- cypherpunks - lists.cpunks.org

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 22 Aug '15

22 Aug '15

On 8/21/15, Mike Perry <mikeperry(a)torproject.org> wrote: ... >> For those into researching other flow capabilities... >> There are also some probes in OS kernels and >> some other opensource taps, they're not as well known >> or utilized as nProbe. >> Other large hardware vendors include Brocade, Avaya, >> Huawei, and Alcatel-Lucent. > > Out of all of these, I was only able find info on Alcatel-Lucent. It > uses cflowd, which appears to be a common subcomponent. It's timeout > ranges are the same as Cisco IOS. for posterity, it would also be useful to scrutinize behavior of: - Arbor Peakflow SP - Narus Insight Manager - Lancope StealthWatch Xe with respect to soft or hard fixed NetFlow limits within analysis or as pushed to tapped switches. best regards,

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 22 Aug '15

22 Aug '15

On Sat, Aug 22, 2015 at 1:09 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > As such, I was only able to discover that its default inactive/idle > timoeut is 30s. I couldn't find a range. > What I really need now is any examples of common routers that have a > default inactive/idle timeout below 10s, or allow you to set it below 10s. Not common unless you consider all the places where software is being used as a network tap, whether by legit operator, or by adversary. nProbe can timestamp in milliseconds. [ 21] %LAST_SWITCHED %flowEndSysUpTime SysUptime (msec) of the last flow pkt [ 22] %FIRST_SWITCHED %flowStartSysUpTime SysUptime (msec) of the first flow pkt [152] %FLOW_START_MILLISECONDS %flowStartMilliseconds Msec (epoch) of the first flow packet [153] %FLOW_END_MILLISECONDS %flowEndMilliseconds Msec (epoch) of the last flow packet Some define and assignment logic sets the defaults. It's software so anyone could adjust the options to at least fall within the "hardcoded" integer type... 1 to u_short. That doesn't mean it's sensible or that other bits in the code won't need munged, I didn't look. u_short idleTimeout, lifetimeTimeout, sendTimeout; #define DUMP_TIMEOUT 30 /* seconds */ readOnlyGlobals.idleTimeout = DUMP_TIMEOUT; readOnlyGlobals.lifetimeTimeout = 4*DUMP_TIMEOUT; readOnlyGlobals.idleTimeout = atoi(optarg); readOnlyGlobals.lifetimeTimeout = atoi(optarg); if(readOnlyGlobals.lifetimeTimeout == 0) { readOnlyGlobals.lifetimeTimeout = 1; printf("[--lifetime-timeout|-t] <timeout> | It specifies the maximum (seconds) flow\n" " | lifetime [default=%d]\n", readOnlyGlobals.lifetimeTimeout); printf("[--idle-timeout|-d] <timeout> | It specifies the maximum (seconds) flow\n" " | idle lifetime [default=%d]\n", readOnlyGlobals.idleTimeout); > I think these devices are wandering into the "adversarial admin" > territory (see section 3 of the proposal). I want to focus on the case > where the adversary demands/sniffs/exploits routers likely to be > installed in most networks. Sniffs... Lavabit was [nearly/actually] forced to install devices on his network for some while, so I see no "Sorry, my vendors config range doesn't support it" distinction here. Telecoms like AT&T don't fight, and Vampires don't care. Demands... The point with the NICs is that even 100Gbit taps are old news. With that comes deployment of flow / bro / etc like things that use them and the logs get saved because humans love to create collect and save useless stuff... to supply on demand. Software taps are popular, probably moreso at the network edges... universities, corp, regional / city, colo, etc. But costs are dropping, tech is rising, depts are doing these things. Yes, a legit operator may be unlikely to adjust, or to set the timeouts too low on their own free will since: 1) why, 2) storage space, 3) processing cpu / bandwidth Exploits... It's all software in the end. I know, I'm partly diverging from legit operator context.

1 0

Brothers at Arms: Jeb Bush says no to crypto
by grarpamp 22 Aug '15

22 Aug '15

https://firstlook.org/theintercept/2015/08/19/jeb-bush-comes-encryption/ Jeb Bush Comes Out Against Encryption Jenna McLaughlin Aug. 19 2015, 3:40 p.m. Getty Images Republican presidential candidate Jeb Bush said Tuesday that encryption makes it harder for law enforcement to track down “evildoers” — and called for a “much better, more cooperative relationship” with Apple, Google, and other tech companies that are building uncrackable private communication apps into their new products. “If you create encryption, it makes it harder for the American government to do its job — while protecting civil liberties — to make sure that evildoers aren’t in our midst,” Bush said in South Carolina at an event sponsored by Americans for Peace, Prosperity, and Security, a group with close ties to military contractors. Bush said, “We need to find a new arrangement with Silicon Valley in this regard because I think this is a very dangerous kind of situation.” But when the event moderator, former CNN anchor Jeanne Meserve, brought up scientists’ conclusions that giving law enforcement special access to communications also gives hackers more access, Bush didn’t explain his position any further. “Good point, except we ought to have much more cooperation when it comes to cybersecurity,” he said.

3 2

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 22 Aug '15

22 Aug '15

On 8/21/15, Mike Perry <mikeperry(a)torproject.org> wrote: > ... > What I really need now is any examples of common routers that have a > default inactive/idle timeout below 10s, or allow you to set it below > 10s. So far I have not found any. i recall a switch vendor that used overflow condition to trim timeouts lower, but this is different from a hard, low limit by configuration. i'll see what i can dig up... best regards, P.S. flow tracking systems always make me point at c++ & scapy userspace driven raw injection around massive flow sybils as retort in their raw take and analytics. most efficient state representation of TCP behavior in memory? it's a fun challenge :P [ P.P.S. this may just crash your in-path, rather than DoS. keep a backup route! ]

1 0

NSA Spying Relies on AT&T'S "Extreme Willingness to Help"
by Shelley 22 Aug '15

22 Aug '15

Nothing we didn't know or expect, just more confirmation/proof that AT&T & Verizon are all too eager to get on their knees for the NSA. https://www.propublica.org/article/nsa-spying-relies-on-atts-extreme-willin… Also worth a look: how they connected the dots, supporting documents. https://www.propublica.org/article/a-trail-of-evidence-leading-to-atts-part… (Apologies for not including the article text, I'm currently mobile.) -S

5 5

Re: Defcon slides
by John Young 21 Aug '15

21 Aug '15

Someone else got a 402. Good Housekeeping Mr Clean machines do not get a 402. Most likely the Kaspersky-Krebs-Schneier-TCMay-Muppets- JPMorgan-In-Q-Tel-in-YourBox v.12 exploit is MiTM by DoD-BBG-Tor. Pay the ransom. No BTC, Rai only. At 05:14 AM 8/21/2015, you wrote: >On Thu, Aug 20, 2015 at 5:03 PM, <wirelesswarrior(a)safe-mail.net> wrote: > > My slides are now online. There is a link from the front page of > cryptome.org under the "Offsite" section. > >http://defcon-wireless-village.com/docs/Defcon23-Covert-Wireless.pdf >http://www.wirelessvillage.ninja/ > >402 Payment Required >Just kidding. Unless you really want to pay us. Chances are, if you >got this page, that means the server doesn't like something about you. >You may be using an invalid HTTP option, or an evil browser string, or >maybe just from a country we are leery of. If you want to access the >page, and you are not attempting to index/hack/inject/pwn it, DM Us to >get it looked at. > >tor so leery.

2 1

Re: Defcon slides
by wirelesswarrior＠Safe-mail.net 21 Aug '15

21 Aug '15

As a backup for those experiencing difficulties via the cryptome.org link I uploaded the slides to a "dropbox" http://s000.tinyupload.com/?file_id=73132852308922752258 WW

1 0

FOIPA adventures
by coderman 21 Aug '15

21 Aug '15

"you want me to consent to make my FBI file public? Are you fucking mad?" - https://twitter.com/thegrugq/status/563036665837789184 --- i am currently making requests through MuckRock.com which i recommend for their helpful and dedicated staff, as well as their time devoted to review and reporting on released information. i am using the professional service, which lets you set requests private until reviewed and ready to release publicly. this implies a bit of trust in MuckRock, and i hope it is not misplaced. few years back i asked for participants in a similar effort. some things resulted: 1) this also opens up the requester to risk; that is, whoever is filing must also potentially show some trust, if a falsified DOJ-361 is sent and used as pretext to "deter" you. i have not heard of this actually happening, but i was also not willing to push it. '''beware who you accept, coder, or they're setting you up for USC 18 fuckery. sure, it may in the end be ok. but you're in misery until cleared.'''' 2) the information is going to be public; if you've got a file because you're a privacy enthusiast, then filing to make your file public is the opposite of enjoying your privacy. there is merit in taking one for team earth human, however... --- as a first report, deliveries of USPS forms DOJ-361 to multiple, and a batch of three sent concurrently. two arrived promptly, but one got scrutiny before leaving town (forms to FBI, perhaps related to ? :) a) INTERPOL Washington FOIA Service Center (202)-616-0201 U.S. Department of Justice Washington, D.C. 20530 --- Form DOJ-361 sent, currently: February 4, 2015 , 11:41 pm - Arrived at USPS Facility - WASHINGTON, DC 20066 Tracking Number: 9405510200829494303833 b) U.S. Department of Justice United States Marshals Service Office of General Counsel Washington, DC 20530-1000 --- Form DOJ-361 sent, currently: February 4, 2015 , 11:40 pm - Arrived at USPS Facility - WASHINGTON, DC 20066 "Your item arrived at our USPS facility in WASHINGTON, DC 20066 on February 4, 2015 at 11:40 pm. The item is currently in transit to the destination." Tracking Number: 9405510200830593742348 c) Record/Information Dissemination Section (RIDS) FBI-Records Management Division 170 Marcel Drive, Winchester, VA 22602-4843 --- Form DOJ-361 sent, currently: February 3, 2015 , 6:15 pm - Arrived at USPS Origin Facility - PORTLAND, OR 97218 "Your item arrived at our USPS origin facility in PORTLAND, OR 97218 on February 3, 2015 at 6:15 pm. The item is currently in transit to the destination." Tracking Number: 9405510200828494428195 [ i offered to send via FAX if mail was problematic and excessively latent. ]

3 28

Defcon slides
by wirelesswarrior＠Safe-mail.net 21 Aug '15

21 Aug '15

Cpunks, My slides are now online. There is a link from the front page of cryptome.org under the "Offsite" section. WW

2 1

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 21 Aug '15

21 Aug '15

On Fri, Aug 21, 2015 at 12:30 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > I submitted a proposal to tor-dev describing a simple defense against > this default configuration: > https://lists.torproject.org/pipermail/tor-dev/2015-August/009326.html nProbe should be added to the router list, it's a very popular opensource IPFIX / netflow tap. http://www.ntop.org/products/netflow/nprobe/ For those into researching other flow capabilities... There are also some probes in OS kernels and some other opensource taps, they're not as well known or utilized as nProbe. Other large hardware vendors include Brocade, Avaya, Huawei, and Alcatel-Lucent. Lots of SDN and monitoring projects can plug in with gear like this, because, FTW... http://telesoft-technologies.com/technologies/mpac-ip-7200-dual-100g-ethern… http://www.hitechglobal.com/IPCores/100GigEthernet-MAC-PCS.htm http://www.napatech.com/sites/default/files/dn-0820_nt100e3-1-ptp_data_shee… https://www.cesnet.cz/wp-content/uploads/2015/01/hanic-100g.pdf http://www.ndsl.kaist.edu/~kyoungsoo/papers/2010-lanman-100Gbps.pdf http://info.iet.unipi.it/~luigi/netmap/

1 0