- cypherpunks - lists.cpunks.org

Fwd: Re: Update: Dallas tornado alarm hack was a 'phreak' occurrence
by Razer 13 Apr '17

13 Apr '17

On 04/13/2017 06:44 AM, lrk wrote: >> ----- Forwarded message from Razer <g2s(a)riseup.net> ----- >> >> To: cypherpunks(a)lists.cpunks.org >> From: Razer <g2s(a)riseup.net> >> Subject: Update: Dallas tornado alarm hack was a 'phreak' occurrence >> Date: Wed, 12 Apr 2017 20:43:04 -0700 >> >> Phone Phreaks! >> >> >>> DTMF replay phreaked out the Dallas tornado alarm, say researchers >>> >>> Strap yourself into the DeLorean: researchers from Duo reckon the >>> Dallas tornado alarm incident was a case of old-style DMTF phreaking. >>> >>> On Friday night, someone figured out how to activate all 156 of >>> the city's sirens in a stunt hack. >>> >>> It turns out the sirens, from Federal Signal, use one of the >>> oldest signalling techniques around: Dual Tone Multiple >>> Frequencies, or DTMF, originating back in the analogue telephony >>> era. The earliest phreaking attacks exploited the tones used to >>> route phone calls to make free long-distance and international calls. >>> >>> For those who've never noticed the beeps that happen when you >>> press buttons on a fixed-line phone, DMTF represents its symbols >>> with pairs of beeps in this layout: >>> >>> [Image: DMTF tone chart from Wikipedia] >>> >>> Telephone network have long been secured against phreaking, but >>> apparently not the Federal Signal sirens in Dallas. It looks like >>> the system was set off by a simple replay attack: record the >>> signal sent during a system test, and play it back. >>> >>> Duo's blog post notes that the DMTF signals, carried over 450 MHz >>> radio carriers, aren't encrypted, so an attacker wouldn't even >>> need to try and interpret the symbols. >>> >>> The other big compromise, according to Duo, was that someone got >>> access to the computers that control how long the sirens would >>> sound when they were activated. That compromise also made it >>> harder for city officials to shut the system down. ?? >>> >>> Bootnote: Duo is surprised that the attacker was able to work out >>> the radio frequency in use, which sits oddly with the author's >>> theory that a disgruntled insider is the most likely attacker. >>> >>> The Register notes that an insider would probably know what >>> frequency the system used, and 450 MHz is in a band familiar with >>> UHF hobbyists. If the sirens' radio used licenced bands, the FCC >>> has the database online. >>> >>> Even for the 700 MHz band, reserved for public safety in the USA, >>> it's easy enough to buy suitable transmitters. > FYI, tone systems like touch-tone don't work over digital voice. Those > synthesizer systems will not recreate the tones accurately. Trunked systems > have other engineering problems which make them the wrong tool for public > safety but the only thing that counts is that Motorola got the taxpayer's > money. > > And the sound of a snare drum, high hat, cymbals, oboe, etc, has never been the same since 'music went square wave' either. Odd that digitized DTMF tones shouldn't work. No frequency component to any of them so high that is should matter. What I find strange is there's a set of 'outband' tones, not normally used for civilian communication that police and fire departments have used historically to prevent intruders into their communications systems. Dallas must have cheaped the contractor installing the system. Rr

1 0

Russian FOSS activist arrested for extremist materials/Tor exit-node
by stargrave＠stargrave.org 13 Apr '17

13 Apr '17

Dmitry Bogatov was arrested on the 6th of April: he became part of the big penal case initiated by Russia’s Investigation Committee on "incitations to mass riots" during the protest action that took place on the 2nd of April in Moscow. According to the Investigation Committee, Bogatov was publishing messages on the forum sysadmin.ru, inciting to violent actions, for example, "he" was suggesting to bring to the Red Square "bottles, fabric, gasoline, turpentine, foam plastic". According to the Investigation, the experts had analyzed the text of these messages and proved a "linguistic and psychological characteristics of incitations to terrorism". However, Dmitry claims that he has nothing to do with posting the incendiary messages. Dmitry Bogatov, 25 years old, teaches maths in MFUA (Moscow Finance and Law University) was a free and open source software activist (https://sinsekvu.github.io/pages/about.html) Dmitry was administrating a Tor exit node (https://atlas.torproject.org/#details/2402CD5A0D848D1DCA61EB708CC1FBD4364AB…) from his house. In fact, the author of "incendiary messages" (called "Airat Bashirov") was using Tor, and, by lack of chance, he used the ip adress of Dmitry's exit node. Dmitry's lawyer, Alexei Teptsov, presented videos from surveillance cameras, that proved that, during the moments when the "incendiary messages" were posted, Dmitry was away from his computer. He was coming back from a fitness center with his wife, Tatiana, a genetician, and then went to a supermarket, where cameras were also working. Moreover, "Airat Bashirov", the author of the provocative messages, continues to post on sysadmin.ru, while Dmitry is under arrest. The last post was seen on the forum on April 11. Dmitry will stay in pre-trial detention center until June 8 at least. Now the Investigation is examining all his seized devices. Dmitry Bogatov aka KAction, Russian free software activist and mathematics teacher at Moscow’s Finance and Law University, arrested in Russia and charged with extremism. https://news.ycombinator.com/item?id=14096625 https://meduza.io/en/feature/2017/04/10/mathematics-teacher-accused-of-inci… https://geektimes.ru/post/287944/ (russian)

1 0

FreeBSD
by grarpamp 13 Apr '17

13 Apr '17

FreeBSD: Not a Linux Distro https://www.youtube.com/watch?v=wwbO4eTieQY https://www.youtube.com/results?search_query=freebsd+raspberry+pi

3 2

Update: Dallas tornado alarm hack was a 'phreak' occurrence
by Razer 13 Apr '17

13 Apr '17

Phone Phreaks! > DTMF replay phreaked out the Dallas tornado alarm, say researchers > > Strap yourself into the DeLorean: researchers from Duo reckon the > Dallas tornado alarm incident was a case of old-style DMTF phreaking. > > On Friday night, someone figured out how to activate all 156 of > the city's sirens in a stunt hack. > > It turns out the sirens, from Federal Signal, use one of the > oldest signalling techniques around: Dual Tone Multiple > Frequencies, or DTMF, originating back in the analogue telephony > era. The earliest phreaking attacks exploited the tones used to > route phone calls to make free long-distance and international calls. > > For those who've never noticed the beeps that happen when you > press buttons on a fixed-line phone, DMTF represents its symbols > with pairs of beeps in this layout: > > [Image: DMTF tone chart from Wikipedia] > > Telephone network have long been secured against phreaking, but > apparently not the Federal Signal sirens in Dallas. It looks like > the system was set off by a simple replay attack: record the > signal sent during a system test, and play it back. > > Duo's blog post notes that the DMTF signals, carried over 450 MHz > radio carriers, aren't encrypted, so an attacker wouldn't even > need to try and interpret the symbols. > > The other big compromise, according to Duo, was that someone got > access to the computers that control how long the sirens would > sound when they were activated. That compromise also made it > harder for city officials to shut the system down. ® > > Bootnote: Duo is surprised that the attacker was able to work out > the radio frequency in use, which sits oddly with the author's > theory that a disgruntled insider is the most likely attacker. > > The Register notes that an insider would probably know what > frequency the system used, and 450 MHz is in a band familiar with > UHF hobbyists. If the sirens' radio used licenced bands, the FCC > has the database online. > > Even for the 700 MHz band, reserved for public safety in the USA, > it's easy enough to buy suitable transmitters. https://www.theregister.co.uk/2017/04/13/dtmf_replay_phreaked_out_the_dalla…

2 1

before snowden
by juan 13 Apr '17

13 Apr '17

january 2012 http://www.dailymail.co.uk/news/article-2093796/Emily-Bunting-Leigh-Van-Bry…

1 0

talk shit on the interweb - ten years in jail
by juan 13 Apr '17

13 Apr '17

http://www.bbc.com/news/world-us-canada-39573922

1 0

Bolero Aussie crowd strike
by Zenaan Harkness 12 Apr '17

12 Apr '17

Nicely done... *Suggest full screen and speakers on to enjoy this wonderful rendition. * http://www.youtube.com/embed/xn7CYzPMf2o

1 0

Inconvenient Things: Truth To Power
by grarpamp 12 Apr '17

12 Apr '17

Al Gore, An Inconvenient Sequel: Truth To Power https://www.youtube.com/watch?v=huX1bmfdkyA Also inconvenient... DPRK, trending https://twitter.com/willripleyCNN https://www.reddit.com/r/northkorea+dprk and Bad Batches of Lawless Punks https://www.youtube.com/watch?v=AcYYsUpxlsI

1 0

The Crushing of Net Neutrality, Science, and Income
by grarpamp 12 Apr '17

12 Apr '17

https://tech.slashdot.org/story/17/04/12/1655222/silicon-valley-kicks-off-f… https://motherboard.vice.com/en_us/article/tennessee-could-give-taxpayers-a… https://muninetworks.org/content/tn-bills-worth-watching-supporting http://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB0529 https://tech.slashdot.org/story/17/04/11/2041207/twitter-allegedly-deleting… https://www.washingtonpost.com/local/public-safety/sessions-orders-justice-… https://hbr.org/2017/04/we-tracked-every-dollar-235-u-s-households-spent-fo… Makers tho... ;) http://cbs6albany.com/news/nation-world/investigation-finds-inmates-built-c… ... for free access to all human knowledge, which you're hardly allowed to build either... https://backchannel.com/how-google-book-search-got-lost-c2d2cf77121d

2 2

National Security Implications of Virtual Currency
by Joshua 12 Apr '17

12 Apr '17

http://www.rand.org/pubs/research_reports/RR1231.html Key Findings Non-State Actors Can Use VCs to Disrupt Sovereignty and Increase Political and/or Economic Power, but Unlikely to Use Established VC; Many Challenges Posed by Creation of VCs - VC deployments are attractive in developing countries and in countries undergoing internal turmoil, where the existing financial infrastructure is either insufficient or weakened. - The rapid deployment of a VC over a large geographic area would likely be less complicated than deploying more common currencies, such as those based on commodities or paper-based currencies. - A non-state actor's VC (including Bitcoin-like currencies) would likely be vulnerable to cyber attack by a sophisticated adversary; more generally, creating new, usable yet reliable VC may pose great challenges, particularly for a non-state actor without technical sophistication. - Promoting adoption of VCs among population is difficult due to newness, lack of legitimacy, and familiarity with physical tangibility of currency. - Deployment of a VC by non-state actors, such terrorist organizations, insurgent groups, drug cartels, and other criminal organizations, would be easier if supported by a nation-state with advanced cyber expertise. - Despite numerous hurdles, trends indicate a future in which VCs could be deployed by non-state actors or other organizations. Sent from [ProtonMail](https://protonmail.ch), encrypted email based in Switzerland.

1 0