- cypherpunks - lists.cpunks.org

Lessons from Silk Road: don't host your virtual illegal drug bazaar in Iceland
by Eugen Leitl 15 Oct '13

15 Oct '13

http://www.theverge.com/2013/10/14/4836994/dont-host-your-virtual-illegal-d… Lessons from Silk Road: don't host your virtual illegal drug bazaar in Iceland By Adrianne Jeffries on October 14, 2013 11:47 am Email When it comes to protecting your virtual black market from the Federal Bureau of Investigation (FBI), some countries are better than others. As it turns out, Iceland is probably not where you want to be. While the country may have protected WikiLeaks from the Americans, it's not harboring the recently busted illegal drug bazaar Silk Road. The Reykjavik Metropolitan Police have confirmed that they handed over data on the Silk Road at the request of American authorities. It's unclear how much information Iceland turned over, but the FBI claims two Silk Road servers were based there. Icelandic police say the site was actually hosted there. Since Iceland does not have a formal Mutual Legal Assistance Treaty (MLAT) with the US, it appears that the FBI negotiated a special one-time agreement in order to get the data. It still looks like the bulk of the information that broke open the case did not come from Iceland, however. The complaint says "an image of the Silk Road Web Server was made on or about July 23rd, 2013, and produced thereafter to the FBI" as a result of a request made to a foreign country under a formal MLAT. "AN IMAGE OF THE SILK ROAD WEB SERVER WAS MADE ON OR ABOUT JULY 23RD, 2013." That image, or bit-for-bit copy, of the Silk Road server gave authorities access to private messages between the Silk Road's owner and other members of the site. It was instrumental in seizing the site and arresting Ross Ulbricht, the man police allege was behind the Silk Road. Runa Sandvik, who works on the anonymizing network Tor, has been trying to figure out which country handed over that server image. She initially ruled out Iceland because it does not have an MLAT with the US. Various Silk Road content was also hosted in the US, Latvia, and Malaysia. Latvia and Malaysia are both MLAT signatories. If the request was indeed made under an MLAT, it looks like the image either came from one of those countries or another that has not been revealed yet by the FBI. Another possibility is that the FBI's complaint erroneously claimed the request was made under an MLAT, when the reality was less formal. Either way, future virtual drug kingpins now know that Iceland is no safe haven. Correction: An earlier version of this story said that Malaysia is not an MLAT signatory; that is incorrect. Malaysia and the US signed an MLAT in 2009.

1 0

[RISKS] Risks Digest 27.53
by RISKS List Owner 15 Oct '13

15 Oct '13

RISKS-LIST: Risks-Forum Digest Tuesday 15 October 2013 Volume 27 : Issue 53 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/27.53.html> The current issue can be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Azerbaijan releases election results -- before the election started (PGN) Computer Failure Cuts off Access to Food Benefits (PGN) Another botched Black Tuesday for MS (Woody Leonhard via Gene Wirchenko) D-Link SOHO Routers reported to contain backdoor (Bob Gezelter) Russian government's political comment trolling operation exposed (Lauren Weinstein) EFF Resigns from Global Network Initiative (EFF) Re: "Let's build a more secure Internet" (Peter Houppermans, Bob Frankston, Fred Cohen) Re: Why the NSA's attacks on the Internet must be made public (Fred Cohen) Re: NSA data center 'meltdowns' force year-long delay (Paul Saffo) Correction re: Cyber Schools Fleece Taxpayers (Gene Wirchenko) Re: Our Founding Fathers ... (Thor Lancelot Simon) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Wed, 9 Oct 2013 22:39:07 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Azerbaijan releases election results -- before the election started http://www.washingtonpost.com/blogs/worldviews/wp/2013/10/09/oops-azerbaija… Azerbaijan's big presidential election, held on Wednesday, was anticipated to be neither free nor fair. President Ilham Aliyev, who took over from his father 10 years ago, has stepped up intimidation of activists and journalists. Rights groups are complaining about free speech restrictions and one-sided state media coverage. The BBC's headline for its story on the election reads `The Pre-Determined President'. <http://www.bbc.co.uk/news/world-europe-24450227> So expectations were pretty low. Even still, one expects a certain ritual in these sorts of authoritarian elections, a fealty to at least the appearance of democracy, if not democracy itself. So it was a bit awkward when Azerbaijan's election authorities released vote results -- a full day before voting had even started. <http://www.eurasianet.org/node/67607?utm_source=dlvr.it&utm_medium=twitter> The vote counts -- spoiler alert: Aliyev was shown as winning by a landslide -- were pushed out on an official smartphone app run by the Central Election Commission. It showed Aliyev as "winning" with 72.76 percent of the vote. That's on track with his official vote counts in previous elections: he won ("won"?) 76.84 percent of the vote in 2003 and 87 percent in 2008. [...] [PGN-ed. The rest of this story is interesting as well. [Also noted by Dan Swinehart, who said, ``This is a variant on the punch line to a joke that I've told for decades. Reality trumps fiction again.'' http://politics.slashdot.org/story/13/10/10/0043217/azerbaijan-election-res… PGN] ------------------------------ Date: Mon, 14 Oct 2013 16:26:37 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Computer Failure Cuts off Access to Food Benefits AP item in *The New York Times*, PGN-ed, 13 Oct 2013: People in 17 states (including NJ and CA) were unable to use their food stamp debit cards for several hours on 12 Oct 2013, because a routine test of backup systems by Xerox failed. (Yes, RISKS readers know nothing is always "routine".) ------------------------------ Date: Thu, 10 Oct 2013 11:30:10 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: Another botched Black Tuesday for MS (Woody Leonhard) Woody Leonhard, InfoWorld, 10 Oct 2013 Another botched Black Tuesday: KB 2878890 patch brings back two-year-old KB 951847 -- repeatedly Microsoft's four-month body count: 23 bad patches. It's past time for Microsoft to improve the quality of its Automatic Updates http://www.infoworld.com/t/microsoft-windows/another-botched-black-tuesday-… [It's a (Bach -> Batch -> BOTCH) FUGUE, which recapitulates the same themes repeatedly, although sometimes in a slightly different form. PGN] ------------------------------ Date: Mon, 14 Oct 2013 03:48:44 -0700 From: "Bob Gezelter" <gezelter(a)rlgsc.com> Subject: D-Link SOHO Routers reported to contain backdoor Apparently, D-Link SOHO routers sold under their own and some private labels have been reported to contain a "backdoor" which can allow anyone Administrator without the device password. This "feature" is implemented by the codebase using a pre-defined username, which does not need a password. Users are cautioned to act appropriately. When will firm's learn that backdoors are generically dangerous and should not be created? The original article is at: http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/ Bob Gezelter, http://www.rlgsc.com ------------------------------ Date: Thu, 10 Oct 2013 09:12:27 -0700 From: Lauren Weinstein <lauren(a)vortex.com> Subject: Russian government's political comment trolling operation exposed http://j.mp/GI5Ro3 (*St. Petersburg Times* via NNSquad) "Local reporters have infiltrated a covert organization that hired young people as "Internet operators" near St. Petersburg and discovered that the employees are being paid to write pro-Kremlin postings and comments on the Internet, smearing opposition leader Alexei Navalny and U.S. politics and culture." ------------------------------ Date: Thursday, October 10, 2013 From: *EFF Press* Subject: EFF Resigns from Global Network Initiative Citing Concerns Over NSA's Impact on Corporate Members, EFF Leaves Industry Group San Francisco - The Electronic Frontier Foundation (EFF) today withdrew from the Global Network Initiative (GNI), citing a fundamental breakdown in confidence that the group's corporate members are able to speak freely about their own internal privacy and security systems in the wake of the National Security Agency (NSA) surveillance revelations. EFF has been a civil society member of the multi-stakeholder human rights group since GNI was founded in 2008 to advance freedom of expression and privacy in the global information and communication technologies sector. While much has been accomplished in these five years, EFF can no longer sign its name on joint statements knowing now that GNI's corporate members have been blocked from sharing crucial information about how the US government has meddled with these companies' security practices through programs such as PRISM and BULLRUN. "We know that many within the industry do not like or approve of such government interference, and GNI has, in statements, made it clear that member companies want permission from the US government to engage in greater transparency," EFF's International Director Danny O'Brien and Director for International Freedom of Expression Jillian C. York write in a letter to GNI leadership. "However, until serious reforms of the US surveillance programs are in place, we no longer feel comfortable participating in the GNI process when we are not privy to the serious compromises GNI corporate members may be forced to make. Nor do we currently believe that audits of corporate practice, no matter how independent, will uncover the insecurities produced by the US government's--and potentially other governments'--behavior when operating clandestinely in the name of national security." EFF's involvement with GNI included helping to define its founding principles over two years of negotiations; coordinating opposition to the United Kingdom's Communications Data Bill in 2011; releasing a paper addressing free-speech issues surrounding account deactivation and content removal; and collaborating with fellow members in internal international technical and policy analysis. However, EFF can no longer stand behind the credibility of what had been one of GNI's most significant achievements--third-party privacy and freedom of expression assessments of service providers, including Google, Microsoft and Yahoo. Moving forward, EFF plans to continue to provide guidance to the GNI and engage companies directly, but as an external organization. EFF supports the other organizations and individuals that continue to work within the GNI for the free speech and privacy rights of users worldwide. "Although EFF is taking a step back, GNI can still serve an important role as a collaborative project between human rights groups, companies, investors and academics," York said. "If the United States government truly supports international 'Internet freedom,' it would recognize the damage its policies are doing to weaken such efforts and the world's confidence in American companies." For the text of the letter: https://www.eff.org/document/gni-resignation-letter-0 For this release: https://www.eff.org/press/releases/eff-resigns-global-network-initiative About EFF The Electronic Frontier Foundation is the leading organization protecting civil liberties in the digital world. Founded in 1990, we defend free speech online, fight illegal surveillance, promote the rights of digital innovators, and work to ensure that the rights and freedoms we enjoy are enhanced, rather than eroded, as our use of technology grows. EFF is a member-supported organization. Find out more at https://www.eff.org. Electronic Frontier Foundation Media Release For Immediate Release: Thursday, October 10, 2013 Jillian C. York Director for International Freedom of Expression Electronic Frontier Foundation jillian(a)eff.org <javascript:;> +1 415 436-9333 x118 ------------------------------ Date: Thu, 10 Oct 2013 09:39:37 +0200 From: Peter Houppermans <peter(a)houppermans.net> Subject: Re: "Let's build a more secure Internet" (Dourado, RISKS-27.52) With all due respect to the respective people involved, in my opinion you have the problem backwards. By attempting to create a trustworthy Internet, you are ignoring the fact that practically any platform carrying data over the Internet only survives by exactly NOT doing that. The nice thing about not trusting the network layer is that it then becomes irrelevant what the carrier is: a comfy "hard shell, soft centre" insider threat corporate LAN, or a shaky "I have only 1 bar and my battery is dying" EDGE connection somewhere out in the field. Well, irrelevant from a security perspective :). Only when we ensure that everything that travels over the Internet has at least a basic level of security attached can we progress, and there is much to fix. Why do websites still default to FTP uploads? Why is encrypted SMTP not the default for inter-party email exchange? You improve security by adjusting the equation effort & risk vs. reward, and use tools you control yourself: content, framing and encryption. What is out of your control is by default untrusted, and doing it right also means that it's no longer worth doing the lower level intercept. Finally, in context I appreciate the irony of sending that submission from a Google account :) ------------------------------ Date: Thursday, October 10, 2013 From: *Bob Frankston* Subject: Re: Let's Build a More Secure Internet (Dourado, RISKS-27.51) [via Dave Farber's IP distribution. PGN] This assumes that the Internet is a layer on top of a physical infrastructure -- a notion which misses the revolutionary idea of the Internet. The Internet is not the switches. It is a way we use the physical infrastructure as a resource rather than a dependency. For that matter the very wording assumes there is an Internet that is apart from everything else when many of the issues are in the practices both in the way we exchange bits and the service we create using connectivity. As long as we require that operators and service providers make a profit we force the creation of the meta data that can then be used to analyze our usage of the network. If we have funding model that doesn't require every wire be a profit center than we wouldn't need to disclose (as much) metadata and the network operators wouldn't obliged to monetize it. There is a risk in seeking the social and business problems in technology rather than in understanding. ------------------------------ Date: Mon, 14 Oct 2013 06:44:50 -0700 From: Fred Cohen <fc(a)all.net> Subject: Let's Build a More Secure Internet - hardly... (Re: RISKS-27.51) > Eli Dourado, *The New York Times*, 8 Oct 2013 > Can we ever trust the Internet again? As usual, the press gets it wrong soup to nuts. Starting with the premise that the Internet was ever worthy of trust in the first place, which leads to the question - trust for what? If you trusted the Internet for integrity, confidentiality, availability, use control, or accountability, you were making a mistake, and this is nothing new. I refer you to the series of articles I wrote in the mid-1990s called Internet Holes and the continuation of that series through the present day (http://all.net/Analyst/index.html) Not that the problems began then... > In the wake of the disclosures about the National Security Agency's > surveillance programs, considerable attention has been focused on the > agency's collaboration with companies like Microsoft, Apple and Google, > which according to leaked documents appear to have programmed "back door" > encryption weaknesses into popular consumer products and services like > Hotmail, iPhones and Android phones. The difference being that they used legal process or money to get willing cooperation? Does anybody really believe that this wasn't being done earlier by planted insiders? And why worry about the NSA when they are only one of more than 100 countries likely undertaking the same sort of thing (many known to be doing so) since the beginning of the Internet. > But while such vulnerabilities are worrisome, equally important - and > because of their technical nature, far less widely understood - are the > weaknesses that the N.S.A. seems to have built into the very > infrastructure of the Internet. We didn't need them to build weaknesses in. The commercial companies are perfectly capable of doing it intentionally and by accident. Weaknesses were always there. In terms of understanding, while I believe the press widely ignored these issues for much of the last 30+ years, the information protection field has been pointing them out since the technology was put into use. > The concern is that even if consumer software companies like Microsoft and > telecommunications companies like AT&T and Verizon stop cooperating with > the N.S.A., your online security will remain compromised as long as the > agency can still take advantage of weaknesses in the Internet itself. As they always have and always likely will. > Fortunately, there is something we can do: encourage the development of an > "open hardware" movement - an extension of the open-source movement that > has led to software products like the Mozilla browser and the Linux > operating system. Open software has nothing on closed software in terms of protection, In fact, arguably, closed source has produced fewer vulnerabilities per line of code over time than open source. I say "arguably" because, as a field, we have few and poorly collected metrics of such things. But those metrics seem to indicate that open source is not more secure as a rule. > The open-source movement champions an approach to product development in > which there is universal access to a blueprint, as well as universal ability > to modify and redistribute the blueprint. Wikipedia is perhaps the > best-known example of a product inspired by the movement. Open-source > advocates typically emphasize two kinds of freedom that their products > afford: they are available free of charge, and they can be used and > manipulated free of restrictions. Open source is not the same as free, not the same as anybody can (legally) modify it, or any such thing. It just means you can see the "blueprint". > But there is a third kind of freedom inherent in open-source systems: the > freedom to audit. With open-source software, independent security experts > can scrutinize the code for vulnerabilities - whether accidentally or > intentionally introduced. The more auditing by the programming masses, the > better the security. As the open-source software advocate Eric S. Raymond > has put it, "given enough eyeballs, all bugs are shallow." This is a fallacy. It is simply not true that more eyes makes better security or that "all bugs are shallow" as a side effect. Experiments have historically shown that even if we point out the location of an intentional Trojan horse to within a few hundred lines of code, experts don;t find it. And automated software doesn't even look for the sorts of intentional subversion that is used in many Trojan horses. > Perhaps the greatest open-source success story is the Internet itself - at > least its "soft" parts. The Internet's communications protocols and the > software that implements them are collaboratively engineered by loose > networks of programmers working outside the control of any single person, > company or government. The Internet Engineering Task Force, which develops > core Internet protocols, does not even have formal membership and seeks > contributions from developers all over the world. And the Internet is full of holes. It is the best example of how open source does not provide protection. And its success is largely because it (the process) doesn't seek to provide protection. The Internet is designed for functionality - widespread, general, rapidly deployed, easily developed, flexible, changeable, etc. functionality. As such, it is designed to support rapid change, not stability. It is designed to be redundant, recoverable, etc. NOT private, unalterable, etc. "Security" is afforded by this approach, but not secrecy, integrity, use control, or accountability. Availability is somewhat questionable. The security provided is the ability to change, learn, adapt, create, do your own thing, etc. > But the problem is that the physical layer of the Internet's infrastructure > - the hardware that transmits, directs and relays traffic online, as well as > its closely knit software (or "firmware") - is not open-source. It is made > by commercial computing companies like Cisco, Hewlett-Packard and Juniper > Networks according to proprietary designs, and then sold to governments, > universities, private companies and anyone else who wants to set up a > network. Making it "open source" will not help the situation. It will likely reveal far more vulnerabilities, but not fix them, and not reveal the tricky ones. But it will certainly cause these companies financial problems as their technical advantages over competitors will collapse, and their investment in new technology be reduced, thus reducing innovation and rate of progress. > There is reason to be skeptical about the security of these networking > products. The hardware firms that make them often compete for contracts > with the United States military and presumably face considerable pressure > to maintain good relations with the government. It stands to reason that > such pressure might lead companies to collaborate with the government on > surveillance-related requests. And those made in China have Chinese Trojan horses. > Because these hardware designs are closed to public scrutiny, it is > relatively easy for surveillance at the Internet's infrastructural level > to go undetected. To make the Internet less susceptible to mass > surveillance, we need to recreate the physical layer of its infrastructure > on the basis of open-source principles. This won't work. It will just make it more expensive to run the government surveillance programs, costing the taxpayers more money and forcing the NSA back into the darker corners. > At the moment, the open hardware movement is limited mostly to hobbyists - > engineers who use the Internet to collaboratively build "open" devices > like the RepRap 3D printer. Which uses what open source processor chips? None! They all depend on proprietary chips. > But the Internet community, through a concerted effort like the one that > currently sustains the Internet's software architecture, could also > develop open-source, Internet-grade hardware. Governments like Brazil's > that have forsworn further involvement with American Internet companies > could adopt such nonproprietary equipment designs and have them > manufactured locally, free from any N.S.A. interference. As if this would free them. It won't. > The result would be Internet infrastructure, both hardware and software, > that was 100 percent open and auditable. Again, a fantasy. Even if realized, it would not accomplish the stated goal. The "open source" version of the Internet would not be an improvement. It is already largely open source, and has all of the problems that the Information age portends. It is an inherent property of the information age that in order to have effective protection, we need to restrain ourselves from doing the wrong thing in high volume and an effective government has to restrain itself or be restrained by its people. But this is nothing new. Perhaps we need well armed Internet militias. Draft of the Xth amendment: A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Internet Arms, shall not be infringed. Fred Cohen - 925-454-0171 - All.Net & Affiliated Companies http://all.net/ PO Box 811 Pebble Beach, CA 93953 ------------------------------ Date: Mon, 14 Oct 2013 07:01:57 -0700 From: Fred Cohen <fc(a)all.net> Subject: Re: Why the NSA's attacks on the Internet must be made public (Schneier, RISKS-27.51) > Among IT security professionals, it has been long understood that the > public disclosure of vulnerabilities is the only consistent way to improve > security. That's why researchers publish information about vulnerabilities > in computer software and operating systems, cryptographic algorithms, and > consumer products like implantable medical devices, cars, and CCTV > cameras. This is a fallacy. There is no substantial science behind the asserted claim (that disclosure improves protection) and no statistics behind the actual claim (that IT security professionals have long understood that or even agree to the asserted claim). The rest of the article repeats this mistake. It asserts cause and effect without a substantial basis. > It's folly to believe that any NSA hacking technique will remain secret > for very long. Really! You may rest assured that they have plenty of methods that, while published long ago in some form, remain largely a secret to anyone who is affected by them. That's because, as a community, we don't bother to review the literature before proclaiming ourselves experts. Nothing I have seen published about what the NSA is asserted to have done is a big secret in terms of the ability to do it. The secret (if there is one) is that they did do it, with whom, etc. The techniques I have heard about are hardly a secret. Bribe a company, extort a company, plant an insider, plant a Trojan, not new, not secret methods. In terms of longevity, I would bet that there are lots of things still secret from the 1950s, some of which died with those who held them. > The NSA has two conflicting missions. Its eavesdropping mission has been > getting all the headlines, but it also has a mission to protect US > military and critical infrastructure communications from foreign attack. > Historically, these two missions have not come into conflict. During the > cold war, for example, we would defend our systems and attack Soviet > systems. The equities issue has always been present, and the equities have historically always favored attack over defense. The question that needs to be addressed is how this balance should be as opposed to how it has been. My personal view is that the defense should be favored far more than it is at present or has been in the past, but then I am a defender. The reason for my view? Because the US and our allies are asymmetrically dependent on information and technology. So successful attack can hurt us a lot more than it hurts them. Meanwhile, successful defense depends on knowledge, skills, effort, etc. which we presumably have more of then our enemies. So if we build strong defenses that require ongoing effort, we will win as long as we are willing to spend the effort and they are not. Of course if it takes too much effort, it will sap our strength... and somewhere in there is an equation to be produced and solved. Fred Cohen - 925-454-0171 - All.Net & Affiliated Companies http://all.net/ PO Box 811 Pebble Beach, CA 93953 ------------------------------ Date: Wed, 09 Oct 2013 20:05:33 -0700 From: Paul Saffo <psaffo(a)me.com> Subject: Re: NSA data center 'meltdowns' force year-long delay (RISKS-27.52) ... it appears the problem isn't with the grid supplying the power, but with the electrical system on the NSA site. ------------------------------ Date: Wed, 09 Oct 2013 21:54:01 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: Correction re: Cyber Schools Fleece Taxpayers (RISKS-27.51) The link for the first item ("Cyber Schools Fleece Taxpayers for Phantom Students and Failing Grades") is actually: http://www.prwatch.org/news/2013/10/12257/junk-bonds-junk-schools-cyber-sch… (The item's link was missing "cyber-schools-".) ------------------------------ Date: Fri, 11 Oct 2013 01:28:48 +0000 (UTC) From: tls(a)panix.com (Thor Lancelot Simon) Subject: Re: Our Founding Fathers ... (Robinson, RISKS-27.51) > A couple thousand years ago, the way you moved from Slave or peon to > Citizen in Imperial Rome was you raised enough money to afford a sword and > shield ... This is empirically false, and it's a shame to see made-up "facts" given credibility by appearing in RISKS. Without this and the several other similar assertions of "fact" in the piece I quote above, I'm not sure there is any support for its argument at all. If you'd like to know how changes in status really took place in Imperial (or pre-Imperial) Rome, I can recommend Crook, J.A., _Law and Life Of Rome_, 90 B.C. - A.D. 212 (Ithaca: Cornell, 1967). Thor Lancelot Simon, : Public Access Networks Corp., tls(a)panix.com ------------------------------ Date: Sun, 7 Oct 2012 20:20:16 -0900 From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. The mailman Web interface can be used directly to subscribe and unsubscribe: http://lists.csl.sri.com/mailman/listinfo/risks Alternatively, to subscribe or unsubscribe via e-mail to mailman your FROM: address, send a message to risks-request(a)csl.sri.com containing only the one-word text subscribe or unsubscribe. You may also specify a different receiving address: subscribe address= ... . You may short-circuit that process by sending directly to either risks-subscribe(a)csl.sri.com or risks-unsubscribe(a)csl.sri.com depending on which action is to be taken. Subscription and unsubscription requests require that you reply to a confirmation message sent to the subscribing mail address. Instructions are included in the confirmation message. Each issue of RISKS that you receive contains information on how to post, unsubscribe, etc. => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines. => .UK users may contact <Lindsay.Marshall(a)newcastle.ac.uk>. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you NEVER send mail! => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. *** NOTE: Including the string "notsp" at the beginning or end of the subject *** line will be very helpful in separating real contributions from spam. *** This attention-string may change, so watch this space now and then. => ARCHIVES: ftp://ftp.sri.com/risks for current volume or ftp://ftp.sri.com/VL/risks for previous VoLume http://www.risks.org takes you to Lindsay Marshall's searchable archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue. Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r <http://the.wiretapped.net/security/info/textfiles/risks-digest/> . ==> PGN's comprehensive historical Illustrative Risks summary of one liners: <http://www.csl.sri.com/illustrative.html> for browsing, <http://www.csl.sri.com/illustrative.pdf> or .ps for printing is no longer maintained up-to-date except for recent election problems. *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 27.53 ************************

1 0

clarification re: [20]
by brian carroll 15 Oct '13

15 Oct '13

quoth me-self: so what if everyone exists in 'some truth' or partial truth, and this is a > pseudo- condition, in that it is ambiguous and variant in terms of how it > can be and is accounted for. [truth] is not 100% absolute, instead it is > embedded in frameworks and contexts that carry it and these can be in error > in terms of viewpoint or beliefs or perspective or facts and even subverted > or twisted, such that truth is aligned within a warped worldview that then > becomes normalized and the basis for relations and exchange, as with today > abstract point requiring clarification: "truth in itself" is proposed true when removed of any known errors, contingently absolute (100%) yet when represented in frameworks of signs, there can be variability due to this embedded or nested condition where truth is being referenced or carried within or by the signage- thus a [sign] for truth, meant to represent it is not this actual truth, it is a conduit or circuit to it, yet may have other characteristics or boundaries as a sign- there may be relativistic aspects involved whereby the word [truth] does not equate with truth universally, given perspective and limits and literacy or its variability in a context of language- whatever is true about truth would be represented in other sign-based translations of this concept of truth, only the specific english-version... (perhaps this is not enough to clarify the many issues involved though they have been addressed elsewhere, where this condition of partial truth is refined into empirical truth, though it occurs conceptually, not just as a sign that represents the concept- and thus, the sign of truth given the observation could be a binary observation of only some part of it, yet equated with it, via its [word] for instance)... [truth] [لجنة تقصي الحقائق] [истината] [veritat] [真相] [αλήθεια] [האמת] [真実] [진실] [حقیقت] [pravda] [ความจริง] [Gerçek şu ki] [Істина] [سچائی] [sự thật] ...it is thus proposed that the fidelity with absolute truth is not a default condition of reading/writing such signs, and instead is minimal with regard to actual grounded truth, bound by the observer and shared observation, in whatever dimensions may exist, which can be arbitrary and minimal in comparison to what the situation actually involves, and that to get at that depth and breadth requires N-dimensional panoptic modeling of various perspectives of pseudo-truth, methodologically evaluated and removed of known errors and running as a working hypothesis of reality, versus a default belief that observations in and of themselves are accurate simply by processing reality in particular frameworks and sharing experience... this can be empirically ungrounded, reliant on limits or errors, relativistic and must be accounted for to validate the modeling, yet linear language itself does not allow this, which is why modeling and diagrams are necessary, to stop the flow of time to delve into the concepts and evaluate their accuracy in terms of structures and frameworks and dimensions and dynamics, versus assuming a non-existent common understanding validates 'beliefs' when they are shared yet these observations do not inherently ground into the same structures, such that a [concept] could be interpreted multiple ways via its superposition, thus the issue of representation in terms of its variability, the instability of language, perhaps best noted by the error or typo which breaks the illusion of perfect transmission of theorized truth that does not actually exist beyond the observer in a limited framework, beyond external accounting. language itself is rigged, a game. it does not map to truth by default. it is corrupted, an image-based pattern-matching exercise that covers truth and replaces it by hollowing it out. it is surface-level evaluation, allows and requires this, unless logic cracks it open and demands truth be accounted for in these statements. otherwise it is friction-free ideology, believe what you will, find others, create your own perspective, etc. truth is underneath or accessed by this insofar as it is accurately referenced, yet it is almost tangential to the language, to the description needed to recreate the world through a constant requirement of story telling and context in order to say anything beyond the shared limited boundary, which is inherently tedious and inefficient and ineffective. in this way also, millions of lines of code and issues of how 'truth' of data is parsed, based on how it is represented in terms of signs, concepts, patterns, relational dynamics. --- not sure unicode-8 will render various signage, thus attachment included...

2 1

Re: [liberationtech] NSA collects millions of e-mail address books globally
by Eugen Leitl 15 Oct '13

15 Oct '13

----- Forwarded message from Nick <liberationtech(a)njw.me.uk> ----- Date: Tue, 15 Oct 2013 11:36:30 +0100 From: Nick <liberationtech(a)njw.me.uk> To: liberationtech <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] NSA collects millions of e-mail address books globally Message-ID: <20131015103630.GA3319@starfish> User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Tue, Oct 15, 2013 at 11:49:46AM +0200, Moritz Bartl wrote: > A self-hosted mail provider will obviously *not* help much against NSAs > mass collection of emails and email addresses. Don't sell it as a > "solution" in this context. Well the article seems to be talking about "address books", as opposed to just harvesting email addresses without context. The same thing could be (and is being) done through metadata capture too, but if I read the article correctly, the direct address book pillaging (which may have extra useful metadata on contact networks compared to collecting email headers over time) is something that using any (secure) self-hosted provider (or local client) would defeat. But as to your general point, I agree that hijacking every thread with adverts for a project is certainly not an activity that is OK, and is not the sort of behaviour that fills me with confidence about said project. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [cryptography] /dev/random is not robust
by Eugen Leitl 15 Oct '13

15 Oct '13

----- Forwarded message from coderman <coderman(a)gmail.com> ----- Date: Mon, 14 Oct 2013 18:07:57 -0700 From: coderman <coderman(a)gmail.com> To: David Johnston <dj(a)deadhat.com> Cc: Cryptography List <cryptography(a)metzdowd.com>, Discussion of cryptography and related <cryptography(a)randombit.net> Subject: Re: [cryptography] /dev/random is not robust Message-ID: <CAJVRA1SEmBgfr46BuGbjpj=+ZjKHKz7dLUcTkYCKA4ikaHY1_Q(a)mail.gmail.com> On Mon, Oct 14, 2013 at 5:35 PM, <dj(a)deadhat.com> wrote: > http://eprint.iacr.org/2013/338.pdf "...it remains unclear if these attacks lead to actual exploitable vulnerabilities in practice." in my mtrngd for XSTORE i not only fed /dev/random when it became write-able (entropy less than full) but also fed it at regular intervals, specifically to keep the pool fresh. in the standard rng-tools rngd, you specify this parameter with the timeout parameter, "Interval written to random-device when the entropy pool is full, in seconds (default: 60)" i am pleased to see this made it into the stock rngd source! best regards, _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[Cryptography] /dev/random is not robust
by Eugen Leitl 15 Oct '13

15 Oct '13

----- Forwarded message from dj(a)deadhat.com ----- Date: Tue, 15 Oct 2013 00:35:13 -0000 From: dj(a)deadhat.com To: Cryptography List <cryptography(a)metzdowd.com>, cryptography(a)randombit.net Subject: [Cryptography] /dev/random is not robust Message-ID: <4ca15bb1026e7a249f79a415fb1f9042.squirrel(a)www.deadhat.com> User-Agent: SquirrelMail/1.4.22-7.fc17 http://eprint.iacr.org/2013/338.pdf _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

NSA collects millions of e-mail address books globally
by Eugen Leitl 15 Oct '13

15 Oct '13

http://www.washingtonpost.com/world/national-security/nsa-collects-millions… NSA collects millions of e-mail address books globally Video: In June, President Obama said the NSA’s email collecting program “does not apply to U.S. citizens.” By Barton Gellman and Ashkan Soltani, Tuesday, October 15, 12:53 AM E-mail the writer The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans, according to senior intelligence officials and top-secret documents provided by former NSA contractor Edward Snowden. The collection program, which has not been disclosed before, intercepts e-mail address books and “buddy lists” from instant messaging services as they move across global data links. Online services often transmit those contacts when a user logs on, composes a message, or synchronizes a computer or mobile device with information stored on remote servers. Rather than targeting individual users, the NSA is gathering contact lists in large numbers that amount to a sizable fraction of the world’s e-mail and instant messaging accounts. Analysis of that data enables the agency to search for hidden connections and to map relationships within a much smaller universe of foreign intelligence targets. During a single day last year, the NSA’s Special Source Operations branch collected 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers, according to an internal NSA PowerPoint presentation. Those figures, described as a typical daily intake in the document, correspond to a rate of more than 250 million a year. Each day, the presentation said, the NSA collects contacts from an estimated 500,000 buddy lists on live-chat services as well as from the inbox displays of Web-based e-mail accounts. The collection depends on secret arrangements with foreign telecommunications companies or allied intelligence services in control of facilities that direct traffic along the Internet’s main data routes. Although the collection takes place overseas, two senior U.S. intelligence officials acknowledged that it sweeps in the contacts of many Americans. They declined to offer an estimate but did not dispute that the number is likely to be in the millions or tens of millions. A spokesman for the Office of the Director of National Intelligence, which oversees the NSA, said the agency “is focused on discovering and developing intelligence about valid foreign intelligence targets like terrorists, human traffickers and drug smugglers. We are not interested in personal information about ordinary Americans.” The spokesman, Shawn Turner, added that rules approved by the attorney general require the NSA to “minimize the acquisition, use and dissemination” of information that identifies a U.S. citizen or permanent resident. The NSA’s collection of nearly all U.S. call records, under a separate program, has generated significant controversy since it was revealed in June. The NSA’s director, Gen. Keith B. Alexander, has defended “bulk” collection as an essential counterterrorism and foreign intelligence tool, saying, “You need the haystack to find the needle.” Contact lists stored online provide the NSA with far richer sources of data than call records alone. Address books commonly include not only names and e-mail addresses, but also telephone numbers, street addresses, and business and family information. Inbox listings of e-mail accounts stored in the “cloud” sometimes contain content, such as the first few lines of a message. Taken together, the data would enable the NSA, if permitted, to draw detailed maps of a person’s life, as told by personal, professional, political and religious connections. The picture can also be misleading, creating false “associations” with ex-spouses or people with whom an account holder has had no contact in many years. The NSA has not been authorized by Congress or the special intelligence court that oversees foreign surveillance to collect contact lists in bulk, and senior intelligence officials said it would be illegal to do so from facilities in the United States. The agency avoids the restrictions in the Foreign Intelligence Surveillance Act by intercepting contact lists from access points “all over the world,” one official said, speaking on the condition of anonymity to discuss the classified program. “None of those are on U.S. territory.” Because of the method employed, the agency is not legally required or technically able to restrict its intake to contact lists belonging to specified foreign intelligence targets, he said. When information passes through “the overseas collection apparatus,” the official added, “the assumption is you’re not a U.S. person.” In practice, data from Americans is collected in large volumes — in part because they live and work overseas, but also because data crosses international boundaries even when its American owners stay at home. Large technology companies, including Google and Facebook, maintain data centers around the world to balance loads on their servers and work around outages. A senior U.S. intelligence official said the privacy of Americans is protected, despite mass collection, because “we have checks and balances built into our tools.” NSA analysts, he said, may not search within the contacts database or distribute information from it unless they can “make the case that something in there is a valid foreign intelligence target in and of itself.” In this program, the NSA is obliged to make that case only to itself or others in the executive branch. With few exceptions, intelligence operations overseas fall solely within the president’s legal purview. The Foreign Intelligence Surveillance Act, enacted in 1978, imposes restrictions only on electronic surveillance that targets Americans or takes place on U.S. territory. By contrast, the NSA draws on authority in the Patriot Act for its bulk collection of domestic phone records, and it gathers online records from U.S. Internet companies, in a program known as PRISM, under powers granted by Congress in the FISA Amendments Act. Those operations are overseen by the Foreign Intelligence Surveillance Court. Sen. Dianne Feinstein, the California Democrat who chairs the Senate Intelligence Committee, said in August that the committee has less information about, and conducts less oversight of, intelligence gathering that relies solely on presidential authority. She said she planned to ask for more briefings on those programs. “In general, the committee is far less aware of operations conducted under 12333,” said a senior committee staff member, referring to Executive Order 12333, which defines the basic powers and responsibilities of the intelligence agencies. “I believe the NSA would answer questions if we asked them, and if we knew to ask them, but it would not routinely report these things, and, in general, they would not fall within the focus of the committee.” Because the agency captures contact lists “on the fly” as they cross major Internet switches, rather than “at rest” on computer servers, the NSA has no need to notify the U.S. companies that host the information or to ask for help from them. “We have neither knowledge of nor participation in this mass collection of web-mail addresses or chat lists by the government,” said Google spokeswoman Niki Fenwick. At Microsoft, spokeswoman Nicole Miller said the company “does not provide any government with direct or unfettered access to our customers’ data,” adding that “we would have significant concerns if these allegations about government actions are true.” Facebook spokeswoman Jodi Seth said that “we did not know and did not assist” in the NSA’s interception of contact lists. It is unclear why the NSA collects more than twice as many address books from Yahoo than the other big services combined. One possibility is that Yahoo, unlike other service providers, has left connections to its users unencrypted by default. Suzanne Philion, a Yahoo spokeswoman, said Monday in response to an inquiry from The Washington Post that, beginning in January, Yahoo would begin encrypting all its e-mail connections. Google was the first to secure all its e-mail connections, turning on “SSL encryption” globally in 2010. People with inside knowledge said the move was intended in part to thwart large-scale collection of its users’ information by the NSA and other intelligence agencies. The volume of NSA contacts collection is so high that it has occasionally threatened to overwhelm storage repositories, forcing the agency to halt its intake with “emergency detasking” orders. Three NSA documents describe short-term efforts to build an “across-the-board technology throttle for truly heinous data” and longer-term efforts to filter out information that the NSA does not need. Spam has proven to be a significant problem for the NSA — clogging databases with information that holds no foreign intelligence value. The majority of all e-mails, one NSA document says, “are SPAM from ‘fake’ addresses and never ‘delivered’ to targets.” In fall 2011, according to an NSA presentation, the Yahoo account of an Iranian target was “hacked by an unknown actor,” who used it to send spam. The Iranian had “a number of Yahoo groups in his/her contact list, some with many hundreds or thousands of members.” The cascading effects of repeated spam messages, compounded by the automatic addition of the Iranian’s contacts to other people’s address books, led to a massive spike in the volume of traffic collected by the Australian intelligence service on the NSA’s behalf. After nine days of data- bombing, the Iranian’s contact book and contact books for several people within it were “emergency detasked.” In a briefing from the NSA’s Large Access Exploitation working group, that example was used to illustrate the need to narrow the criteria for data interception. It called for a “shifting collection philosophy”: “Memorialize what you need” vs. “Order one of everything off the menu and eat what you want.” Julie Tate contributed to this report. Soltani is an independent security researcher and consultant.

1 0

To Get Around US Law, The NSA Collects Email Address Books And Chat Buddy Lists From Foreign Locations
by shelley＠misanthropia.info 15 Oct '13

15 Oct '13

http://m.techcrunch.com/2013/10/14/to-get-around-us-law-the-nsa-collects-em… To Get Around US Law, The NSA Collects Email Address Books And Chat Buddy Lists From Foreign Locations by ALEX WILHELM posted 2 Hours Ago The Washington Post [link below] broke news this afternoon that the National Security Agency (NSA) is collecting huge numbers of email address books and chat buddy lists for both foreign individuals and United States citizens. It appears that the NSA lacks Congressional authority to collect buddy lists and address book information in the way that it currently does. As the Post rightly points out, address book data can include physical addresses, very personal information, and more. To get around that lack of a mandate, the NSA has agreements with non-U.S. telcos and works with other, non-U.S. intelligence groups. So to get its hands on even more information, the NSA avoids the constraints of its provided oversight and legal boundaries, by going to alternative sources of the data that it wants. That matters because the rules of other countries for tracking the communication of United States citizens are more lax. Recall that the NSA is in some ways slowed from collecting information on citizens of the United States, but not those of other countries. So, if the NSA is willing to accept data from foreign intelligence agencies that it is not able to collect in this case, why not in other cases as well? If the NSA won’t respect the constraints that are put in place on its actions for a reason, and will instead shirk its responsibilities and find a way to get all the data it could ever desire, then we have even less reason to trust its constant petitions that it follows the law, and is the only thing keeping the United States safe from conflagration. The Post continues: “When information passes through ‘the overseas collection apparatus,’ [an intelligence office] added, ‘the assumption is you’re not a U.S. person.’” This means that when the NSA sweeps up contact data, buddy lists, and address sets from overseas, the same rules that keep it from collecting information on United States citizens aren’t likely in play. Minimization, it would seem, would be minimal. The phone metadata program knows who you called, when, and for how long. PRISM can force your private information out of major Internet companies. XKeyscore can read your email, and tracks most of what you do online. And the above program circumvents Congressional oversight by collecting more data on U.S. citizens by merely executing that collection abroad. How private are you feeling? – Facebook provided TechCrunch with the following statement: “As we have said many times, we believe that while governments have an important responsibility to keep people safe, it is possible to do so while also being transparent. We strongly encourage all governments to provide greater transparency about their efforts aimed at keeping the public safe, and we will continue to be aggressive advocates for greater disclosure.” Microsoft repeated to TechCrunch what it had told the Washington Post, that it “does not provide any government with direct or unfettered access to our customers’ data” and that if the above revelations are true, then the company would “have significant concerns.” Source: http://www.washingtonpost.com/world/national-security/nsa-collects-millions… (also archived at Cryptome)

1 0

Re: Bitcoin mining efficiency and Botnets
by Bill Stewart 15 Oct '13

15 Oct '13

Lodewijk andrÃ© de la porte <l(a)odewijk.nl> sent an interesting reply. >Date: Tue, 15 Oct 2013 02:57:52 +0200 >Subject: Re: Bitcoin mining efficiency and Botnets >From: Lodewijk andrÃ© de la porte <l(a)odewijk.nl> > >"High end" (optimal for mining != high end per >se) GPU's have been dumped since forever in >favor of FPGAs. Some people picked them for >availability or resell value even in the FPGA era. > >FPGA is now totally dead because ASICs rule the >game totally. They're totally Bitcoin exclusive >so resale value if Bitcoin goes bam is 0. >They're flooding the market at increasingly >competitive prices and there's likely no money >to be made off them soon, except where electricity is cheap. > >If your profit depends on bitcoin achieving a >certain success it is usually better to buy BTC >directly, and save yourself risk and hassle with physical objects. > >Note: Litecoin's mayor advantage is that it's >something that works relatively better on GPU. >There GPU is still fighting FPGA and ASIC would >be less feasible (maybe even infeasible?) bc of memory demands.

1 0

An Interview with Simon Persson of CounterMail
by chad＠sveltemail.com 14 Oct '13

14 Oct '13

Hey Everyone, I posted this up on HN and Reddit, and it was largely ignored. Perhaps you guys will find it interesting... http://www.unfinishedman.com/interview-simon-persson-founder-countermail-se…

2 1