- cypherpunks - lists.cpunks.org

Erasing / Recovering Data
by grarpamp 21 Nov '16

21 Nov '16

jdb: > My understanding is that this software actually > over-writes the data on the hard disk, rather than merely deleting > references to it in the directory. These days, with the hyper-high density > of data employed, probably only a single re-write of data is necessary, > although I was surprised when I heard that Bleachbit only did ONE re-write. > https://en.wikipedia.org/wiki/BleachBit Other than destruction, single pass is sufficient for routine end user purposes between end users. ie: hardware swapping, to wit (a) below. Suggestions otherwise need to involve a device still in common use and cite one of the following... For boring end users... a) the exact make model methodology of the test device that magically regrew said erased bits on its own. b) full business particulars including cost of the recovery service that recovered said erased bits, including make model of the test device. For the more tricky situations... c) survey of academic literature placing those academic solutions within time/money/favors of LEA (potentially operating under stingray type LEA secrecy contracts). d) they were an enemy of the state subjected to top secret recovery tools, time, and money that unavailable to LEA (who are essentially constrained to operate under (b or c) above). Lists seem to love to circlejerk about this while failing to provide whitepaper references and costs and threat models effective against hardware currently in use. When in doubt, encrypt by default and/or destroy.

1 0

alt-left Twitter purges many alt-right accounts
by Zenaan Harkness 20 Nov '16

20 Nov '16

Once known as the "free speech wing of the free speech party", Twitter's true colours are hard to hide for even those with slowest brainial neorone. Facebook to follow and Google joining the party. Where's that "True Free Speech" app where you need it... Actor James Woods quits Twitter over its recent mass censorship and “alt-right” account purge http://theduran.com/actor-james-woods-quits-twitter-over-its-recent-mass-ce…

8 24

ZFS Gaining Native Encryption
by grarpamp 20 Nov '16

20 Nov '16

http://open-zfs.org/wiki/ZFS-Native_Encryption https://youtu.be/frnLiXclAMo https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=shari… http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2016 Tom Caputi of Datto will give a talk on ZFS-Native Encryption at the OpenZFS Developer Summit 2016, covering the following: A brief intro to how modern symmetric encryption algorithms work (mostly so that people understand the parameters required for encryption) A brief explanation of the ICP and what work was required to make it relatively portable An explanation of what changes were made to ZFS, including implementation details regarding: The new DSL Keychain (in user memory, in kernel memory, and on disk) The way the DSL keychain hooks into the existing DSL code (with regards to create, clone, destroy and "owning" operations) What data is encrypted and what is left in the clear The changes made to the ZIO layer for data kept in the primary pool storage Encrypted ZIL blocks Encrypted L2ARC data Future extensions and challenges Encrypted send (with regards to the current compressed send work) Support for more encryption algorithms Support for more keysources / locations

1 0

Decade Of Pirates On The Run: Still Blinded To Real Potential Of Overlay Networks
by grarpamp 20 Nov '16

20 Nov '16

https://yro.slashdot.org/story/16/11/17/2135251/music-torrent-site-whatcd-h… http://www.theverge.com/2016/11/17/13669832/what-cd-music-torrent-website-s… http://www.zataz.com/operation-what-cd-12-serveurs-saisis-chez-ovh-free/ What.cd, an invite-only music torrent website first launched in 2007, has been shut down after a raid by French authorities. The private tracker offered free (and often illegal) access to a massive, deeply thorough collection of music and was popular among audiophiles for its strict rules around quality and file formats. The site was created after the shutdown of another well-known torrent website, Oink, which operated between 2004 and 2007. Though its primary focus was music sharing, What.cd also permitted torrents of computer software, ebooks, and other content. Zataz Magazine is reporting 12 servers that powered What.cd's infrastructure were seized by French cybercrime authorities. What.cd hasn't been taken offline completely, but torrents are unavailable and the homepage now displays a message confirming its demise: "Due to some recent events, What.CD is shutting down. We are not likely to return any time soon in our current form. All site and user data has been destroyed. So long, and thanks for all the fish." https://yro.slashdot.org/story/16/11/18/2258232/major-cyberlocker-exua-to-s… https://yro.slashdot.org/story/16/11/16/2134207/police-raid-pirate-site-sei… https://torrentfreak.com/major-cyberlocker-ex-ua-to-shut-down-amid-police-c… https://torrentfreak.com/ukraine-copyright-amendments-aim-to-please-united-… Earlier this week, news broke that following a complaint from the MPAA, local piracy giant FS.to was raided by police, with more than 60 servers seized and 19 people arrested. That investigation is still ongoing but now an even bigger target has folded in its wake. Founded in 2009, EX.UA is Ukraine's largest cyberlocker and one of the largest sites in the country, period. With millions of visitors each day the site is a much-loved resource but very shortly the platform will close its doors for good. In an announcement to users, EX.UA's owners said that it was time to throw in the towel after 12 months of trouble for the site and potential legal trouble ahead. "Over the past year EX.UA has had a chance to feel the direct threats, blackmail (including at the international level), and DDOS attacks. These actions jeopardize the personal information and personal files stored by users on the service," the site announced. EX.UA's operators say they have always tried to operate with respect for the laws of Ukraine, including dealing with takedowns quickly. However, the site does not approve of the system of distribution and rights management in place in the country and says it was one of the site's goals to raise this issue in Ukrainian society. Just recently, Ukraine passed a law which will allow copyright holders to block allegedly infringing sites without obtaining a court order. This, EX.UA says, is a sign of "uncivilized lobbying" and will only result in less respect for copyright. Faced with a change in the law and a desire to respect it, EX.UA's operators say that they will shut down the site. Users have just under two weeks to save their files.

1 1

Governments Criminalizing Militarizing Civilian Identity and Control Structures
by grarpamp 20 Nov '16

20 Nov '16

https://yro.slashdot.org/story/16/11/19/0521222/privacy-group-sues-the-fbi-… https://www.onthewire.io/epic-sues-fbi-over-biometric-database-records/ A major privacy group has filed a lawsuit against the FBI to force the bureau to release all relevant documents about its plan to share a huge amount of biometric information with the Department of Defense. The lawsuit filed by EPIC (Electronic Privacy Information Center) concerns the FBI's Next Generation Identification (NGI) system, which comprises fingerprint, iris scan, and facial recognition data, and the bureau has been using it for several years... EPIC's lawsuit asks that the FBI be forced to release records about the plan to share NGI data with the Department of Defense under the Freedom of Information Act. EPIC filed a FOIA request about the plan last year and though the FBI said it has located 35 pages of records that are responsive to the request, it hasn't released any of those records.

1 0

Drone Hating: Natural Response For More Than Just The Human Species
by grarpamp 20 Nov '16

20 Nov '16

https://news.slashdot.org/story/16/11/19/2258252/commercial-mining-drones-k… The world's seventh-biggest gold producer has lost more than nine drones because of eagle attacks. "People couldn't believe I was able to get such a good photo of an eagle airborne," complained surveyor Rick Steven at a conference sponsored by the Australasian Institute of Mining and Metallurgy. "But I didn't... Another eagle took that photo... I was getting attacked by two eagles simultaneously." The specially-constructed drones carry a $10,000 camera for high-resolution photos and equipment that produces high-detail contour maps of potential mining areas, and so far the company estimates they've lost more than $100,000 worth of technology to eagle attacks. They've tried camouflage -- including disguising the drones as another eagle -- but unfortunately, according to Stevens, the eagle is the "natural enemy" of the drone. One drone's video is interrupted by the sudden appearance of an eagle, followed almost immediately by footage from the ground by a sideways drone camera. That video -- included in the article -- ends with a reminder that "Eagle attacks on drones have been documented across the world, to the point where some European police forces are now training them to take down unauthorized aircraft." http://www.abc.net.au/news/2016-11-17/wedge-tailed-eagles-bring-down-drones… https://yro.slashdot.org/story/16/02/01/1919257/dutch-police-train-bald-eag…

1 0

Donald Trump
by grarpamp 20 Nov '16

20 Nov '16

1 0

Silicon Valley wants to work with Donald Trump. (The Hill)
by Razer 20 Nov '16

20 Nov '16

All the Silicon Valley "Libertarians" are lining up for the Fascist/Racist-in-Chief. Not unexpected here. They all lined up for another fascist/racist a while back. Ron Paul. http://thehill.com/policy/technology/306846-silicon-valley-makes-nice-with-…

1 0

Fwd: [tor-dev] Browsers, VMs and Targeted Hardware Bit-Flips
by grarpamp 20 Nov '16

20 Nov '16

https://www.whonix.org/wiki/Advanced_Attacks https://www.whonix.org/wiki/KVM#Unsafe_Features ---------- Forwarded message ---------- There have been a series of recent attacks that take advantage of "rowhammer" (a RAM hardware bit-flipping vulnerability) to flip bits in security-critical data structures. VMs sharing the same physical RAM are vulnerable, and browsers and mobile apps are remote vectors with proof-of-concept implementations. Rowhammer summary: https://en.wikipedia.org/wiki/Row_hammer An attack that flips targeted bits in another virtual machine on the same physical RAM, targeting OpenSSH public keys, GPG public keys, and Debian package sources: https://www.vusec.net/projects/flip-feng-shui/ A similar proof-of-concept Android app: https://www.vusec.net/projects/drammer/ A JavaScript-based in-browser remote proof-of-concept: https://arxiv.org/pdf/1507.06955v1.pdf It seems like a short step from these existing attacks to targeting Tor Browser users remotely. I wonder whether it might be possible to target relays (or clients) using OR cells or directory documents with specific content, but this seems much less likely. I have been thinking about how we could make Tor (and browsers, and other processes, and OSs) less vulnerable to these kinds of attacks. In general, some of the process-level defences against one or more of the above attacks are: * sign or checksum all security-critical data structures, * implement and check cross-certification, * don't rely on cached checks (or checks performed at load time) continuing to be accurate, * minimise time between checking validity and using the data, (this includes signatures, checksums, data structure consistency) * make the content of memory pages (including loaded files) less predictable, * make sure the hamming distance between trusted, valid inputs and untrusted, valid inputs is large, in particular: * register domains that are one bit-flip away from trusted domains, (or, alternately, mandate SSL, and pin certificates, and fix broken CA roots) Some of the OS-level defences are: * turn off memory deduplication, * write and verify checksums on each page, Some of the firmware/hardware defences are: * increase the RAM refresh rate, * improve RAM design, * use ECC RAM. Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

1 0

FBI Injecting You Thanksgiving Turkeys With Liquid Fear
by grarpamp 20 Nov '16

20 Nov '16

http://www.cbsnews.com/news/fbi-concerned-about-terrorist-activity-on-thank… The FBI is alerting law enforcement officials across the country that there is concern about a potential terrorist attack around Thanksgiving or the Inauguration, CBS News’ Jeff Pegues reports. The alert specifically warned of homegrown terrorists and cited shopping malls, special events and other crowded venues as possible targets. Specific locations in Washington, D.C. and northern Virginia are described as “target-rich” zones. Potential tactics that could be used include guns, IEDs or drones equipped with IEDs. The FBI warned about potential indicators of lone-wolf activity, including isolation from friends and family, lifestyle changes, increased use of encrypted forms of communication and more. The warning comes from activity in al Qaeda’s “Inspire Magazine.” The NYPD warned earlier this week that the magazine of ISIS had called the Macy’s Thanksgiving Day parade an “excellent target.” https://en.wikipedia.org/wiki/Talk:Inspire_(magazine) https://pietervanostaeyen.files.wordpress.com/2016/11/inspireissue16-high.p… http://jihadology.net/category/inspire-magazine/

1 0