in the body of email messages. These emails contained no content other than the remote image and had generic subjects often associated with non-targeted spam. Below are a list of the subject line topics used for the initial reconnaissance emails. - Invitations - Refunds for airline tickets - Warnings - <no subject> The image links in each email were unique per target. This was likely done to test the validity of email addresses, and to determine which accounts were more likely to open phishing email messages. However, Volexity ultimately did not note any correlation between reconnaissance emails and follow-on spear-phishing campaigns. Examples of URLs to remote images are shown below: > hxxp://fireclaws.spiritfield[.]ga/[filename].jpeg?[integer] > > hxxp://feralrage.spiritfield[.]ga/[filename].jpeg?[integer] > > hxxp://oaksage.spiritfield[.]ga/[filename].jpeg?[integer] > > hxxp://claygolem.spiritfield[.]ga/[filename].jpeg?[integer] The [integer] at the end of each URL was used to identify the specific victim. The subdomains were found to be unique per email, but it is unknown why they were chosen. Gaming enthusiasts may recognize that the subdomains correspond to the names of spells from the game[Diablo II](https://user.xmission.com/~trevin/DiabloIIv1.09_Skills.html). Malicious Emails In the second attack phase, Volexity observed multiple spear-phishing campaigns run on December 16, 23, 24, and 27, 2021. In these campaigns, the attacker embedded links to attacker-controlled infrastructure. In some cases, it appears more of an effort was made to craft a lure that was more enticing to the targeted individual. Two different themes were used in the first wave of attacks. The first theme was interview requests purporting to be from various news organizations such as Agence France-Presse (AFP) and BBC. The second theme was invitations to a charity auction hosted by Sotheby's. In once instance, the attacker used the same "Jacqueline Martin" email address, where Jacqueline was used to represent both BBC and Sotheby's. Examples of these messages are shown below. https://www.volexity.com/wp-content/uploads/2022/02/zimbra-bbc.pngFigure 2. Example phishing email using human-rights themed targetinghttps://www.volexity.com/wp-content/uploads/2022/02/zimbra-sotheby… 3. Example phishing email using an auction theme However, not all content was custom or otherwise made to stand out to the targets. The spear-phishing waves that followed were largely generic and mostly themed around the holiday season, notably purporting to be from various airlines or Amazon. The attacker sent numerous emails with Christmas and New Years greetings purporting to be from Air France, British Airways, Iberia Airways, Lufthansa, Southwest Airlines, and United Airlines. The attacker sent similar holiday greetings purporting to be from Amazon but also sent generic messages inviting the user to try Amazon Prime or get discounts on their purchases. Examples of these phishing messages are shown below. https://www.volexity.com/wp-content/uploads/2022/02/zimbra-amazon.pngFigure 4. Phishing email using Amazon Prime trial themehttps://www.volexity.com/wp-content/uploads/2022/02/zimbra-christmas.p… 5. Christmas themed phishing email Subsequent waves from attack phase of the spear phishing campaigns used a similar URI pattern but with a consistent subdomain. The format is given below: > hxxps://update.secretstep[.]tk/[filename].jpeg?u=[integer]&t=[second_integer] The second integer in this case was used to denote the target organization. Upon clicking the malicious link, the attacker infrastructure would attempt a redirect to a page on the targeted organization’s Zimbra webmail host, with a specific URI format which—if the user is logged in—exploits a vulnerability allowing an attacker to load arbitrary JavaScript in the context of a logged-in Zimbra session. Since there is no available patch for this vulnerability, Volexity is not currently disclosing the required URI pattern required for successful exploitation. A beautified and marked-up copy of the code loaded by the attacker is given[here](https://github.com/volexity/threat-intel/blob/main/2022/2022-02…. The functionality of the attacker code is simple: - Iterate through each email in the user's inbox and sent folders. - For each email encountered, send the email body and any attachments to the configured callback address (mail.bruising-intellect[.]ml) via HTTP POST requests. A screenshot of the main loop used for retrieving emails from a victim’s inbox is shown below: https://www.volexity.com/wp-content/uploads/2022/02/zimbra-attacker-code.pn… 6. Marked-up copy showing the inbox email theft code The overall effect of this attack is that by getting a user to click a link in an email and leave their browser window open for any length of time, the attacker can steal the contents of their mailbox. The JavaScript code used to facilitate mail theft has to be customized per version of Zimbra, as the attacker needs to request a page containing a CSRF-Token in order to make subsequent requests to steal mail data. An example of the POST data format in the event of a successful mail theft is given below. Figure 7. Example POST data sent by the JavaScript containing full email body data. Infrastructure Analysis and Attribution Based on the infrastructure used in the attacks against its customer, Volexity was able to identify a number of additional domains and IP addresses used by the attacker based on simple passive DNS pivots. All identified infrastructure used Freenom domains hosted on AS399269, which belongs to BitLaunch (BLNWX). These appear to be virtual private servers that were likely purchased via bitlaunch.io, a service which allows for purchasing infrastructure using the Bitcoin currency. All identified IP addresses were observed running Apache 2.4.6 on CentOS with PHP 5.4.16. When SSL is used, certificates were purchased via ZeroSSL. A full list of IOCs is given[here](https://github.com/volexity/threat-intel/blob/main/2022/2022-02…. Notably, Scanbox-related activity Volexity previously described in its private reporting in August 2021 also used the same server settings (although without SSL). In terms of attribution, none of the infrastructure identified by Volexity exactly matches infrastructure used by previously classified threat groups. However, based on the targeted organization and specific individuals of the targeted organization, and given the stolen data would have no financial value, it is likely the attacks were undertaken by a Chinese APT actor. Furthermore, there were three clues to suggest the attacker could be Chinese: - The vast majority of emails were sent between 04:00 and 08:30 UTC, fitting hours of a working day of UTC + 8 hours. - Emails were sent with headers indicating they were sent from a +0800 UTC time zone. - The hard-coded headers used in the Zimbra requests generated by the attacker’s JavaScript code contain a timezone set to “Asia/Hong_Kong”. Conclusion and Recommendations While this Zimbra XSS vulnerabilty may not be as widereaching and damaging as the Microsoft Exchange vulnerability [Volexity discovered](https://www.volexity.com/blog/2021/03/02/active-exploitation-of… disclosed last year, it can still have catastrophic consequences for organizations that land in the crosshairs of an attacker with the exploit. At the time of this writing, there is no official patch or workaround for this vulnerability. Volexity has notified Zimbra of the exploit and hopes a patch will be available soon. A timeline of events related to this exploit is given below: Exploits against mail servers have been numerous in the last few years. They continue to be a productive avenue for attackers wishing to steal data from organizations running on-premise mail services. Vulnerability data published by NIST reveals that Zimbra accumulated 23 severe and critical vulnerabilities since 2019. When software products are assigned many severe vulnerabilities, threat actors usually take note and invest in developing capabilities to exploit them. This is especially true if the product holds valuable information on relevant organizations, such as email. Volexity recommends the following: - All of the indicators[here](https://github.com/volexity/threat-intel/blob/main/2022/20… should be blocked at the mail gateway and network level. - Users of Zimbra should analyze historical referrer data for suspicious access and referrers. The default location for these logs can be found at/opt/zimbra/log/access*.log. - Users of Zimbra should consider upgrading to version 9.0.0, as there is currently no secure version of 8.8.15. If you believe your organization may been breached from this vulnerability or similar related activity, and you need assistance conducting an incident response investigation, please[contact](https://www.volexity.com/company/contact/breach-assistance/… for further assistance. This vulnerability and related threat activity were detailed to Volexity Threat Intelligence customers in TIB-20211224. Appendix A: Related Infrastructure value entity_type description amazon-check[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day amazon-check[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day amazon-check[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day amazon-check[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day amazon-team[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day bruising-intellect[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day chargedboltsentry.spiritfield[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day findtruth[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day flameshock.spiritfield[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day iceywindflow[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day iceywindflow[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day iceywindflow[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day mail.bruising-intellect[.]ml hostname Infrastructure used in conjunction with Zimbra 0-day; hosted malicious JS used to steal user mail and was C2 for that malicious JS mx.newsonline[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day news-online[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day news-voice[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day newsonline[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day opticaleel.iceywindflow[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day playquicksand[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day playquicksand[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day playquicksand[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day playquicksand[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day secretstep[.]tk hostname Infrastructure used in conjunction with Zimbra 0-day; initial domain used to redirect users to malicious Zimbra URL shadowmaster.iceywindflow[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day shadownight.playquicksand[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day shadownight.spiritfield[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day spiritfield[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day spiritfield[.]ga hostname Infrastructure used in conjunction with Zimbra 0-day; used in reconnaissance emails to validate if addresses were real before sending actual payload later spiritfield[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day spiritfield[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day spiritx[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day support.newsonline[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day thunderchannel[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day thunderchannel[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day tigerstrike.iceywindflow[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day update.secretstep[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day winderosion.spiritfield[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day windsoft[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day windsource.thunderchannel[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day windsource.thunderchannel[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day www.amazon-check[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day www.findtruth[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day www.iceywindflow[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day www.news-online[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day www.news-voice[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day www.newsonline[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day www.playquicksand[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day www.playquicksand[.]gq hostname Infrastructure likely used in conjunction with Zimbra 0-day www.spiritfield[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day www.spiritx[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day www.thunderchannel[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day www.thunderchannel[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day www.windsoft[.]cf hostname Infrastructure likely used in conjunction with Zimbra 0-day www.yahoo-corporation[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day yahoo-corporation[.]ml hostname Infrastructure likely used in conjunction with Zimbra 0-day yahoo-corporation[.]tk hostname Infrastructure likely used in conjunction with Zimbra 0-day yahoo-movie.spiritx[.]ga hostname Infrastructure likely used in conjunction with Zimbra 0-day 108.160.133.32 ipaddress Suspected related C2 server 172.86.75.158 ipaddress Resolution for known domain associated with Zimbra exploitation 206.166.251.141 ipaddress Resolution for known domain associated with Zimbra exploitation 206.166.251.166 ipaddress Resolution for known domain associated with Zimbra exploitation [0day](https://www.volexity.com/blog/tag/0day/),[APT](https://www.volexity.c… phishing](https://www.volexity.com/blog/tag/spear-phishing/),[xss](https://… -

1 0