- cypherpunks - lists.cpunks.org

Did m$ released patch for unsupported windozes after Wannacry hit?
by Georgi Guninski 16 May '17

16 May '17

Wannacry hit on 2017-05-12 using exploit generously donated by the NSA. For supported windozes the bug was fixed in 2017-03 for unknown reasons. Looks like for unsupported windozes like XP the patch was released on 2017-05-13 after Wannacry hit: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598 Is it really so?

4 6

Re: [Cryptography] Bizarre behavior of a non-smart mobile phone
by grarpamp 15 May '17

15 May '17

On Sun, May 14, 2017 at 6:56 PM, Dave Horsfall <dave(a)horsfall.org> wrote: > I don't know about American mobile phones, but here down-under I have the > choice of the phone's memory or the SIM card on my ancient Android phone. For "contact" lists, yes, and there is also question of if one refers to that, explicitly, or to storing of "missed" "received" "dialed" calls on the phone or SIM. Same for SMS / MMS messages. Writers should be much more clear when specifying example cases.

1 0

[TriggerWarning: Alt-Right troll] Richard Spencer leads torch-bearing Confederate statute defenders
by Razer 14 May '17

14 May '17

SOME PEOPLE have discipline problems. "The interests of the State are therefore the same as those of the United States. Its prosperity will rise or fall with the welfare of the country. The duty of its citizens, then, appears to me too plain to admit of doubt. All should unite in honest efforts to obliterate the effects of war, and to restore the blessings of peace. They should remain, if possible, in the country; promote harmony and good feeling; qualify themselves to vote; and elect to the State and general Legislatures wise and patriotic men, who will devote their abilities to the interests of the country, and the healing of all dissensions. I have invariably recommended this course since the cessation of hostilities, and have endeavored to practice it myself." ~Letter to former Virginia governor John Letcher (28 August 1865), as quoted in Personal Reminiscences, Anecdotes, and Letters of Gen. Robert E. Lee (1875) by John William Jones, p. 203 https://www.washingtonpost.com/local/virginia-politics/alt-rights-richard-s… Also see this informative FlowChart: http://i.imgur.com/hY438ba.jpg

1 0

How the Executive can override Congress and the ACLU
by Ryan Carboni 14 May '17

14 May '17

https://www.schneier.com/blog/archives/2006/01/us_customs_open.html Here, Schneier commends the ACLU for improving civil liberties protections. http://www.rstreet.org/2014/11/19/yes-the-government-can-open-your-mail-wit… A John Conyers requested the DoJ view on the matter, to investigate it. Governmentattic requested the documents in 2010, was released to them in 2012, and they finally posted it in 2014. A large issue in our modern era is apparently how US laws are being interpreted far outside what people expect. The ACLU has done nothing in this matter. They are protecting civil liberties through the most ineffective and indirect mechanisms imaginable, anyone who spends millions of dollars per year with their lack of accomplishments must be doing something wrong. The executive issues signing statements saying that the judicial branch overrules Congress, whereas Congress writes the laws. Congress will always overrule the Supreme Court when it comes to reasonable interpretations of laws, it appears as if Congress has to explicitly state it so, which Congress has not done. I just thought everyone should be aware that the Holocaust was strictly legal. So was the Soviet gulag. The law itself is not a prophylactic against immorality. Anyway, Seymour Hersh has done incredible reporting, he talks about it here: https://www.c-span.org/video/?311093-1/seymour-hersh-investigative-journali… He hears a rumor from one place, and then goes thoroughly investigates it. (makes me wonder how anything was Top Secret with Bavarian fire drills) Of course it doesn't seem like the ACLU ever asked him about any of it... or famed Jason Leopold for that matter. So what matters? Either federal intrusions are wholly legal, or they are illegal. Somehow they have proven to be wholly legal over time, besides the meek complaints by the ACLU that it's still illegal. Or maybe the NSA is filled with thousands of men acting with impunity, who know what they are doing is illegal. The most frightening possibility of all, no? On a wholly different topic, I wonder why certain crimes are still possible to commit through the internet. Congress can always mandate ID for some services or cut funding for other services.

2 1

Keylogger Found in Audio Driver of HP Laptops
by Razer 13 May '17

13 May '17

H/t @Liberationtech @twitter https://twitter.com/Liberationtech/status/862849917806661634 > > The audio driver installed on some HP laptops includes a feature that > could best be described as a keylogger, which records all the user's > keystrokes and saves the information to a local file, accessible to > anyone or any third-party software or malware that knows where to look. > > Swiss cyber-security firm modzero discovered the keylogger on April 28 > and made its findings public today. > Keylogger found in preinstalled audio driver > > According to researchers, the keylogger feature was discovered in the > Conexant HD Audio Driver Package version 1.0.0.46 and earlier. > > This is an audio driver that is preinstalled on HP laptops. One of the > files of this audio driver is MicTray64.exe > (C:\windows\system32\mictray64.exe). > > This file is registered to start via a Scheduled Task every time the > user logs into his computer. According to modzero researchers, the > file "monitors all keystrokes made by the user to capture and react to > functions such as microphone mute/unmute keys/hotkeys." > > This behavior, by itself, is not a problem, as many other apps work > this way. The problem is that this file writes all keystrokes to a > local file at: > > C:\users\public\MicTray.log > > Audio driver also exposes keystrokes in real-time via local API > > If the file doesn't exist or a registry key containing this file's > path does not exist or was corrupted, the audio driver will pass all > keystrokes to a local API, named the OutputDebugString API. > > The danger is that malicious software installed on the computer, or a > person with physical access to the computer, can copy the log file and > have access to historical keystroke data, from where he can extract > passwords, chat logs, visited URLs, source code, or any other > sensitive data. > > Furthermore, the OutputDebugString API provides a covert channel for > malware to record real-time keystrokes without using native Windows > functions, usually under the watchful eye of antivirus software. > Keylogger feature confirmed in HP laptops > > Modzero researchers said they found the Conexant HD Audio Driver > Package preinstalled on 28 HP laptop models. Other hardware that uses > this driver may also be affected, but investigators haven't officially > confirmed that the issue affects other manufacturers. > > HP EliteBook 820 G3 Notebook PC > HP EliteBook 828 G3 Notebook PC > HP EliteBook 840 G3 Notebook PC > HP EliteBook 848 G3 Notebook PC > HP EliteBook 850 G3 Notebook PC > HP ProBook 640 G2 Notebook PC > HP ProBook 650 G2 Notebook PC > HP ProBook 645 G2 Notebook PC > HP ProBook 655 G2 Notebook PC > HP ProBook 450 G3 Notebook PC > HP ProBook 430 G3 Notebook PC > HP ProBook 440 G3 Notebook PC > HP ProBook 446 G3 Notebook PC > HP ProBook 470 G3 Notebook PC > HP ProBook 455 G3 Notebook PC > HP EliteBook 725 G3 Notebook PC > HP EliteBook 745 G3 Notebook PC > HP EliteBook 755 G3 Notebook PC > HP EliteBook 1030 G1 Notebook PC > HP ZBook 15u G3 Mobile Workstation > HP Elite x2 1012 G1 Tablet > HP Elite x2 1012 G1 with Travel Keyboard > HP Elite x2 1012 G1 Advanced Keyboard > HP EliteBook Folio 1040 G3 Notebook PC > HP ZBook 17 G3 Mobile Workstation > HP ZBook 15 G3 Mobile Workstation > HP ZBook Studio G3 Mobile Workstation > HP EliteBook Folio G1 Notebook PC > > The Conexant HD Audio Driver Package has versions for the following > operating systems. > > Microsoft Windows 10 32-Bit > Microsoft Windows 10 64-Bit > Microsoft Windows 10 IOT Enterprise 32-Bit (x86) > Microsoft Windows 10 IOT Enterprise 64-Bit (x86) > Microsoft Windows 7 Enterprise 32 Edition > Microsoft Windows 7 Enterprise 64 Edition > Microsoft Windows 7 Home Basic 32 Edition > Microsoft Windows 7 Home Basic 64 Edition > Microsoft Windows 7 Home Premium 32 Edition > Microsoft Windows 7 Home Premium 64 Edition > Microsoft Windows 7 Professional 32 Edition > Microsoft Windows 7 Professional 64 Edition > Microsoft Windows 7 Starter 32 Edition > Microsoft Windows 7 Ultimate 32 Edition > Microsoft Windows 7 Ultimate 64 Edition > Microsoft Windows Embedded Standard 7 32 > Microsoft Windows Embedded Standard 7E 32-Bit > > HP did not respond to a request for comment from Bleeping Computer in > time for this article's publication. > > Here's how to Check for and Remove the HP MicTray64 Keylogger... > BleepingComputer: https://www.bleepingcomputer.com/news/security/keylogger-found-in-audio-dri…

3 4

Sharing... or Stealing: Claims Uber uses self-driving technology stolen from Google referred to US attorney
by Razer 12 May '17

12 May '17

The "sharing" biz in 'Merica has the ethics of a thief. Not that stealing form Google might be a bad thing, but the fact that BILLIONAIRE VENTURE CAPITALISTS allow to happen in companies they fund and sit on the boards of is telling about what they do to the financial markets they infest as well (Btc too!). Judge refers theft allegations against Uber to US Attorney http://www.mcclatchydc.com/news/politics-government/national-politics/artic… See: "Timeline: Bad news keep piling on for troubled Uber" > Uber has had a rough year, much of it its own making. > > There have been lawsuits, allegations of sexual harassment and a > federal investigation into claims that it has used a fake version of > its app to thwart authorities. Now, a federal judge in San Francisco > has referred allegations of trade secret theft to the U.S. Attorney's > office for investigation. > > Here's a timeline of some of Uber's troubles in recent months. > > — Feb. 2: Amid mounting pressure from employees and calls for boycott > from customers, Uber CEO Travis Kalanick quits President Donald > Trump's council of business leaders. > > — Feb. 19: A former Uber engineer, Susan Fowler, discloses a slew of > sexual harassment and sexism claims in a blog post about her year at > Uber. She wrote that on her first official day on her team at Uber, > her boss propositioned her in a string of messages on the company > chat, and higher-ups ignored her complaints. She outlined examples of > blatant sexism at Uber that was seemingly tolerated by the company. > Kalanick called what she described "abhorrent." > > — Feb. 23: Waymo, a self-driving car company spun off from Google, > sues Uber . Waymo alleges that Anthony Levandowski — a former top > manager for Google's self-driving car project and now the executive > running Uber's self-driving car division — stole pivotal technology > propelling Uber's effort to build autonomous vehicles. > > — Feb. 28: A video emerges of CEO Travis Kalanick arguing with a > driver. It includes yelling and profanity and ends with a combative > Kalanick dismissing the agitated driver's claims that sharp reductions > in fares forced him into bankruptcy. In the video, Kalanick shouts > that "some people don't like to take responsibility for their own > s---. They blame everything in their life on somebody else. Good > luck." He then slams the door. > > — March 3: A New York Times report reveals that the company has been > wielding a secret weapon to thwart authorities who have been trying to > curtail or shut down its ride-hailing service in cities around the > world. One project, called "Greyball," identified regulators who were > posing as riders while trying to collect evidence that Uber's service > was breaking local laws governing taxis. > > — March 19: Uber's president, Jeff Jones, resigns less than a year > after joining the company. He told the tech blog Recode that "the > beliefs and approach to leadership that have guided my career are > inconsistent with what I saw and experienced at Uber, and I can no > longer continue as president of the ride-sharing business." > > — April 12: Uber's head of communications, Rachel Whetstone, is the > latest to leave the company . > > — April 27: Levandowski announces he is stepping aside (though staying > at the company), while Uber defends itself against charges that he > provided Uber's self-driving project with technology stolen from Waymo. > > — May 5: Reports emerge of an audit report by the city of Portland, > Oregon, which reveals that the Justice Department is probing > allegations that Uber used the Greyball software to try to stymie > authorities. > > — May 11: A federal judge in San Francisco refers allegations that > Uber is using trade secrets stolen from Waymo autonomous car to the > U.S. Attorney's office for investigation. http://www.mcclatchydc.com/news/politics-government/national-politics/artic… Rr Ps to those who say "How WILL I get around without Uber?" Take a taxi... Meet someone whose not like you, schmuck.

2 1

The Visual Capitalist
by grarpamp 12 May '17

12 May '17

http://www.visualcapitalist.com/ http://money.visualcapitalist.com/

1 0

Fwd: [Cryptography] Big ugly security problem in post-2008 Intel chipsets.
by grarpamp 12 May '17

12 May '17

---------- Forwarded message ---------- From: iang <iang(a)iang.org> Date: Wed, May 10, 2017 at 10:25 AM Subject: Re: [Cryptography] Big ugly security problem in post-2008 Intel chipsets. To: cryptography(a)metzdowd.com On 07/05/2017 18:38, Peter Todd wrote: > On Sat, May 06, 2017 at 11:28:38PM -0400, iang wrote: >> >> On 01/05/2017 22:40, Ray Dillinger wrote: >> Unpopular opinions! I think there was an element of truth in all that, but >> two things changed - one was the evolution serious criminal gangs which >> industrialised the process. The second was the rise of cyberwar... although >> the jury's out as to whether this was caused by e.g. Obama's OLYMPICGAMES or >> as a natural evolution, a tit for tat. > > Cryptocurrencies have also forced cryptocurrency-related companies to adopt > vastly improved security because theives can directly steal money. Yes, this is why financial cryptography was always more fun. It has the tightest feedback loop - get it wrong and you get robbed. This tight feedback loop is mostly absent in other forms of cryptography such as privacy, retail commerce (aka SSL & passwords), political / natsec and military. Which means, in financial cryptography as opposed to the others, we learn the fastest, assuming we're capable of that. > Additionally theres a second, less-obivous effect of the above: > non-cryptocurrency-related companies are getting hacked by theives trying to > gain access to user data that in turn will let them hack other targets with > cryptocurrency holdings. For example, phone companies are frequently getting > social engineered to exploit their customers' 2FA setups, and in turn, exploit > cryptocurrency accounts at stuff like exchanges. Right. We always knew that the phones were an inadequate 2FA simply because they were relatively easy to attack. And once the stakes were high enough, they were attacked. Now, for online banking, this was sorta maybe ok because the online banks also had other security layers inside the banks, so using the phone was their cheapest widespread option. But this fell apart for cryptocurrencies which typically did not have other layers of protection (ok, they had verbal protections like multisig and and and). The interesting thing is that people wake up and blame the telco. But it was never the telco's threat model to protect bitcoin or online banking... iang _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

The Zen White Paper
by Joshua 12 May '17

12 May '17

The Zen White Paper https://www.scribd.com/document/347946086/Zen-White-Paper Currently as Bitcoin argues aspects of self-accumulation and distribution (the exact same issues fiat currencies face), other competitors have emerged. Many have began to realize the supply of internet money is endless and any project designed to capture more ground in the fight for digital self-determination is a righteous one. With the hybridization of cooperative blockchain projects and digital mints it is possible to build completely autonomous economic systems. In the near future these independent blockchain systems will become interoperable resulting in the overall decline of traditional economic systems and non-cooperative blockchain systems (such as Bitcoin). The ultimate success of these systems directly relies on the mutual usage and transfer of the token. Join us as we deprecate the economic institutions of today for a better tomorrow.

5 9

Re: What is the value of the State?
by Steven Schear 12 May '17

12 May '17

Those pushing the anthropomorphic climate change agenda never, AFAIK, ever admit that this view is ONLY consensus (based on data and models) but not independently verifiable via the Scientific Method, the gold standard for science. Warrant Canary creator On May 8, 2017 5:22 PM, "\0xDynamite" <dreamingforward(a)gmail.com> wrote: >> except for very token >> gestures. > > I don't think that the tens of billions of dollars that go to > special interests including of course the 'scientific' mafia > are a token gesture. There's aren't "tens of billions" of dollars spent to prove global warming except to counter-act the deniers. \x

3 5