- cypherpunks - lists.cpunks.org

Keyshuffling Nintendo 3DS Secure Bootchain
by grarpamp 01 Apr '17

01 Apr '17

https://github.com/Plailect/keyshuffling https://www.3dbrew.org/ https://media.ccc.de/v/32c3-7240-console_hacking We demonstrate an attack on the secure bootchain of the Nintendo 3DS in order to gain early code execution. The attack utilizes the block shuffling vulnerability of the ECB cipher mode to rearrange keys in the Nintendo 3DS's encrypted keystore. Because the shuffled keys will deterministically decrypt the encrypted firmware binary to incorrect plaintext data and execute it, and because the device's memory contents are kept between hard reboots, it is possible to reliably reach a branching instruction to a payload in memory. This payload, due to its execution by a privileged processor and its early execution, is able to extract the hash of hardware secrets necessary to decrypt the device's encrypted keystore and set up a persistant exploit of the system.

1 0

WikiLeaks: Vault7 Marble Framework, CIA, Barrett Brown Commentary
by grarpamp 01 Apr '17

01 Apr '17

https://wikileaks.org/vault7/releases/#Marble%20Framework Today, March 31st 2017, WikiLeaks releases Vault 7 "Marble" -- 676 source code files for the CIA's secret anti-forensic Marble Framework. Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA. https://sputniknews.com/radio_by_any_means/201703301052100018-dangers-of-th… https://video.img.ria.ru/Out/MP3/20170329/2017_03_29_ByAnyMeans188Sprkr_yfl… @07:10 On this episode of "By Any Means Necessary" host Eugene Puryear is joined by award winning journalist Barrett Brown. Barrett founded Project PM, a research collaboration and wiki, to facilitate analysis of the troves of hacked emails and other leaked information concerning the inner workings of the cyber-military-industrial complex. In January 2015, Brown was sentenced to 63 months in federal prison for the crimes of accessory after the fact, obstruction of justice, and threatening a federal officer stemming from the FBI's investigation into the 2012 Stratfor email leak. On November 29, 2016, Barrett Brown was released from federal custody. Barrett returns to talk about the Vault 7 Wikileaks, the usage of the internet of things, the cyber-security landscape, and the relationship between the US intelligence community and multinational corporations.

2 2

[Suitable for framing] "Because All Their Talk About Personal Freedom Is Bullshit"
by Razer 01 Apr '17

01 Apr '17

2 1

James Atkinson: Tapping Presidential Wires, A Spy Hunters Perspective
by grarpamp 01 Apr '17

01 Apr '17

https://cryptome.org/2017/03/Trumps-Fiber-Rings-NSA-Eavesdropping-03-17-201… http://www.gloucestertimes.com/news/local_news/spy-hunter-gets-probation-in… https://www.youtube.com/watch?v=Fm6QtRMuJfQ SYNOPSIS: Our modern day lives are brief, very intense flashes of light, circling The World on ultra-pure puffs of smoke, and our governments crave to capture all those flashes of lights. There is no doubt that routine clear intercepts and eavesdropping has and is continuing without a peep from any of the nationally recognized news agencies reminiscent of Rome's bread and circus days. Detailed below is a detailed account of routine spy intercept programs which are designated as "legal" in which Trump Tower, like millions of others, were indeed intercepted. [Paper continues at length...] ModernTechnologicalMarvels MassiveConcentratedAccess TheFlyintheOintment FreedomFromDetection(Usually) AccessByDefaultAKeytoHelptheEavesdroppers FlexibleRestrictionsontheGovernment ReigningintheGovernmentandBreachesofConstitutionalLaw SpecialTopSecretECIWiretapping FAIRVIEWLONGLINESTITANPOINTESKYSCRAPER COOLSPYHUNTINGMETHOD TheNewYorkReachAround TheFiveEyesReachAroundinAction ShuttingDownTheNSAInterceptions,Legally DecadesofUnlawfulEavesdroppingResultsin"MoreCareful"Wiretapping ALongHistoryofPresidentsBuggingTheirPoliticalOpponents LetUsNotForget"TrickyDickey" UnlawfulWiretappingUnderFISA AndThenTherewas9/11 TheGrandAmericanTraditionContinues ChainofFools I'maUSCitizenI'mNotaTerroristIJustWantedtoSeeParis InHatredWeTrust 2016-TheEstablishedPoliticalStructuresBegintoShake StreetWise,andPrivacyAstute Behold,TheEmperorisNaked HugeSteelBox,toHideaVerySmallKey PseudoScramblingAsanIllusionofEncryption Tappingthe"Wires"ofPresidentTrump WashingtonDCPlumbers OneForeignerintheBuilding InTime,theDetailsWillBeTold AHistoricalPatternofMotiveandPractice SpiesatHolmdel,MiddletonandNorthAndover Room641AinSanFrancisco ECIFAIRVIEWandBLARNEY Alas,poorYorick!Iknewhim,Horatio... Speakingofthe1970WilliamBinney TheWorstNightmareoftheNSA,AndAnEpicDisaster TheWrinkle NSARegionalDataCenters Let'sTalkAboutCloudComputing AmazonWebServices,andFrontCompanies WhatisanNSARegionalSignalsOperationsCenterRSOC? Conclusions Mr.Atkinson is the industry leader in Bug Sweeps, Wiretap Detection, Detection of Covert Video Cameras, Detection of Covert Microphones, and related inspections, TSCM, TEMPEST, NONSTOP, Emissions Security (EMSEC), Signals Intelligence and related fields. He has forty years of hands-on experience on a wide range of computer systems, involving multiple generations of technology, including huge, highly secure, and highly classified mainframe systems, to modern desktop, laptop, and handheld computers. Well experienced in the design and development, prototyping, and production of specialized electronic devices and instrumentation. He is also a skilled photographer, computer programmer and artist. He is a recognized expert technical, analytical and research for the detection, nullification, and isolation of eavesdropping devices, technical surveillance penetrations, technical surveillance hazards, and physical security weaknesses. Mr. Atkinson is highly skilled in intelligence Analysis and activities to determine the existence and capability of surveillance equipment being used against the governments, corporations, establishments, or persons. He is also formally trained in technical, forensic skills to include computer forensics, network forensics, hard drive forensics, Wi-Fi forensics, WAN forensics, and cell phone forensics. He has testified as an expert witness is numerous courts, and has been called to testify before Congress three times as an expert witness. Mr. Atkinson is considered to be the "Leonardo da Vinci of Bug Sweeps."

1 0

Wikileaks CIA hacking tools.
by jim bell 01 Apr '17

01 Apr '17

WikiLeaks says CIA disguised hacking as Russian or Chinese activity http://dailym.ai/2oFVI1t via http://dailym.ai/android

1 0

[OT] Donald Trump Soundboard + Donald Trump Voodoo
by Cecilia Tanaka 31 Mar '17

31 Mar '17

Donald Trump Soundboard, la la la... :D <https://play.google.com/store/apps/details?id=com.berrybongobrother.donaldt…> Bonus LOL: - Donald Trump Voodoo :D <https://www.etsy.com/pt/listing/387489774/to-your-health-sale-donald-trump-…>

2 3

VPNs and Proxies: Not Exactly Magical
by grarpamp 31 Mar '17

31 Mar '17

https://www.cnet.com/news/vpn-protect-online-privacy-its-complicated/ https://www.wired.com/2015/07/proxy-services-totally-unsecure-alternatives/

2 1

Realities of Data Mining / Brokering You and Beyond
by grarpamp 31 Mar '17

31 Mar '17

https://www.reddit.com/r/news/comments/62fjdr/cards_against_humanity_creato… https://www.reddit.com/user/delftblauw http://www.stopdatamining.me/opt-out-list/ I wanted to counter some notions that this is not personally identifiable information. The data from ISPs itself is not. It is true that you won't be able to call the ISP company and ask for the search history of /u/delftblauw (I am boring anyway), but rather it is how that little slice of data the ISPs provide is part of the whole pie that is your digital profile. I worked in the industry that aggregates and models your data and wanted to give some insight to how this all works for those willing to read this wall of text. I started in IT fresh out of college for a small marketing company in the Midwest that aggregated personal information and demographics to sell lists for companies to market to. We worked with a larger company that provided us a "master list" of persons in the US. This master list was kind of like a digital phone book, with a lot of aggregate demographics attached to the record. All sorts of information was collected in aggregate from private and public sources this larger company gathered. Attributes such as political affiliations are garnered from lists bought from political parties and candidates you donated to. Personal interests from the magazines you subscribe to, even charities and causes you donate to. Of course your age, estimated income, household size, education, etc. are all folded in. The aggregation here works off of semi-anonymous identifiers and keys that are incredibly interconnected digitally such as your home address, email address, phone numbers, and even usernames for niche topics. The aggregation is pulled together from disparate sources. For example, let's say Company A gave us your name and email address along with the fact you are "likely" a democrat since you contributed $10 to Bernie Sanders PAC. Company B is "more secure" so they only provide your email address and the fact that you said you make over $100k on their survey. Company C gives us your name and home address along with the fact that you subscribe to National Geographic. We can query census data to find the average income in your census block based on your address. Also, I see your home address has a lien on it from the HOA dues you didn't pay after linking the public record provided from your county government. I say it's semi-anonymous because on its own these elements don't identify you, and they are subject to change. However, these attribute have varying degrees of permanency. You are far more likely to change your home address than your email address, and you are more likely to have multiple email addresses than you are phone numbers. There is a reason LinkedIn and Facebook Messenger will not shut up about asking for your phone number. Now think of things like Reddit. How many accounts do you have? One, for sure right? Maybe another for a throwaway? Your main account has all that sweet karma though, no way you're going to abandon that. If Reddit sells your username and the email address you registered together (no idea if they do this, this is purely a hypothetical everyone reading here can relate to), all of the sudden the "master list" now has your Reddit username. Tack on the fact that the subreddits you are subscribed to indicates likely interest. For instance, if you are subscribed to a very loud subreddit dedicated to the current US president along with other conservative subreddits, you are likely a Republican. If you are subscribed to those along with Democrat-leaning subreddits, you are likely highly interested in politics in general. My job was to build everything from queries to ANN models to create a profile for you. Given the basic example above, three companies and public data just let me identify or at least make an educated guess linking your name, email address, phone number, address, hobbies, income, and public delinquencies. This is basic, and there is a lot more that goes into this, but it should give a rough idea here. I did it. Facebook does it. Reddit does it. And now your ISPs are/will continue doing it. Now, the way we monetize this is from the aggregate list. The more data we have on you, and the higher confidence we have in that data, the more valuable you are to us. One of our partners was a large website used for researching new car purchases. They would give us their data to build into our models and sell on their behalf. When a car manufacturer would call us and ask for a list of households with 5+ people, income 75k+, and have a car first registered 4+ years ago, and were researching competitor models, we could look at our models and pull back a list of names, email address, phone numbers, etc. they can market to. This is how you get the email that says, "Instead of the CX9, take a look at the all new 2018 Subaru Ascent!" just a few days after you were casually looking at a car. For the digital companies like Facebook, Google, and Reddit, this data is largely self-serving to be able to target ads to you as you use the site. Now that said, this is all absolutely personally identifiable. I routinely queried myself as well as friends and family to pull back their "full profile". Everyone I showed had the same reaction that goes from utter surprise to a mix of embarrassment and vulnerability. I always tried to reassure them that there was nothing "crazy" we could find out, but if I wanted to I could have checked the debt and credit history, political party, and general interests, and gender (no surprises!) of all the dates I had in my 20's. Just joking, I was a data engineer, I didn't have any dates! After I left there, I made sure to opt out of the master list we received from the larger company. There are so many damn companies doing this now it's exhausting. Once your data is out there, it's out there forever. If my old company was the only company that had say, the ability to know if I contributed to the Endangered Toucan Fund, and a company came along asking for a list of people who support endangered wildlife, they could purchase my email address and now all of the sudden my old company just became Company N from the example listed above. I have learned to just accept this as a fact of the digital age. Edit: For those looking to opt-out from the large private data aggregation and mining that is going on all over, here is a good list to start from. It's whack-a-mole though guys and gals. For every one you opt out of, a new start up is niche mining something else. Try and make peace or push public policy.

1 0

Cashless Australia Go Fuck Yourself, And Some Other Things
by grarpamp 30 Mar '17

30 Mar '17

https://news.slashdot.org/story/17/03/27/0220216/is-australia-becoming-a-ca… http://www.abc.net.au/news/2017-03-27/is-australia-on-the-brink-of-becoming… http://www.smh.com.au/business/atm-use-hits-15yearlow-as-shift-to-cashless-… Australia's Reserve Bank will roll out an instantaneous money-transferring technology later this year, "which will push Australia even further towards being a cashless society," according to ABC. An anonymous reader quotes their report: In 2014, 12 financial institutions signed up to build the "New Payment Platform," partly as a way of bringing Australia up to speed with other countries that are ahead in the race to becoming completely cashless. Sweden is on track to become the world's first completely cashless economy, and just last November India got rid of its highest denomination bills, effectively eliminating 90 per cent of its paper money... The "New Payment Platform" will mean money can be transferred almost instantaneously, even when the payer and payee are members of different banks. "It's estimated that somewhere between about $3.5 and $5 billion in Australia every year is lost in tax revenue due to the sort of cash economy," says an economics professor at the University of New South Wales, who predicts Australia could be cash-free by 2020. The Australian Payments Association reports that over 75% of the country's face-to-face payments are already tap-and-go, and ATM withdrawals have sunk to a 15-year low. Fuck Australia and Fuck their stupid Queen too. Fuck Tax. Fuck Control. Fuck Slavery. Fuck Databases. Fuck Surveillance. Fuck Religion. Fuck Police. Fuck BigCorp. Fuck Governments and the all Idiots in them. Fucking stupid world.

4 5

the Janssen Scale of Delusion
by Jr. Gong 30 Mar '17

30 Mar '17

> xDynamite dreamingforward at gmail.com > Sun Mar 26 13:13:33 PDT 2017 > > Christians Encrypted their mushroom cult in a deity. Their (((homeboy))) Moses inhaled DMT kickin' it behind that burning acacia bush and came up with the morals you argue for...and yet you are against "drugs". Food has root control of the body, mind, and soul, "drugs" are userland. You must be against the cocoa bean, too, yeah ? > "Smoking pot is harmless", for example, is the > first seed of delusion Anyone who doesn't question "harmless" with "how ?" is doomed to begin with. The delusion is in the trusting of others. > which allows the user to allow Sounds like a sheckle scheme to me. > brain to get co-opted by the toxicity of THC. Prove it is "toxic".

3 2