May 2022 - cypherpunks - lists.cpunks.org

Re: Entropy code
by zeynepaydogan 06 May '22

06 May '22

Notice, as an unrelated side note, that in c++ you can't pass full arrays to functions as you would in managed languages, you have to pass a pointer to the first byte of an array to be processed and the return a pointer to the first byte of the resulting processed array. The function copies the chunks of high entropy code to a new array and inserts a pattern of ascending bytes starting by a initial random byte. Not all bytes can be random because the entropy would not be reduced, so only the first one is. There rest will follow a pattern and here of course you can select many different patterns. For this example I used a simple incremental pattern. Final task will restore the original byte array by eliminating the inserted low entropy chunks of code. PBYTE restore_original(PBYTE high_ent_payload) { constexpr int payload_size = (payload_size_after_entropy_reduction + 1) / 2; // re-calculate the original payload size BYTE low_entropy_payload_holder[payload_size_after_entropy_reduction] = {0}; // create a new array to hold the bytes to be processed memcpy_s(low_entropy_payload_holder, sizeof low_entropy_payload_holder, high_ent_payload, payload_size_after_entropy_reduction); // move the array to be processed to the newly created array // Create an empty array which will contain the restored data static BYTE restored_payload[payload_size] = {0}; int offset_of_hi_entropy_payload = 0; int offset_of_original_payload = 0; // Because high and low entropy chunks are of the same size, then simply copy the high entropy ones to the restored array and skip the low entropy ones for (size_t i = 0; i < number_of_chunks; i++) { for (size_t j = 0; j < chunk_size; j++) { restored_payload[offset_of_original_payload] = low_entropy_payload_holder[offset_of_hi_entropy_payload]; offset_of_hi_entropy_payload++; offset_of_original_payload++; } for (size_t k = 0; k < chunk_size; k++) { offset_of_hi_entropy_payload++; } } // Copy the remaining bytes if (remaining_bytes) { for (size_t i = 0; i < sizeof remaining_bytes; i++) { restored_payload[offset_of_original_payload++] = high_ent_payload[offset_of_hi_entropy_payload++]; } } return restored_payload; } So lets explain this graphically. Suppose a byte belonging to a high entropy chunk is represented by the letter "H" and a low entropy byte belonging to a low entropy chunk is represented by the letter "L", and the remaining never modified bytes are represented by the letter "R" The original high entropy array is something like this: HHHHHHHHHHHHHHHHHRRR The processed low entropy array is something like this: HHHHLLLLHHHHLLLLHHHHLLLLHHHHRRR So to restore the original high entropy array from the low entropy processed array we simply eliminate the low entropy "L" bytes and we finally append the remaining "R" bytes. The restored high entropy array is something like this after low entropy chunks elimination: HHHHHHHHHHHHHHHHHRRR Finally we can explain the main function that will use the previous two functions to perform all the jobs, and to make sure that all of this works, we will calculate the Shannon entropy at each step to corroborate entropy is high at the beginning, then reduced and finally its increased once more.

1 1

Entropy code
by zeynepaydogan 06 May '22

06 May '22

Entropy is a measure of randomness in a set of data. The more random your data is, the more entropy it has. When we talk of entropy we are generally referring to Shannon Entropy which is an algorithm that will produce a result between 0 and 8, where 8 means there is no pattern in the data, thereby its very random and 0 means data follows a pattern. When you are used to evaluate digital data its very easy to see these patterns without even doing any calculation. Its the analog of the movie The Matrix when you can see what is going on in the Matrix Code without the translator. Random high entropy digital data looks very chaotic while low entropy data looks more organized, even you may be able to see some symmetric patterns formed by the array of bytes in the data, though it is still not readable in any known language, and again, no calculation is needed in general. It turns out that one of the techniques, I would say, almost universally used to hide malicious code is packing the code or encoding it to change its byte pattern signature to fool security products. The problem of this approach is also universal. As you pack or obfuscate the malicious code, its entropy increases. In fact, studies have demonstrated that entropy can be used very effectively to separate none malicious code from malicious one based on its entropy. Malicious samples will typically have an entropy over 7.2 while legitimate software ranges from 4.8 to 7.2. An entropy close to 8 will be seen in 30% of malicious samples but only in 1% of innocent code. More than half of malicious samples will have an entropy over 7.2 while only one out of ten legitimate applications will have such high entropy. In conclusion, not all malicious samples have high entropy (but a great majority will) and not all legitimate applications will have a low entropy (but the majority will). The reason why legitimate samples can have high entropy is related to the fact that packing is a valid technique used to decrease the size of executables, protect resources, and many applications take advantage of this. So even though entropy is not enough to differentiate malicious code from normal innocent code, malware analysis tools have used high entropy as one of the main elements in their malicious scoring systems to flag samples. If you have been in the crypters world, you can corroborate this by scanning your stub alone and then your stub with the encoded payload stored in the data section or resources section. Detection immediately increases. Anti-malware solutions will look for high entropy not only as a global value on the entire executable but also section by section and there is little that we can do to counter it. Even though this has been a problem for many years, the proposed techniques are not definitive. If you read on the topic, malware authors propose to increase the amount of normal code versus obfuscated code as first solution. Evidently then the stub has to be bigger and full of unused code. So although possible I don't see this as a good solution. Second solution is even more inconvenient because it would require to reduce the amount of obfuscated code meaning that the malicious code would have to be smaller in comparison to the stub. Unfortunately in most situations, its the opposite. The stub is greatly smaller than the payload. This, therefore will limit the possible payloads to the very few small ones. Another possibility is obfuscate the code using an algorithm that does not increase entropy (like XORing and Base64 encoding). This last one I think is the more convenient, which does not mean that is perfect. XORing as well as Base64 encoding can be easily decrypted to unmask the real purpose of the code. Also signatures can be created directly, both against the XORed as well as the Base64 encoded data. Finally, Some anti-malware solutions can even decode these simple schemes during the emulation phase of the analysis. Thinking in better possible alternatives I came up with an interesting idea that I have seen applied to some few malware samples in the past. If the problem is randomness, then why not try to disguise the malicious obfuscated code by inserting patterns to reduce its randomness and therefore its global entropy. In this way you are not limited to obfuscate the code with simple algorithms and yet stay under the radar of anti-malware solutions; also the obfuscated code could be of any size. With this in mind I created a POC to reduce the Shannon entropy of an obfuscated malicious array of bytes. The idea is to break the array in chunks and insert a low entropy pattern of bytes between one chunk and the next. When the sample is to be executed we have to rebuild the original payload in memory and at this point we have bypassed the static detection of the high entropy code. I want to stop in the pattern to follow for the low entropy bytes because you can create different patterns in order to avoid signature detections. Using several mathematical equations you could come up with many different low entropy patterns but for the purpose of the article we will use a simple one. The second needed task is the one that will put together the high entropy chunks of bytes with the low entropy ones. Not much to say about it. The third task will restore the original array of bytes by eliminating the low entropy patterns, because after all, we need to restore the obfuscated code to what it was originally in order to proceed to the de-obfuscation phase.

1 1

APster goes to war
by professor rat 06 May '22

06 May '22

Righteous war, naturally - DEATH to the CHEKIST INSECT THAT PREYS UPON THE PEOPLE! https://www.abc.net.au/news/2022-05-05/ukraine-zelenskyy-launches-new-globa… Volodymyr Zelenskyy launches new global crowdfunding platform to help Ukraine fight Russia Everyone a remailer: Everyone a Mint: Everyone an assassin WELCOME to the REVOLUTION!

1 0

JPMorgan Chase’s Rap Sheet
by professor rat 05 May '22

05 May '22

Coming from a dipshit eunuch, like Popgun Larceny, this listicle has all the heft and gravitas of a one-star YELP review. APster Dimon or STFU

1 0

THE US FED approve of money-laundering - they always have and always will
by professor rat 05 May '22

05 May '22

Page 459, " Too big to fail" by Andy Sorkin "...Goldman had been on Wachovia's payroll as its adviser, and as such, knew every aspect of its internal numbers..." So ' Government Sachs " knew what Wachovia was up to back in 2009. Wachovia bank laundered billions from Mexico's murderous drug gangs https://www.theguardian.com/world/2011/apr/03/us-bank-mexico-drug-gangs

1 0

MIA Coin
by Gunnar Larson 05 May '22

05 May '22

https://coinmarketcap.com/currencies/miamicoin/ Up near 90%

1 0

Powell Says Fed Doesn’t Have a Credibility Problem with the American People – Despite Gallup Poll Showing Lowest Confidence Since 2008 Financial Crisis
by Gunnar Larson 05 May '22

05 May '22

Powell Says Fed Doesn’t Have a Credibility Problem with the American People – Despite Gallup Poll Showing Lowest Confidence Since 2008 Financial Crisis <https://wallstreetonparade.com/2022/05/powell-says-fed-doesnt-have-a-credib…> By Pam Martens <https://wallstreetonparade.com/about-3/about/>: May 5, 2022 ~ [image: Federal Reserve Chair Jerome Powell] <https://wallstreetonparade.com/wp-content/uploads/2020/03/Federal-Reserve-C…> Federal Reserve Chair Pro Tempore Jerome Powell At the Fed’s press conference yesterday, Federal Reserve Chair Pro Tempore <https://www.federalreserve.gov/newsevents/pressreleases/other20220204a.htm> Jerome Powell was asked by Mike McKee of Bloomberg Television a series of questions on monetary policy which ended with this: “Are you concerned about Fed credibility with the American people?” Powell answered the monetary policy questions but did not directly address the credibility issue. McKee then repeated the question, phrased as follows: “Do you think the Fed has a credibility problem?” Powell’s answer provides an alarming insight into with whom the Fed seeks to maintain confidence. Powell said this: *Powell*: No. I don’t. A good example of why would be that—so in the fourth quarter of last year, as we started talking about tapering sooner and then raising rates this year, you saw financial markets reacting, you know, very appropriately. Not to bless any particular day’s measure, but the way financial markets—you know, the forward rate curve has tightened in response to our guidance and our actions really amplifies our policy. I mean, it’s—monetary policy is working through expectations now to a very large extent. We’ve only done two rate increases, but if you look at—if you look at financial conditions, the two year [U.S. Treasury note] has—the two year is at 280 now [2.80 percent]. In September, I think it was at 20 basis points. And that’s all through the economy. People are feeling those higher rates already. And so that is—that shows that the markets think that our forward guidance is credible. And I think that’s—we want to keep it that way.” Instead of talking about credibility with the American people, Powell spoke solely of “*financial markets* reacting” and how “the *markets* think that our forward guidance is credible.” In effect, Powell blurted out the internal mindset of the Fed: As long as it pleases the markets and Wall Street, it has all the credibility it thinks it needs. For how the disfigured structure of the Fed has led to its unprecedented cronyism and a Wall Street-centric focus, see our report: These Are the Banks that Own the New York Fed and Its Money Button <https://wallstreetonparade.com/2019/11/these-are-the-banks-that-own-the-new…> . Unfortunately, only the wealthiest 10 percent of Americans own the vast majority of the stock market and the reality that this is really whom the Fed is serving has made its way into the collective thinking of Americans. The Fed’s trillions of dollars in bailouts to the miscreant megabanks on Wall Street during and after the financial crisis of 2008, followed by its court battles <https://wallstreetonparade.com/2022/01/mainstream-media-has-morphed-from-ba…> to keep that information a secret from the American people, did permanent damage to the Fed’s credibility. Its 2019-2020 bailouts of the same miscreant banks have simply cemented more bricks in the wall between the Fed and the American people. (See here <https://wallstreetonparade.com/2022/01/nomura-jpmorgan-and-goldman-sachs-re…> and here <https://wallstreetonparade.com/2022/03/the-feds-secret-repo-loans-another-n…> .) Gallup released a survey this past Monday which showed that confidence in the Fed’s Powell among the American people is lower than it was in Fed Chair Ben Bernanke during the 2008 financial crisis – the worst economic crisis since the Great Depression. In April 2008, Bernanke had a 47 percent confidence ranking among the American people. In Gallup’s latest poll, which was conducted April 1 through April 19 among a random sample of 1,018 American adults, Powell had only a 43 percent confidence ranking. Before the 2008 financial crisis, the Fed had used only one method of bailing out banks – its Discount Window – which had to be used as a lender-of-last-resort for commercial banks, on a short-term basis and against safe collateral. For how lawyer Rodge Cohen of Sullivan & Cromwell changed all that, see our report: Sullivan & Cromwell’s Rodge Cohen: The Untold Story of the Fed’s $29 Trillion Bailout <https://wallstreetonparade.com/2019/05/sullivan-cromwells-rodge-cohen-the-u…> . The Fed’s trading scandal that made headlines for months last year has also done permanent damage to the Fed’s reputation and to Powell. Numerous Fed officials have been implicated, including Powell himself <https://prospect.org/economy/powell-sold-more-than-million-dollars-of-stock…>. But the most egregious trading conduct, that of Robert Kaplan, the former President of the Dallas Fed, appears to be undergoing a coverup by the Fed. The Fed will not release the dates of Kaplan’s “over $1 million” in stock trades and S&P 500 futures, despite the fact that Kaplan was legally required to provide those dates for the five years he served as President of the Dallas Fed. See our report: Robert Kaplan Was Trading Like a Hedge Fund Kingpin for Five Years while President of the Dallas Fed; a Dozen Legal Safeguards Failed to Stop Him <https://wallstreetonparade.com/2021/09/robert-kaplan-was-trading-like-a-hed…> . The Federal Reserve is the central bank of the United States whose primary mission is to set monetary policy. The Fed can’t fulfill that mission if it is simultaneously attempting to placate Wall Street. There is an urgent need for Congress to strip the Fed of its supervisory role over the Wall Street megabanks as well as its ability to bail out the trading units (casinos) of those same banks. No less than the national security and economic future of the United States hangs in the balance. -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0

Anarchists actions in Athens
by professor rat 05 May '22

05 May '22

https://anarchistnews.org/content/responsibility-claim-attack-mat-riot-squa… Repost an endorsement in this case

1 0

Fwd: SoFi Technologies, Inc. (SOFI) - End of Day Stock Quote
by Gunnar Larson 05 May '22

05 May '22

---------- Forwarded message --------- From: SoFi Technologies, Inc. (SOFI) <no-reply(a)q4inc.com> Date: Thu, May 5, 2022 at 5:18 PM Subject: SoFi Technologies, Inc. (SOFI) - End of Day Stock Quote To: <g(a)xny.io> [image: Social Finance, Inc. (SoFI)] SoFi Technologies, Inc. (SOFI): NASDAQ:SOFI Last Price 6.83 Change -0.31 Volume 46,362,931 % Change -4.34% Day High 7.11 52 Week High 24.95 Day Low 6.57 52 Week Low 6.01 Today's Open 7.05 Previous Close 7.14 5/5/2022 4:00 PM To unsubscribe from this list, please visit the email alert section of the SoFi Technologies, Inc. (SOFI) site <https://u20786187.ct.sendgrid.net/ls/click?upn=l2vR80O-2F1asqjKC9U01ayVlbuv…>. ------------------------------ Date Sent: 5/5/2022 5:18:22 PM Powered by Q4 Inc. <https://u20786187.ct.sendgrid.net/ls/click?upn=jvFPy7-2FS5bN6KfDPPDGgLx7EGc…> -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0

New York Court of Appeals Rejects Litigation Agreement Discovery
by Gunnar Larson 05 May '22

05 May '22

Check out my new article: https://litigationfinancejournal.com/new-york-court-of-appeals-rejects-liti… New York Court of Appeals Rejects Litigation Agreement Discovery In what might be the first time in the history of New York State published law, a New York Appeals Court has rejected relevance associated with discoverability of litigation funding agreements in Worldview Entertainment Holdings v. Woodrow. The five justice panel refused the necessity of probing the plaintiffs financial background on grounds that the assessment has no material association with the nature of pure discovery. Validity Finance profiles <https://validityfinance.com/insights/appellate-court-joins-wave-of-trial-co…> insights into the decision. According to Validity, the court described the defendant’s litigation agreement discovery motion as “palpably improper.” New York’s Court of Appeals requires certain standards to be met to entertain and approve such discovery requests. In this instance, the court’s decision of non-approval was brief, according to Validity’s assessment of the concern. Click here <https://validityfinance.com/insights/appellate-court-joins-wave-of-trial-co…> to read more about the historic precedent. -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

1 0