- cypherpunks - lists.cpunks.org

<nettime> A message from the police: IF YOU SUSPECT IT, REPORT IT
by Eugen Leitl 17 Jul '14

17 Jul '14

/s/terrist/spook ----- Forwarded message from nettime's blockwart <nettime(a)kein.org> ----- Date: Thu, 17 Jul 2014 09:59:02 +0200 From: nettime's blockwart <nettime(a)kein.org> To: nettime-l(a)mx.kein.org Subject: <nettime> A message from the police: IF YOU SUSPECT IT, REPORT IT http://www.warwickshire.police.uk/currentIssues/campaigns/suspectreport Terrorists have to live somewhere. They store their equipment and materials somewhere. They need vehicles. They have people who help them - and these people might come and go at strange times of the day and night. They may make unusual financial transactions or use false documents to hide their real identities. They may be behaving differently to how you've known them to behave in the past. If you suspect it, report it. You can also give non-urgent information that may assist police investigations online through www.online.police.uk. Van – Terrorists need transport. If you work in commercial vehicle hire or sales, has a sale or rental made you suspicious? Passport – Terrorists use multiple identities. Do you know someone with documents in different names for no obvious reason? Mobile phone – Terrorists need communication. Anonymous, pay-as-you-go and stolen mobiles are typical. Have you seen someone with large quantities of mobile phones? Has it made you suspicious? Camera – Terrorists need information. Observation and surveillance help terrorists plan attacks. Have you seen anyone taking pictures of security arrangements? Chemicals – Do you know someone buying large or unusual quantities of chemicals for no obvious reason? Mask and goggles – Terrorists use protective equipment. Handling chemicals is dangerous. Maybe you’ve seen goggles or masks dumped somewhere. Credit card – Terrorists need funding. Cheque and credit card fraud are ways terrorists generate cash. Have you seen any suspicious transactions? Computer – Terrorists use computers. Do you know someone who visits terrorist-related websites? Suitcase – Terrorists need to travel. Meetings training and planning can take place anywhere. Do you know someone who travels but is vague about where they are going? Padlock – Terrorists need storage. Lock-ups, garages and sheds can all be used by terrorists to store equipment. Are you suspicious of anyone renting a commercial property? # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message -----

5 4

Leaked GCHQ catalog of exploit tools for manipulation and mass surveillance
by Eugen Leitl 17 Jul '14

17 Jul '14

http://blogs.computerworld.com/privacy/24145/leaked-gchq-catalog-exploit-to… Leaked GCHQ catalog of exploit tools for manipulation and mass surveillance By Darlene Storm July 16, 2014 1:22 PM EDTAdd a comment Just as civil liberties groups challenge the legality of the UK intelligence agency’s mass surveillance programs, a catalog of exploit tools for monitoring and manipulation is leaked online. The Joint Threat Research Intelligence Group (JTRIG), a department within the Government Communications Headquarters (GCHQ), “develops the majority of effects capabilities” for UK’s NSA-flavored intelligence agency. First Look Media first published the Snowden-leaked Wikipedia-like document full of covert tools used by GCHQ for surveillance and propaganda. JTRIG tools and techniques help British spies “seed the internet with false information, including the ability to manipulate the results of online polls,” monitor social media posts, and launch attacks ranging from denial of service, to call bombing phones, to disabling users' accounts on PCs. Devil’s Handshake, Dirty Devil, Reaper and Poison Arrow are but a few vicious-sounding JTRIG system tools, but the naming convention for others are just inane like Bumblebee Dance, Techno Viking and Jazz Fusion. Perhaps the British spies were hungry when coming up with Fruit Bowl, Spice Island, Nut Allergy, and Berry Twister? Most of the tools are "fully operational, tested and reliable,” according to the 2012 JTRIG Manual, but "Don't treat this like a catalog. If you don't see it here, it doesn't mean we can't build it." Like the previously leaked TAO exploits, it’s an eye-opener as to exploits that GCHQ can deploy. GCHQ spy tools, techniques and exploits in JTRIG manual Some of the especially invasive tools that are “either ready to fire or very close to being ready” include: Angry Pirate can “permanently disable a target’s account on their computer.” Stealth Moose can “disrupt” a target’s “Windows machine. Logs of how long and when the effect is active.” Sunblock can “deny functionality to send/receive email or view material online.” Swamp Donkey “silently” finds and encrypts all predefined types of files on a target’s machine. Tracer Fire is an “Office document that grabs the targets machine info, files, logs, etc and posts it back to GCHQ.” Gurkhas Sword is a tool for “beaconed Microsoft Office documents to elicit a targets IP address.” Tornado Alley is a delivery system aimed at Microsoft Excel "to silently extract and run an executable on a target's machine." Changeling provides UK spies with the “ability to spoof any email address and send email under that identity.” Glassback gets a target’s IP by “pretending to be a spammer and ringing them. Target does not need to answer.” Denial of Service: Rolling Thunder uses P2P for distributed denial of service. Predators Face is used for “targeted denial of service against web servers.” Silent Movie provides “targeted denial of service against SSH services.” Other JTRIG exploits include Screaming Eagle, “a tool that processes Kismet data into geolocation information” and Chinese Firecracker for “overt brute login attempts against online forums.” Hacienda is a “port scanning tool designed to scan an entire country or city” before identifying IP locations and adding them to an “Earthling database.” Messing with cellphones: Burlesque can “send spoofed SMS text messages.” Cannonball can “send repeated text messages to a single target.” Concrete Donkey can “scatter an audio message to a large number of telephones, or repeatedly bomb a target number with the same message.” Deer Stalker provides a way to silently call a satellite and GSM phone “to aid geolocation.” Imperial Barge can connect two target phones together in a call. Mustang “provides covert access to the locations of GSM cell towers.” Scarlet emperor is used for denial of service against targets’ phones via call bombing. Scrapheap Challenge provides “perfect spoofing of emails from BlackBerry targets.” Top Hat is “a version of Mustang and Dancing Bear techniques that allows us to pull back cell tower and Wi-Fi locations targeted against particular areas.” Vipers Tongue is another denial of service tool but it’s aimed at satellite or GSM phone calls. Manipulation and propaganda Bomb Bay can “increase website hits/rankings.” Gateway can “artificially increase traffic to a website;” Slipstream can “inflate page views on websites.” Underpass “can change the outcome of online polls.” Badger can mass deliver email messages “to support an Information Operations campaign.” Gestator can amplify a “given message, normally video, on popular multimedia websites” like YouTube. The “production and dissemination of multimedia via the web in the course of information operations” can be accomplished with Skyscraper. There are also various tools to censor or report “extremist” content. Online surveillance of social networks Godfather collects public data from Facebook. While Spring Bishop finds private photos of targets on Facebook, Reservoir allows the collection of various Facebook information. Clean Sweep can “masquerade Facebook wall posts for individuals or entire countries.” Birdstrike monitors and collects Twitter profiles. Dragon’s Snout collects Paltalk group chats. Airwolf collects YouTube videos, comments and profiles. Bugsy collects users’ info off Google+. Fatyak is about collecting data from LinkedIn. Goodfella is a “generic framework to collect public data from online social networks.” Elate monitors a target's use of UK's eBay. Mouth finds, collects and downloads a user’s files from achive.org. Photon Torpedo can “actively grab the IP address of an MSN messenger user.” Pitbull is aimed at large scale delivery of tailored messages to IM services. Miniature Hero is about exploiting Skype. The description states, “Active Skype capability. Provision of real time call records (SkypeOut and SkypetoSkype) and bidirectional instant messaging. Also contact lists.” If that’s not enough mass-scale surveillance and manipulation to irk you, there are more weaponized tricks and techniques in the JTRIG Manual.

1 0

the NSA revelations all in one chart
by Eugen Leitl 17 Jul '14

17 Jul '14

http://projects.propublica.org/nsa-grid/ The NSA Revelations All in One Chart This is a plot of the NSA programs revealed in the past year according to whether they are bulk or targeted, and whether the targets of surveillance are foreign or domestic. Most of the programs fall squarely into the agency’s stated mission of foreign surveillance, but some – particularly those that are both domestic and broad-sweeping – are more controversial. Just as with the New York Magazine approval matrix that served as our inspiration, the placement of each program is based on judgments and is approximate. For more details, read our FAQ or listen to our podcast. Also, take our quiz to test your NSA knowledge.

1 0

BadBIOS forensics
by Bluelotus 17 Jul '14

17 Jul '14

I am donating BadBIOS infected laptops, flashdrives, tampered live fedora CD, infected personal files (plain text files, MP3, PDF, jpg, tiff, doc), infected external DVD writer, etc. to any one interested in conducting forensics. I wrote threads on my limited ability to perform forensics in /r/badBIOS subreddit of reddit.com. My other threads are in other subreddits. Look at my submit history. My laptops were indicted, infected and implanted.

3 3

Mathematicians discuss severing ties to the NSA
by Tom 17 Jul '14

17 Jul '14

FYI: http://www.ams.org/notices/201406/rnoti-p623.pdf -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Re: [Cryptography] What has Bitcoin achieved?
by grarpamp 17 Jul '14

17 Jul '14

On Wed, Jul 16, 2014 at 6:41 PM, <dan(a)geer.org> wrote: > http://www.cnbc.com/id/101841875 > Breyer also predicted big things for digital currencies. > > He said the leader in the field may not end up being bitcoin, which > is the most prominent name now but has faced price volatility, theft > and scandal over the past year. Other providers will emerge. > > "I have zero doubt in the next five to seven years that we will see > at least half a dozen multibillion dollar digital currency companies," > he said. All currencies and property exhibit volatility, scandal and theft. It is a laugh to suggest otherwise, especially for anything 'new'. And of course there will be new digital currency 'companies'. Let's just call them what they will be, large central banks and govt's. But none of them will have the property that their currency is not under their control. Other than the obivous head start bitcoin has in the digital currency game, that is what bitcoin offers philosophically... freedom from control. No company can or will offer that with their currency. And people are choosing freedom to the tune of roughly $100M moved per day [1] when they could just as easily use the current centralized digital currencies of CC/ACH/wire. If bitcoin itself ends up not scaling well enough, or being anonymous enough, or resistant enough to centralization... another decentral digital currency will do better and take its place. The only real question is, will a decentralized currency such as bitcoin beat the centralizers in the race to global adoption by the masses? And similarly to reach point of no return adoption before centralizers realize it's too late to say no? You really don't want to let big central things emerge (here $trillion-dollar corps), bad things always happen with that. [1] http://bitcoincharts.com/bitcoin/ http://blockchain.info/charts http://www.coindesk.com/

1 0

Keybase.io
by Scott Blaydes 17 Jul '14

17 Jul '14

I know Keybase.io is old news, but I still have a couple of invites if anyone in interested. Bonus if your request is encrypted. Thank you, Scott Blaydes ========================\ /---------------------------------------------------------- scott(a)sbce.org \ / *BSD/Linux Advocate crypto user GPG 096EECF0D8A2381E \/ Society for Better Computing Ethics gpg key on keyserver / \ http://sbce.org/ -------------------------------------------/ \==================================

1 0

Re: [Cryptography] Security clearances and FOSS encryption?
by Eugen Leitl 16 Jul '14

16 Jul '14

----- Forwarded message from Phillip Hallam-Baker <phill(a)hallambaker.com> ----- Date: Tue, 15 Jul 2014 14:00:21 -0400 From: Phillip Hallam-Baker <phill(a)hallambaker.com> To: "Rick Smith, Cryptosmith" <me(a)cys.me> Cc: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] Security clearances and FOSS encryption? Message-ID: <CAMm+LwiUT1cEt2gAfKXaqK27a8yD6A+sd1+j_7u+hyJoSh3CTg(a)mail.gmail.com> On Tue, Jul 15, 2014 at 12:14 PM, Rick Smith, Cryptosmith <me(a)cys.me> wrote: > I think our discussion is getting a little muddy: some authors are using > "security clearance" when they really mean "employment" by a government > agency (directly or as a contractor, including military and intel > organizations). > > The security clearance is a side-effect of one's employment. > > And let me remind everyone, again, that you don't need a clearance or any > public form of government employment in order to be a spy, confidential > informant, or agent provocateur. Exactly, the people to worry about are the people who don't declare their affiliations and/or clearances. And that is why what the NSA did with the Bullrun program is such a problem. How would a government spy be likely to behave? One possibility is that they would be a very visible and prominent technical contributor leading a major working group working for a company like BBN or Van Dyke or SAIC or one of the other beltway contractors that is likely a wholly owned subsidiary of the CIA/NSA from the days that they had to conceal the funding sources to the black budget. But another possibility is that they would be a less technical, non technical type who was always willing to do work like write up reports or drafts or chair a working group and you would wonder how they managed to do so much without an apparent source of funds. In other words an NSA plant looking to derail a project is going to look just like the 10% of IETF members who do 80% of the actual technical work. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

1 0

The next gen P2P secure email solution ["meta" data]
by grarpamp 16 Jul '14

16 Jul '14

On Tue, Jul 15, 2014 at 5:03 PM, John Denker <jsd(a)av8n.com> wrote: > http://www.metzdowd.com/pipermail/cryptography/2014-July/022150.html > It seems to me that the binary distinction between "metadata" and > other data is a crock. As a glaring example of the problem, common > protocols for encrypted email encrypt only the main body of the > message, leaving /all/ the headers unencrypted. This is a serious > security breach, as discussed below [*]. > > We can do better than this. We need to do better than this. > > At first glance, one might think that "data is data" and we should > not distinguish "metadata" from other data, but actually I wish to > go in the other direction, and distinguish /more/ classes of data. > ... > Let's be clear: A great deal of the stuff that appears in RFC822 > headers is not needed for delivery of the message, and MUST NOT > be sent in the clear. > ... > To say the same thing another way: Assume the law of the jungle. > The only privacy rights you have are the ones you can enforce on > your own, using the strength of your cryptography. Well, when you give up those rights by still disclosing your source IP and trusting your 'destination organization' [aka provider] with address info regarding you and who you're mailing... it's not much of a solution. Put in as many classes as you want... besides the body of the message which you control, you can't fix centralized Email. Here's another class of provider and browser based non solutions... https://cpunks.org/pipermail/cypherpunks/2014-July/004894.html There's a thread of this subject ongoing that acknowledges Email can't really be fixed against the issues of the day... and discusses other possible messaging designs towards a next gen solution... https://cpunks.org/pipermail/cypherpunks/2013-December/002638.html https://cpunks.org/pipermail/cypherpunks/2014-July/004900.html The goal is likely one or both of these over an anonymous P2P network... o direct delivery to your recipients online node. o stored delivery to same (push or pull, only exposes destination). More interesting than wasting time on futility of old Email.

1 0

The ultimate goal of the NSA is total population control
by Eugen Leitl 15 Jul '14

15 Jul '14

http://www.theguardian.com/commentisfree/2014/jul/11/the-ultimate-goal-of-t… The ultimate goal of the NSA is total population control At least 80% of all audio calls, not just metadata, are recorded and stored in the US, says whistleblower William Binney – that's a 'totalitarian mentality' Antony Loewenstein theguardian.com, Friday 11 July 2014 00.54 BST William Binney testifies before a German inquiry into surveillance. Photograph: Getty Images William Binney is one of the highest-level whistleblowers to ever emerge from the NSA. He was a leading code-breaker against the Soviet Union during the Cold War but resigned soon after September 11, disgusted by Washington’s move towards mass surveillance. On 5 July he spoke at a conference in London organised by the Centre for Investigative Journalism and revealed the extent of the surveillance programs unleashed by the Bush and Obama administrations. “At least 80% of fibre-optic cables globally go via the US”, Binney said. “This is no accident and allows the US to view all communication coming in. At least 80% of all audio calls, not just metadata, are recorded and stored in the US. The NSA lies about what it stores.” The NSA will soon be able to collect 966 exabytes a year, the total of internet traffic annually. Former Google head Eric Schmidt once argued that the entire amount of knowledge from the beginning of humankind until 2003 amount to only five exabytes. Binney, who featured in a 2012 short film by Oscar-nominated US film-maker Laura Poitras, described a future where surveillance is ubiquitous and government intrusion unlimited. “The ultimate goal of the NSA is total population control”, Binney said, “but I’m a little optimistic with some recent Supreme Court decisions, such as law enforcement mostly now needing a warrant before searching a smartphone.” He praised the revelations and bravery of former NSA contractor Edward Snowden and told me that he had indirect contact with a number of other NSA employees who felt disgusted with the agency’s work. They’re keen to speak out but fear retribution and exile, not unlike Snowden himself, who is likely to remain there for some time. Unlike Snowden, Binney didn’t take any documents with him when he left the NSA. He now says that hard evidence of illegal spying would have been invaluable. The latest Snowden leaks, featured in the Washington Post, detail private conversations of average Americans with no connection to extremism. It shows that the NSA is not just pursuing terrorism, as it claims, but ordinary citizens going about their daily communications. “The NSA is mass-collecting on everyone”, Binney said, “and it’s said to be about terrorism but inside the US it has stopped zero attacks.” The lack of official oversight is one of Binney’s key concerns, particularly of the secret Foreign Intelligence Surveillance Court (Fisa), which is held out by NSA defenders as a sign of the surveillance scheme's constitutionality. “The Fisa court has only the government’s point of view”, he argued. “There are no other views for the judges to consider. There have been at least 15-20 trillion constitutional violations for US domestic audiences and you can double that globally.” A Fisa court in 2010 allowed the NSA to spy on 193 countries around the world, plus the World Bank, though there’s evidence that even the nations the US isn’t supposed to monitor – Five Eyes allies Britain, Canada, Australia and New Zealand – aren’t immune from being spied on. It’s why encryption is today so essential to transmit information safely. Binney recently told the German NSA inquiry committee that his former employer had a “totalitarian mentality” that was the "greatest threat" to US society since that country’s US Civil War in the 19th century. Despite this remarkable power, Binney still mocked the NSA’s failures, including missing this year’s Russian intervention in Ukraine and the Islamic State’s take-over of Iraq. The era of mass surveillance has gone from the fringes of public debate to the mainstream, where it belongs. The Pew Research Centre released a report this month, Digital Life in 2025, that predicted worsening state control and censorship, reduced public trust, and increased commercialisation of every aspect of web culture. It’s not just internet experts warning about the internet’s colonisation by state and corporate power. One of Europe’s leading web creators, Lena Thiele, presented her stunning series Netwars in London on the threat of cyber warfare. She showed how easy it is for governments and corporations to capture our personal information without us even realising. Thiele said that the US budget for cyber security was US$67 billion in 2013 and will double by 2016. Much of this money is wasted and doesn't protect online infrastructure. This fact doesn’t worry the multinationals making a killing from the gross exaggeration of fear that permeates the public domain. Wikileaks understands this reality better than most. Founder Julian Assange and investigative editor Sarah Harrison both remain in legal limbo. I spent time with Assange in his current home at the Ecuadorian embassy in London last week, where he continues to work, release leaks, and fight various legal battles. He hopes to resolve his predicament soon. At the Centre for Investigative Journalism conference, Harrison stressed the importance of journalists who work with technologists to best report the NSA stories. “It’s no accident”, she said, “that some of the best stories on the NSA are in Germany, where there’s technical assistance from people like Jacob Appelbaum.” A core Wikileaks belief, she stressed, is releasing all documents in their entirety, something the group criticised the news site The Intercept for not doing on a recent story. “The full archive should always be published”, Harrison said. With 8m documents on its website after years of leaking, the importance of publishing and maintaining source documents for the media, general public and court cases can’t be under-estimated. “I see Wikileaks as a library”, Assange said. “We’re the librarians who can’t say no.” With evidence that there could be a second NSA leaker, the time for more aggressive reporting is now. As Binney said: “I call people who are covering up NSA crimes traitors”.

3 2