- cypherpunks - lists.cpunks.org

Re: FD mailing list died. Time for new one (or something better!)
by coderman 21 Mar '14

21 Mar '14

On Thu, Mar 20, 2014 at 3:18 AM, coderman <coderman(a)gmail.com> wrote: > a modest and proportionate proposal, >... > finding someone with strong reputation and good judgement to publicly > validate and speak to the efforts of the equally reputable but > absolutely anonymous service operator? > ... now that's a hard sell ... *grin* if finding said operators for a dedicated service is hard then finding a quorum to run mixmasterminions as intake to hidden list likely just as peril fraught. note that a local only (hidden only) mailer would be easy enough to extend to link to incoming mix messages, if/when desired, in addition to Usenet intake, as also mentioned. a persistent and available store of disclosures (late comers seeking archives) is a critical requirement. your threat model is the nation state intelligence community tailored operations teams. [see also: malware list DoS on orig Stuxnet payload xmit, belgian cyptographers blowing up bullruns, etc.] - every other adversary is a cake walk in comparison.** --- in a sense, the robust full-disclosure replacement problem is fundamentally the secure whistleblower leak site problem is fundamentally the "user friendly, fails safe, default always anon" communication problem. "this is a global problem" "you are the firefighters", "..." --- ** so, what happened at DEF CON 22 was, ...

1 1

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 21 Mar '14

21 Mar '14

---------- Forwarded message ---------- Date: Thu, Mar 20, 2014 at 8:38 AM specifically you are building hardened, reproducible pkgs/isos from snapshots of - live Qubes OS for baremetal layer - tails, whonix, kali, arch, ramfsonly variants, exotics per all reqs - ENTROPY DONE RIGHT, END TO END, FROM DEVELOPER COMMITS TO RUNTIME GUESTS ^this is capitalized because after decades of seeding crypto laughbly wrong, we're still routinely making laughably wrong seeds, everywhere... i am getting desperate! ,see also: http://blog.cryptographyengineering.com/2014/03/how-do-you-know-if-rng-is-w… - the bootstrap client is built for native platforms to retrieve over various means for linux32, linux64, osx32, osx64, win32, win64, android, iOS, windows mobile which deploys the hardened bare metal systems with scrutinized builds above OH: "duuuuude, don't do it. no. don't. no no no." 'cmon, :) how long have you wanted to see a nice weaponized pre-auth ssl+escalate drop? :) :) :)' "not funny! these are operations nightmares you fucker!" Q: "I heard infosec is dead. the citation was infosuck as definitive. #oldtimers and stuff" A: i don't know shit, but one thing i do know is: if your hacker peer group is this bad and/or one of the 1:4 malicious entrapping snitches and/or ALL got v8nd doing stupid shit while high on stupid shit making stupid judgement calls and/or otherwise failed to be decent humans - then you're doing it wrong! good news it is not too late to make good friends and get over your bullshit ;) [in all seriousness, it's an amazing time to be alive! the unappreciated work that is being done is everywhere if you make an effort to seek it out.] Q: "How big could such a bounty/bet get?" A: if i was the CIA i would take the snowden docs that are eventually after 42 years or so disseminated in full and dump them to the hidden fuller disclosure. drop a few TAO 0day expected to lose utility on the list as false flag. use it to grind some axes through SUBQUANTUMSQUIRRELMESH cover and use pilfered bounty to bet against the opers driving "perceived risk of running hidden site" to level 'wutsohigh'. then i'd use black funds stoking social media fire storm, the righteous furor pre-disposing the public to zero sympathy for what follows. nulling the meatbags simple as identities strategically leaked for hidden disclosure service operators to "lower american clandestine chemical cleaners" for prompt chemical dissolution. the subsequent narco pulp tie up bolsters pre-seeded notions that said "criminal hacker terrorists working for foreign intelligence services conspiring to kill americans with logic bombs thrown from darknet intertubes" deserved righteous death by sword clearly, if not for this narco deal then surely for <insert 3-5 favorite fad horsewomen here for straw beating>. finally, having driven the bounty on the hidden disclosure service to an absurd level twice the GDP of china, i would dump and mix the coins to a hidden wallet and disappear into history, never to be seen or heard from again. TL;DR: the pot could be twice the GDP of china if the CIA is playing the game with us and feeling extra dirty. [ 35 yrs later: the fact this was an exceptionally compartmentalized black op is quietly noted along with a few hundred thousand other arcane dumps no once cares about anymore... also un-noted: this operation was 100% sucessful in scaring all the fear cowed whitehats, grayhats, blackhats and inbetween from ever thinking about operating a truly fully disclosing forum for communication in the modern world. times have changed you hacker punks! ] Q: "When I asked if this could get any further off-topic, I was lamenting - not challenging!" A: hey, i'm not the one who is slacking on the disclosure of the hidden disclosure service! i just expand the anonymity set here... FIN: really done on this subject. if you're actually curious and willing to volunteer time and testing, go off-list and on-crypto :) https://peertech.org/files/0x65A847E7C2B9380C-pub.txt current OTR 157B7040 4339EFCA D83EF33D 7064F401 843A7E98 https://peertech.org/files/otr.txt

1 0

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 21 Mar '14

21 Mar '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Thu, Mar 20, 2014 at 7:22 AM Q: "Onions are fragile and sporadically un-available." A: that's not a question ;) see also <lots of Tor trac numbers here> Q: ".. How do faster soliderer onions?" A: glad you asked, earth human! for a limited time only!! [ ... shipping and handling not included, ... ] + with consensus, namecoin to a set of consistent or rotating onion URIs + concurrent hidden service endpoints to map addresses aggressively + concurrent ipv4 or ipv6 addrspaces to hidden web services on TCP/DNS + including those discussed built on multi-homed stream transports to the mapped endpoints Q: "How do you trust shady ipv4, ipv6, openssl, zlib, libevent, http, smtp, wtfp web attack surface?" A: clearly you should not. a legit op accrues pwn pot as show of good faith... [swelling pool of shadydogecoins for great justice!] Q: "Where is it?" A: ,, hah! almost got me! .. i know nothing. [ i hear the gruqq awaits to check your opsec at the subscreen? i was hallucinating. there were squirrels... ] Q: "Can this veer any further off-topic?" A: you're no exile from zeroed list, are you :P PS: the sooner someone leaks the bootstrap to hidden fuller disclosure the sooner i can take this tangent back apropos *grin* Q: "If I show you my digests will you show me yours teehee?" A: sure; builds ~200-500min - afford your patience accordingly. (builders shamelessly solicited) --- > a modest and proportionate proposal, > > fuller-disclosure:...

1 0

Fwd: FD mailing list died. Time for new one (or something better!)
by coderman 21 Mar '14

21 Mar '14

over on the OSS list i have been venting some bullshit friction over the full-disclosure cave in and closure. for shame! see also thread on more better mixmasters, ---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Thu, Mar 20, 2014 at 3:18 AM Subject: Re: FD mailing list died. Time for new one (or something better!) To: oss-security(a)lists.openwall.com a modest and proportionate proposal, fuller-disclosure: - a hidden list (local accts only, no clearnet linkage) - a hidden daily digest (per mod prefs, see below) - a hidden xmpp (otr required - plaintext abused) - a hidden web archive (of the list traffic, read-only) - a hidden public chat (group xmpp+/|ircd, no clearnet linkage) - a hidden pastebin with or without simple nonce auth - a advogato reputation sys to stack rank and put below the fold (for list digest content, public chat, web archive, and public pastes) use case A: "JerkVendor is Jerk" - more accomodating disclosure fails, good faith and gratis effort returned with bile. - bugtraq drama ensues, takedowns. - "Hey, the advisory is still up here! -> fullerd.onion/..." use case B: "The Hot Drop" - *whispers* 'remember the Athens Affair? i'd rather not Opt-Out to report' - BREAKING NEWS: "Anonymous russian hackers drop dox on spyhack to darknet fullerd.onion..." use case C: "It's my party and I'll..." - 'so how it happened was, , i coaxed pre-auth SSL cert parsefail remote exec with escalate to system' - "Hey DEF CON! fuck that full-disclosure closure drama, let's get this party started!" - DEF CON XX official start and group xmpp/ircd distributes nonce for 0day to thousands of hidden participants simultaneously. [ remainder of distribution happens over sneakernet at con due to unexplained outage across entire Tor network for all users... ] not a concern at all, ever: - "HOLY SHIT TAKE THAT DOWN NOW!!!" legal motions - "HOLY SHIT TAKE THAT DOWN NOW!!!" supporter/peer pressure - "HOLY SHIT TAKE THAT DOWN NOW!!!" matters of national security - "HOLY SHIT TAKE THAT DOWN NOW!!!" hint in datagram at 100Gbps [ the inverse is use case D: "99.44% Peace of Mind" ] i don't see the point in anything less; other technologies filling existing roles fine, while the truly necessary drops have zero outlet. . . . finding someone with strong reputation and good judgement to publicly validate and speak to the efforts of the equally reputable but absolutely anonymous service operator? ... now that's a hard sell ... *grin*

1 0

targeted attack authorizations and oversight
by coderman 21 Mar '14

21 Mar '14

> "... to go for the end points [requires?] a constitutional, more carefully > overseeing sort of intelligence gathering model." having observed domestic LE (inc. FBI) in action and military systems in action, they usually have distinct and different characteristics: LE specific and narrow and by the book and for the record, this is a specific focus they give attention. Military any-and-all-means-to-the-end less discriminating, brute strength ground out the solution by force majeure method. anomaly: the DC 19 rogue base stations DITU DRT technique was in-discriminant (until it had to be :) and yet the DC 20 NSA TAO/QUANTUM*.* style "in the towers" absurd over kill attacks were also absolutely precise - if your "selector"(phone) was not on the list you'd never know [without some fancy watching close to target, perhaps?]. if you were indeed on the shitlist, every sensor, stored byte, and key material got compromised instantly; your airplane mode is funny cute. ... presumably "anything in range of the Rio and our multiwatt amps" they argued was targeted and limited. as for had to be discriminating, if you want to load test spook gear just figure out what drives their automation and then jam the fuck to 11 on that signal. [where signal is anything that feeds the weird machine; take all advantages inherent in attacker perspective! fork bombs and kernel panics equally disruptive] anomaly reloaded: DC 21: nobody playing? you're still watching; fair is fair! ...

1 1

Skype and Crypto Pushed by Snowden a Ploy?
by John Young 20 Mar '14

20 Mar '14

In connection with using "encrypted, secure connection" Skype for Snowden's imagery at SXSW and TED, as well as encrypted comms with journalists and event organizers, what has led these comsec advisors to believe that all too vulnerable Skype is secure, as well as all too vulnerable popular crypto pushed for journalists? Is there any indication Snowden has deployed less vulnerable protections which have not been disclosed as backing for his encouragement to trust encryption and to allow Skype to finger his location and leak his comms? To be sure, many of his remarks seem to be carefully scripted for low-brow consumption characteristic of journalism. So there may be a secure back-channel being used with Skype and pop crypto as diversion. The low-brow slides, clips, short docs, redactions released by the media point to a deception of some sort yet to be disclosed until 25 years has passed. Hyperventilating press accounts of the releases suggest either deception, inexperience or technical ignorance or all. Still, that kind of misleading comsec deception would be commonplace security measures characterisitic of NSA and wizards -- to induce the flock to churn massive amount publicity about encrypted comms -- and Skype -- to camouflage the Tor, blacker and deeper comms, not to say the even blacker and deeper tools not seen by Snowden or not yet released. More sopisticated would be to use the small amount of NSA releases to cloak far greater distribution (a method used by WikiLeaks and the black market as well as the spy industry). That too would closer to what the big boys and girls do, and therefore would be exactly what they are watching for. Including watching for ploys to hide ploys. .

3 2

Fwd: A new Mixmaster is in the works!
by Cypher 20 Mar '14

20 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A few of us have decided to take a crack at updating Mixmaster. The announcement is below. Feedback is welcomed. Anthony - -------- Original Message -------- Subject: A new Mixmaster is in the works! Date: Wed, 19 Mar 2014 20:36:51 -0500 From: Crypto <crypto(a)jpunix.net> Hello Everyone! Today Lance Cottrell (the original author of Mixmaster) myself, (chief Mixmaster Alpha tester and contributor) and Anthony Papillion (Cypher) had a meeting on Jitsi to discuss the current status of Mixmaster and remailers in general. We have decided that we are going to investigate updating to a new Mixmaster that will fill the weaknesses and issues that are present in the current version of Mixmaster (Mixmaster 3.0). The first issue will address the 1024-bit key length. We will be looking at the development code currently available on the Internet. The first thing we will do is to implement a 4096-bit key structure. More features are under discussion. We would like your input on what features you would like to see. Please keep in mind that we are looking at functionality first. Secondly we are looking at introducing a desktop GUI for major operating systems. Lastly we want to make using remailers and encryption as seamless as possible. Your thoughts and suggestions are welcome but please remember that it is just the three of us so let's keep the "exotic" stuff to the end of the project. -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCgAGBQJTKkdjAAoJEFuutbL6JoJr9bIP+wXcbDdBjBaA27/rBu0M54D8 4ghwgpbcmCo6iKZzBJphwuV0cDbEqqlNUBslJVmOqRBftWkpN9t4v4rggWmzSs4S RNZVMPm5ad6DcW9eJTvnuldW/BL95arrolSLja0jLv5CaFLdaGo3PnBThoRQFxT9 82mTx5Fzdc+s+OVSIuO/FGeVFWhCZsru9nUlUT82rnrbNYeTnuR9iQUNltFlkM1S yDS2sAaP+0fKJQUo4lsRO8dCxKRvLln0yJDNLdZvH3Am8sBIgbBg4DvF++ZRx6nz V3mAPmmDXU37w+0GLdad1Euuge+Wj74Wha/zKTeCRs2fKwBffIAdepVLzVd/X2fX dI+lO2MIKkp6xvJIqMy9O+g26YJfNx1hYLdA9glCflpVioEQqiMsy7ech7Fltgbv wAtZfLrkl+FMUTQUy7lwMLv7gAPIW4qc1WZBJiB9cMqxQvNW0gOazLvWD0fsg7/d i6RRmqik7cQyyW9MOy3agnC3tLvdYwIV2yMAyB5WRrNl0QaDPEb7J7bzRSZOFosB DcbH7ZuuGjvRhSsyEu/lT8Ad6GJ+OYKO3C/ODO8jyok9Cxv03YoZeVoj3xbFVWrL zpETZGPDMjQ1m3SrQiU+kaJY2vns3XRFEao+/sz+7YxmS3kDA+OZguoRVkek0+im FwAuh/nO85QZAnGL2Q2O =aj0r -----END PGP SIGNATURE-----

1 0

usual or desperate call for white papers?
by Cari Machet 20 Mar '14

20 Mar '14

'Air Force Research Laboratory Information Directorate (AFRL/RI) is soliciting white papers for various scientific studies, investigations, and experiments to increase our knowledge, understanding and capability in order to expand cyber operations technologies within the Department of Defense (DoD).' https://www.fbo.gov/index?s=opportunity&mode=form&id=0daa017bdb65a7d810e377… -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

4 6

SHA-7 crypto patented by Italian Postal Service
by Fabio Pietrosanti (naif) 20 Mar '14

20 Mar '14

LOL - LOL - LOL - LOL - LOL On italian government "innovation portal" it has been published a patent by the "Italian Postal Service" of SHA-7 : "The encryption SHA-7 allows to generate a unique “message digest” " LOL reading on http://italiainnovatori.gov.it/en/innovations/sha-7-2/ -naif

3 2

MH370 in hangar at Diego Garcia, detainees already rendered
by Anonymous Remailer (austria) 20 Mar '14

20 Mar '14

The flight was hijacked by a non secured flightplan upload to the flight management system. It was then flown to Diego Garcia, where the passengers were disembarked by force, the selectees from the passenger list are in one of the US navy brig ships anchored since 9/11 at Diego Garcia, "chatting" with CIA interrogators. Disposition of the other detainees passengers NOT known at the present. The statement released by the malaysian gov is false. They know where the detainees are. The adsb xmissions aboard the 777 are handled by an older subsystem and are NOT so easily silenced from the cockpit. By the same token the flight management system flight plan upload capability aboard boeing planes has been shown to be insecure and vunerable by security researchers since the B737. The worst part of all is that the "simulators" for the FMS are a windows based program that is linked with the libraries either representing the windows environment of the simulator OR thet are linked with the "production" libraries to produce the FMS firmware for use on the aircraft itself. Thing about programming in a windows environment? ALL the fucking calls are unique to the Microsoft windows environment and NOT portable at all to other runtime environments, UNLESS that runtime is windows based.. say like windows mobile(big flop) or a proposed hypothetical environment I am going to call Windows PLANE. Windows PLANE would have inherited the same crappy programming environment that caused the US Navy to do an abrupt 180 turnaround prom putting its firecontrol and navigation systems under control of windows after a near disaster in the mid alantic caused by windows domain failuresa Windows PLANE would have all the same flaws as the crappy laptop you like to lug around Fucking Boeing, all of those windows development asshats that did this need killin' for putting their personal profit ahead of the lives of millions who fly.

11 18