- cypherpunks - lists.cpunks.org

From sand to silicon chips, openly
by Steven Schear 15 May '18

15 May '18

http://parallel.princeton.edu/openpiton/open_source_processors.php

4 4

Cryptocurrency: #BankersAgainstBitcoin, New Documentaries, Snowden
by grarpamp 15 May '18

15 May '18

1 0

Rowhammer is now remote exploitable
by grarpamp 15 May '18

15 May '18

---------- Forwarded message ---------- From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Date: Mon, May 14, 2018 at 11:03 PM Subject: [Cryptography] Rowhammer is now remote exploitable To: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> An interesting paper just turned up on arXiv: Nethammer: Inducing Rowhammer Faults through Network Requests https://arxiv.org/abs/1805.04956 [...] In this paper, we present Nethammer. Nethammer is the first truly remote Rowhammer attack, without a single attacker-controlled line of code on the targeted system. [...] Depending on the location, the bit flip compromises either the security and integrity of the system and the data of its users, or it can leave persistent damage on the system, i.e., persistent denial of service. We investigated Nethammer on personal computers, servers, and mobile phones. Nethammer is a security landslide, making the formerly local attack a remote attack. Peter. _______________________________________________

1 0

Oliver Stone: The Putin Interviews
by grarpamp 15 May '18

15 May '18

http://www.imdb.com/title/tt6840134/ torrents http://uj3wazyk5u4hnvtk.onion/search/putin%20interviews/0/99/0

1 0

BriarProject Messaging 1.0 Released
by grarpamp 15 May '18

15 May '18

Briar 1.0 for Android has been released. Briar is a secure messaging app that uses peer-to-peer connections between mobile phones to implement decentralised messaging, forums and blogs. It operates over Tor, Bluetooth and wifi. https://briarproject.org/ https://code.briarproject.org/akwizgran/briar

4 9

TPC: Totally Protected Comms vs. The Perfect Crime
by Steve Kinney 15 May '18

15 May '18

I'm spamming teh list with a duplicate of a reply to a previous post because I think this is cute. It's been bouncing around in my head for ages and I think its time may have come. On 05/12/2018 02:49 AM, grarpamp wrote: > Look to new messaging, fill, PETS and other venues, whatever, etc.. > search for papers, fidn tbe bibs, see what's out there, or what you > might create. Here's a silly notion: First you need a network of servers that can store and forward large amounts of data in the form of text, and distribute it across enough nodes to make the stored data deletion-resistant and reasonably accessible to a large number of users. NNTP will do nicely. Then you need privately owned devices capable of downloading gigabytes of data daily, and applying a decryption test to millions of messages as they flow by. Today's low end PCs will do nicely. Those gigabytes of text? Symmetrically encrypted messages from the whole Alice, Bob, etc. alphabet soup of users, employing keys obtained by whatever means from their intended message recipients. Everyone participating in this network would download the whole stream, testing the encrypted subject line of each discrete message with their personal keys, looking for the flag that says "this one's for you." Those messages would be decrypted instead of discarded, and presented in a local inbox. The rest would just zoom on past. Sending a message? Encrypt it and its subject line with your recipients' keys, and send it on its way. If your recipient downloads the stream before your message expires, success. 3rd party observers? Out in the cold, unless they penetrate individual users' machines or otherwise compromise endpoints, one user at a time. This protocol presents as an application of the most time honored and reliable principle of engineering practice: Brute force and total ignorance. With a side of COTS: We already have all the parts, this could be done with shell scripts. The only counter attacks I immediately see include flooding past the breaking point with purely random bits, which may require mitigation via short cycle message expiration or some kind of registration or proof of work process for users; or interruption of traffic by a global (or local) active adversary. Call the protocol and associated tools TPC: An acronym for Totally Protected Communication or, for those in the know, The Perfect Crytocrime. Bonus: Quantum cryptanalysis can't touch that, far as we know. :o)

1 1

Internet Party - Moment of Truth: Dotcom, Assange, Greenwald, Snowden
by grarpamp 15 May '18

15 May '18

https://www.youtube.com/watch?v=Pbps1EwAW-0

1 0

Interview: Frank Herbert - Saviors and Political Animals
by Steve Kinney 15 May '18

15 May '18

I made a video from a found audio file, as little hobby project: Frank Herbert - Saviors and Political Animals This interview is a pre-Internet artifact recorded in 1984, and makes no reference to cryptography. But IMO it's dead center on topic for CPunks, because self identifying Libertarians and Anarchists need all the help they can get. Frank's ecological models of power dynamics in human affairs provides a stout dose of scientific and engineering sense that may cure any of several loads of ideological nonsense. "All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted." - Frank Herbert Frank Herbert was a true polymath, accepted without credentials as a participating member of the academic Ecology community (a demanding multidiscipliplinary science), as well as being an avid historian and radical political theorist. The mp3 I found included a lot with David Lynch, director of the original Dune movie, and about the film itself. So I cut the interview down to just Frank's historical and political exposition, and added a few appropriate quotes and pictures. Here's it. Bring popcorn and/or paper & pencil. https://archive.org/details/FrankHerbertSaviorsAndPoltiicalAnimals :o)

3 2

Re: [tor-relays] Strange BGP activity with my node
by grarpamp 14 May '18

14 May '18

On Mon, May 14, 2018 at 2:19 PM, charlie <contact(a)charlieluna.com> wrote: > in the current state of society with certain governmental agencies > performing things the way they are, i don't trust any ISP anymore or > government agency anymore. the apology from that ISP, in my opinion, smells > like the worst pile of crap ever. i don't buy it. > > i wish there was a way for us to run a TOR network without having to be on > an ISP's network. !gnitsop pot potS That being said... There are many ways... - Start laying fiber / wifi to your neighbors, guerrilla networking, create your own new global internets with your own new rules - CJDNS, I2P, GNUnet, Tor, messaging ... all the various anonymous encrypted overlays... they are their own "non ISP networks"... run your own services on them, they're likely better than nothing. - Do you really need to be giving Alexa Top 100 access to your life and asshole... especially anymore now that decentralized models and software are rolling out... As far as this BGP event, as someone noted earlier, commercial [subscription based] "security" services deploy many potential means for themselves and their customers, including acting within their routing infrastructures, to blackhole / filter / snoop traffic destined to external risks deemed. No different than adblock, "hosts" files, etc. So long as it's not default deny, packets can still get out, somewhere, to the equivalent of bridges / vpn's / proxies as need be. Their explanation is within plausible ops legitimacy. As is questioning trust in aforesaid entities... you certainly can't do an inspection on either of them, yet you still give them your dollars. That's quite funny. Again, more interesting would be looking for and analysing attacks against the tor nodes (and those of other networks) as a whole. Unfortunately no one's researched that yet here. Perhaps because Tor [izens] keeps shouting "sniffing bad", thus programming out one of the tech needed to do that. And other attacks, such as potential bgp steering, sybils, the network paths, etc, are also less discussed [1]. Or because coordination is hard. Oh well... Demons lurk where Sun never peeks. At least tor doesn't use dns to bootstrap and run, that would be a whole other layer of attack surface. [1] For example, after years of mentions, there's still no voluntary meetup PKI WoT cross certification / inspection / identification, statistical / checklist, jurisdiction / AS / location, whatever else, based node analysis and selection project to which users could potentially subscribe their clients to. All networks to date still use effectively random free-for-all node selection. That's reasonable in some threat models, but without the research and attempted construction and deployment of alternate selection models operating voluntarily in parallel... it's quite possibly a lurkers paradise. > On 05/14/2018 10:39 AM, Trevor Ellermann wrote: > > Thanks for the responses. To follow up this is how the offending ISP > responded to our inquiries. I do not believe any further follow up is > necessary. > > *snip* > Thank you for getting in touch. > > I am afraid an engineer made an error in the BGP configuration of one of our > devices earlier this afternoon, which resulted in a number a host routes > being inadvertently announced to certain of our upstream providers. > > The route itself existed as part of a set of prefixes internally routed to > null on our network. This particular IP hosts a TOR relay node, and while > that is perfectly legitimate we have a business requirement to block access > to these internally: > > https://metrics.torproject.org/rs.html#details/383D6E34D9BEA92E97092B134A70… > > The route should never have been announced outside our own AS. > Unfortunately due to human error it was advertised earlier today (May 9th) > from approx. 11:04 to 11:10 UTC. I can assure you this was an unintentional > error, we had no desire to interrupt or affect communications outside our > AS. The mistake was quickly spotted by our own NOC team and reverted. > > I hope you can accept our sincere apologies for this issue, we have taken > steps to ensure that any similar mistake will not have such impact in > future. > *snip* > > On Wed, May 9, 2018 at 11:54 AM, grarpamp <grarpamp(a)gmail.com> wrote: >> >> On Wed, May 9, 2018 at 2:06 PM, Trevor Ellermann <trevor(a)ellermann.net> >> wrote: >> > I just a notification from my data center that someone is trying to >> > hijack >> > the IP of my exit node. Seems like the sort of thing someone might do >> > when >> > trying to attack Tor. I'm in a very remote area with limited access but >> > any >> > suggestions on actions I should take? >> >> Make sure your box and keys aren't compromised. >> If that's ok, best they can do if the announcements are >> listened to is camp on the ip for a while using their own keys, >> (there might be some identification attacks made possible with >> such a transient reroute,) circuits would fail till the consensus >> updated to them, but there could be some duplicate ip split horizon >> issues involved due to filtering. >> If they hacked the boxes there's hardly need to expend noisy >> reroutes when they can do most attacks using the box itself. >> >> Hop on the route servers or your other favorite interfaces >> to the net and analyze who all is announcing /32's trying to >> cover any other tor nodes. >> >> Sane isp's will filter such things without prior coordination. It's fairly >> rare, >> and for them to bother giving customers courtesy reports. Though >> depending on nature of ticket / relationship with GBLX, you might want >> to reply saying you've never worked with Asavie and don't approve >> of the action regarding your IP. >> >> You can also search AS200005 to see what kind of heat >> they catch from other operators / internet analysis tools. >> >> > ==================================================================== >> > Possible Prefix Hijack (Code: 10) >> > ==================================================================== >> > Your prefix: 204.17.32.0/19: >> > Prefix Description: GBLX-US-BGP >> > Update time: 2018-05-09 12:11 (UTC) >> > Detected by #peers: 1 >> > Detected prefix: 204.17.56.42/32 >> > Announced by: AS200005 (Asavie Technologies Limited) >> > Upstream AS: AS200005 (Asavie Technologies Limited) >> > ASpath: 200005 >> > >> > >> > >> > https://torstatus.blutmagie.de/router_detail.php?FP=383d6e34d9bea92e97092b1… >> _______________________________________________ >> tor-relays mailing list >> tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

1 0

Google's Evil / Cozy Warmonger / Project Maven Triggers Mass Resignations
by grarpamp 14 May '18

14 May '18

https://gizmodo.com/google-employees-resign-in-protest-against-pentagon-con… It's been nearly three months since many Google employees -- and the public -- learned about the company's decision to provide artificial intelligence to a controversial military pilot program known as Project Maven, which aims to speed up analysis of drone footage by automatically classifying images of objects and people. Now, about a dozen Google employees are resigning in protest over the company's continued involvement in Maven. The resigning employees' frustrations range from particular ethical concerns over the use of artificial intelligence in drone warfare to broader worries about Google's political decisions -- and the erosion of user trust that could result from these actions. Many of them have written accounts of their decisions to leave the company, and their stories have been gathered and shared in an internal document, the contents of which multiple sources have described to Gizmodo.

2 1