- cypherpunks - lists.cpunks.org

SpyVeillance: TrustCor CA Exposed As GovCorp SpySploit Operation
by grarpamp 04 Dec '22

04 Dec '22

https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addr… https://www.msn.com/en-us/news/technology/mysterious-company-with-governmen… https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4… Major Web Browsers Drop Mysterious Authentication Company After Ties To US Military Contractor Exposed TrustCor Systems vouches for the legitimacy of websites. But its physical address is a UPS Store in Toronto. Mysterious company with government ties plays key internet role An offshore company that is trusted by the major web browsers and other tech companies to vouch for the legitimacy of websites has connections to contractors for U.S. intelligence agencies and law enforcement, according to security researchers, documents and interviews. Google’s Chrome, Apple’s Safari, nonprofit Firefox and others allow the company, TrustCor Systems, to act as what’s known as a root certificate authority, a powerful spot in the internet’s infrastructure that guarantees websites are not fake, guiding users to them seamlessly. The company’s Panamanian registration records show that it has the identical slate of officers, agents and partners as a spyware maker identified this year as an affiliate of Arizona-based Packet Forensics, which public contracting records and company documents show has sold communication interception services to U.S. government agencies for more than a decade. One of those TrustCor partners has the same name as a holding company managed by Raymond Saulino, who was quoted in a 2010 Wired article as a spokesman for Packet Forensics. Saulino also surfaced in 2021 as a contact for another company, Global Resource Systems, that caused speculation in the tech world when it briefly activated and ran more than 100 million previously dormant IP addresses assigned decades earlier to the Pentagon. The Pentagon reclaimed the digital territory months later, and it remains unclear what the brief transfer was about, but researchers said the activation of those IP addresses could have given the military access to a huge amount of internet traffic without revealing that the government was receiving it. The Pentagon did not respond to a request for comment on TrustCor. TrustCor also did not respond to a request for comment. [Minutes before Trump left office, millions of the Pentagon’s dormant IP addresses sprang to life] TrustCor’s products include an email service that claims to be end-to-end encrypted, though experts consulted by The Washington Post said they found evidence to undermine that claim. A test version of the email service also included spyware developed by a Panamanian company related to Packet Forensics, researchers said. Google later banned all software containing that spyware code from its app store. A person familiar with Packet Forensics’ work confirmed that it had used TrustCor’s certificate process and its email service, MsgSafe, to intercept communications and help the U.S. government catch suspected terrorists. “Yes, Packet Forensics does that,” the person said, speaking on the condition of anonymity to discuss confidential practices. Packet Forensics counsel Kathryn Temel said the company has no business relationship with TrustCor. She declined to say whether it had had one previously. The latest discovery shows how the technological and business complexities of the internet’s inner workings can be leveraged to an extent that is rarely revealed. Concerns about root certificate authorities, though, have come up before. In 2019, a security company controlled by the government of the United Arab Emirates that had been known as DarkMatter applied to be upgraded to top-level root authority from intermediate authority with less independence. That followed revelations about DarkMatter hacking dissidents and even some Americans; Mozilla denied it root power. In 2015, Google withdrew the root authority of the China Internet Network Information Center (CNNIC) after it allowed an intermediate authority to issue fake certificates for Google sites. With Packet Forensics, a paper trail led to it being identified by researchers twice this year. Mostly known for selling interception devices and tracking services to authorities, the company is four months into a $4.6 million Pentagon contract for “data processing, hosting and related services.” In the earlier spyware matter, researchers Joel Reardon of the University of Calgary and Serge Egelman of the University of California at Berkeley found that a Panamanian company, Measurement Systems, had been paying developers to include code in a variety of innocuous apps to record and transmit users’ phone numbers, email addresses and exact locations. They estimated that those apps were downloaded more than 60 million times, including 10 million downloads of Muslim prayer apps. Measurement Systems’ website was registered by Vostrom Holdings, according to historic domain name records. Vostrom filed papers in 2007 to do business as Packet Forensics, according to Virginia state records. Measurement Systems was registered in Virginia by Saulino, according to another state filing. After the researchers shared their findings, Google booted all apps with the spy code out of its Play app store. Tremel said that “a company previously associated with Packet Forensics was a customer of Measurement Systems at one time” but that there was no ownership stake. When Reardon and Egelman looked deeper at Vostrom, they found it had registered the domain name TrustCor.co, which directed visitors to the main TrustCor site. TrustCor has the same president, agents and holding-company partners listed in Panamanian records as Measurement Systems. A firm with the same name as one of the holding companies behind both TrustCor and Measurement Systems, Frigate Bay Holdings, filed papers to dissolve this March with the secretary of state in Wyoming, where it was formed. The papers were signed by Saulino, who listed his title as manager. He could not be reached for comment. TrustCor has issued more than 10,0000 certificates, many of them for sites hosted with a dynamic domain name service provider called No-IP, the researchers said. That service allows websites to be hosted with constantly changing Internet Protocol addresses. Because root authority is so powerful, TrustCor can also give others the right to issue certificates. Certificates for websites are publicly viewable so that bad ones should be exposed sooner or later. There have been no reports so far that the TrustCor certificates have been used inappropriately, for example by vouching for impostor websites. The researchers speculated that the system is only used against high-value targets within short windows of time. The person familiar with Packet Forensics’ operations agreed said that was in fact how it has been used. “They have this position of ultimate trust, where they can issue encryption keys for any arbitrary website and any email address,” Egelman said. “It’s scary this is being done by some shady private company.” The leadership page of the TrustCor’s website lists just two men, identified as co-founders. Though that page does not say so, one of them died months ago, and the other’s LinkedIn profile says he left as chief technology officer in 2019. That man declined to comment. The website site lists a contact phone number in Panama, which has been disconnected, and one in Toronto, where a message had not been returned after more than a week. The email contact form on the site doesn’t work. The physical address in Toronto given in its auditor’s report, 371 Front St. West, houses a UPS Store mail drop. TrustCor adds another layer of mystery with its outside auditing firm. Instead of using a major accounting firm that rates the safety of internet infrastructure companies, TrustCor selected one called Princeton Audit Group, which gives its address as a residential townhouse in Princeton, N.J. In addition to TrustCor’s certificate power, the firm offers what purports to be end-to-end encrypted email, MsgSafe.io. But researchers said the email is not encrypted and can be read by the company, which has pitched it to a variety of groups worried about surveillance. MsgSafe has touted its security to a variety of potential customers, including Trump supporters upset that Parler had been dropped by app stores in January 2021, and to users of encrypted mail service Tutanota who were blocked from signing on to Microsoft services. “Create your free end-to-end encrypted email today with over 40 domains to choose from and are guaranteed to work with Microsoft Teams,” the company tweeted in August. Reardon sent test messages over MsgSafe that appeared unencrypted in transmission, meaning MsgSafe could read them at will. Egelman ran the same test with the same result. Jon Callas, a cryptography expert at the Electronic Frontier Foundation, also tested the system at The Post’s request and said that MsgSafe generated and kept the private key for his account, so that it could decrypt anything he sent. “The private key has to be under the person’s control to be end-to-end,” Callas explained. Packet Forensics first drew attention from privacy advocates a dozen years ago. In 2010, researcher Chris Soghoian attended an invite-only industry conference nicknamed the Wiretapper’s Ball and obtained a Packet Forensics brochure aimed at law enforcement and intelligence agency customers. The brochure was for a piece of hardware to help buyers read web traffic that parties thought was secure. But it wasn’t. “IP communication dictates the need to examine encrypted traffic at will,” the brochure read, according to a report in Wired that quoted Saulino as a Packet Forensics spokesman. “Your investigative staff will collect its best evidence while users are lulled into a false sense of security afforded by web, e-mail or VOIP encryption,” the brochure added. The brochure told customers they could use a decryption key provided by a court order or a “look-alike key.” Researchers thought at the time that the most likely way the box was being used was with a certificate issued by an authority for money or under a court order that would guarantee the authenticity of an impostor communications site. They did not conclude that an entire certificate authority itself might be compromised. Obtaining trusted root certificate authority takes time and money for the infrastructure and for the audit that browsers require, experts say. Each browser has slightly different requirements. At Mozilla’s Firefox, the process takes two years and includes crowdsourced and direct vetting as well as an audit. But all of that typically focuses on formal statements of technological steps, rather than mysteries of ownership and intent. The person familiar with Packet Forensics said the big tech companies probably were unwitting participants in the TrustCor play: “Most people aren’t paying attention.” “With enough money, you or I could become a trusted root certificate authority,” said Daniel Schwalbe, vice president of technology at web data tracker DomainTools. Mozilla currently recognizes 169 root certificate authorities, including three from TrustCor. The case gives new focus to problems with that system, in which critical tech companies outsource their trust to third parties with their own agendas. “You can’t bootstrap trust, it has to come from somewhere,” Reardon said. “Root certificate authorities are the kernel of trust from which it is all built on. And it will always be shaky, because it will always involve humans, committees and decision-making.” Reardon and Egelman alerted Google, Mozilla and Apple to their research on TrustCor in April. They said they have heard little back. Google did not respond to a request for comment. Mozilla said it would say more after reviewing details from the researchers. Major Web Browsers Drop Mysterious Authentication Company After Ties To US Military Contractor Exposed This week several major web browsers quickly severed ties with a mysterious software company used to certify the security of websites, three weeks after the Washington Post exposed its connections to a US military contractor, the Post reports. TrustCor Systems provided 'certificates' to browsers to Mozilla Firefox and Microsoft Edge, which vouched for the legitimacy of said websites. "Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware," said Mozilla's Kathleen Wilson in an email to browser security experts. "Trustcor’s responses via their Vice President of CA operations further substantiates the factual basis for Mozilla’s concerns." According to TrustCor's Panamanian (!?) registration records, the company has the same slate of officers, agents and officers as Arizona-based Packet Forensics, which has sold communication interception services to the U.S. government for over a decade. One of those contracts listed the “place of performance” as Fort Meade, Md., the home of the National Security Agency and the Pentagon’s Cyber Command. The case has put a new spotlight on the obscure systems of trust and checks that allow people to rely on the internet for most purposes. Browsers typically have more than a hundred authorities approved by default, including government-owned ones and small companies, to seamlessly attest that secure websites are what they purport to be. -WaPo Also of concern, TrustCor's small staff in Canada lists its place of operation at a UPS Store mail drop, according to company executive Rachel McPherson, who says she told their Canadian staffers to work remotely. She also acknowledged that the company has 'infrastructure' in Arizona as well. McPherson says that ownership in TrustCor was transferred to employees despite the fact that some of the same holding companies had invested in both TrustCor and Packet Forensics. Various technologists in the email discussion said they found TrustCor to be evasive when it came to basic facts such as legal domicile and ownership - which they said was not appropriate for a company responsible for root certificate authority that verifies a secure 'https' website is not an imposter. The Post report built on the work of two researchers who had first located the company’s corporate records, Joel Reardon of the University of Calgary and Serge Egelman of the University of California at Berkeley. Those two and others also ran experiments on a secure email offering from TrustCor named MsgSafe.io. They found that contrary to MsgSafe’s public claims, emails sent through its system were not end-to-end encrypted and could be read by the company. McPherson said the various technology experts had not used the right version or had not configured it properly. -WaPo In a previous case which illustrates the importance of trusting root-level authorities - a security company controlled by the United Arab Emirates, DarkMatter, applied in 2019 to have top-level root authority from their status as an intermediate authority with less independence. The request followed revelations that DarkMatter had hacked dissidents and even some Americans - after which Mozilla denied it root power. "Received email from DDNS no-IP, they offering free TrustCor Standard DV SSL certificate." "Free, comes complete with spyveillance and exploit, lol." "Imagine that even the most trusted CA's are actually rogue!"

1 0

Exit Lopp
by professor rat 04 Dec '22

04 Dec '22

Jameson Lopp could pass himself off as a cypherpunk until recently. Even a professional cypherpunk! ( Military grade encryption? ) So what bought him down? Well, in one word I would say " Ethereum ". Cypherpunks collapse govts - they don't suck up to them. That's the Circle-of-Eunuchs dept. And now, increasingly the Ether-Huffers. Meantime Bitfinex CTO, Paolo Ardoino is currently bragging about managing a huge amount of ETH ( over a billion USD's worth ) while at the same time preening, posing and posturing as some sort of expert on OG c-punks & revolutionary P2P technology. Another damn fool thinks they can run with the fox and hunt with the hounds - well this won't last long. Paolo will soon come a CROPPER.

1 0

Blockstream thick as thieves with Corpse Fiat and the Etherium
by professor rat 04 Dec '22

04 Dec '22

As may be quickly seen at links below Blackstream is happy doing business with companies that hold vast amounts of Corpse Fiat ( USDT Tether ) and Bitfinex ( Over a billion's worth of Ethereal garbage ) But there's more going on here than simply business-as-usual, suits business. Adam Back and Paolo Ardoino are so close to marriage they're making Samson Mow jealous. How do I get Liquid-based Tether (USDt)? https://help.blockstream.com › en-us › articles › 90000... Acquiring Liquid-based Tether (USDt) There are multiple methods to acquire USDt on Liquid, including exchanges, swaps platforms, and... Acquire L-BTC and USDt with Bitfinex - Blockstream Help Center https://help.blockstream.com › en-us › articles › 90000... BTC on the Bitfinex platform must be converted to L-BTC before making a Liquid withdrawal. Bitfinex converts BTC and L-BTC at a 1:1 ratio and charges no fees. Blockstream Green: Simple and secure Bitcoin wallet https://blockstream.com › green Blockstream Green makes it easy to get started sending and receiving Bitcoin and Liquid-based assets such as L-BTC and Tether's USDt

1 0

Attenzione attenzione - Paolo Ardoino is undergoing gender reassignment
by professor rat 03 Dec '22

03 Dec '22

Prego be advised, Paolo Ardoino is undergoing gender reassignment and now wishes to be known as ' Stacy Herbert " Thank you for respecting her boundaries at this time. Things every glazed-eyed, cypherpunk lunatic should know Adam Back @adam3us 1h Past people asking questions who literally do not know how exchanges work, never opened a leveraged perp postion, and don’t know what an insurance fund is . . ."

1 0

start of the war - 2014 US jewnazi invasion of ukraine
by punk 03 Dec '22

03 Dec '22

7) "Dennis Kucinich and Lawrence Wilkerson Expose US Role in Creating Ukraine Crisis" http://www.ronpaulinstitute.org/archives/peace-and-prosperity/2014/march/06…

1 0

Whats one gutted nerd more or less?
by professor rat 03 Dec '22

03 Dec '22

Horrorscope with Satan in Gemini https://www.reuters.com/technology/crypto-exchange-gemini-trying-recover-90… Silbert a GoGo - dead Barry Walking

1 0

[ot][spam][crazy][spam][crazy] confusion adventure
by Undescribed Horrific Abuse, One Victim & Survivor of Many 03 Dec '22

03 Dec '22

Welcome to Confusion Adventure! What do you do? > look around Everything is confusing. > look harder You find some confusions nearby. > look at confusion. It's confusing. > take confusion You pick up one of the confusions and add it to you inventory. > inventory You are carrying: - 1 confusion - other confusing stuff > sit down

1 4

People Prompting Consumer Language Models to Break Cryptographic Primitives
by Undescribed Horrific Abuse, One Victim & Survivor of Many 03 Dec '22

03 Dec '22

In https://twitter.com/EarlenceF/status/1598497634763038721 , the poster prompts a language model to factor a 39-digit prime, and it responds confidently with a believable answer. Others reply with similar usecases. It’s frightening because I rely on software that uses RSA. Coderman posted to this list a paper on machine learning in cryptography some time ago. I did not read it, sadly. These models use a structure capable of inferring nearly any algorithm, but have not been trained around cryptographic uses. However, one can infer that it is possible to train a model to reverse a primitive, somehow, given that there is some unknown way to reverse that primitive. Public research is far in advance of the capabilities of consumer models, as well. Hence, primitives that are built in a way informed by such possible attacks of automated discovery have value. For me, I still struggle to move my body and use my mind, or I would look at the problem domain more, to find a personal cryptography I might trust more, or find how current primitives might be weak. But maybe what is exciting here is that, as tools comparable to AGI become more commonplace, many many more people will be working on problems like these. If they use the tools in untethered ways.

1 0

Trump Org Defense Team Calls for Mistrial Over DA's References to Ex-President's Actions
by Gunnar Larson 03 Dec '22

03 Dec '22

https://www.law.com/newyorklawjournal/2022/12/02/trump-org-defense-team-cal… Former President Donald Trump speaks at Trump National Golf Club in Bedminster, N.J., Wednesday, July 7, 2021. Photo: Seth Wenig/AP NEWS Trump Org Defense Team Calls for Mistrial Over DA's References to Ex-President's Actions Defense attorney Michael van der Veen argued that the Manhattan DA had presented Donald Trump as an unindicted co-conspirator in the fraud scheme, putting a bias on the jury “that can’t be undone.” December 02, 2022 at 02:51 PM 4 minute read Criminal Law Jane Wester Jane Wester More from This Author During his closing argument Friday in the criminal tax fraud trial of the Trump Organization, Manhattan assistant district attorney Joshua Steinglass showed jurors a memo initialed by former President Donald Trump. In the memo, Trump Organization chief operating officer Matthew Calamari asked the company’s controller, Jeffrey McConney, to reduce his salary by $72,000, the amount the Trump Organization paid for his rent in 2012. Prosecutors have argued the process of “backing out” personal expenses from executives’ salaries was one way the Trump Organization avoided taxes in the later years of the alleged fraud scheme. Steinglass noted that Trump had written “OK” and his initials on the memo in his signature black Sharpie. “There’s only one reason for that, which is to underreport income,” Steinglass said. “Mr. Trump is explicitly sanctioning tax fraud.” The Trump Organization defense team immediately offered an objection, which was sustained by Acting Supreme Court Justice Juan Merchan. Steinglass reiterated after a sidebar that Trump “is not on trial,” but he emphasized that jurors should be skeptical of the defense narrative that McConney and Allen Weisselberg, who pleaded guilty to 15 counts in August and testified under a plea agreement, “went rogue” and acted without the knowledge or approval of the company’s CEO. “This whole narrative to show Donald Trump was blissfully ignorant is just not real,” he said, later urging jurors to “put aside the elephant that’s not in the room” while remembering that “the rules apply to everyone.” The “explicitly sanctioning” comment was one of several issues raised by Trump Organization defense attorney Michael van der Veen when he moved for a mistrial at the conclusion of Steinglass’ summation. “We picked a jury and voir dired a jury based on the People’s representation that this case was not going to be about Donald Trump,” van der Veen said. Van der Veen argued that Steinglass had presented Trump as an unindicted co-conspirator in the fraud scheme, putting a bias on the jury “that can’t be undone.” Steinglass argued that the DA’s theory has always been that corporate liability is predicated on the actions of Weisselberg and McConney, not Trump, but Trump was nevertheless the CEO and president of the Trump Organization. “If the name of the CEO were John Doe, there’d be no objection here,” Steinglass said. Merchan said he did not recall Steinglass promising not to mention Trump. Instead, he said, he recalled Steinglass saying the DA’s case would not get into politics or suggest Trump should be sitting at the defense table. “I don’t believe that it’s necessary to declare a mistrial,” Merchan said. “In fact, that’s not even really a thought.” The Trump Organization defense attorneys also objected strongly to a chart prepared for Steinglass’ closing argument, which Merchan eventually allowed him to present. The chart showed the various ways in which Weisselberg earned money through salary, bonus and unreported personal expenses across the years of the alleged fraud scheme. Steinglass argued that, contrary to the defense team’s argument that the Trump Organization saved only an incidental amount on Medicare taxes through Weisselberg’s scheme, the company saved hundreds of thousands of dollars by funding its executives’ cars and apartments with so-called “pre-tax” dollars. “In order to do this legally, to get the same amount into Allen Weisselberg’s pockets, the Trump Corp. and Trump Payroll Corp. would have had to gross him up roughly double,” Steinglass said. RELATED STORIES Trump Org Lawyers, Manhattan DA Clash Over References to Ex-President in Closing Arguments 'Weisselberg Did It for Weisselberg': Trump Org Defense Attorneys Make Closing Arguments in Fraud Trial Trump Org, Resting Defense Case, Blasts 'Misleading' Testimony of Mazars Accountant You Might Like

1 0

No good deed goes unpunished
by professor rat 03 Dec '22

03 Dec '22

Mange came out for Ukraine soon after the latest invasion. " . . . Assange's position on Russia was evolving. Assange in 2012 had his own show on the Kremlin-funded news network RT, and that same year, he produced episodes for the network where he interviewed opposition thinkers like Noam Chomsky and so-called "cypherpunks." FROM https://www.ukrinform.net/rubric-other_news/2288391-assange-refused-to-disc… Please be informed both Noam Chomsky, those cheap, plastic-toy-imitation cypherpunks and other fascist scumbags all went on RUSSIAN PROPAGANDA TV after the infamous and unholy HOULA MASSACRE in Syria. https://en.wikipedia.org/wiki/World_Tomorrow The Houla massacre (Arabic: مجزرة الحولة) was a mass murder of civilians by Syrian government forces that took place on May 25, 2012 https://en.wikipedia.org/wiki/Houla_massacre ALL PUBLIC " OSINT " open-source intelligence made freely available in order to bring all fascist Russian scumbag agents to swift, sure and deadly punishment. VICTORY to free Ukraine ( later for anarchism )

1 0