- cypherpunks - lists.cpunks.org

cypherpunk consortium for carefree crossings
by coderman 06 Nov '14

06 Nov '14

regarding border crossing behaviors of the powers that be, it seems the most expedient response to detainments and data dupe'ings [0][1][2] is to answer with deterrent. possibilities to dissuade dastardly detours: - sunlight the best disinfectant; publicize attempts at intimidation and friction at crossings. - every detainment incurs a disclosure of intelligence collection technique. (requires a pool of un-disclosed spook ballast) - every detour spurs privacy enhancing technology development. a bounty for the most desired improvements, aggressive tactics lead directly to more users, better features, stronger privacy. other ideas? how many Tor trac tickets threatened to be develop to ensure ioerror a safe domestic passage? best regards, 0. "... her work has been hampered by constant harassment by border agents during more than three dozen border crossings into and out of the United States. She has been detained for hours and interrogated and agents have seized her computer, cell phone and reporters notes and not returned them for weeks." - https://en.wikipedia.org/wiki/Laura_Poitras#Government_surveillance 1. "I'm flying back to the US after writing about helping Ed Snowden and the journalists he leaked documents to. Wish me luck at the border." - https://twitter.com/micahflee/status/529191556897443840 2. "I'm looking forward to the time when we don't have to worry about politically motivated US border harassment. A distant time, probably." - https://twitter.com/ioerror/status/529206920838930433

2 1

Re: [tor-relays] [tor-talk] Platform diversity in Tor network [was: OpenBSD doc/TUNING]
by grarpamp 06 Nov '14

06 Nov '14

>> I'd agree simply because Windows presents a much larger attack surface. The >> amount of code running on a minimal Unix installation plus Tor is a lot less >> than a Windows system, especially network facing code. > ... > Running code, or network accessible code? Either way I don't see how > you came to that calculation. 'Minimal' Unix + Tor + SSH restricted > by SSH Key vs 'Minimal' Windows + Tor + RDP restricted by Client > Certificate. I also don't know what you mean by 'minimal' as very few > ... > I think a Windows Server, properly configured, is roughly as secure as > a properly configured Linux Server. > ... > I think there have been more bugs that result in RCE on production > Linux servers running SSH and a webserver in the past 4 years than > there have been in production Windows servers running RDP and IIS. > ... > I think if you're pointing fingers at China and the NSA, you should > assume they have RCE in both Windows and Linux. > ... > I think running relays on Windows Servers is no worse than running > relays on Linux Servers, and therefore it is good to do, because it > adds diversity to the network. Attack surface on a well adminned relay comes down to three things: - Network stack itself (kernel) - Daemon software itself (tor + remote admin) - Their respective use of other kernel/library/shell provided resources. I might suggest the current proportion of Windows to Linux is roughly ideal. This is primarily because, all other things set equal at 'minimal' (= tor + remote admin), good adminning, and good control of corporate secrets (or moles)... Windows still has one huge strategic weakness at that point... the magic packet. It's the whole binary vs. opensource argument. So essentially, the correct ratio of the two might be the odds you place that a binary OS has a magic packet. Today's node count shows 73% to opensource platforms. I'd suspect 73% is about where a lot of analysts might bet on Windows being magical, whether by/for the NSA, or any other reason or source. (Remember this... https://en.wikipedia.org/wiki/NSAKEY That was just from running 'strings'. Good luck trolling all of Windows with a disassembler... a nice fat payoff if you do. And the number of disassembling vs. opensource auditors is probably even more heavily skewed. And Windows is 'trusted' by buyers, nor can you replicate their binaries from any 'source code sharing agreements'. Then it's Patch Tuesday again... so it could be no one has or ever will disassemble audit it. So odds end up being pitched instead. And for many applications, that's good enough.) The real problem below is the 96% allocation of opensource to Linux and 4% to Other opensource. That's something that should be fixed. For these purposes, it doesn't matter which BSD/Other you pick... once you get the security odds there back towards say 50:50 Linux:Other, then you can debate userland and relative security amongst them all you want. Here's some links to get you started, including two other main branches of the Unix Kernel family tree at the bottom... 5939 Linux 1591 Windows 173 FreeBSD http://www.freebsd.org/ 56 Darwin 44 OpenBSD http://www.openbsd.org/ 7 NetBSD http://netbsd.org/ 6 SunOS 4 Bitrig https://www.bitrig.org/ 2 GNU/kFreeBSD https://www.debian.org/ports/kfreebsd-gnu/ 2 DragonFly http://www.dragonflybsd.org/ 0 Illumos (OpenSolaris) http://wiki.illumos.org/display/illumos/Distributions 0 Minix http://www.minix3.org/ Official metrics... https://metrics.torproject.org/network.html Someone should really do an analysis of platform vs. exit bandwidth as well. Anyone? Also, isn't there some project out there that is counting the historical number of kernel bugs+severity per OS over time? [To cpunks to cover all the other volunteer node based networks out there that could benefit from tuning their platform ratios.]

1 0

Cody Wilson to run for Bitcoin Foundation board, plans its destruction
by grarpamp 05 Nov '14

05 Nov '14

http://upstart.bizjournals.com/entrepreneurs/hot-shots/2014/11/04/cody-wils…

3 2

Crypto collision used to hijack Windows Update goes mainstream
by Georgi Guninski 05 Nov '14

05 Nov '14

http://www.theregister.co.uk/2014/11/05/md5_hash_collision/ The cryptographic hash collision attack used by cyberspies to subvert Microsoft's Windows Update has gone mainstream, revealing that MD5 is hopelessly broken.

1 0

BitLocker, OneDrive, PRISM
by rysiek 05 Nov '14

05 Nov '14

Hi there, WTF am I reading? http://cryptome.org/2014/11/ms-onedrive-nsa-prism.htm "... because the [BitLocker] recovery key is automatically stored in SkyDrive for you." -- Pozdr rysiek

3 2

What NSA Is Doing to Improve Security Post-Snowden
by George W. Maschke 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 NSA Director Mike Rogers spoke at Stanford University's Hoover Institute this past weekend, and a faculty member asked him what the NSA is doing with regards to personnel security to stop another incident like Edward Snowden's release of classified documents. Interestingly, the first and primary measure that the NSA director mentioned was polygraph testing. It's interesting because polygraphy is a thoroughly discredited pseuodoscience. It depends on the person being "tested" being ignorant of the trickery on which the procedure relies. How ironic that America's most technologically sophisticated intelligence agency relies on early 20th century pseudoscience as the keystone of its personnel security program. For additional commentary, see "NSA Director Mike Rogers on Polygraph Screening" on the AntiPolygraph.org blog: https://antipolygraph.org/blog/2014/11/04/nsa-director-mike-rogers-on-polyg… George Maschke PGP Public Key: 316A947C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUWf25AAoJEEYqwKuPDNWqPMgP/3QDCJH5epob6MKlYYTAH30A gYQBfIkIa93Wufhmt+Od2zlbQSxkshEnD/mNnujqih/bybrvj+OSLR2ejCwzoaL1 PMoR07E1kJRjKw0wEIbxnf0SLVGJedOHhUsu6/WUJ9DWYZ7mCiSyVgH+AOIhaQDy SUFoi9Nl3dZvUBN8FqRPeL4tHp0LG6QIV3N0pZZddOw68qIeI53HQ8Rv14VAFgix oAIzHJ77Y+0gcyp1WIxFyopVfnioezf15YVSl3hC0z+m1V/lRFUullHJWWbG4nm9 xenuqWwVF5T6wj4Lstep5seKBoKobr1+haGPkVfggNcfOMAY4PCjolzmA4j8yOci Sn8vx7U1eVGAwdPkppT33ug+GWzj5yXMVCjH95U+JyO6My4cY97YOhtQe5fUn0ep vhbPMRy+Q1lvtRYd9lZI/ZLRVOUp1652IqjhgCmIMCCR3ZtSPWq3RQmreepf6XgA tCU2u6SkpgK7N2+NvMMFe+lrcBUIxO6MTBW61xl6CHmw3WIsPTUfstwGwcUkm2Im jjnQuLNqE+IMEsaZ0202r9791DnohXOtbg7epGSayk35oBA4xvCZm0/A4vStgCSO Dt8jSht5ULJZJ1jqnSkkAzfXrKHxlCFRlRkrNWn7qcTKGm2Iza0DCA5513cU80xj AD3rPiQBA0/r6N78GYaY =9xb+ -----END PGP SIGNATURE-----

3 3

Wind River Security Features and Cryptography Libraries
by John Young 05 Nov '14

05 Nov '14

Wind River Security Features and Cryptography Libraries (which appear to be the basis of the $750,000 fine by BIS) http://cryptome.org/2014/11/wind-river-security-crypto.pdf

2 1

Crypto War Redux
by John Young 04 Nov '14

04 Nov '14

USG enforcing crypto export controls: "Intel Subsidiary Agrees to $750,000 Penalty for Unauthorized Encryption Exports" (Oct 8) http://www.bis.doc.gov/index.php/about-bis/newsroom/press-releases/107-abou… A story to go with that: "Software Companies Now on Notice That Encryption Exports May Be Treated More Seriously: $750,000 Fine Against Intel Subsidiary" (Oct 15) http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/10… My source: http://www.reddit.com/r/snowden/comments/2l5fnm/software_companies_now_on_n… (posted by "platypusmusic", who often has very good posts on Reddit, especially in the /r/snowden: http://www.reddit.com/r/snowden/ ) ----- Contraband crypto welcomed: cryptome(a)earthlink.net

3 2

Privacy has always been a fight against rulers and funders
by John Young 04 Nov '14

04 Nov '14

Verifying US-UK concordance, with FBI head, Director of NSA said much the same as GCHQ to the US Chamber of Commerce on October 28, 2014: https://www.nsa.gov/public_info/speeches_testimonies/28oct14_dirnsa.shtml These heads of spy and LE agencies are proposing that companies and citizens continue to serve and become spies, agents, informers, coverts in mirroring their enemies of their security states. And not only are asking for patriotic volunteers by sticks of fear and aiding the enemy but contracting for services by carrots of privileged briefings, access, profits and tax write-offs. No wonder oligarchs are increasing and are rushing to aid and abet spies in all countries. Will First Look's Racket magazine come to life to join The Intercept, so buzzworthily named to fit what they do: front for First Look Media's invention and distribution of comsec products which if true to the ancients' practice will spy on the populace with everylasting panoptic look. This is hardly new, indeed is as old as governments and their precursor "lawful" rulers of the populace which cannot be trusted with anarchic self-rule, much less armed with treasonous cryptoanarchy for absolute right to privacy from rulers. Even this list of rogues was founded and struggles to survive on its impossible mission to resist this ancient history and current fervor of duplicity and dual-use of the ever growing family of securities -- personal, home, clan, region, nation, global, religion, ideology -- deployed to simultaneously attack and protect the populace by declaring who is insider and who is outsider, take your pick, save your life. Us or them. Divide and conquer. Praise and smear. Lop heads and drone. Imprison and exile. Significantly for this clan, comsec remains an essential tool for attacking and protecting. It annoys the masters of comsec no end for rogues to mess with their command and control communications and ubiquitous civic spying operations. It requires recruitment of comsec rogues to mess with rogues, as amply demonstrated here and other security fora where coders and hackers are prime candidates for quietly switching sides, remaining in place, covertly informing, sabotaging, implanting, faulting, I/O erroring, pretending opposition to the state, stashing their fees, teaching cryptology, advising NGOs, counseling dissidents, whistling Dixie for media and audiences, advocating openness, disclosing shallow vulns to hide the deeper. This list goes on, as evidenced here and on the gobs of freedom of information outlets which have spread as widely as the Internet, black net, deep net, chats, OTRs, Tor, and now cellphone webs and swarms of earnest instigators indistinguishable from TLAs taking 100% and giving back at best 50%, with bountiful support from freedom-loving oligarchs, soliciting volunteers, paying overseers of volunteers, accruing profits by shifting taxation to the populace for their protection and spying on it to assure system security, oiled with bounties, bonuses and Sabu-grade walk-frees awards for whistleblowing on the whistleblowing, and not least, enduring legal fees for ACLU- grade justice tipped against oppostion to civil liberties racketeering aided and abetted by backdoored comsec also known as rule of law.

1 0

Fwd: [seL4 Announce] seL4-based "RefOS" released
by coderman 04 Nov '14

04 Nov '14

---------- Forwarded message ---------- From: Announcements about seL4 — low volume list <announce(a)sel4.systems> Date: Tue, 4 Nov 2014 06:12:54 +0000 Subject: [seL4 Announce] seL4-based "RefOS" released Today we announce the release of the RefOS project. RefOS is an OS personality that runs on seL4. RefOS stands for "Reference OS", the aspirational goal of the project, which is to provide a reference OS personality for seL4. RefOS is a student project built as a case study to explore more dynamic virtual memory (VM) management systems than the typical static systems architected on separation kernels. When compared to statically allocated systems, a key difference (and complexity) of dynamic VM management is relaxing the assumption that virtual memory (and memory objects) are managed by a single task upon the microkernel (or by the microkernel itself). RefOS has a distributed VM framework inspired by the Sawmill VM framework [1], though differing in the centralisation of some core book-keeping into a single server (mainly fault forwarding and mapping authorisation). An additional goal of the project was to create tension between user-level and kernel-level VM primitives to enable ongoing kernel experimentation in the area of higher-level VM abstractions. The current functionality of RefOS consists of processes, an in-memory boot-image file server, and console support. Additionally, some games and test applications have been ported to the system. RefOS is available at https://github.com/seL4/refos-manifest under a "BSD 2-Clause" license. [1] Mohit Aron, Jochen Liedtke, Kevin Elphinstone, Yoonho Park, Trent Jaeger, and Luke Deller. 2001. The sawmill framework for virtual memory diversity. In Proceedings of the 6th Australasian conference on Computer systems architecture (ACSAC '01). IEEE Computer Society, Washington, DC, USA, 3-10.

1 0