- cypherpunks - lists.cpunks.org

Bitcoiner Running Game On NYDFS BitLicense In Court
by grarpamp 01 Apr '17

01 Apr '17

http://www.article78againstnydfs.com/ https://cei.org/blog/new-yorks-bitlicense-trial https://www.2600.com/offthehook/mp3files/2017/off_the_hook__20170329.mp3 New York's "BitLicense" on Trial Jim Harper • March 8, 2017 Regulators enjoy a lot of deference in the courts, and New York regulations in New York courts are no exception. But Theo Chino’s challenge to New York’s “BitLicense” regulation stands as good a chance as I’ve seen of toppling an inadvisable and poorly devised regulation. I was happy to play a small part this week in the effort to get the regulation overturned. For those just tuning in, the “BitLicense” is a special regulation aimed at Bitcoin businesses, which the New York Department of Financial Services (NYDFS) issued in June, 2015. When New York’s then-Superintendent of Financial Services Benjamin Lawsky first encountered Bitcoin, he sent subpoenas to everyone in the Bitcoin world and went on TV talking about “narcoterrorists.” But by the time he concluded the matter, he thought differently. In fact, immediately after his office finalized the “BitLicense” regulation, Lawsky decamped to a private sector consultancy where his website now boasts that he was one of 2014’s “Top Ten Most Influential People in Bitcoin.” Since imposing the “BitLicense” requirement, the NYDFS has licensed (or “chartered”) a whopping five companies (as of January, at least). The NYDFS has chased off four other companies trying to provide Bitcoin services in New York. They join the many more firms that suspended services in New York after the regulation was finalized. Enter Theo Chino. While the big Bitcoin companies steered clear or meekly complied with the BitLicense – they expect to be repeat players before the NYDFS, of course – Mr. Chino opted to stand and fight. First filing a pro se petition against the regulation, he now has counsel to carry forward what is known as an Article 78 action against the “BitLicense” regulation. An Article 78 proceeding in New York allows aggrieved parties to challenge regulatory actions, including actions taken that are beyond the jurisdiction of the regulatory body or officer. That is one basis for Chino’s challenge: that the NYDFS was never given authority by the legislature to regulate Bitcoin. Another argument is that the action was arbitrary and capricious or an abuse of discretion. In theory, administrative regulation assigns expert, neutral lawmakers to the task of taking arguments from the public and figuring out the very best rules. This doesn’t seem to be what happened in the BitLicense rulemaking. As I described to the New York Supreme Court in an affidavit filed by Chino’s counsel this week, the NYDFS stated that “extensive research and analysis” supported the “BitLicense” regulation. But when I asked for it (wearing my hat as the Bitcoin Foundation’s Global Policy Counsel), the agency first promised to share it, then delayed sharing it, and then never shared it. As a point of comparison, at this time the European Banking Authority had produced a 46-page analysis of benefits and risks from Bitcoin. The results were far from perfect, but the methodology allowed for reasoned debate about the need for regulation and what any regulation might address. The EBA demonstrated part of what an administrative rulemaking process should entail. The NYDFS either didn’t do any analysis to speak of or declined to make its analysis public, denying itself feedback from Bitcoin experts. Not only do the defects in the NYDFS’s processes bode well for Theo Chino’s Article 78 challenge to the “BitLicense,” the results do, too. The BitLicense made New York a pariah jurisdiction for Bitcoin, denying consumers access to service providers in this highly innovative field. The world’s financial capital has made itself a Bitcoin backwater. Other regulators, looking on with interest, have not followed New York’s lead. Thanks to the persistence of Theo Chino and his counsel, the “BitLicense” is in the dock and heading for trial. The case will have many twists and turns, but hopefully the idea of special, restrictive regulation aimed at digital currency will get the electric – er, the electronic chair.

1 0

SuperNET, Blockchain (and Governance?)
by grarpamp 01 Apr '17

01 Apr '17

https://bitcointalk.org/index.php?topic=762346 https://supernet.org/ http://www.digitalcatallaxy.com/report2015.html

1 0

Keyshuffling Nintendo 3DS Secure Bootchain
by grarpamp 01 Apr '17

01 Apr '17

https://github.com/Plailect/keyshuffling https://www.3dbrew.org/ https://media.ccc.de/v/32c3-7240-console_hacking We demonstrate an attack on the secure bootchain of the Nintendo 3DS in order to gain early code execution. The attack utilizes the block shuffling vulnerability of the ECB cipher mode to rearrange keys in the Nintendo 3DS's encrypted keystore. Because the shuffled keys will deterministically decrypt the encrypted firmware binary to incorrect plaintext data and execute it, and because the device's memory contents are kept between hard reboots, it is possible to reliably reach a branching instruction to a payload in memory. This payload, due to its execution by a privileged processor and its early execution, is able to extract the hash of hardware secrets necessary to decrypt the device's encrypted keystore and set up a persistant exploit of the system.

1 0

WikiLeaks: Vault7 Marble Framework, CIA, Barrett Brown Commentary
by grarpamp 01 Apr '17

01 Apr '17

https://wikileaks.org/vault7/releases/#Marble%20Framework Today, March 31st 2017, WikiLeaks releases Vault 7 "Marble" -- 676 source code files for the CIA's secret anti-forensic Marble Framework. Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA. https://sputniknews.com/radio_by_any_means/201703301052100018-dangers-of-th… https://video.img.ria.ru/Out/MP3/20170329/2017_03_29_ByAnyMeans188Sprkr_yfl… @07:10 On this episode of "By Any Means Necessary" host Eugene Puryear is joined by award winning journalist Barrett Brown. Barrett founded Project PM, a research collaboration and wiki, to facilitate analysis of the troves of hacked emails and other leaked information concerning the inner workings of the cyber-military-industrial complex. In January 2015, Brown was sentenced to 63 months in federal prison for the crimes of accessory after the fact, obstruction of justice, and threatening a federal officer stemming from the FBI's investigation into the 2012 Stratfor email leak. On November 29, 2016, Barrett Brown was released from federal custody. Barrett returns to talk about the Vault 7 Wikileaks, the usage of the internet of things, the cyber-security landscape, and the relationship between the US intelligence community and multinational corporations.

2 2

[Suitable for framing] "Because All Their Talk About Personal Freedom Is Bullshit"
by Razer 01 Apr '17

01 Apr '17

2 1

James Atkinson: Tapping Presidential Wires, A Spy Hunters Perspective
by grarpamp 01 Apr '17

01 Apr '17

https://cryptome.org/2017/03/Trumps-Fiber-Rings-NSA-Eavesdropping-03-17-201… http://www.gloucestertimes.com/news/local_news/spy-hunter-gets-probation-in… https://www.youtube.com/watch?v=Fm6QtRMuJfQ SYNOPSIS: Our modern day lives are brief, very intense flashes of light, circling The World on ultra-pure puffs of smoke, and our governments crave to capture all those flashes of lights. There is no doubt that routine clear intercepts and eavesdropping has and is continuing without a peep from any of the nationally recognized news agencies reminiscent of Rome's bread and circus days. Detailed below is a detailed account of routine spy intercept programs which are designated as "legal" in which Trump Tower, like millions of others, were indeed intercepted. [Paper continues at length...] ModernTechnologicalMarvels MassiveConcentratedAccess TheFlyintheOintment FreedomFromDetection(Usually) AccessByDefaultAKeytoHelptheEavesdroppers FlexibleRestrictionsontheGovernment ReigningintheGovernmentandBreachesofConstitutionalLaw SpecialTopSecretECIWiretapping FAIRVIEWLONGLINESTITANPOINTESKYSCRAPER COOLSPYHUNTINGMETHOD TheNewYorkReachAround TheFiveEyesReachAroundinAction ShuttingDownTheNSAInterceptions,Legally DecadesofUnlawfulEavesdroppingResultsin"MoreCareful"Wiretapping ALongHistoryofPresidentsBuggingTheirPoliticalOpponents LetUsNotForget"TrickyDickey" UnlawfulWiretappingUnderFISA AndThenTherewas9/11 TheGrandAmericanTraditionContinues ChainofFools I'maUSCitizenI'mNotaTerroristIJustWantedtoSeeParis InHatredWeTrust 2016-TheEstablishedPoliticalStructuresBegintoShake StreetWise,andPrivacyAstute Behold,TheEmperorisNaked HugeSteelBox,toHideaVerySmallKey PseudoScramblingAsanIllusionofEncryption Tappingthe"Wires"ofPresidentTrump WashingtonDCPlumbers OneForeignerintheBuilding InTime,theDetailsWillBeTold AHistoricalPatternofMotiveandPractice SpiesatHolmdel,MiddletonandNorthAndover Room641AinSanFrancisco ECIFAIRVIEWandBLARNEY Alas,poorYorick!Iknewhim,Horatio... Speakingofthe1970WilliamBinney TheWorstNightmareoftheNSA,AndAnEpicDisaster TheWrinkle NSARegionalDataCenters Let'sTalkAboutCloudComputing AmazonWebServices,andFrontCompanies WhatisanNSARegionalSignalsOperationsCenterRSOC? Conclusions Mr.Atkinson is the industry leader in Bug Sweeps, Wiretap Detection, Detection of Covert Video Cameras, Detection of Covert Microphones, and related inspections, TSCM, TEMPEST, NONSTOP, Emissions Security (EMSEC), Signals Intelligence and related fields. He has forty years of hands-on experience on a wide range of computer systems, involving multiple generations of technology, including huge, highly secure, and highly classified mainframe systems, to modern desktop, laptop, and handheld computers. Well experienced in the design and development, prototyping, and production of specialized electronic devices and instrumentation. He is also a skilled photographer, computer programmer and artist. He is a recognized expert technical, analytical and research for the detection, nullification, and isolation of eavesdropping devices, technical surveillance penetrations, technical surveillance hazards, and physical security weaknesses. Mr. Atkinson is highly skilled in intelligence Analysis and activities to determine the existence and capability of surveillance equipment being used against the governments, corporations, establishments, or persons. He is also formally trained in technical, forensic skills to include computer forensics, network forensics, hard drive forensics, Wi-Fi forensics, WAN forensics, and cell phone forensics. He has testified as an expert witness is numerous courts, and has been called to testify before Congress three times as an expert witness. Mr. Atkinson is considered to be the "Leonardo da Vinci of Bug Sweeps."

1 0

Wikileaks CIA hacking tools.
by jim bell 01 Apr '17

01 Apr '17

WikiLeaks says CIA disguised hacking as Russian or Chinese activity http://dailym.ai/2oFVI1t via http://dailym.ai/android

1 0

[OT] Donald Trump Soundboard + Donald Trump Voodoo
by Cecilia Tanaka 31 Mar '17

31 Mar '17

Donald Trump Soundboard, la la la... :D <https://play.google.com/store/apps/details?id=com.berrybongobrother.donaldt…> Bonus LOL: - Donald Trump Voodoo :D <https://www.etsy.com/pt/listing/387489774/to-your-health-sale-donald-trump-…>

2 3

VPNs and Proxies: Not Exactly Magical
by grarpamp 31 Mar '17

31 Mar '17

https://www.cnet.com/news/vpn-protect-online-privacy-its-complicated/ https://www.wired.com/2015/07/proxy-services-totally-unsecure-alternatives/

2 1

Realities of Data Mining / Brokering You and Beyond
by grarpamp 31 Mar '17

31 Mar '17

https://www.reddit.com/r/news/comments/62fjdr/cards_against_humanity_creato… https://www.reddit.com/user/delftblauw http://www.stopdatamining.me/opt-out-list/ I wanted to counter some notions that this is not personally identifiable information. The data from ISPs itself is not. It is true that you won't be able to call the ISP company and ask for the search history of /u/delftblauw (I am boring anyway), but rather it is how that little slice of data the ISPs provide is part of the whole pie that is your digital profile. I worked in the industry that aggregates and models your data and wanted to give some insight to how this all works for those willing to read this wall of text. I started in IT fresh out of college for a small marketing company in the Midwest that aggregated personal information and demographics to sell lists for companies to market to. We worked with a larger company that provided us a "master list" of persons in the US. This master list was kind of like a digital phone book, with a lot of aggregate demographics attached to the record. All sorts of information was collected in aggregate from private and public sources this larger company gathered. Attributes such as political affiliations are garnered from lists bought from political parties and candidates you donated to. Personal interests from the magazines you subscribe to, even charities and causes you donate to. Of course your age, estimated income, household size, education, etc. are all folded in. The aggregation here works off of semi-anonymous identifiers and keys that are incredibly interconnected digitally such as your home address, email address, phone numbers, and even usernames for niche topics. The aggregation is pulled together from disparate sources. For example, let's say Company A gave us your name and email address along with the fact you are "likely" a democrat since you contributed $10 to Bernie Sanders PAC. Company B is "more secure" so they only provide your email address and the fact that you said you make over $100k on their survey. Company C gives us your name and home address along with the fact that you subscribe to National Geographic. We can query census data to find the average income in your census block based on your address. Also, I see your home address has a lien on it from the HOA dues you didn't pay after linking the public record provided from your county government. I say it's semi-anonymous because on its own these elements don't identify you, and they are subject to change. However, these attribute have varying degrees of permanency. You are far more likely to change your home address than your email address, and you are more likely to have multiple email addresses than you are phone numbers. There is a reason LinkedIn and Facebook Messenger will not shut up about asking for your phone number. Now think of things like Reddit. How many accounts do you have? One, for sure right? Maybe another for a throwaway? Your main account has all that sweet karma though, no way you're going to abandon that. If Reddit sells your username and the email address you registered together (no idea if they do this, this is purely a hypothetical everyone reading here can relate to), all of the sudden the "master list" now has your Reddit username. Tack on the fact that the subreddits you are subscribed to indicates likely interest. For instance, if you are subscribed to a very loud subreddit dedicated to the current US president along with other conservative subreddits, you are likely a Republican. If you are subscribed to those along with Democrat-leaning subreddits, you are likely highly interested in politics in general. My job was to build everything from queries to ANN models to create a profile for you. Given the basic example above, three companies and public data just let me identify or at least make an educated guess linking your name, email address, phone number, address, hobbies, income, and public delinquencies. This is basic, and there is a lot more that goes into this, but it should give a rough idea here. I did it. Facebook does it. Reddit does it. And now your ISPs are/will continue doing it. Now, the way we monetize this is from the aggregate list. The more data we have on you, and the higher confidence we have in that data, the more valuable you are to us. One of our partners was a large website used for researching new car purchases. They would give us their data to build into our models and sell on their behalf. When a car manufacturer would call us and ask for a list of households with 5+ people, income 75k+, and have a car first registered 4+ years ago, and were researching competitor models, we could look at our models and pull back a list of names, email address, phone numbers, etc. they can market to. This is how you get the email that says, "Instead of the CX9, take a look at the all new 2018 Subaru Ascent!" just a few days after you were casually looking at a car. For the digital companies like Facebook, Google, and Reddit, this data is largely self-serving to be able to target ads to you as you use the site. Now that said, this is all absolutely personally identifiable. I routinely queried myself as well as friends and family to pull back their "full profile". Everyone I showed had the same reaction that goes from utter surprise to a mix of embarrassment and vulnerability. I always tried to reassure them that there was nothing "crazy" we could find out, but if I wanted to I could have checked the debt and credit history, political party, and general interests, and gender (no surprises!) of all the dates I had in my 20's. Just joking, I was a data engineer, I didn't have any dates! After I left there, I made sure to opt out of the master list we received from the larger company. There are so many damn companies doing this now it's exhausting. Once your data is out there, it's out there forever. If my old company was the only company that had say, the ability to know if I contributed to the Endangered Toucan Fund, and a company came along asking for a list of people who support endangered wildlife, they could purchase my email address and now all of the sudden my old company just became Company N from the example listed above. I have learned to just accept this as a fact of the digital age. Edit: For those looking to opt-out from the large private data aggregation and mining that is going on all over, here is a good list to start from. It's whack-a-mole though guys and gals. For every one you opt out of, a new start up is niche mining something else. Try and make peace or push public policy.

1 0