- cypherpunks - lists.cpunks.org

TPM-FAIL: Trusted Platform Module - Exploited
by grarpamp 14 Nov '19

14 Nov '19

http://tpm.fail/tpmfail.pdf https://github.com/VernamLab/TPM-Fail TPM meets Timing and Lattice Attacks Trusted Platform Module (TPM) serves as a root of trust for the operating system. TPM is supposed to protect our security keys from malicious adversaries like malware and rootkits. Most laptop and desktop computers nowadays come with a dedicated TPM chip, or they use the Intel firmware-based TPM (fTPM) which runs on a separate microprocessor inside the CPU. Intel CPUs support fTPM since the Haswell generation (2013). TPM chips are also used in other computing devices such as cellphones and embedded devices. We discovered timing leakage on Intel firmware-based TPM (fTPM) as well as in STMicroelectronics' TPM chip. Both exhibit secret-dependent execution times during cryptographic signature generation. While the key should remain safely inside the TPM hardware, we show how this information allows an attacker to recover 256-bit private keys from digital signature schemes based on elliptic curves. A team of academics has disclosed today two vulnerabilities known collectively as TPM-FAIL that could allow an attacker to retrieve cryptographic keys stored inside TPMs. The first vulnerability is CVE-2019-11090 and impacts Intel's Platform Trust Technology (PTT). Intel PTT is Intel's fTPM software-based TPM solution and is widely used on servers, desktops, and laptops, being supported on all Intel CPUs released since 2013, starting with the Haswell generation. The second is CVE-2019-16863 and impacts the ST33 TPM chip made by STMicroelectronics. This chip is incredibly popular and is used on a wide array of devices ranging from networking equipment to cloud servers, being one of the few chips that received a CommonCriteria (CC) EAL 4+ classification — which implies it comes with built-in protection against side-channel attacks like the ones discovered by the research team. Unlike most TPM attacks, these ones were deemed practical. A local adversary can recover the ECDSA key from Intel fTPM in 4-20 minutes depending on the access level. We even show that these attacks can be performed remotely on fast networks, by recovering the authentication key of a virtual private network (VPN) server in 5 hours.

1 0

BrBrBr: Corrupt Brazil Swats at Greenwald
by grarpamp 13 Nov '19

13 Nov '19

https://reddit.com/r/worldnews/comments/c1glfa/after_exposing_corrupted_bra… https://www.commondreams.org/news/2019/06/14/after-exposing-corrupted-brazi… Greenwald and his colleagues published leaked chats from government officials that appear to show justice minister Sérgio Moro was involved in a plot to keep former Brazilian President Luiz Inacio Lula da Silva, known as Lula, from entering the country's 2018 presidential race. The reporting has already caused controversy in Brazil and forced Moro to answer difficult questions from the public. In addition to physical harm, Greenwald, who is American but lived in Brazil for many years, says powerful members of the Brazilian government are also threatening to have him deported because of his journalism. Greenwald's husband, David Miranda, is a member of the Socialism and Liberty Party, and was elected to Brazil's National Congress last year. https://twitter.com/ggreenwald/status/1139275872840667138 https://twitter.com/carlosjordy/status/1139249465062301699 A Congressman from Bolsonaro's party explicitly threatening me with arrest and/or deportation for reporting on the massive improprieties of Bolsonaro's Justice Minister and the prosecutors who imprisoned Lula. This is their prevailing mentality, laid out explicitly: Assisti agora a um vídeo do Glenn Greenwald debochando do PSL dizendo que o partido amarelou de convidá-lo na Comissão de Segurança. Vamos à verdade: 1 - Eu não estava lá, mas jamais teria deixado q fizessem convite. O convidado não é obrigado a responder perguntas, responde o que quer. Aquilo se tornaria um palco para a esquerda blindá-lo e ele falaria o que quisesse de forma distorcida. 2 - O ideal seria uma convocação, mas que, no caso dele, só seria possível numa CPI, o que eu e @filipebarrost já estamos providenciando coletando assinaturas. 3 - Independente do seu comparecimento ao Congresso, seu caso já está sendo investigado na justiça. Senhor @ggreenwald, não pense que você é um imortal acima do bem e do mal. Você praticou ativismo jornalístico através de um ato criminoso, o que lhe faz cúmplice. 4 - Respeite o País que o recebeu, você não pode afrontar nossas instituições e autoridades, cometendo crimes contra a segurança nacional e não imaginar que pode ser punido criminalmente e DEPORTADO. 5 - Se instaurarmos a CPI, não vale amarelar e recorrer ao STF impetrando HC para não comparecer.

3 3

Microsoft OS Workaround Site "My Digital Life" Still Running
by grarpamp 13 Nov '19

13 Nov '19

https://forums.mydigitallife.net/ ISO links, KMS, howtos, BIOS mods, Apps, etc. Seems popular, been running for years. Windows 98 Universal Product Key: VP9VV-VJW7Q-MHY6W-JK47R-M2KGJ

1 0

you can safely bet the 1933 USD fix did not apply to Rothschild - Executive Order 6102 "no personal gold ownership" - [PEACE]
by Zenaan Harkness 13 Nov '19

13 Nov '19

A little history for the uninitiated: https://www.zerohedge.com/news/2018-09-29/how-executive-order-6102-doomed-a… Here's the thing, the uber-elite, such as Rockefellers, Rothschilds etc, have been hoarding (using that term loosely - the Fed's reserves are in serious question, as was the tonnes under the WTC towers, each of which apparently "disappeared", more facts required) gold using fiats. The fiat system has been designed to cyclically collapse (you thought the Federal Reserve was constitutional/lawful?), and those fiats are used for more generalised systematized hoarding, such that when the collapse happens, and the mathematical reset trigger is pulled, those holding the gold are the same old Goldbergs, Silversteins, Rothschilds and the rest. So a reset is not useful in and of itself. What is required is a systemic change. There are simple solutions, but they do require a general consciousness - the unwashed sheeple need to become a little more washed/ aware. Good luck,

1 1

5G Riddled With Security Holes
by grarpamp 13 Nov '19

13 Nov '19

https://www.wired.com/story/5g-vulnerabilities-downgrade-attacks/ https://techcrunch.com/2019/11/12/5g-flaws-locations-spoof-alerts/ 5G [intentionally ;] full of security holes. Not even going to bother pasting it's so pathetic. "Mounting those attacks takes only software-defined radios that cost a few hundred dollars. The 5GReasoner tool also found issues with..."

2 2

Bolivia coup led by Christian fascist paramilitary leader and millionaire – with foreign support
by Ryan Carboni 13 Nov '19

13 Nov '19

Bolivia coup led by Christian fascist paramilitary leader and millionaire – with foreign support https://thegrayzone.com/2019/11/11/bolivia-coup-fascist-foreign-support-fer… Read it in full, it will get to the part about Americans.

4 5

No, Mr. Busby, there is a Santa Claus.
by jim bell 13 Nov '19

13 Nov '19

No, Mr. Busby, there is a Santa Claus. Dear Mr. Busby, On the Cypherpunks Archive web page, https://cryptoanarchy.wiki/blog/2018/07/05/the-cypherpunks-mailing-list-arc… , you said: "I have an uneasy feeling that many of the posts from this era may already be irrecoverably lost. If this is true it would be a great shame for future generations who want to learn about this vital period of internet history and development. There is an argument that perhaps the list participants would like their privacy preserved, however I don’t think it is a strong one. An open-subscription mailing list is ultimately a public forum. Posting to it is an act of placing information into the public domain." No, Mr. Busby, you need not worry about that specific possibility. There were clearly hundreds of people who subscribed to the CP email list, even as early as mid 1995. Each of them regularly received copies of posted CP emails, which were presumably reliably stored onto their computers' hard drives, possibly floppy disks, and eventually possibly backup tapes. Those hard drives were occasionally retired, but when that happened many of them were probably put on shelves to gather dust. Remember, at the moment they were retired, they were not considered totally worthless. And shelves are remarkable things: If you put something on them, perhaps in a box, that object generally does not simply disappear after years or even decades. So there was no immediate reason to throw those hard drives away, even if the potential value of that hardware gradually dropped. So, in many cases, it can be expected that such hardware remains and is ultimately retrievable, (Only idiots like Razer think otherwise, apparently.) Does anybody believe that EACH AND EVERY copy of ANY specific CP email was totally erased, everywhere around the world it happened to be. Including, for instance, the NSA and other government TLA's? How foolish! But what you need to do, immediately, is to worry about a far more omnous reality, one that I have discovered within the last 3+ days. I was a heavy participant in the Cypherpunks list from perhaps March 1995 onwards, and for a couple of years. And, quite unlike most of the now-current subscribers, the large majority of whom were not on the CP list in 1995, I can actually REMEMBER the general events of that time frame. Which is one of the main reasons I have a powerful advantage as I studied a specific kind of message and text that is, or at least SHOULD BE, in the Cypherpunks archive for 1995. You, sorting through a veritable ocean of look-sorta-alike data, are very unlikely to spontaneously notice what data happens to be "missing". If you go into a forest, how can you notice one missing tree, or a dozen? (Yes, a sawed-off stump remains an excellent clue.) I, however, knowing that my name (jim bell) and my old email adddress (jimbell(a)pacifier.com) and references to 'assassination politics' and 'AP' should be heavily present, have a huge advantage. If they aren't (still) there, I will notice it. And they aren't. And I did. You presumably don't notice it, at least not until I explain what should be present, yet isn't present. Quite understandable. But now you know. I suggest that you read my comments for the last 3 or so days on CP. In some of them, I point out that the text string 'jim bell' does not seem to be present in the 1995 archive you are maintaining, nor in the Venona file for that year. And the text string 'AP', in the limited meaning of the name of my 1995 essay, "Assassination Politics", which soon enough the vast majority of the time was shortened to merely 'AP'. Yet, I first entered the CP list about March 1995, and was solidly responding to dozens, of messages, per day. And other people, many dozens of them, were posting similar, and responding, messages back to me, and to others on the list. None of that seems to be present, at least not before November 2005, and yet it is solidly present in 2006. And yet, mysteriously, references to me and my then-email address, jimbell(a)pacifier.com simply don't occur until November 1995. But if you compare the 1996 archive, and the Venona-file equivalent, you will see that these text strings are subsequently heavily present that later year, 1996, as in fact they should also have been for more than the last half of the year 1995. And in fact, there should be far more references to "AP", per day in mid-late 1995, than eventually would be (and, I presume, still are) found in 1996. (only clueless, malicious people like Razer don't comprehend this, or at least they pretend not to be able to figure it out.) Since you are sympathetic to the Cypherpunks cause (why else would you be here?), I can tell you that there is some very good news, There is no reason to believe, now that I have discovered a major problem with the tampering, that it will be impossible to re-acquire most if not all of the emails making up what should be the archive. But the not-quite-so-good-news is that perhaps you ought to mentally re-orient yourself, shift gears a little. Yes, I agree that making and maintaining an accurate Cypherpunks archive it good and important. But you don't mow the grass when your house is on fire, do you? I say we have an 'emergency', since I have discovered massive and deliberate tampering with the CP archive. Because of your motivation to maintain an accurate list, I think you should also be motivated to figure out who managed to engineer such an abhorrent fraud, And you will notice that these tasks heavily overlap. To generate an accurate archive now requires determining what material has been omitted. And that is a difficult task: Prior to this, I suppose you thought you were dealing only with accidental, inadvertent data omissions. Now, you are aware that that there is at least one huge, deliberate, malicious fraud. And just because I noticed (so far) one of them, doesn't mean that there are not others, ones that I haven't yet noticed. Clearly, the fact that this fraud wasn't discovered until 3 days ago means that the "tools", and "system" that we should otherwise expect will find this sort of thing didn't actually work. So, if they are not changed, there is no reason to believe they will begin to work in the future. You were aware of some omissions, you just didn't understand what they were and how they were caused: "I have an uneasy feeling that many of the posts from this era may already be irrecoverably lost. If this is true it would be a great shame for future generations who want to learn about this vital period of internet history and development." Also, you should be aware that deliberately tampering with computer data is a Federal felony. https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/1… The people who accomplished this forgery are in grave danger of prosecution, or at least they should be if the government prosecutors do their job. And part of OUR task will be to expose AND publicize this corruption sufficiently well so as to help guarantee that the Feds don't have any alternative to prosecute them. Do you think you can do that? And that includes finding out the nature of the forgery, in at least enough detail to allow a prosecutor to bring a winning case. Are you getting excited now, Mr. Busby? It's only going to get more "real" from here on in. "Fasten your seat belts, it's going to be a bumpy night." https://www.youtube.com/watch?v=3vEEh0GF_C8 Jim Bell

9 29

TED Talks: Cryptographers, quantum computers and the war for information
by jim bell 13 Nov '19

13 Nov '19

TED Talks: Cryptographers, quantum computers and the war for information. https://www.ted.com/talks/craig_costello_cryptographers_quantum_computers_a…

1 0

Tech Xplore: Researchers discover vulnerabilities affecting billions of computer chips
by jim bell 13 Nov '19

13 Nov '19

Tech Xplore: Researchers discover vulnerabilities affecting billions of computer chips. https://techxplore.com/news/2019-11-vulnerabilities-affecting-billions-chip…

1 0

Common Networks bets 5G will replace cable internet in your home
by jim bell 13 Nov '19

13 Nov '19

https://www.cnbc.com/2019/11/12/common-networks-bets-5g-will-replace-cable-…

3 4