- cypherpunks - lists.cpunks.org

Chrome 56 Adds Bluetooth Snitch API (will tell you when your fridge needs defrosting)
by Razer 07 Feb '17

07 Feb '17

When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it. https://www.theregister.co.uk/2017/02/05/chrome_56_quietly_added_bluetooth_… https://yro.slashdot.org/story/17/02/06/1425208/chrome-56-quietly-added-blu…

1 0

Dozens of iOS TLS-enabled Apps Subject to MITM Attacks
by Razer 07 Feb '17

07 Feb '17

While developing a tool for evaluating mobile application security, researchers at Sudo Security Group Inc. found out something unexpected. Seventy-six popular applications in Apple's iOS App Store, they discovered, had implemented encrypted communications with their back-end services in such a way that user information could be intercepted by a man-in-the-middle attack. The applications could be fooled by a forged certificate sent back by a proxy, allowing their Transport Layer Security to be unencrypted and examined as it is passed over the Internet. The discovery was initially the result of bulk analysis done by Sudo's verify.ly, a service that performs bulk static analysis of application binaries from Apple's App Store. Will Strafach, president of Sudo, verified the applications discovered by the system were vulnerable in the lab, using a network proxy configured with its own Secure Socket Layer certificate. In the post about his findings being published today, Strafach wrote: > > During the testing process, I was able to confirm 76 popular iOS > applications allow a silent man-in-the-middle attack to be performed > on connections which should be protected by TLS (HTTPS), allowing > interception and/or manipulation of data in motion. According to > Apptopia estimates, there has been a combined total of more than > 18,000,000 (Eighteen Million) downloads of app versions which are > confirmed to be affected by this vulnerability. > Ars independently verified that several applications discovered by Strafach were vulnerable. These sorts of vulnerabilities are nothing new; thousands of applications have had incorporated bugs that caused TLS to become vulnerable to attack, both on iOS and Android. But the fact that they persist even as Apple tries to push developers toward greater security is disconcerting, to say the least—especially in applications that could expose financial or health data along with user credentials. The data exposed by the vulnerability in each of the applications varied in sensitivity. For just less than half—33 of the applications—the risk was relatively low, as most of the data was "partially sensitive analytics data," Strafach said. These apps included a number of third-party "uploader" apps for Snapchat (which exposed Snapchat usernames and passwords) and the Vice News app, among others. In 24 cases, the exposed data included login credentials or session tokens that would allow an attacker to hijack the account associated with the application, though those accounts were not tied to highly sensitive data. However, the remaining 19 applications left sensitive data exposed to attack. In these cases, Strafach "confirmed ability to intercept financial or medical service login credentials and/or session authentication tokens for logged in users." The names of these apps are not currently being published. "Currently, this list is only available to limited parties due to sensitivity," Strafach wrote. "I have been in touch with MITRE and will follow up later with a listing of the CVE IDs for affected iOS applications of which data interception would be considered medium risk or high risk." The same old story Until recently, many mobile applications didn't protect much of the data sent to their back-end interfaces. When we looked at passive monitoring of mobile applications in 2014, we discovered many applications that were passing session tokens and other sensitive data in the clear. And for some developers that have moved to secure connections, poor verification of TLS certificates has continued to be problem. Even security-focused applications have run into trouble with TLS validation, including the two-factor authentication provider Duo. In 2015, Duo issued a security advisory warning that one version of their iOS application had left open a TLS vulnerability. Many secure applications avoid the issue by using "pinned" certificates hard-coded into applications, which allows them to avoid interception of the certificate hand-shake at the beginning of a TLS session. But that may not be practical for other applications. Apple has been pushing iOS developers to use App Transport Security (ATS) to secure data transmitted by applications sold through the App Store. In December, Apple extended the deadline for application developers to implement ATS. ATS uses TLS v. 1.2 and requires stronger cryptography (AES and SHA-2), as well as "forward secrecy" to protect past transactions if a certificate is compromised. But ATS doesn't ensure that applications properly verify the certificate—just that the developer uses TLS to begin with. ATS does allow for use of Certificate Transparency—a public "log" of verified certificates. Google is also pushing the service and is planning to use Certificate Transparency to enforce validation of trusted web sites by October 2017. But not all certificate authorities (let alone site and app operators) have signed off on implementing CT, so its adoption by app developer is still in its infancy. And if Apple tries to enforce Certificate Transparency now, it could actually cause some applications to become less secure, Strafach said. Developers "would not be able to utilize certificate pinning for their connections, and they could not trust otherwise untrusted certificates which may be required for intranet connections within an enterprise using an in-house PKI." The one ray of sunshine for end-users is that man-in-the-middle attacks (other than those by state actors) are possible only when connected to the Internet via an untrusted Wi-Fi connection. If you're connected using cellular broadband or a trusted wireless network, man-in-the-middle attacks are highly unlikely—though attackers can use Wi-Fi network spoofing to fool a device into connecting to a malicious network, as Ars has demonstrated in the lab in the past. With links: https://arstechnica.com/security/2017/02/dozens-of-popular-ios-apps-vulnera…

1 0

[Access Now] Beware: countering “violent extremism” online risks human rights
by Cecilia Tanaka 07 Feb '17

07 Feb '17

*Beware: countering “violent extremism” online risks human rights.* https://www.accessnow.org/beware-countering-violent-extremism-online-risks-… I will read their guide below a bit later. At first sign, I liked the material very much. It seems pretty reasonable and rational. *ACCESS NOW Position Paper: A Digital Rights Approach To Proposals For Preventing Or Countering Violent Extremism Online.* https://www.accessnow.org/cms/assets/uploads/2016/10/CVE-online-10.27.pdf ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

3 3

Freedom Hosting Fukcs Kids
by The Cuckq 06 Feb '17

06 Feb '17

Freedom Hosting 2.0 Pwned Info & Database Leaked 02/05/17 Freedom Hosting 2.0 was hakced. > Earlier today a Reddit user running a dark web crawler > reported that all websites hosted by Freedom Hosting II > had been compromised and were now displaying the following > message: >> Hello Freedom Hosting II, you have been hacked >> We are disappointed This is an excerpt from your front >> page We have a zero tolerance policy to child pornography.  >>  but what we found while searching through your server is >> more than 50% child porn >> Moreover you host many scam sites, some of which are >> evidently run by yourself to cover hosting expenses. >> All your files have been copied and your database has been >> dumped. (74GB of files and 2.3GB of database) >> We are selling all data (excluding cp) for 0.1 BTC. Send 0.1 >> BTC to 14iCDyeCSp12AmhVfJGxtrzXDabFop4QtU and send your >> transaction id to fhosting(a)tt3j2x4k5ycaa5zt.onion or >> fhosting(a)danwin1210.me and Well get back to you with a full >> dump. >> Up to January 31st you were hosting 10613 sites. Private >> keys are included in the dump. Show full list >> We are Anonymous. We do not forgive. We do not forget. You >> should have expected us. > Verification > > Privacy researcher Sarah Jamie Lewis used a customised onion > scan tool in October last year and found that Freedom > Hosting II represented 15-20% of active onion sites detected > based on matching SSH fingerprints. > The hack appears to be genuine. Not only are the tested > hosted sites compromised, the main customer portal is already > compromised, as this too is displaying the same message. > fhostingesps6bly.onion was one of the primary onion addresses > of Freedom Hosting II, the un-hacked version can be seen via > this archived capture. > Brand legacy and follow up > Freedom Hosting II is the brand successor to the original > Freedom Hosting, formally run by Irishman Eoin Marques, > similarly notorious for hosting child pornography and fraud > sites. > The original Freedom Hosting was taken down by the FBI in > conjunction with a JavaScript 0-day attack on its users back > in 2013. It is reasonable to except that law enforcement will > be highly interested in the hacked data as it must intersect > with operations against the worst of the worst sites under > active investigations. In many cases this will mean bringing > investigations to a premature close with some suspects > evading justice, but in other cases providing a wealth of > data on serious criminal operations. Archived link to the article from pirate.london: https://archive.fo/077M1 Pizzagate people on Voat are investigating this: voat.co/v/pizzagate/1617245

3 2

Dead links to blog.torproject.org and the Streisand effect
by Georgi Guninski 06 Feb '17

06 Feb '17

Why are Tor deleting their own pages on blog.torproject.org? They have something to hide, lol? >From @Kinney's domain, near end: http://pilobilus.net/comsec-101.html |See How to handle millions of new Tor clients on the TOR Blog. https://blog.torproject.org/blog/how-to-handle-millions-new-tor-clients This returns Page Not Found for me. Still alive on archive.org: http://web.archive.org/web/20131010204046/https://blog.torproject.org/blog/… Other pages from 2013 are alive on Tor's blog. IIRC there was similar issue with a page about Appelbaum, not sure.

6 7

[OT] [songs] "La Migra (cruza La Frontera II)" and "Viva President Trump" - Brujeria
by Cecilia Tanaka 06 Feb '17

06 Feb '17

If the <insert here the worst bad word that you know> orange guy really builds the Great Wall of USA, I have two useful suggestions for all the Mexicans: - Walls are really great for wonderful graffiti and are an awesome support for quickies. I already tried both in different places and walls always work amazingly! ;) It's serious! You can ask to all the engineers and analysts of buildings here about the sublime importance of a very secure structure for this kind of passionate and intense act. See what happened with the poor Building 7, tsk tsk! :( I don't really recommend the use of instable supports like a Bush, for example. Nobody should trust Bushes. Bushes hurt the skin, aren't comfortable, will destroy your clothes and are a treacherous support. You will probably end in the middle of the plant and it's impossible to be discreet laughing very loud... Sorry, erotic disasters are pretty fun even when you are the unlucky victim, hahaha!! ;D Besos y abrazos! <3 - c. PS: - I swear I never thought USA could have a President even more stupid than the last Bush... Poor country, poor world! :( ========== *"La Migra (cruza La Frontera II)" - Brujeria* *https://youtu.be/U0kCRbSyjmo <https://youtu.be/U0kCRbSyjmo>* [Brujo:] ¿Cuánto quiere ese coyote? [Mexicano:] Diez mil pesos [Brujo:] Pa todos [Mexicano:] No, Jefe, Pa cada uno [Brujo:] Pinché coyote ladrón, hay que joder al güey Coyotes rateros, te chingan la féria Siguen al brujo, te llévo por gratis Trae tú abuela, tú tía, el lelo Pinches polleros, viven pa' féria Te cobran tú sueldo y largan tú abuela La pinche migra te está esperando Te devuelven despues de una paliza La migra halló tú abuela en el desierto La mandaron a Tijuana pegada con palos El brujo tiene contrabando bien bueno Numeros de seguro y cartas verdes La migra la migra Te pegan bien duro La migra la migra Te pica el culo La misma migra te pasan por lana Mordidas de féria te compra todo Siguen al brujo, te llevo al norte Cuidado con ese alambre cortado Hay cabron ahi viene la troca Pa tras pinches pollos ahi viene la migra Larga tú abuela, correle tia ya Ya aplastaron el lelo La migra la migra te chingan los pollos La migra la migra te coje en el hoyo La migra, la migra, la migra, la migra *Lyrics in English:* [Brujo:] How much does that coyote want? [Mexican:] Ten thousand pesos [B:] For all [M:] No, Boss, f or each one [B:] Fucking coyote thief, We have to fuck the idiot Thieves "Coyotes" they fuck you with the bribery Follow El Brujo I brought you for free Bring your grandmother your aunt Elena Fucking Chickens live for the bribery Earn your pay and take your grandmother Fucking Border Patrol is waiting for you They brought you back with a beating The border patrol found your grandmother in the desert They order her to Tijuana bind to sticks El Brujo has good contraband Social Secure numbers and green cards Border patrol Border patrol They hit you hard Border patrol Border patrol They kick your ass The same border patrol let you pass for money Some money buy all Follow El Brujo I'll bring you to the north Careful with this cut fence Oh motherfucker, here come's the truck Go back fucking chickens here come's the border patrol Carry your grandmother, run aunt They've already crushed the slow one The border patrol, the border patrol They fuck the chickens The border patrol, the border patrol They catch you in the hole The border patrol, the border patrol, the border patrol ========== *"Viva Presidente Trump" - Brujeria* *https://youtu.be/iGJzMzW3kuY <https://youtu.be/iGJzMzW3kuY>* Viva Presidente Trump! Ya sabemos de su onda, que un chingo nos odia, Su vision es ser el gran pito hitler wilson Habla mal de mexicanos, ilegales y mojados, Si llega ser presidente va ver bronca eb cada estado Long live President Trump We know the score, he fucking hates us His vision is to be the big dick Hitler Wilson He talks shit about Mexicans, aliens and wetbacks If he becomes president there’ll be trouble in every state Yo si quiero que llega ser presidente gabacho Por que el quiere ver guerra igual que nosortros Yo si quiero que gane el presidente trumpudo Por que si lo empiensa a huebo nosotros lo acabamos I actually want him to be president gabacho Because he wants war and so do we I want the Trumpy president to win Because if he starts something, we’re definitely gonna finish it Oooooodia los mojados, odia mexicanos Si Trump gana va deportar a todos Odia mi raza, ama su dinero Ese guero loco va empesar la guerra He hates wetbacks, he hates Mexicans If Trump wins he’ll deport everyone He hates my race, he loves his money That crazy güero is going to start a war Hey don chapo, guarda tu dinero Pa gratis te lo llevo amarrado como perro Yo si voto pal guero loco Por su culpa vamos hacer guerra Hey Mr. Chapo, keep your money I’ll bring him to you for free tied up like a dog I’m voting for the crazy güero Because of him we’re going to war El quiere guerra Igual que yo Hechando chingasos Entrale cabron He wants war And so do I Throwing punches Get in the ring motherfucker Habla mierda - de mexico Odia mojados - deportar los Quiere guerra - entrale cabron Ya hay soldados metidos en cada pinche rincon! He talks shit, about Mexico He hates wetbacks, deport them He wants war, get in the ring fucker There are soldiers in every fucking corner El quiere guerra Igual que yo El quiere guerra Entraqle cabron Soldados metidos En cada rincon Viva presidente trump! He wants war And so do I He wants war Get in the ring fucker Soldiers in Every corner Long live President Trump! Haci es cabrones me escucharon bien Quiero el mas pendejo para presidente gabacho Si quieres guerra? Entrale mamon El ejercito esta listo Con soldados metidos en cada rincon Viva mexico cabron! That’s right fuckers, you heard me right I want the biggest asshole for president gabacho If you want war, come on you twat The army is ready With soldiers in every corner Viva México Cabron! ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

2 1

What happened with the people from the Dreyfus' Underground book?
by Georgi Guninski 06 Feb '17

06 Feb '17

What happened with the people from the Dreyfus' Underground book? https://en.wikipedia.org/wiki/Underground_%28Dreyfus_book%29 | |Underground: Tales of Hacking, Madness and Obsession on the |Electronic Frontier is a 1997 book by Suelette Dreyfus, |researched by Julian Assange. It describes the exploits of |a group of Australian, American, and British black hat |hackers during the late 1980s and early 1990s, among them Assange himself. 8lgm were active after the crash per vague memories. A book "Underground: X years later" will be of interest to me.

2 1

Doomsday Preps, Rogue #altgov #TheResistance, FBI Gets Unadjuticateds Fired
by grarpamp 06 Feb '17

06 Feb '17

https://www.thesun.co.uk/news/2702812/billionaire-tech-tycoons-are-frantica… https://twitter.com/RoguePOTUSStaff https://theintercept.com/2017/02/04/the-fbi-is-building-a-national-watchlis… http://www.abovetopsecret.com/

1 0

Fwd: InvestigatingTrump.com
by Shawn K. Quinn 06 Feb '17

06 Feb '17

-------- Forwarded Message -------- Subject: InvestigatingTrump.com Date: Sun, 5 Feb 2017 17:30:49 -0500 From: Michael Ravnitzky <mikerav(a)VERIZON.NET> Reply-To: Michael Ravnitzky <mikerav(a)VERIZON.NET> To: FOI-L(a)LISTSERV.SYR.EDU Investigative Reporter Peter Lance has started a website called: http://www.InvestigatingTrump.com Michael Ravnitzky mikerav(a)verizon.net -- Shawn K. Quinn <skquinn(a)rushpost.com> http://www.rantroulette.com http://www.skqrecordquest.com

3 3

Israel: Minister Resigns as Netanyahu Goes Full-Nazi - irony knows no limits
by Zenaan Harkness 05 Feb '17

05 Feb '17

Reality delivering once in a century comedy gold right now. And marches in TelAviv for open borders -now- baby snowflake! Israel: Minister Resigns as Netanyahu Goes Full-Nazi http://www.dailystormer.com/israel-minister-resigns-as-netanyahu-goes-full-… " You know that "democrats are the real racists" meme the cucks are always trying to spread? Well, "Jews are the real Nazis" is even better. Israeli Prime Minister Benjamin Netanyahu suffered his second cabinet resignation in a week on Friday when a minister quit over the appointment of a hardline nationalist in the "extremist government". Environment minister Avi Gabbay announced his resignation in a strongly worded statement that accused Netanyahu of putting the country on a path to ruin. Gabbay said that he was "unable to swallow" Netanyahu's decision to take the defence portfolio from former general Moshe Yaalon and hand it to Avigdor Lieberman, who has pledged harsh measures against Palestinian "terrorists". Yaalon resigned from the government a week ago in protest, warning of a rising tide of extremism in the party and the country as a whole. "

1 0