- cypherpunks - lists.cpunks.org

Video meme hunt: hackers
by rysiek 20 Jul '14

20 Jul '14

Hi guys, if I want to introduce the anarchist approach by showing this video: http://www.youtube.com/watch?v=SGyAnXfd4Yg and the diggers' approach by showing this video: http://www.youtube.com/watch?v=3toLwGs7o-k then what short video you would recommend for introducing the hacker approach? -- Pozdr rysiek

1 0

Re: New XMPP servers
by Crypto 20 Jul '14

20 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 7/20/2014 10:20 AM, Damian Fossi wrote: > Thank you > > > On 20 July 2014 09:42, Crypto <crypto(a)jpunix.net> wrote: > > Hello Everyone! > > For those that are using secure XMPP clients (Jitsi and the like) > I'd like to announce two new Prosody servers. Both are located in > the Netherlands and are available for public use. If you would like > to try them out they are located at chat.jpunix.net and > chat.cpunk.us. Both are fully-featured. Give them a try if you're > so inclined! You're very welcome! Just to be sure, I run chat.jpunix.net. chat.cpunk.us is a sister site that is under different management. - -- Crypto -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTy/JEAAoJEDhzgt+U8WIybXMP/0jOSMr+F3NAeahDgluDNcyl /TZ4jjEpsjECCAz8ivNAh2ARo1gLcncPZ+8LsItNzHNLu9tUrubeET2hxx2OLb77 Ojzs021KV2d2x0ewIlhvJoWi5ZuPFghZ6CrjTFRNpyhwKe5a6iHkpwkJD+QEHY8T hvH9rMubdHwxK9G6RlsNTYavJ8qMj02JNpGbhEaisgeT0N4T+/QMEn2nqPC0Dczf egFZJFfU0vjRZcrT+3Xd6njBOaNzONzewEbVvdyB9TrKuVwNJK76YTEsIixl4rmA MQSSf45Zq5KHEhauO26K/2Cn7bx7CurIErfXkzpnbdf2XJWazcJMjZtnyZUMHudd zn5zjq2iwjDReRA6WZaGO2phCGXp8J4xew6aBvM+ReINff1pKkYdOuAOPRZqIWzW kql4K4z1Ye4IalioIu+I4tnPsUDd/gijpyh5hZwUPeWXfiTMcQr0wpzlXHCnyxHp waRaFI5qub9qu6GekMFuU/IEnJFfRSql0bTakszqS5oegupNLUTPbyxY3P77Wojt oRrRKkeWK2GvDBMd5mjgZ05Qgpp+lDe3JCTXpL4vfuCyC3c+RJ1ZG4sLA+potSBs wKCuMHZbE0Zi86NggQiPPKPE5GCBG3g6DVRl2yQgTNS29IlWbqfC5iT2JZHdv1x5 Qm01qb8iE9yQPe6s0YvD =Kfsq -----END PGP SIGNATURE-----

1 0

New XMPP servers
by Crypto 20 Jul '14

20 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Everyone! For those that are using secure XMPP clients (Jitsi and the like) I'd like to announce two new Prosody servers. Both are located in the Netherlands and are available for public use. If you would like to try them out they are located at chat.jpunix.net and chat.cpunk.us. Both are fully-featured. Give them a try if you're so inclined! - -- Crypto -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTy85WAAoJEDhzgt+U8WIyBAkQAK3+TXmPU6z7Pj8ZbnHBg5cB p2xLfXJuWbObrF4Dd8izbsFGcir1zJw6E/hfyNLD9gZQGhRmvvsQWP3LkWuo6spF 1r92QAumNZQP6hRjKcgvPH28sBKXg8GElW78v+vDUlggpym/UBNXqxxsA6JDXPRT LPwzuqCBayHsA0ghY2TrBy73yLURjJzaJOayd2QWBRcNtEt30NFxU0uu3jkVmsX7 ovqqmFIekNiuiecYFad2+9bH/rt5BsMz6jFZIVhVaXueb9GeQO/Qmu1IXp8yxnS4 XAHDa+5tuUbZDzYvSuwLGdIJpMUxaxnoKQiXEDTNal7cyNt3xkKHXjOIav2eElx1 VD/l4mbTbfn3k8QgtMl1fUJS8o35vHurpF7Yjw/uG/sAy1G2XRG85VoF4vKP08OX /QgZr4LXR9U1uX912Zbf6gjNXsqtOQMP3JL0oa13AzAdT3WKwPJcWOCU2feD5eDh 0uT1rzUk1sS4qfveI1cG45HKz31ayNl2pYX58VXN9F7VtR4F/xPW9FjwG80cm1yv a99OvN1M01GQqUAGh+dj+VKHmPRhux61dpVErgi6viV3Ev5Bb/JvDc7uIGoO/ZcJ 48N/sQjVsABqYFD4yTDm6GrsLeG1OaYXOlhzrwHxPTUsMEJE8BnB4Z6NAVt7PocH LsYy+G/0yoSU8zTHsRBq =7ba8 -----END PGP SIGNATURE-----

3 2

Re: [Cryptography] What has Bitcoin achieved?
by grarpamp 20 Jul '14

20 Jul '14

On Thu, Jul 17, 2014 at 4:02 PM, John Levine <johnl(a)iecc.com> wrote: >>But none of them will have the property that their currency is not >>under their control. Other than the obvious head start bitcoin has >>in the digital currency game, that is what bitcoin offers >>philosophically... freedom from control. > > I realize that's the theory, but in reality, there is a mining pool > that could easily grow to be more than half of all the miners, at > which point it could start ignoring blocks from outside the pool, > which would be to the benefit of people inside the pool. So long as > the cost of joining the pool remained small, e.g., if you join you > still get 98% of the coins you mine, this looks to me like it would be > a stable situation, no matter how much outsiders complained about how > awful it was. Thing is, having seen the possibilities, people actually *want* this freedom from central control, in a bad way, and they're willing to act to get it. They also realize that if they, and the entire community, don't act together to maintain the decentralization they have... then it's over. That's why ghash.io (the largest pool) just announced that they will not exceed 40%. Down from 55% to 32% now... http://www.coindesk.com/ghash-commits-40-hashrate-cap-bitcoin-mining-summit/ http://www.coindesk.com/bitcoin-mining-detente-ghash-io-51-issue/ http://blockchain.info/pools And why BTC isn't exactly rushing to support regulation... http://www.reddit.com/r/IAmA/comments/1ygcil/as_requested_im_ben_lawsky_sup… http://www.reddit.com/r/Bitcoin/comments/2aycxs/hi_this_is_ben_lawsky_at_ny… http://www.reddit.com/r/Bitcoin/comments/2b1jpl/dear_ben_lawsky_thank_you_f… Further, again, since people want decentral, if some large entity does manage a BTC takeover, no problem... all users ok with that will stay with the now central coin, and the free decentral people will just exchange their coin (or fork) into whatever is the current decentral coin. Repeat as needed. So far BTC has a good history of actively cooperating to avoiding central. Excepting mining companies (ie: the 10% corps, who have made similar self limiting statements), the VC money seems to stay out of the coin itself and is being placed in surrounding service ventures... exchanges, banking, processors, wallets, retail. In the end years from now, maybe only three coin will remain... - A World central - A State central - A World decentral/anon/etc With all of them being roughly similar in acceptance, volatility, etc. > There also remain long term questions about the technical viability of > Bitcoin, most notably whether people will still find it interesting > after the transaction cost rises. (If a transaction costs a dollar, > there's a lot of other options with much less price volatility.) People spend more than a dollar to post mail, or drive to the store. It will be a long time before the ASIC and electric cost to clear a transaction (at whatever network transaction demand rate) exceeds palatability, if ever. Pick a projected compute power, node count, required tx rate (at 100% utilization) and then basically figure gigawatt and gigahash dollars per tx. http://www.coinometrics.com/bitcoin/btix https://bitmaintech.com/productDetail.htm?pid=00020140704023505485N5SxDMkW0… https://medium.com/@interdome/how-much-electricity-does-bitcoin-use-c350bd8… http://organofcorti.blogspot.nl/ A guesstimate with current state and data? - Installing double current hashrate to take 50+% costs about $130M in retail hardware alone. Less for a real deployment. - About $10k/hr to power it. More for cooling, support, bandwidth. - About $0.40/tx-current spread over a year. Much less if running at 100% tx rate capacity. Up to twice more due to doubling current hashrate. Right now that amount is being covered by coin mining profit. The future taper of coin production vs then current market value of coin vs tx fees will be interesting. And ASIC platforms have yet to reach performance plateau. The base tx cost is cost of the coin algorithm to support a given required tx rate. That seems quite low. The race (difficulty) to claim the tx fee profit drives it up. Yet the hardware market is open, yielding a level playing field. So as long as the required tx rate can be met affordably within the algorithm, this is unlikely to be an issue. Cost of tx rates also naturally moderate the proportion of users amongst each payment system. It remains to be seen, once all the various BTC costs are fully optimized, if BTC can handle tx rates approaching the credit cards. Even if not, that doesn't keep it from utility at its own natural rate limit. Some seriously big players don't seem to have any problem with BTC... http://www.coindesk.com/computer-giant-dell-now-accepts-bitcoin/ > To me Bitcoin is very interesting as an experiment. It shows that > within certain parameters, the distributed proof of work model is > viable. I doubt that anyone anticipated the grotesque amount of > computing resources that people would throw at it, or that there would > be mining pools. > > The model is likely useful for applications like distributed notary, > particularly if there are several mutually suspicious groups > participating which makes it less likely that any one of them could > take over. > > It's also impressive to see the number of economically ignorant > enthusiasts who imagine there is something innovative or disruptive > about a commodity bubble, which is what Bitcoin is. Well, since BTC is nothing but experimental scrap metal, please be sure to send yours (and that of all your central fiat loving friends) off for proper recycling to my recycle bin here... btc:1C96B6DszNqnX4KRzveu6BKRuznmmdFhdm Liked or learned something from the links, etc? Tips go here, I'll buy a miner / tx processor, or do something generally useful... btc:1D6rPeQUETfGpSp2JB2oojJUC8GiURyhp7

2 1

Identifying back doors, attack points, and surveillance mechanisms in iOS devices
by coderman 20 Jul '14

20 Jul '14

doubt this will surprise anyone; iOS intentionally designed to support surveillance. --- http://www.sciencedirect.com/science/article/pii/S1742287614000036 "Identifying back doors, attack points, and surveillance mechanisms in iOS devices" by Jonathan Zdziarski Abstract The iOS operating system has long been a subject of interest among the forensics and law enforcement communities. With a large base of interest among consumers, it has become the target of many hackers and criminals alike, with many celebrity thefts (For example, the recent article “How did Scarlett Johansson's phone get hacked?”) of data raising awareness to personal privacy. Recent revelations (Privacy scandal: NSA can spy on smart phone data, 2013 and How the NSA spies on smartphones including the BlackBerry) exposed the use (or abuse) of operating system features in the surveillance of targeted individuals by the National Security Agency (NSA), of whom some subjects appear to be American citizens. This paper identifies the most probable techniques that were used, based on the descriptions provided by the media, and today's possible techniques that could be exploited in the future, based on what may be back doors, bypass switches, general weaknesses, or surveillance mechanisms intended for enterprise use in current release versions of iOS. More importantly, I will identify several services and mechanisms that can be abused by a government agency or malicious party to extract intelligence on a subject, including services that may in fact be back doors introduced by the manufacturer... '''

3 2

minimum viable toolset for low level malware forensics [was: BadBIOS forensics]
by coderman 20 Jul '14

20 Jul '14

On Wed, Jul 16, 2014 at 4:19 AM, Bluelotus <bluelotus(a)openmailbox.org> wrote: > ... > I wrote threads on my limited ability to perform forensics for those technical, the minimum viable toolset for identifying low level subversive programming is: - a solid base (clean hw, clean installs, clean environment) in a separate location with RF shielding. (a closed metal barn out in the country, for example. if you're a geek you love the thought of a faraday closet ;) - instrumented runtime (e.g. volatility memory forensics, system performance profiling, all to append only storage) on any systems you are using as suspect to attack. - obstructed runtime (see thread on "how to hack your systems before someone else") - this is optional; a modified system that appears to be vulnerable / stock condition will exhibit undefined behavior under attempted enabling, sometimes. otherwise it may be difficult to identify a successful infection. - direct flash memory pinout rig (specs for all chips including flash memory associated with BIOS, integrated management controllers, network devices, I/O ports, keyboard, trac pad or mouse, HD/DVD/CD drives, graphics memory, wifi, 4g, and bluetooth wireless adapters will be needed you're programming an FPGA to perform reads directly from the flash chips. converting flash memory into high level block storage the next black art upward. - wide band high performance software defined radio. you will be building custom GNU radio blocks and running many from third party repositories or research projects. you are using a two stage process, where wide sweeps and auto ranging are applied to sample swaths of signal of interest to storage. then parallel processing on other hardware or later time (off-use-hours) extracting known / useful data and anomalies for further analysis. - in-line network archival, shaping, and cut-out for link to internet / local network. this works best as a zero visibility transparent ethernet bridge with ARP spoofing and ether mangling at each end. that does not speak IP at all. the shaping is used to squelch suspect or unexpected peak traffic (both a signalling system for malicious activity and a means to constrain the reach once compromised) as per the kit above, you are instrumenting a system to observe its runtime behavior on an external audit system. this is because the advanced attacks inject into processes and ring0, persisting only what is needed / chosen (enabling hooks). you need to capture the active payloads that are delivered on-demand in host memory space. you are observing the network and RF space for anomalies and discrepancies. for example, a wifi radio disabled yet still emitting into 2.4Ghz/5.xGhz spectrum. network captures also provide evidence to correlate with malicious memory, for example identifying a payload delivered over the network, with keys from volatility used to decrypt the encrypted communications containing the payload identified in memory. you are (sometimes destructively) sampling all flash memory as parts of advanced payloads persist outside of the OS and storage level interface visibility. (stealth at bus/bios level). discrepancies in blocks that should not have changed, executable code segments where not expected, strange carvings of wear leveling around "protected" offsets. all of these are indicators for further scrutiny and instruction level reversing (if corresponding to microcontroller programming instructions for manipulating streams read or written to and from device, for example :) last but not least, you are not getting attached to any hardware, because at any moment you may find it all suspect and have to replace all laptops, desktops, routers, printers, mobile devices, storage media, media servers, smart televisions, and god forbid you installed one of those intelligent thermostats. [ laugh for sanity, then go back and read the list, and then understand that the far end of the nation state malware asymptote is full of freaky exotics. i also hope you never hit that level of "all systems go" *grin* ] best regards,

1 0

Rainforest Connection and WildLeaks
by grarpamp 20 Jul '14

20 Jul '14

Nice to have Eugen back, wherever did he go? Thanks for posting this applied tech ink.

1 0

first reference to "data diodes" in NSA documents or leaks
by coderman 20 Jul '14

20 Jul '14

i am trying to find the first reference to "data diodes" in any NSA documents or leaks. bonus points for background on where this technical structure originated and why :) best regards,

1 0

Re: Strong Security Processes Require Strong Privacy Protections, Re: [liberationtech] Foxacid payload
by John Young 18 Jul '14

18 Jul '14

On two related threads: It's a challenge to work counter-spying without access to all of Snowden's alleged, note alleged -- nobody knows except Ed how many or where multiply-accumulated and -stashed from 2008-2013 and afterwards -- documents. But parsing the unknown, imagining and acting on possibilities, is the purpose counter-spying as well as spying. Failure expected, narrowing it for modest utility, no lasting triumph. Privacy as elusive as security. It could be, has been, argued that open source coding, like the Internet, is a ploy, or decoy, like comsec standards committees and spy oversight committees, even, some claim, Tor and PKC, AV and Blacknet, so forth and so on paraded here for Internet dog years. Duplicity, buyer beware and who watches the watchers inherent, is that not the wee chihuahua way of survival against greater powers of Fort Huachuca whisperers, GMO vegetables, fracked minerals, DoD-fabricated asteroids and black hos of nightsweat zombies. Whistling in the dark, whistleblowing sunshine, coding out of sight except for sneaky supra-Tempest io-germs gnawing backbone taps into HUMINT dervishing switch doctors.

1 0

Re: [liberationtech] Foxacid payload
by John Young 18 Jul '14

18 Jul '14

Some, maybe all, of those sitting on Snowden docs would/are selling to the highest bidder for other clandestine hacks. The fundamental purpose of security is to do that lulling, gulling and smiling at the ease with which trust can be exploited when a manufactured crisis drives the fearful into gaping maws of protection. The especially private kind, the higher the secrecy the higher the price, is most effective. Fake highest classification markings obligatory. The frenzy to exploit Snowden revelations, tiny as they are, has saved the security industry -- mil-com-spy-edu-org-hackers -- from post-2-war decline. BTW, what are the odds all parties to the Snowden boondoggle are placing on hot war cyberwar to surpass the cool stinking-poo of AV and security vendors planting malware to foster upticks of market? No nonsense Omidyar has bet $200 million on peddling security products generated by his $50 million investment in insecurity scare news via Snowden cornicopia of NSA scare programs, which in turn have received huge boosts of counter-Snowden actions by the usual suspects of mil-com-spy-edu-org-hackers. Nothing like it since 9/11. Thank you, Edward Snowden, thank you media, for prolonging godsent cyber fear and salvation. Dust off cyber Pearl Harbor posters for Defcon, HOPE, Blackhat, this very sordid squat. >this is exactly why some who have received these payloads are sitting >on them, rather than disclosing. > >it is more useful to mitigate privately, and observe how/when an >exploit is used, > than burn it publicly for zero effective security improvement. > >(the less scrupulous would sell to highest bidder for other clandestine hacks) > > >better ideas welcome! > > >best regards, >-- >Liberationtech is public & archives are searchable on Google. >Violations of list guidelines will get you moderated: >https://mailman.stanford.edu/mailman/listinfo/liberationtech. >Unsubscribe, change to digest, or change password by emailing >moderator at companys(a)stanford.edu.

2 1