- cypherpunks - lists.cpunks.org

potential leak on Torpedo
by Eugen Leitl 21 Jul '14

21 Jul '14

https://pay.reddit.com/r/TOR/comments/2b8oq3/please_read_if_you_usedepend_o… Please read if you use/depend on Tor. Never before seen FH information. (self.TOR) submitted 16 hours ago * by Deepthroat2 [+1] Hello everyone, I have some information that I have been dying to share for months, but due to the circumstances, and to avoid detection, I had to wait for some time before I was able to safely make this post. My goal here is to provide information that I know is credible and for the Tor community to use it as they see fit, due to the nature of my work, and the severe penalties associated with breaking the rules and giving out information you aren't supposed too, I have no way of verifying or proving anything to you that I say here, I understand if find me less than credible, however, this is essentially a PSA, and you can take it for what it's worth to you. Just about one year ago, the Tor community was shaken by a Firefox exploit which utilized a javascript exploit and an old vulnerbility in the Tor Browser Bundle to unmask some users of Freedom Hosting. There has been rampant misinformation, and speculation to the point that I felt like pulling my hair out, or just simply bursting out into laughter when reading some of the outlandish claims made by people who have little to no idea what they are talking about. Today, I will set the record straight. The FH exploit was a government engineered, and deployed exploit that was designed in response to former Director Mueller's fustration at an earlier child pornography case in which the FBI was ridiculed for being unable to ascertain the source of child pornography, for those who aren't familiar with this case, it involved a man who had accessed child pornography by accident on a Tor hidden service, and then brought his desktop computer to the office, explaining what had happened and that he subsequently preformed a "Full wipe" on the disk. The agent who took the report had limited knowledge about Tor, however, at the time he knew that any directed effort to identify a specific Tor user was hopeless, and in the report he indicated that "There is currently no known way to ascertain the location of a Tor user, thus, no investigative leads exsist." This got leaked to the press, and they had a field day, hinting at the incompetency of the Bureau. Needless to say, the FBI had it's ego hurt quite badly by this public display of incompetency. Then Director Mueller directed the CEOS (Child exploitation and obscenity section) to find a way to penetrate the layers of protection provided by Tor, and to come up with a fesible way to conduct a sting operation in order to bring these people to justice. The FBI had previously conducted a sting on viewers of child pornography in a case out of Nebraska, that resulted in the arrest of about 25 people. This was the first successful take down of CP consumers that were utilizing a Tor hidden service. One of the errors that I see alot on these forums and others was that the Nebraska take down was done in a similar fashion to the FH exploit, with the code being deployed onto the pages of the boards, however, this is not the case. From my understanding, the Nebraska field office was able to find the actual server, take it over covertly, then upload a series of files that purported to be child pornography, but actually contained nothing but encrypted gibberish. They were video files that were embedded with code that called back to a computer that recorded the IP address of the requestor, date and time similar to the way windows media player attempts to recall album information and cover art for music cds and such. These were files that the user actually had to download and attempt to open. This is why the service was run for weeks, and only 25 people were identified as users. This method was described by the techs who deployed it as a "NIT" or "Network Investigational Tool". Now for Freedom Hosting.... The javascript exploit could not be deployed directly on the servers which Mr. Marques was using due to either technical reasons, or legal requirements by the AUSA in Maryland. So the decision was made to clone the services exactly, and transport then to the home of the FBI CEOS in the Greenbelt division of Maryland. This location was picked specifically because sentencing in this district for Child Pornography crimes is more severe. It was July 31st of 2013 when the exploit actually went live, and tried to identify criminals. It was installed previously, however, there were technical problems early on and the code had to be revised 3 times before it was running as intended, it ran for about 11 days before being shut down. The amount of people identified by this exploit is still a closely gaurded secret, with only agents having a direct "Need to know" being privy to this information. Howver, the victory dance was short lived as news started flowing around that the evidence may not be admissible in court, due to the manner in which it was collected, among other reasons. Although proper warrants were issued, it would take atleast 4-7 years to comb through the list of suspects, and question, arrest each one. The major problem is that after about 12 months, the courts start to presume your evidence is prejudicial to the defendant because you're supposed to have an indictment and serve it on the defendant within 30 days, and that just wasn't possible. You can request an extension of this time, however you must present a new, fresh reason for doing so..."We still aren't ready" doesn't cut it. There is no statue of limitations for the crime of "Accessing with intent to view child pornography" so barring any other limitations, the FBI can come after someone 10-15 years later. The AUSA became uncomfortable with the prospects of his legal case against the exploitees of FH and went to the US Attorney. There was disagreement as to whether or not the evidence would be viable, however, the operation went on anyways. One of the victims of the FH exploit was a man by the name of Grant Klein from Vermont. The Bureau had made arrangements with the local police for assistance with the raid (This is pretty much standard operation procedure, and is done for the saftey of the agents, as well as to maintain professional courtesy. Local cops get butt hurt when you arrest people on their turf without them knowing). The FBI had provided the local police with court documents and the affidavit of arrest regarding the cirsumstances of Mr. Klein's warrant, which they promptly posted onto their press release against the wishes of the FBI. This resulted in the termination of atleast one employee from local PD. He was raided and before even being asked a question ,he began spewing a confession. His home was searched, and a desktop computer with no hard disk was found, as well a laptop computer belonging to his wife Susan. There was no illegal materials found on these, however, he had a smartphone in the drawer of a nightstand which contained illegal images of minors. He was arrested and charged with 3 seperate crimes. To make a long story short, the FH related charges were dropped because the FBI had crossed a legal line by offering up child pornography de novo, by shutting down the server, then bringing it back online hosting real CP. They were uncomfortable with the prospects of this case, and were able to use a leon good faith exception to admit the evidence they found on his phone to make a single possession charge stick, however, he agreed to plead guilty. The rest of the leads which lead to foreign nationals were then distributed accordingly to the various LEA's. Also, earlier this wekk, the UK police arrested 660 people as part of Operation Notarise. The operation name of the FBI takedown in Nebraska was "Operation Torpedo" This was a cute poke at both the method they used, and the users they targeted Torpedo - Navy missile Tor Pedo - Tor Pedophile. -DT moar comments on Reddit

1 0

Huge collection of Security Data Science papers
by Eugen Leitl 21 Jul '14

21 Jul '14

(looks useful) https://pay.reddit.com/r/netsec/comments/2b8pk2/huge_collection_of_security… Over the past several years I have collected and read many security research papers/slides and have started a small catalog of sorts. The topics of these papers range from intrusion detection, anomaly detection, machine learning/data mining, Internet scale data collection, malware analysis, and intrusion/breach reports. I figured this collection might useful to others. All links lead to PDFs hosted here. I hope to clean this up (add author info, date, and publication) when I get some more time as well as adding some detailed notes I have on the various features, models, algorithms, and datasets used in many of these papers. Here are some of my favorites (nice uses of machine learning, graph analytics, and/or anomaly detection to solve interesting security problems): CAMP - Content Agnostic Malware Protection Notos - Building a Dynamic Reputation System for DNS Kopis - Detecting malware domains at the upper dns hierarchy Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis Polonium - Tera-Scale Graph Mining for Malware Detection Nazca - Detecting Malware Distribution in Large-Scale Networks PAYL - Anomalous Payload-based Network Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Here is the entire collection: Intrusion Detection A Close Look on n-Grams in Intrusion Detection- Anomaly Detection vs. Classiﬁcation A Kill Chain Analysis of the 2013 Target Data Breach A Lone Wolf No More - Supporting Network Intrusion Detection with Real-Time Intelligence A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Acquiring Digital Evidence from Botnet Attacks: Procedures and Methods (PhD Thesis) ALERT-ID - Analyze Logs of the network Element in Real Time for Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Anomaly-based Intrusion Detection in Software as a Service Back to Basics - Beyond Network Hygiene Beehive - Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces Beheading Hydras - Performing Effective Botnet Takedowns Bloodhound - Searching Out Malicious Input in Network Flows for Automatic Repair Validation Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling CAMP - Content Agnostic Malware Protection Casting out demons - Sanitizing training data for anomaly sensors CloudFence - Data Flow Tracking as a Cloud Service Comparing anomaly detection techniques for HTTP Cujo - Efficient detection and prevention of drive-by-download attacks Decoy Document Deployment for Effective Masquerade Attack Detection Detecting Spammers with SNARE - Spatio-temporal Network-level Automatic Reputation Engine Detecting Unknown Network Attacks Using Language Models Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis Effective Anomaly Detection with Scarce Training Data Efficient Multidimensional Aggregation for Large Scale Monitoring EFFORT - Efficient and Effective Bot Malware Detection ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates - slides ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis FiG - Automatic Fingerprint Generation Filtering Spam with Behavioral Blacklisting FLIPS - Hybrid Adaptive Intrusion Prevention HMMPayl - An Intrusion Detection System Based on Hidden Markov Models Kopis - Detecting malware domains at the upper dns hierarchy Large-Scale Malware Analysis, Detection, and Signature Generation Leveraging Honest Users - Stealth Command-and-Control of Botnets - slides Leveraging Honest Users - Stealth Command-and-Control of Botnets Local System Security via SSHD Instrumentation Machine Learning In Adversarial Environments Malware vs. Big Data (Umbrella Labs) McPAD - A Multiple Classifier System for Accurate Payload-based Anomaly Detection Measuring and Detecting Malware Downloads in Live Network Traffic Mining Botnet Sink Holes - slides MISHIMA - Multilateration of Internet hosts hidden using malicious fast-ﬂux agents Monitoring the Initial DNS Behavior of Malicious Domains N-Gram against the Machine - On the Feasibility of the N-Gram Network Analysis for Binary Protocols Nazca - Detecting Malware Distribution in Large-Scale Networks Netgator - Malware Detection Using Program Interactive Challenges - slides Network Traffic Characterization Using (p, n)-grams Packet Representation Notos - Building a Dynamic Reputation System for DNS On the Feasibility of Online Malware Detection with Performance Counters On the Infeasibility of Modeling Polymorphic Shellcode On the Mismanagement and Maliciousness of Networks Outside the Closed World - On Using Machine Learning For Network Intrusion Detection PAYL - Anomalous Payload-based Network Intrusion Detection PAYL2 - Anomalous Payload-based Worm Detection and Signature Generation Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware Practical Comprehensive Bounds on Surreptitious Communication Over DNS - slides Practical Comprehensive Bounds on Surreptitious Communication Over DNS Privacy-preserving Payload-based Correlation for Accurate Malicious Traffic Detection Revealing Botnet Membership Using DNSBL Counter-Intelligence Revolver - An Automated Approach to the Detection of Evasive Web-based Malware Self-organized Collaboration of Distributed IDS Sensors SinkMiner- Mining Botnet Sinkholes for Fun and Profit Spamming Botnets - Signatures and Characteristics Spectrogram - A Mixture of Markov Chain models for Anomaly Detection in Web Traffic The Security of Machine Learning Toward Stealthy Malware Detection Traffic Aggregation for Malware Detection Understanding the Domain Registration Behavior of Spammers Understanding the Network-Level Behavior of Spammers VAST- Network Visibility Across Space and Time Malware A static, packer-agnostic filter to detect similar malware samples A study of malcode-bearing documents A survey on automated dynamic malware-analysis techniques and tools APT1 Technical backstage (malware.lu hack backs of APT1 servers) Automatic Analysis of Malware Behavior using Machine Learning BitShred - Fast, Scalable Code Reuse Detection in Binary Code BitShred - Fast, Scalable Malware Triage Deobfuscating Embedded Malware using Probable-Plaintext Attacks Escape from Monkey Island - Evading High-Interaction Honeyclients Eureka - A framework for enabling static malware analysis Extraction of Statistically Significant Malware Behaviors Fast Automated Unpacking and Classification of Malware FIRMA - Malware Clustering and Network Signature Generation with Mixed Network Behaviors FuncTracker - Discovering Shared Code (to aid malware forensics) - slides FuncTracker - Discovering Shared Code to Aid Malware Forensics Extended Abstract Malware files clustering based on file geometry and visualization using R language Mobile Malware Detection Based on Energy Fingerprints — A Dead End Polonium - Tera-Scale Graph Mining for Malware Detection Putting out a HIT - Crowdsourcing Malware Installs Scalable Fine-grained Behavioral Clustering of HTTP-based Malware SigMal - A Static Signal Processing Based Malware Triage Tracking Memory Writes for Malware Classification and Code Reuse Identification Using File Relationships in Malware Classification VAMO - Towards a Fully Automated Malware Clustering Validity Analysis Data Collection Crawling BitTorrent DHTs for Fun and Proﬁt CyberProbe - Towards Internet-Scale Active Detection of Malicious Servers Demystifying service discovery - Implementing an internet-wide scanner gitDigger - Creating useful wordlists from GitHub PoisonAmplifier - A Guided Approach of Discovering Compromised Websites through Reversing Search Poisoning Attacks ZMap - Fast Internet-Wide Scanning and its Security Applications (slides) ZMap - Fast Internet-Wide Scanning and its Security Applications Vulnerability Analysis/Reversing A Preliminary Analysis of Vulnerability Scores for Attacks in Wild Attacker Economics for Internet-scale Vulnerability Risk Assessment Detecting Logic Vulnerabilities in E-Commerce Applications ReDeBug - Finding Unpatched Code Clones in Entire OS Distributions The Classification of Valuable Data in an Assumption of Breach Paradigm Toward Black-Box Detection of Logic Flaws in Web Applications Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning - slides Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning Anonymity/Privacy/OPSEC/Censorship Anonymous Hacking Group – #OpNewblood Super Secret Security Handbook Detecting Traffic Snooping in Tor Using Decoys Risks and Realization of HTTPS Traffic Analysis Selling Off Privacy at Auction The Sniper Attack - Anonymously Deanonymizing and Disabling the Tor Network The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions - slides The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions Tor vs. NSA Data Mining An Exploration of Geolocation and Traffic Visualization Using Network Flows to Aid in Cyber Defense DSpin - Detecting Automatically Spun Content on the Web Gyrus - A Framework for User-Intent Monitoring of Text-Based Networked Applications Indexing Million of Packets per Second using GPUs Multi-Label Learning with Millions of Labels - Recommending Advertiser Bid Phrases for Web Pages Real-Time Handling of Network Monitoring Data Using a Data-Intensive Framework Shingled Graph Disassembly - Finding the Undecideable Path Synoptic Graphlet - Bridging the Gap between Supervised and Unsupervised Profiling of Host-level Network Traffic Cyber Crime Connected Colors - Unveiling the Structure of Criminal Networks Image Matching for Branding Phishing Kit Images - slides Image Matching for Branding Phishing Kit Images Inside a Targeted Point-of-Sale Data Breach Investigating Advanced Persistent Threat 1 (APT1) Measuring pay-per-install - the Commoditization of Malware Distribution Scambaiter - Understanding Targeted Nigerian Scams on Craigslist Sherlock Holmes and the Case of the Advanced Persistent Threat The Role of the Underground Market in Twitter Spam and Abuse The Tangled Web of Password Reuse Trafﬁcking Fraudulent Accounts - The Role of the Underground Market in Twitter Spam and Abuse CND/CNA/CNE/CNO Ampliﬁcation Hell - Revisiting Network Protocols for DDoS Abuse Defending The Enterprise, the Russian Way Protecting a Moving Target - Addressing Web Application Concept Drift Timing of Cyber Conflict –Jason @jason_trost SECURITYDATA SCIENCERES

1 0

Fwd: request for video and transcript - Fuckhackerfucks! An Audience Bashing
by coderman 21 Jul '14

21 Jul '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Mon, Jul 21, 2014 at 2:28 AM Subject: Re: request for video and transcript - Fuckhackerfucks! An Audience Bashing To: Rich Jones <miserlou(a)gmail.com> On Sun, Jul 20, 2014 at 8:41 PM, Rich Jones <rich(a)openwatch.net> wrote: > I was kind of disappointed by it.. normally Johannes is very funny, but this > was just kind of rambling Marxist SJW stuff without much imperative or > self-awareness.. or maybe the coffee hadn't hit me yet.. i expected nothing, and enjoyed a shared frustration. best regards, "This e-postcard powered by Google Wuffie" "This e-postcard best viewed in G+"

1 0

request for video and transcript - Fuckhackerfucks! An Audience Bashing
by coderman 21 Jul '14

21 Jul '14

the stream at http://new.livestream.com/internetsociety2/hopex2 less than optimal. "Johannes of art tech group monochrom will indulge in a public rant about hacker culture and why it has to be saved from itself." and other enumerated unusefullness :) [ no telling when http://store.2600.com/videos.html will update, BTC for digital please? ] --- speaking of Fuckyouhackerfucks, http://trouble.org/?p=1013 <him> do you even know what this is? <her> a bitcoin QRcode <him> ...

4 3

Re: [Cryptography] What has Bitcoin achieved?
by grarpamp 21 Jul '14

21 Jul '14

> This is wandering away from crypto No better way to naysay BTC than to break the crypto and wash everyone out. $Billions gone, and a permanent seat in the research hall of fame ;-) (BTW, where are the BTC insurance companies...) >> announced that they will not exceed 40%. Down from 55% to 32% now... > That's not surprising. Bitcoin is a speculative asset, and at this > point the Bitcoin fans have a shared interest in keeping its price up. > The story that nobody's in charge is one of the things that makes > people want to buy it, so, well, sure. In the admittedly unlikely > event that there are enough contracts or debts denominated in Bitcoin > that there were significant non-speculative demand, things could > change. I'd agree that actual market float outstanding is thin right now. Yet different from purely propping things up, speculation is all about assessing future value and making moves accordingly today... https://ciphrex.com/archive/bofa-bitcoin.pdf http://honestnode.com/bitcoin-fair-value-a-first-assessment/ http://www.coindesk.com/bitcoin-2014-report/ http://www.coindesk.com/state-of-bitcoin-q2-2014-report-expanding-bitcoin-e… > This is what's technically known as "marketing BS". Dell accepts > dollars. They have a deal with Coinbase in which Coinbase takes the > risk of raising dollars by selling Bitcoins in return for a commission Not so fast! Yes, Dell accepts dollars (subject to whatever BTC holdback they, like Overstock, may be specifying). However obtaining those dollars is totally dependant on Coinbase's ability to convert BTC to dollars on exchange or privately. And Coinbase is surely nowhere near whole enough from commissions to be able to back their contracts against any significant outstanding float in a long price dive situation. Therefore Dell *is* in the BTC game before dollars on these sales, regardless of the denomination they're booking. So is everyone else who 'accepts' BTC. Dell and others are large companies, with well paid accountants and lawyers... it takes more than whim of 'marketing BS' for them to put a BTC sticker on their door. >>> volatility > but if > there's another collapse in the Bitcoin market The BTC market has been in a fairly steady log uptrend over the long term. The 'collapses' people speak of are, in that context, spikes returning to normal. All new markets and properties undergo price discovery. It's a continual process. Ever watch the NYSE, it's volatile too. > the distributed notary idea seems likely to be useful for something There is no 'useful for this or useful for that' concerning things riding on top of this tech... the underlying model, including the social contract aspects, either works for all uses, or for none. It's either broken or it's not. > but it's never going to replace real money. Neither will credit/debit cards. Nor is your fiat paper of choice 'real money' either, it's just called money by default. (Probably because the next default, real property, is hard to fit in your pocket.) Digital currencies will, like 'money', operate in the layer above real property. Again, here's the recycle bin for your trash, this time I'll even waive the recycling fee... ;) btc:1C96B6DszNqnX4KRzveu6BKRuznmmdFhdm > On re, replies on: Ghash.io, 50%, takeovers, self regulation... 50% is not a magical binary breakpoint, it merely permits more influence as the share moves along the scale from 50% to 100%. Right now, the $130M plus expenses (or $27M plus for ghash) that is needed to reach 50% seems to not be worth it to anyone. Who is graphing the cost-to-50%? And the cost-to-50% to market cap, volume, and quantity ratios? Those would be interesting and important graphs to watch. $130M is nothing to someone who wants to own a currency. So why hasn't it happened to BTC yet? Perhaps because the value of BTC owes a lot to its decentralization. If so, and you take that away, you're risking your own value before you start. And risking an exodus fork. Just as easy as it was to add BTC to Dell's checkout in N days time, adding another currency is easy if yours (or your takeover) fails, or customers continue to demand a decentral one. And you're not going to win a takeover anyways because no one will tolerate you blocking their transactions... no entity survives having 50, 40, 30 percent of its users in abject protest against theft, loss of value and service, and principle. Among other things, you'd be prosecuted, sued, DDoS'd off the net, badmouthed, and forked against. Probably better to start your own digital currency and put $115M into marketing and $15M into central hardware. > Also, were such a thing in the works, I wouldn't count on the > people involved publicly broadcasting their intentions on Twitter. That only applies to mining 'companies'. Mining 'pools' derive their share from the users who elect to use them. Of course a pool could become a company. And a company could uphold the social contract. The Ghash was a remarkable social contract event by both shedding users and users leaving. It's happened before, and each time it does it underscores the importance of the contract to the currency to everyone involved. In the end, if anyone succeeds in taking/making any private/centralized coin, there will be some users who follow it, and some people who reject it in favor of other decentral coin. Digital banking and transacting has been done for decades. Banks could have made ACH/Wire compellingly attractive to users and the marketplace. But they waited, and didn't, and lost the chance... just like telcos lost the internet and music lost itself. As with those things, crypto in the 90's and overlay networks today, what is really being tested with BTC along with the tech, are meta concepts such as freedom, regulation, where value is stored, law, etc. At the moment it would be quite hard to say decentral digital currency is failing or holds little long term prospect. You can fund more drunken rambling here... :) btc:1D6rPeQUETfGpSp2JB2oojJUC8GiURyhp7

2 1

Video meme hunt: hackers
by rysiek 20 Jul '14

20 Jul '14

Hi guys, if I want to introduce the anarchist approach by showing this video: http://www.youtube.com/watch?v=SGyAnXfd4Yg and the diggers' approach by showing this video: http://www.youtube.com/watch?v=3toLwGs7o-k then what short video you would recommend for introducing the hacker approach? -- Pozdr rysiek

1 0

Re: New XMPP servers
by Crypto 20 Jul '14

20 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 7/20/2014 10:20 AM, Damian Fossi wrote: > Thank you > > > On 20 July 2014 09:42, Crypto <crypto(a)jpunix.net> wrote: > > Hello Everyone! > > For those that are using secure XMPP clients (Jitsi and the like) > I'd like to announce two new Prosody servers. Both are located in > the Netherlands and are available for public use. If you would like > to try them out they are located at chat.jpunix.net and > chat.cpunk.us. Both are fully-featured. Give them a try if you're > so inclined! You're very welcome! Just to be sure, I run chat.jpunix.net. chat.cpunk.us is a sister site that is under different management. - -- Crypto -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTy/JEAAoJEDhzgt+U8WIybXMP/0jOSMr+F3NAeahDgluDNcyl /TZ4jjEpsjECCAz8ivNAh2ARo1gLcncPZ+8LsItNzHNLu9tUrubeET2hxx2OLb77 Ojzs021KV2d2x0ewIlhvJoWi5ZuPFghZ6CrjTFRNpyhwKe5a6iHkpwkJD+QEHY8T hvH9rMubdHwxK9G6RlsNTYavJ8qMj02JNpGbhEaisgeT0N4T+/QMEn2nqPC0Dczf egFZJFfU0vjRZcrT+3Xd6njBOaNzONzewEbVvdyB9TrKuVwNJK76YTEsIixl4rmA MQSSf45Zq5KHEhauO26K/2Cn7bx7CurIErfXkzpnbdf2XJWazcJMjZtnyZUMHudd zn5zjq2iwjDReRA6WZaGO2phCGXp8J4xew6aBvM+ReINff1pKkYdOuAOPRZqIWzW kql4K4z1Ye4IalioIu+I4tnPsUDd/gijpyh5hZwUPeWXfiTMcQr0wpzlXHCnyxHp waRaFI5qub9qu6GekMFuU/IEnJFfRSql0bTakszqS5oegupNLUTPbyxY3P77Wojt oRrRKkeWK2GvDBMd5mjgZ05Qgpp+lDe3JCTXpL4vfuCyC3c+RJ1ZG4sLA+potSBs wKCuMHZbE0Zi86NggQiPPKPE5GCBG3g6DVRl2yQgTNS29IlWbqfC5iT2JZHdv1x5 Qm01qb8iE9yQPe6s0YvD =Kfsq -----END PGP SIGNATURE-----

1 0

New XMPP servers
by Crypto 20 Jul '14

20 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Everyone! For those that are using secure XMPP clients (Jitsi and the like) I'd like to announce two new Prosody servers. Both are located in the Netherlands and are available for public use. If you would like to try them out they are located at chat.jpunix.net and chat.cpunk.us. Both are fully-featured. Give them a try if you're so inclined! - -- Crypto -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTy85WAAoJEDhzgt+U8WIyBAkQAK3+TXmPU6z7Pj8ZbnHBg5cB p2xLfXJuWbObrF4Dd8izbsFGcir1zJw6E/hfyNLD9gZQGhRmvvsQWP3LkWuo6spF 1r92QAumNZQP6hRjKcgvPH28sBKXg8GElW78v+vDUlggpym/UBNXqxxsA6JDXPRT LPwzuqCBayHsA0ghY2TrBy73yLURjJzaJOayd2QWBRcNtEt30NFxU0uu3jkVmsX7 ovqqmFIekNiuiecYFad2+9bH/rt5BsMz6jFZIVhVaXueb9GeQO/Qmu1IXp8yxnS4 XAHDa+5tuUbZDzYvSuwLGdIJpMUxaxnoKQiXEDTNal7cyNt3xkKHXjOIav2eElx1 VD/l4mbTbfn3k8QgtMl1fUJS8o35vHurpF7Yjw/uG/sAy1G2XRG85VoF4vKP08OX /QgZr4LXR9U1uX912Zbf6gjNXsqtOQMP3JL0oa13AzAdT3WKwPJcWOCU2feD5eDh 0uT1rzUk1sS4qfveI1cG45HKz31ayNl2pYX58VXN9F7VtR4F/xPW9FjwG80cm1yv a99OvN1M01GQqUAGh+dj+VKHmPRhux61dpVErgi6viV3Ev5Bb/JvDc7uIGoO/ZcJ 48N/sQjVsABqYFD4yTDm6GrsLeG1OaYXOlhzrwHxPTUsMEJE8BnB4Z6NAVt7PocH LsYy+G/0yoSU8zTHsRBq =7ba8 -----END PGP SIGNATURE-----

3 2

Re: [Cryptography] What has Bitcoin achieved?
by grarpamp 20 Jul '14

20 Jul '14

On Thu, Jul 17, 2014 at 4:02 PM, John Levine <johnl(a)iecc.com> wrote: >>But none of them will have the property that their currency is not >>under their control. Other than the obvious head start bitcoin has >>in the digital currency game, that is what bitcoin offers >>philosophically... freedom from control. > > I realize that's the theory, but in reality, there is a mining pool > that could easily grow to be more than half of all the miners, at > which point it could start ignoring blocks from outside the pool, > which would be to the benefit of people inside the pool. So long as > the cost of joining the pool remained small, e.g., if you join you > still get 98% of the coins you mine, this looks to me like it would be > a stable situation, no matter how much outsiders complained about how > awful it was. Thing is, having seen the possibilities, people actually *want* this freedom from central control, in a bad way, and they're willing to act to get it. They also realize that if they, and the entire community, don't act together to maintain the decentralization they have... then it's over. That's why ghash.io (the largest pool) just announced that they will not exceed 40%. Down from 55% to 32% now... http://www.coindesk.com/ghash-commits-40-hashrate-cap-bitcoin-mining-summit/ http://www.coindesk.com/bitcoin-mining-detente-ghash-io-51-issue/ http://blockchain.info/pools And why BTC isn't exactly rushing to support regulation... http://www.reddit.com/r/IAmA/comments/1ygcil/as_requested_im_ben_lawsky_sup… http://www.reddit.com/r/Bitcoin/comments/2aycxs/hi_this_is_ben_lawsky_at_ny… http://www.reddit.com/r/Bitcoin/comments/2b1jpl/dear_ben_lawsky_thank_you_f… Further, again, since people want decentral, if some large entity does manage a BTC takeover, no problem... all users ok with that will stay with the now central coin, and the free decentral people will just exchange their coin (or fork) into whatever is the current decentral coin. Repeat as needed. So far BTC has a good history of actively cooperating to avoiding central. Excepting mining companies (ie: the 10% corps, who have made similar self limiting statements), the VC money seems to stay out of the coin itself and is being placed in surrounding service ventures... exchanges, banking, processors, wallets, retail. In the end years from now, maybe only three coin will remain... - A World central - A State central - A World decentral/anon/etc With all of them being roughly similar in acceptance, volatility, etc. > There also remain long term questions about the technical viability of > Bitcoin, most notably whether people will still find it interesting > after the transaction cost rises. (If a transaction costs a dollar, > there's a lot of other options with much less price volatility.) People spend more than a dollar to post mail, or drive to the store. It will be a long time before the ASIC and electric cost to clear a transaction (at whatever network transaction demand rate) exceeds palatability, if ever. Pick a projected compute power, node count, required tx rate (at 100% utilization) and then basically figure gigawatt and gigahash dollars per tx. http://www.coinometrics.com/bitcoin/btix https://bitmaintech.com/productDetail.htm?pid=00020140704023505485N5SxDMkW0… https://medium.com/@interdome/how-much-electricity-does-bitcoin-use-c350bd8… http://organofcorti.blogspot.nl/ A guesstimate with current state and data? - Installing double current hashrate to take 50+% costs about $130M in retail hardware alone. Less for a real deployment. - About $10k/hr to power it. More for cooling, support, bandwidth. - About $0.40/tx-current spread over a year. Much less if running at 100% tx rate capacity. Up to twice more due to doubling current hashrate. Right now that amount is being covered by coin mining profit. The future taper of coin production vs then current market value of coin vs tx fees will be interesting. And ASIC platforms have yet to reach performance plateau. The base tx cost is cost of the coin algorithm to support a given required tx rate. That seems quite low. The race (difficulty) to claim the tx fee profit drives it up. Yet the hardware market is open, yielding a level playing field. So as long as the required tx rate can be met affordably within the algorithm, this is unlikely to be an issue. Cost of tx rates also naturally moderate the proportion of users amongst each payment system. It remains to be seen, once all the various BTC costs are fully optimized, if BTC can handle tx rates approaching the credit cards. Even if not, that doesn't keep it from utility at its own natural rate limit. Some seriously big players don't seem to have any problem with BTC... http://www.coindesk.com/computer-giant-dell-now-accepts-bitcoin/ > To me Bitcoin is very interesting as an experiment. It shows that > within certain parameters, the distributed proof of work model is > viable. I doubt that anyone anticipated the grotesque amount of > computing resources that people would throw at it, or that there would > be mining pools. > > The model is likely useful for applications like distributed notary, > particularly if there are several mutually suspicious groups > participating which makes it less likely that any one of them could > take over. > > It's also impressive to see the number of economically ignorant > enthusiasts who imagine there is something innovative or disruptive > about a commodity bubble, which is what Bitcoin is. Well, since BTC is nothing but experimental scrap metal, please be sure to send yours (and that of all your central fiat loving friends) off for proper recycling to my recycle bin here... btc:1C96B6DszNqnX4KRzveu6BKRuznmmdFhdm Liked or learned something from the links, etc? Tips go here, I'll buy a miner / tx processor, or do something generally useful... btc:1D6rPeQUETfGpSp2JB2oojJUC8GiURyhp7

2 1

Identifying back doors, attack points, and surveillance mechanisms in iOS devices
by coderman 20 Jul '14

20 Jul '14

doubt this will surprise anyone; iOS intentionally designed to support surveillance. --- http://www.sciencedirect.com/science/article/pii/S1742287614000036 "Identifying back doors, attack points, and surveillance mechanisms in iOS devices" by Jonathan Zdziarski Abstract The iOS operating system has long been a subject of interest among the forensics and law enforcement communities. With a large base of interest among consumers, it has become the target of many hackers and criminals alike, with many celebrity thefts (For example, the recent article “How did Scarlett Johansson's phone get hacked?”) of data raising awareness to personal privacy. Recent revelations (Privacy scandal: NSA can spy on smart phone data, 2013 and How the NSA spies on smartphones including the BlackBerry) exposed the use (or abuse) of operating system features in the surveillance of targeted individuals by the National Security Agency (NSA), of whom some subjects appear to be American citizens. This paper identifies the most probable techniques that were used, based on the descriptions provided by the media, and today's possible techniques that could be exploited in the future, based on what may be back doors, bypass switches, general weaknesses, or surveillance mechanisms intended for enterprise use in current release versions of iOS. More importantly, I will identify several services and mechanisms that can be abused by a government agency or malicious party to extract intelligence on a subject, including services that may in fact be back doors introduced by the manufacturer... '''

3 2