- cypherpunks - lists.cpunks.org

SIGINT and improving wireless privacy at the PHY
by wirelesswarrior＠Safe-mail.net 27 Jul '15

27 Jul '15

I will be co-presenting a paper, with Ettus' Balint Seeber, at Defcon 23 (Balint will also be presenting a separate, coordinated, paper). http://www.wirelessvillage.ninja/speakersched.html WW

4 3

DMARC report mailing list subscriber address leaks
by Seth 25 Jul '15

25 Jul '15

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list. I can start posting them publicly if anyone's interested.

5 8

Re: Poitras joins Roark in pro se solidarity
by John Young 25 Jul '15

25 Jul '15

USG may use Poitras suit to try Snowden absentia as well as to suppress withholders of his slow dripping public dump. At 07:49 AM 7/25/2015, you wrote: >rules of the road: > http://cryptome.org/2015/07/poitras-003.pdf

2 1

Re: Hackers Remotely Kill a Jeep on the Highway
by Razer 25 Jul '15

25 Jul '15

From offlist: On 07/24/2015 01:24 PM, Peter Fairbrother wrote: > Fiat Chrysler recalls 1.4 million cars after Jeep hack > > http://www.bbc.co.uk/news/technology-33650491 Was just cruising twitter and noticed that @Uconnect is touting the patch for their Chrysler in-car entertainment system. I suspect the lack of 'firewall' between it and the car control circuitry was similar to the problem that caused a China-base Mattel contractor to send lead-painted toys to be included in (was it BK?) 'happy meals' for kids. The problem? What the toy was going to be used for simply wasn't mentioned in the specs delivered to the contractor so they never took it into consideration to use a non-toxic coating. In this case it looks like the in-car entertainment system manufacturer simply wasn't aware of the rest of the circuitry in the vehicle, and it wasn't mentioned by Chrysler, so they never even thought about it. RR

4 6

Poitras joins Roark in pro se solidarity
by coderman 25 Jul '15

25 Jul '15

rules of the road: http://cryptome.org/2015/07/poitras-003.pdf

1 0

Building a trustworthy computer OSCON talk by Matthew Garrett
by Seth 24 Jul '15

24 Jul '15

Not sure if anyone was attending OSCON today and caught this talk earlier, but if have audio or video please post. http://www.oscon.com/open-source-2015/public/schedule/detail/41536 Building a trustworthy computer Matthew Garrett (CoreOS) 11:10am–11:50am Friday, 07/24/2015 Protect D139/140 Tags: Open hardware, Tools and techniques, Geek life lifestyle Average rating: ***** (5.00, 1 rating) Rate This Session Slides: http://cdn.oreillystatic.com/en/assets/1/event/129/Building%20a%20trustwort… Prerequisite Knowledge Some knowledge of the major components of a modern computer and how they fit together, but no detailed knowledge of firmware or hardware design is required. Description The Snowden revelations demonstrated the lengths that government agencies were willing and able to go to in order to subvert computers. But these attacks aren’t limited to state-level actors – security researchers continue to demonstrate new vulnerabilities and weaknesses that would permit sophisticated criminals to achieve the same goals. In the face of these advanced attacks, what can we do to detect and mitigate them? How can we make use of existing security features, and what changes can we make to system design? In short, how can we ensure that a user can trust that their computer is acting in their interests rather than somebody else’s? This presentation will cover some of the existing security features and recent design changes in systems that can make it easier to detect attacks, and provide mechanisms for defending against them in the first place, along with simple design changes that would make it easier for users to ensure that components haven’t been backdoored. In addition it will discuss some of the remaining challenges that don’t have solid answers as yet. Topics covered will include: Firmware security Trusted platform modules, attestation, and associated privacy risks Hardware design to support offline verification Remaining components that could act against the interests of the hardware owner Photo of Matthew Garrett Matthew Garrett CoreOS Matthew Garrett is a security developer at CoreOS, specializing in the areas where software starts knowing a little more about hardware than you’d like. He implemented much of Linux’s support for UEFI Secure Boot, does things with TPMs and has found more bugs in system firmware than he’s entirely comfortable with.

1 0

Message of Concern re. CSIS action sent from Cryptostorm
by odinn 24 Jul '15

24 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, A tweet was sent out from Cryptostorm concerning one of their staff who was apparently taken away by the CSIS: https://twitter.com/cryptostorm_is/status/624070397219180544 The text of the tweet: "Core cryptostorm team member @grazestorm is currently held hostage by rogue CSIS agents. Not a joke. Deadly serious. Please copy/RT broadly." The tweet was timestamped 9:15 PM - 22 Jul 2015 For reference, the CSIS is the Canadian Security Intelligence Service. Please keep eyes on @cryptostorm_is twitter feed and provide them with moral and any other support you deem appropriate. Cryptostorm are good people. - -O - -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJVsHgzAAoJEGxwq/inSG8CCZYH/1g2n2d+Magp+N1zn41oMhOo UU//rIsLkx3Erjbdy1Q8k78vg5MePmOqX6DrvrIKpj+Uai6QSefVYhbwQU0inJ7w rcR6I7Sq7twSxc9vHUOOGLnshf4bVaKsjL4Q0PUneFNdF93EOAUUx/+0lIe4AcxK PZU51ZOsXaTBej6oi+MSLEQWCZ5RqBi8SKCeNVP7nQ6g75+zW/8MRQ1mHwJ3xz4/ 9I+vb2EwSJ/tI2A0OajTxyxezuOCzutBZyVQ5q5T04+IXvtFt/1TVNlQGAji4cA4 +DrSKfhnWbcFOTqDX35OckL1SGQCF8IgaisgVWxAsS3vcmXQVHqb9mMm0KHiGGk= =P2S0 -----END PGP SIGNATURE-----

4 5

Quantum Cryptography
by Chris Magistrado 24 Jul '15

24 Jul '15

I've been lurking for awhile, but haven't seen too much on this subject. There's this DC talk that I was thinking of attending. https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Aumasson Thoughts, references or white papers<3 ?

1 0

Hackers Remotely Kill a Jeep on the Highway
by Georgi Guninski 24 Jul '15

24 Jul '15

Not sure if this is true: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ <quote> I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. ... Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass. ... The result of their work was a hacking technique—what the security industry calls a zero-day exploit—that can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. ... I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission. Immediately my accelerator stopped working. </quote>

4 4

an ominous comment
by dan＠geer.org 24 Jul '15

24 Jul '15

Discussing security policy post-OPM debacle in a setting to which I have access (sorry to be oblique), it was said by a CxO "We have to prepare for the day when no software we depend on is run on premises." I did not handle this well (think sputtering as an alternative to white rage). At the same time, I am probably in a bubble in that I suspect that nearly everyone I see with a computer (of any form factor) is already in that situation or, save for Javascript piped in from the cloud to run locally, soon will be -- denizens of this list and a few others excepted. Echoing Lenin echoing Chernyshevsky, "What is to be done?" or, perhaps, "Is anything to be done?" --dan

29 112