- cypherpunks - lists.cpunks.org

Suspicious Sockets Layer - CloudFlare's half-baked SSL
by Razer 08 Feb '17

08 Feb '17

"We were inspired to collect the data on this page after reading this report: Phishers using CloudFlare for SSL. Also see this technical analysis (PDF, 545 KB) on the use of SSL by CloudFlare and similar services. The CloudFlare certificates we found all had the common name in the same style as the "ssl2796.cloudflare.com" shown in that Netcraft report. The "ssl2796" in the name is a CloudFlare tracking ID in the 110,481 root domains we found that use "standard" (not "universal") CloudFlare certificates. Every root domain also has a subdomain wildcard line (*.example.com), which we deleted to save space. We compiled this list by attempting a handshake with the CloudFlare domains in our database. The "standard" certificates on this page (with "ssl" in front of the number instead of "sni") mean that the domain has a paid account at CloudFlare. Paid accounts make up about five percent of the domains that use CloudFlare, according to news reports. It's all a marketing effort anyway, whether paid or free. There is no such thing as "secure" SSL when you have potential Men-In-The-Middle at scores of data centers around the world. Local authorities could be sniffing the plaintext available at these data centers, and CloudFlare wouldn't have a clue. (Their "data centers" are typically a rack or two of equipment that CloudFlare ships to a real data center, along with installation instructions.) We asked CloudFlare to confirm that sniffing is possible at these so-called "data centers," but they didn't respond. By now we're wondering if there's a plaintext Ethernet port at the back of their equipment rack that makes interception easy and convenient. If so, it would make no difference whether the origin server has its own certificate. CloudFlare may claim that there is no way plaintext can be accessed from their equipment racks, despite the fact that some sort of decrypt and re-encrypt must occur there due to the nature of their role as a CDN. After all, CloudFlare has engineers who come up with clever techniques to enhance SSL. But imagine that you are a government regulator in a country where a big ISP hosts a CloudFlare "data center." Your job is to consider the Internet in terms of public safety and current laws, and you go to that ISP with a list of CloudFlare-user domains you want blocked. The ISP replies that everything is encrypted, and CloudFlare traffic cannot be intercepted. In other words, nothing can be done about the ISIS sites, carders, booters, gamblers, escorts, phishers, malware, and copyright infringers that CloudFlare protects. How would you respond? It's fairly obvious — you ask this ISP to block the CloudFlare IP addresses used by the offending domains (this is already happening in Russia). If those IPs change, then block CloudFlare's entire IP space, and continue to monitor the situation. If CloudFlare's traffic still gets through, you ask the ISP to pull the plug on CloudFlare's racks. This is why CloudFlare will add a plaintext port to their own hardware someday, if they haven't already. The CloudFlare certificates below encrypt the traffic only between the browser and CloudFlare. The traffic between the original web server and CloudFlare remains unencrypted unless the web server owner has his own certificate installed on his machine. Almost everyone who browses a https domain reached from CloudFlare is unaware that just half of the route is encrypted. When they see the padlock on their screen, they feel that everything is safe. This is why phishers love CloudFlare's SSL. It's easy to use for a cybercriminal with numerous domains hidden behind the privacy services of various registrars. Moreover, the subdomain wildcard option on each domain is handy for obscuring a URL in a phishing email. Suppose that grandpa, age 90, gets an official-looking email that advises him to immediately change his password. He clicks on the URL in the email and ends up at bankofamerica.q4.es. This page is an excellent imitation of the Bank of America pages he remembers, and there is also that nice little SSL padlock in the corner of the address bar. Would he fill out the form? Probably, because he doesn't realize that he's at a subdomain of q4.es and is entering his old and new password into a fake page for the benefit of a phisher. As if the "standard" certificates aren't enough of a problem, there are also 4.6 million "universal" certificates that present bigger problems. All you need for a free CloudFlare account is a domain and an email address. Little countries and even some little islands all have their own top-level domain these days. Rich people can buy a generic top-level domain. Many registrars around the world are pleased to sell these ccTLD and gTLD registrations. It's a cash cow for everyone, but especially for bad guys. The same situation exists for anyone who needs a throwaway email address that's nearly impossible to trace. Now add CloudFlare's free fly-by-night "universal" SSL. When you email CloudFlare to open your new account, they ask for your domain. Then they scrape your zone file from whatever dubious nameservers are listed at your dubious registrar. Without asking, they assign you a dubious "universal" SSL certificate. All of these "universal" certificates include that magical wildcard subdomain that invites so much mischief. Some critics are referring to these CloudFlare certificates as "fraudulent" because the domain ownership validation (a necessary component of the SSL standard) is achieved only from CloudFlare's initial access to the zone file. With the paid accounts, there are payment records associated with a CloudFlare customer. But with free CloudFlare accounts, everything is too easy for bad guys, and the information about who's really behind a domain is frequently beyond the reach of law enforcement. The problem is that Silicon Valley is too self-serving. After the embarrassing NSA leaks, Google declared that everyone should look for a little padlock on their screen when they visit a website. Even your cat pictures should sport a little padlock these days! Now CloudFlare comes along and hopes to pave their way toward an IPO by giving away more free padlocks than anyone else. But by now the padlocks are almost meaningless. The NSA probably finds this amusing. The domains shown in blue were not using CloudFlare nameservers when they were checked on 2017-02-02. Additional information is available for these domains and their certificates. Just paste the domain (without the certificate number) into the search box." Search Box and links here: http://www.crimeflare.com/cfssl.html

1 0

Donald Trump Declares a "Ruthless" War on Drugs
by Razer 08 Feb '17

08 Feb '17

This will also undoubtedly be used to fund the "War on the 'Darknet'. The War On Drugs is, and has always been, a war on "Drug's" victims. Meanwhile BATF gives their Central Intelligence Agency-Mexican Mafia friends (Gulf Cartel) weapons by 'losing them', and thanks to PlaneSpotters we know Donald Trump's close friend and former CEO of Chrysler Carl Icahn's plane has been used to transport drugs. https://www.washingtonpost.com/video/national/trump-vows-to-be-ruthless-in-… http://www.madcowprod.com/2016/03/09/donald-trump-palm-beach-homies/ Ps. Vox: How the war on drugs has made drug traffickers more ruthless and efficient http://www.vox.com/policy-and-politics/2017/1/30/14346766/drug-war-failure-…

1 0

[WAR] Mark Dice investigates "8yo role model", "Kesha"
by Zenaan Harkness 08 Feb '17

08 Feb '17

Kinda cute. Kinda lame. Kinda old. Rather topical on pizzagate. Mark Dice "Kesha Insults Christians Live on Today Show" https://www.youtube.com/watch?v=mxUpYetd_FQ

1 0

[TriggerWarning: AltRight Troll] Statue of Liberty was originally Muslim woman
by Razer 08 Feb '17

08 Feb '17

Subhead: "Lady Liberty was also originally meant to wear hijab." French sculptor Frédéric Auguste Bartholdi's statue was initially intended for Egypt's Suez Canal -- and was supposed to represent a liberated (Egyptian) female slave. As pointed out by The Daily Beast’s Michael Daly in an op-ed, the statue itself was originally intended to represent a female Egyptian peasant as a Colossus of Rhodes for the Industrial Age. Frédéric-Auguste Bartholdi, the French designer of the statue, was inspired by Egyptian peasant women. More, and links: http://arynews.tv/en/americas-famed-statue-of-liberty-was-originally-a-musl… Ps. “Give me your tired, your poor, your huddled masses yearning to breathe free, the wretched refuse of your teeming shore. Send these, the homeless, tempest-tost to me, I lift my lamp beside the golden door!” Note that it DOES NOT say "Give me your hired al-Qaeda mercenary goatfuckers, the traitors who interpreted the screams of their tortured countrymen in some CACI-manned CIA owned dungeon" http://www.moonofalabama.org/2016/07/us-army-hires-abu-ghraib-torture-compa…

1 0

[WAR] Fukushima conspiracy theories and facts
by Zenaan Harkness 08 Feb '17

08 Feb '17

Whodunnit? The Argument that Fukushima Was Sabotaged January 27, 2012 https://www.henrymakow.com/theargumentfukushimasabotage.html (Jeff Rense refused to link to this article. He thinks it is a psy-op to absolve the nuclear industry of blame for Fukushima. Fine. But when I posted it anyway so people could decide for themselves, he announced he would no longer link to my site. You will no longer find my work on Rense's site. Sad that a 10 year relationship should end in this fashion. See, "The Hidden Jeff Rense." and "Jeff Rense Steps in It." https://www.henrymakow.com/thehiddenjeff_rense.html https://www.henrymakow.com/jeff_rense_steps_in_it.html ) Former NSA analyst, Jim Stone, argues that there was no mag 9.0 earthquake. The tsunami was caused by nuclear bombs in the sea and the Fukushima explosion and meltdown was caused by mini-nukes hidden in cameras installed by an Israeli security firm. The motive: punish Japan for offering to enrich Iranian uranium and straying from Illuminati diktat. This website reserves judgment but offers this introduction by James Farganne in the spirit of free discussion. by James Farganne (henrymakow.com) When we compare the 6.8-magnitude earthquake which devastated Kobe, Japan January 17, 1995 with Fukushima, the evidence does not stack up. A quick Google Images search of Kobe reveals incredible destruction of buildings, bridges, elevated highways, and other infrastructure. The Fukushima quake, magnitude 9.0, struck about 70 km off the coast of Japan on March 11, 2011. It sent a 15-meter tsunami crashing over perfectly undamaged bridges, houses, roads, and cars -- over a populace which had not been warned of the incoming tsunami, because there was no mag 9.0 earthquake. They were taken completely off-guard. Yet helicopters were waiting, and people all over Japan got to watch the tsunami roll in on live TV. What on earth was going on? Ordinarily, the Japanese people are warned of tsunamis. Why weren't they warned? Why was there no structural damage, no reason for them to suspect that a tsunami was coming? The quake must have seemed like nothing special to a nation of people who are used to quakes. In a video taken in one Tokyo newsroom during the Fukushima quake, staff were seen to continue typing at their computer stations, totally unfazed by it. A 9.0-magnitude earthquake is more than 100 times stronger than a 6.8. A 9.0 should have devastated everything within a 1,000-km radius. There should have been widespread urban carnage, even worse than what Kobe suffered. Yet the Fukushima quake of 3/11/11 did not cause a single structure to collapse. But don't take my word for it. Go look up the helicopter footage on YouTube. http://www.youtube.com/watch?v=oeoHW6hj92I&feature=related Look at the infrastructure the tsunami was crashing onto. Not the slightest bit of damage. http://www.youtube.com/watch?v=J2hUwFo6Vpc&feature=related Common sense is enough to make you wonder. Jim Stone did more than wonder. He dug up and analyzed the Japanese seismograms. He proved there was no 9.0 quake, and no epicenter out at sea. Instead, there were three simultaneous quakes of much lesser magnitude, all of them inland. The authorities lied about the 9.0 quake -- made it up out of whole cloth. An earthquake did not cause the tsunami. There must have been another cause. blast door.jpgReactors Destroyed by Nukes It turns out that the official explanation for the Fukushima reactor explosions was bogus as well. Nuclear power containment walls are extremely thick and strong. Hydrogen explosions could never have destroyed them. As a historical reference, hydrogen explosions occurred at Three Mile Island and caused no structural damage, nor even any injuries to plant personnel. Furthermore, Reactor Four contained no fuel on 3/11/11, and was therefore nonoperational -- yet it exploded and was destroyed as completely as were the other reactors that day. Reactor Four is like Building 7 at the World Trade Center - an utter impossibility, a blatant smoking gun. A reactor containing no fuel cannot operate; a nonoperational reactor cannot explode unless someone explodes it. The destruction of Reactor Four can only have been the result of sabotage. Israeli Involvement In February 2010, Japan offered to enrich uranium for Iran. http://www.thenewamerican.com/world-mainmenu-26/asia-mainmenu-33/3016-japan… Soon thereafter, an Israeli firm by the name of Magna BSP secured a contract to run security at the Fukushima Daiichi plant. They installed oversized cameras strongly resembling gun-type nuclear weapons. There is strong evidence that they planted Stuxnet, an Israeli computer virus that attacks Siemens power plant control systems, and which Israel previously used to damage Iran's nuclear program. Magna BSP also established internet data links in the reactor cores, in blatant violation of international nuclear regulations. All twelve members of that security team returned to Israel in the week before 3/11/11. In the aftermath of the disaster, the Israelis publicly monitored the reactor cores via their illegal internet data links. Yet no one took them to task for this. Jim Stone Targeted for Revealing Truth What caused the tsunami? What destroyed the reactors? Using skills honed as a former NSA analyst with an engineering background, Jim Stone concluded that Israel was behind the destruction of Fukushima Daiichi. Now he is paying the price. Stone proved that there was no 9.0-magnitude quake to cause the tsunami. The tsunami must have been artificially induced, perhaps by an atomic bomb placed in the Japan Trench. The tsunami was blamed for flooding the reactors and causing the explosions. But Stone presents compelling evidence that Israel destroyed the Fukushima Daiichi plant by installing gun-type nuclear weapons in the guise of security cameras, and then setting them off in the tsunami's aftermath. Stone demonstrates that the Stuxnet virus continues to distort sensor readings at the disaster site to this day. Unlike many others in the world of whistle blowers, Stone bases his conclusions on hard evidence and unassailable logic. Anyone can review and challenge his work. He is open to it. Since releasing his report and making several radio appearances to support it, Jim Stone has been harassed, threatened, unlawfully detained, and is currently facing prison time on completely trumped-up charges. I have watched the reaction to his work on the net. Some have slandered him. Others have railroaded his work. No one has debunked him yet. His conclusions have ramifications that make 9/11 pale in significance. Why, all across the alternative media, this roaring silence on the work of Jim Stone? Why haven't more truth sites simply linked to his report, directing people to review the evidence and decide for themselves? Some have expressed suspicion that Stone might not be what he claims to be. That's irrelevant. Facts are facts. The report stands on facts. If you haven't done so yet, I urge you to study Jim Stone's Fukushima report. It is well worth the considerable time and effort. Then, if you agree that his conclusions are correct, please do your part in spreading this information and dispelling the alternative media's silence on it. To conclude, a 9.0-magnitude earthquake never happened in Japan on 3/11; the tsunami must have been artificially induced. Nor did hydrogen explosions obliterate containment walls of concrete and rebar several feet thick. The official story is impossible. Israel was punishing Japan, and Zionist operatives now are attempting to destroy Jim Stone, the man who exposed the truth. -- The original report: www.jimstonefreelance.com/fukushima1.html Interview with visuals: http://www.youtube.com/watch?v=1G9QlynPBcQ

2 1

[WAR] former Marine sergeant asks the obvious of locals in Iraq, evacuated - YouTube vid CENSORED
by Zenaan Harkness 08 Feb '17

08 Feb '17

Well the vid is not quite censored, but it went from 8 million, to 43 million views, and the original, with its view count, has been removed by Google! (Unless the obvious youtube search of "Steven Gern" and sort by view count, is somehow problematic, but at least it's the presumably obvious.) So here's the (new version?) vid, with only ~19K views, evidently just a few short of 43 million: https://www.youtube.com/watch?v=avLnLnTGtco Here's his evacuation vid (less than 300K views): https://www.youtube.com/watch?v=6ZgcLVK3KB0 On the surface at least, this looks like some serious political interference by Google, with its mission to mould the public political discourse according to its own vision. Zenaan

2 2

[CIVIL WAR] Revolution on the streets only one police-strike away
by Zenaan Harkness 08 Feb '17

08 Feb '17

Be prepared pepes, time's getting closer... Bloodthirsty mob takes over city's streets leaving trail of death and rape after police go on strike http://www.mirror.co.uk/news/world-news/bloodthirsty-mob-leaves-trail-death…

1 0

2nd Amendment petition to USA WH to repeal National Firearms Act of 1934
by Zenaan Harkness 08 Feb '17

08 Feb '17

This one's interesting: " Eliminate the National Firearms Act of 1934 and get our machine guns, suppressors, short barrel shotguns back https://petitions.whitehouse.gov/petition/repeal-nfa " I'd personally vote against recreational nukes, to be sure, but more machine guns could change the American landscape a little ...

1 0

[WAR] Wikileaks: bomb the Muslims, and you are fine; ban the Muslims, and you are the enemy.
by justa 07 Feb '17

07 Feb '17

** The Futile Efforts of Donald Trump http://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413c… ------------------------------------------------------------ by Israel Shamir on Tue, Feb 7, 2017 President Trump had paid a hefty advance to the Jews. He did (almost) all they wanted for their Jewish state: he promised to move the US embassy to the occupied Jerusalem thus legalising their annexation of the holy city; he condoned their illegal settlements, he gave them starred positions in his administration; he told the Palestinians to drop their case in the ICC or else, he even threatened Iran with war. All that in vain. Jewish organisations and Jewish media attack Trump without slightest hesitation and consideration. His first step in curbing the soft invasion wave had been met with uniform Jewish vehemence. Sad - the globalists are winning: ** The Fifth Column Globalists Have Won: Muscovites Banned From Keeping Bears at Home. RIP Russia http://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413c… ------------------------------------------------------------ by Riley Waggaman on Mon, Feb 6, 2017 It's finally happened. Russia's many enemies — foreign and domestic — have successfully conspired to destroy one of Russia's most ancient and holy writs: The right to keep and bear bears. At home. In Moscow. Where your home probably consists of a 2-bedroom apartment. And one of those bedrooms is the kitchen.

1 1

[#AboveMyPayGrade] Protecting quantum computing networks against hacking threats
by Razer 07 Feb '17

07 Feb '17

> Professor Ebrahim Karimi, a member of uOttawa's Department of > Physics and holder of the Canada Research Chair in Structured > Light, and doctoral student Frédéric Bouchard observe the setup > they used to clone the photons that transmit information, called > qudits. Credit: University of Ottawa > > > As we saw during the 2016 US election, protecting traditional computer > systems, which use zeros and ones, from hackers is not a perfect > science. Now consider the complex world of quantum computing, where > bits of information can simultaneously hold multiple states beyond > zero and one, and the potential threats become even trickier to > tackle. Even so, researchers at the University of Ottawa have > uncovered clues that could help administrators protect quantum > computing networks from external attacks. > > "Our team has built the first high-dimensional quantum cloning machine > capable of performing quantum hacking to intercept a secure quantum > message," said University of Ottawa Department of Physics professor > Ebrahim Karimi, who holds the Canada Research Chair in Structured > Light. "Once we were able to analyze the results, we discovered some > very important clues to help protect quantum computing networks > against potential hacking threats." > > Quantum systems were believed to provide perfectly secure data > transmission because until now, attempts to copy the transmitted > information resulted in an altered or deteriorated version of the > original information, thereby defeating the purpose of the initial > hack. Traditional computing allows a hacker to simply copy and paste > information and replicate it exactly, but this doesn't hold true in > the quantum computing world, where attempts to copy quantum > information-or qudits-result in what Karimi refers to as "bad" copies. > Until now. > > For the first time, Professor Karimi's team was able to clone the > photons that transmit information, namely the single carriers of light > known as qubits, as well as quantum theory allows, meaning that the > clones were almost exact replicas of the original information. > However, in addition to undermining what was previously thought to be > a perfect way of securely transmitting information, the researchers' > analyses revealed promising clues into how to protect against such > hacking. > > "What we found was that when larger amounts of quantum information are > encoded on a single photon, the copies will get worse and hacking even > simpler to detect," said Frédéric Bouchard, a University of Ottawa > doctoral student and lead author of an open access publication that > appeared this month in the renowned journal Science Advances. "We were > also able to show that cloning attacks introduce specific, observable > noises in a secure quantum communication channel. Ensuring photons > contain the largest amount of information possible and monitoring > these noises in a secure channel should help strengthen quantum > computing networks against potential hacking threats." > > Karimi and his team hope that their quantum hacking efforts could be > used to study quantum communication systems, or more generally to > study how quantum information travels across quantum computer > networks. To read their paper, visit the Science Advances website. > > More information: High-dimensional quantum cloning and applications to > quantum hacking, Science Advances 03 Feb 2017, DOI: > 10.1126/sciadv.1601915 > > Provided by University of Ottawa https://phys.org/news/2017-02-quantum-networks-hacking-threats.html

2 4