- cypherpunks - lists.cpunks.org

Ghostscript: Multiple arbitrary code execution vulns
by Steve Kinney 26 Aug '18

26 Aug '18

Just when you thought there was a "safe" graphic document format... CERT says: https://www.kb.cert.org/vuls/id/332928 A similar problem in ghostscript, fixed in 2006: http://seclists.org/oss-sec/2016/q4/29 Tech press says: https://threatpost.com/unpatched-ghostscript-flaws-allow-remote-takeover-of… Not sure about the "take total control" part unless a payload can trick the user into entering the root password in a bogus dialog on the desktop: Nothing that uses ghostscript /should/ have administrator privileges. Isn't a family of exploits that can do everything the user can do in a terminal bad enough? So until patch, no u view PDF or PS dox from unknown source, untrusted source, or passed thorough insecure network. No reports of exploits in the wild as yet. :o/

1 0

Re: God Mode Backdoors, AP Crowdfund vs Wikileaks Models
by grarpamp 26 Aug '18

26 Aug '18

On 8/26/18, Mirco Romanato <painlord2k(a)libero.it> wrote: > Il 15/08/2018 08:54, grarpamp ha scritto: >> Anyone who thinks Intel CPU's don't have backdoors... is fucking stupid. >> AMD... same, yet perhaps a slightly lesser form of corporate >> insidiousness. >> Same for all cell phone CPUs and baseband processors. >> >> Publishing the backdoors in Intel's products, and >> all the others... makes a fine AP crowdfund target. >> Because the Wikileaks model so far either didn't get >> or hasn't published the scoop. > What we need is a way to show it exist: > 1) The designs with the backdoor implemented > 2) A way tio exploit the backdoor(s) > > What we need is a way to have a backdoor exploited, showing the backdoor > exist and it is usable. > > The good part about cryptocurrencies is a lot of money is behind > computers and such stuff. So a lot of money can be stolen if the > backdoor is exploited. > And, if it is exploited, we know it is there. > > Put out a wallet on a system where the only way known to steal the > wallet is to use a CPU/GPU/whatever backdoor. > > Mirco > > --- > Questa email è stata esaminata alla ricerca di virus da AVG. > http://www.avg.com Belongs on list, and no one cares what any AVG says.

1 0

at least replace the US Gov administration with normal folks
by Zenaan Harkness 26 Aug '18

26 Aug '18

Hey folks, it's been SUCH a long time since I last emailed - rather than a lotto, which I and others I've asked believe would lead too rapidly into chaos, pick "farmer family folk" to fill ALL the US government administrative positions. Give them a few weeks training - order the existing "administration" employees to train the newcomers - and then replace the existing administration - all the way to the top - with the newcomers. Trump's big problem is that he wants to drain the swamp. Unilaterally disbanding the US government might be appealing, but is, just perhaps, at a wild guess, not quite going to fly right now. But perhaps Trump could find a few 100s of "normal" men and women, young and old, from across the rural and farming areas of America, to fill all the positions of the US government's administration - from the State Department to the Department of Justice and everything inbetween, wholus bolus. That's gotta be better than the utterly farcical shit show the world is watching now where the swamp soldiers on for 2 years ignoring 100s of actual crimes and clinging to the hope they will impeach Trump after midterms for being blackmailed by an ex-girfriend pornography "actor" to pay money to keep her quiet prior to his election. "The Left" has turned America into a violent Machiavellian evil-clown machine which is an utter disgrace to human dignity. Allowing the farce to go on for so long has quite probably been a useful exercise - to draw out and demonstrate to the world the madness that is within the USA administration, "justice" department, etc etc. Good luck world,

1 0

#S17
by Razer 24 Aug '18

24 Aug '18

Remember that hash? [html follows] ██████╗ ██████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗ ██╔═══██╗██╔════╝██╔════╝██║ ██║██╔══██╗╚██╗ ██╔╝ ██║ ██║██║ ██║ ██║ ██║██████╔╝ ╚████╔╝ ██║ ██║██║ ██║ ██║ ██║██╔═══╝ ╚██╔╝ ╚██████╔╝╚██████╗╚██████╗╚██████╔╝██║ ██║ ╚═════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ███████╗██╗██╗ ██╗ ██████╗ ██████╗ ███╗ ██╗ ██╔════╝██║██║ ██║██╔════╝██╔═══██╗████╗ ██║ ███████╗██║██║ ██║██║ ██║ ██║██╔██╗ ██║ ╚════██║██║██║ ██║██║ ██║ ██║██║╚██╗██║ ███████║██║███████╗██║╚██████╗╚██████╔╝██║ ╚████║ ╚══════╝╚═╝╚══════╝╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝ ██╗ ██╗ █████╗ ██╗ ██╗ ███████╗██╗ ██╗ ██║ ██║██╔══██╗██║ ██║ ██╔════╝╚██╗ ██╔╝ ██║ ██║███████║██║ ██║ █████╗ ╚████╔╝ ╚██╗ ██╔╝██╔══██║██║ ██║ ██╔══╝ ╚██╔╝ ╚████╔╝ ██║ ██║███████╗███████╗███████╗ ██║ ╚═══╝ ╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝ ╚═╝ > September 17th, 2018: > > An online occupation > > We shut down big tech for a day > > How do we take on the largest and most corrupt corporate Goliaths to > ever exist? > > In three steps: > > First, we sow the seeds of dissent on Twitter, on Instagram, on > Zuckerberg’s own playground of Facebook... > > MEME 1: Boycott Bezos > > MEME 2: Does Google do evil? > > MEME 3: Does Mark Zuckerberg have Fascist tendencies? > > Then we zero in on Facebook and attack the platform from within: > > We change our profile photos to #OSV memes... > > We create a strange Google Search-Free Day... > > We cause an uncanny lull on amazon.com... refuse to buy anything from > Bezos for a day... > > On September 17th, we unleash a one-day #FuckItAll flood of memes, > posts, tweets, and statuses full of everything Silicon Valley wants to > keep offline. > Facebook makes me feel like shit > > We crash their servers, flood their feeds, disrupt their algorithms. > Open the code motherfucker > > We expose Silicon Valley’s ugly underbelly, thrusting its fascist > tendencies into the open for the whole world to see. > let me get high one more time > > We take on Big Tech’s Orwellian overreach. > > Take back control of our lives and minds, on + offline... > > Flip the power balance... > > Make the Internet ours again > Occupy Silicon Valley 2018 > > On September 17th, seven years after we occupied Wall Street, be a > part of history again... > > Join us in taking Big Tech down for a day... > > Spread the news like wildfire—slap these print-outs across big tech > adverts, slip 'em into the textbooks of yesteryear and the coat > pockets of the utterly unsuspecting. Splatter #OSV memes across the > face of social media. Let's light a fire under the dormant activists > and galvanize a global army. > > It's time to take back the internet. > > http://abillionpeople.org/occupysiliconvalley.html

1 0

My new piece from courthouse: Reality Winner's sentencing
by Douglas Lucas 24 Aug '18

24 Aug '18

Hi cypherpunks, Yesterday I attended NSA whistleblower Reality Winner's sentencing and wrote a detailed, descriptive article about what took place for Buffalo's print and online news outlet The Public. I put a little more focus on the document than usual - you might have noticed today Trump tweeting[1] trying to downplay the significance of her case...As the prosecution themselves admitted, Winner was incarcerated to the longest prison term ever for a federal defendant leaking to the media. Here's my article: http://www.dailypublic.com/articles/08242018/reality-winner-sentenced-63-mo… [1] https://twitter.com/realDonaldTrump/status/1032948187416416256 Thanks, Doug

3 2

Court Rules Accessing Smart Meters is a "Search"
by jim bell 23 Aug '18

23 Aug '18

https://www.engadget.com/2018/08/23/court-rules-smart-meter-data-government… Smart meters are designed to reduce energy consumption, lower household bills and, by extension, help the planet along a little bit. But could they also be used by the government to spy on you? This is the question that was thrown into the spotlight this week when the Seventh Circuit handed down a landmark opinion ruling, stating that data collected by smart meters is protected by the Fourth Amendment. Data provided by smart meters does not facilitate spying in the traditional sense, of course. But as these devices collect energy usage data at high frequencies (every five, 15 or 30 minutes, usually) it wouldn't be difficult for someone with access to that data to build a pretty clear picture of what's going on inside that property -- information that wouldn't otherwise be available without a search. Previously, courts have ruled that the Fourth Amendment does not protect household energy data -– a precedent largely based on readings from traditional analog energy meters which don't really reveal anything at all, other than the total amount of energy used over a long period of time. The Electronic Frontier Foundation (EFF) and Privacy International filed an amicus brief urging the Seventh Circuit (a federal court with jurisdiction in the central and northern districts of Illinois) to reconsider this position, which they subsequently did, potentially setting an example for the protection of energy data throughout the US. The court held that residents have a reasonable expectation of privacy, and government access of this data constitutes, in essence, a search. It added that the "ever-accelerating pace of technological development carries serious privacy implications" and that smart meters "are no exception." This ruling sets a critical precedent. According to the EFF more than 40 percent of American homes have a smart meter – a number set to rise to 80 percent by 2020. Some reports suggest law enforcement agencies are already trying to get access to data from energy companies without a warrant -- this ruling could be crucial in staving off unjust invasions of privacy. Via: cnet Source: EFF In this article: business, consumption, court, energy, FourthAmendment, gear, government,green, home, monitor, politics, privacy, protection, rule, security, smart, spying

1 0

Let kids play
by Zenaan Harkness 23 Aug '18

23 Aug '18

Why You Should Forget School and Let Kids Play https://www.zerohedge.com/news/2018-08-22/why-you-should-forget-school-and-… https://www.thedailybell.com/all-articles/news-analysis/why-you-should-forg… “This may seem old-fashioned, but there are skills to be learned when kids aren’t told what to do,” said Dr. Michael Yogman, a Harvard Medical School pediatrician who led the drafting of the call to arms. Whether it’s rough-and-tumble physical play, outdoor play or social or pretend play, kids derive important lessons from the chance to make things up as they go, he said.

1 0

Cody Wilson
by Steven Schear 21 Aug '18

21 Aug '18

A number of Cody's friends and supporters of Defense Distributed are reaching out to help raise money to defend them against the recent suits filed by several State Attorney Generals and to take his case to the Supreme Court. It seems Cody has personally been footing the bill so he really needs the bread. https://defdist.org/donate/

4 5

Second SecureDrop Developer: Suicided (James Dolan, ref: Aaron Swartz)
by grarpamp 21 Aug '18

21 Aug '18

https://twitter.com/search?q=james+dolan+suicide https://www.reddit.com/r/conspiracy/comments/7pcqba/second_developer_of_wik…

2 1

Next Year's Federal Military budget over $700 billion. Is that a problem?
by jim bell 18 Aug '18

18 Aug '18

The folllowing article is from Reason Magazine. Next year's Federal budget will include over $700 billion in military spending. I have claimed that my AP idea will essentially eliminate military spending, around the world. I've said this for over 23 years. Isn't this a sufficient motivation to adopt AP? Yet, there are still people who say that AP won't, or can't, be implemented. Isn't such wasteful spending a powerful motivation to cease with the current system, and proceed with a system that will eliminate wars, military spending, and government spending? Governments in the 20th century killed over 250 million people. Is that acceptable Jim Bell http://reason.com/blog/2018/08/13/trump-signs-82-billion-spending-boost-fo "President Donald Trump on Monday signed a military budget boosting the Pentagon's spending by $82 billion in the next year—a spending increase that dwarfs the entire military budgets of most other nations on Earth. Russia, for example, will spend an estimated $61 billion on its military this year. Total. With the increased spending included in this year's National Defense Authorization Act (NDAA), the Pentagon will get to spend more than $700 billion next year. The budget hike was a priority for Trump and was approved by Congress as part of a March spending deal that saw spending on both defense and domestic programs hiked by about $165 billion—smashing through Obama-era spending caps. This year's NDAA is "the most significant increase in our military and our war-fighters in modern history," Trump said. "It was not very hard. I went to Congress, I said, 'Let's do it, we gotta do it.'" Indeed, it was not very hard. Democrats are quick to condemn nearly everything Trump proposes and many Republicans are less than enamored with the current occupant of the White House, but partisan animosity vanishes when defense spending comes up. The final House vote on the NDAA—technically known as the "John S. McCain National Defense Authorization Act" because you wouldn't vote against something named after an American hero, right?—was 359-54, while the final Senate roll call was 87-10, with only two Republican senators opposing the bill and three declining to cast votes. The spending increase will allow the Pentagon to hire another 4,000 active duty soldiers, Trump said, and would help replace aging tanks, planes, and ships with "the most advanced and lethal technology ever developed." "Hopefully, we'll be so strong that we'll never have to use it," Trump said. "But if we ever did, nobody has a chance." Trump also used the occasion to plug his recent call for the creation of a Space Force, which would be the sixth branch of the U.S. military. A Space Force is necessary, Trump said, to counter aggression from other countries in the final frontier. "I've seen things that you don't even want to see," Trump said, apparently referencing advancements in space technology being developed by other countries. There is no funding included in this NDAA for the Space Force, but the administration plans to have the new branch up and running by 2020—and it's not going to be cheap. No worries, Trump seemed to say on Monday, as he promised more spending increases to come—reversing what he said was years of "depleted" spending on the Pentagon. But as I noted in June when the NDAA cleared the Senate: the Pentagon's biggest problem isn't a shortage of funding, but misuse of the money that it already receives. Unfortunately, we don't know much about that because the Pentagon has still not been subjected to a full scale audit, despite the fact that all federal agencies and departments were ordered to undergo mandatory audits in 1990. A preliminary audit of just one office within the Pentagon found that more than $800 million could not be accounted for. Auditors said the Pentagon's Defense Logistics Agency (DLA)—described as "the military's Walmart" because it's responsible for processing supplies and equipment—has financial management "so weak that its leaders and oversight bodies have no reliable way to track the huge sums it's responsible for." Whether it's investing in bomb-sniffing elephants, paying $8,000 for something that should cost $50, or shelling out for the famous $640 toilet seat, there's no shortage of absurd waste in the Pentagon. A Reuters probe in 2013 found "$8.5 trillion in taxpayer money doled out to the Pentagon since 1996 … has never been accounted for. That sum exceeds the value of China's economic output [for 2012]." The Pentagon doesn't need more money, but until politicans from at least one party show a willingness to turn off the tap, there is no incentive for the Department of Defense to change its culture of waste and tradition of opacity.

7 23