- cypherpunks - lists.cpunks.org

Data transferred over air gap.
by jim bell 12 Aug '16

12 Aug '16

http://arstechnica.com/security/2016/08/new-air-gap-jumper-covertly-transmi… "Researchers have devised a new way to siphon data out of an infected computer even when it has been physically disconnected from the Internet to prevent the leakage of sensitive information it stores. The method has been dubbed "DiskFiltration" by its creators because it uses acoustic signals emitted from the hard drive of the air-gapped computer being targeted. It works by manipulating the movements of the hard drive's actuator, which is the mechanical arm that accesses specific parts of disk platter so heads attached to the actuator can read or write data. By using so-called seek operations that move the actuator in very specific ways, it can generate sounds that transfer passwords, cryptographic keys, and other sensitive data stored on the computer to a nearby microphone. The technique has a range of six feet and a speed of 180 bits per minute, fast enough to steal a 4096-bit key in about 25 minutes. "An air-gap isolation is considered to be a hermetic security measure which can prevent data leakage," Mordechai Guri, a security researcher and the head of research and development in the cyber security labs at Israel's Ben-Gurion University, told Ars. "Confidential data, personal information, financial records and other type of sensitive information is stored within isolated networks. We show that despite the degree of isolation, the data can be exfiltrated (for example, to a nearby smart phone)." Besides working against air-gapped computers, the covert channel can also be used to steal data from Internet-connected machines whose network traffic is intensively monitored by intrusion prevention devices, data loss prevention systems, and similar security measures. The technique is documented in a technical paper titled DiskFiltration: Data Exfiltration from Speakerless Air-Gapped Computers via Covert Hard Drive Noise, which was published Thursday night. Guri and the other Ben-Gurion University researchers who devised the covert channel created the video demonstration below." [end of partial quote]

3 2

Western Digital self-encrypting drives have security flaws.
by jim bell 12 Aug '16

12 Aug '16

http://arstechnica.com/security/2015/10/western-digital-self-encrypting-har… "Several versions of self-encrypting hard drives from Western Digital are riddled with so many security flaws that attackers with physical access can retrieve the data with little effort, and in some cases, without even knowing the decryption password, a team of academics said. The paper, titled got HW crypto? On the (in)security of a Self-Encrypting Drive series, recited a litany of weaknesses in the multiple versions of the My Passport and My Book brands of external hard drives. The flaws make it possible for people who steal a vulnerable drive to decrypt its contents, even when they're locked down with a long, randomly generated password. The devices are designed to self-encrypt all stored data, a feature that saves users the time and expense of using full-disk encryption software. "After researching the inner workings of some of the numerous models in the My Passport external hard drive series, several serious security vulnerabilities have been discovered, affecting both authentication and confidentiality of user data," the researchers wrote. "We developed several different attacks to recover user data from these password protected and fully encrypted external hard disks." Most of the disks studied encrypt and decrypt data using a USB bridge that connects a computer to the external drive's SATA interface. The interface is supposed to be off limits until after the computer user has entered the correct password, and to prevent cracking attacks that try billions of password guesses each second, the plain-text passcode is cryptographically salted and subjected to 1,000 iterations of the SHA256 hash function. But a constellation of errors makes it possible to crack the password in a short amount of time. In one case, the underlying key was predictable because the random numbers used to generate it was derived from the current time on the computer clock. That flaw was fixed last year, but it's likely many people with vulnerable drives have no idea they're at risk. In other cases, it was possible to extract the hash off the drive and load it onto a computer so it could be subjected to off-line cracking." [end of partial quote]

1 0

Someone leaked Microsoft Keys
by jim bell 12 Aug '16

12 Aug '16

http://www.ibtimes.co.uk/microsoft-accidentally-leaks-golden-keys-that-unlo… [partial quote] "Microsoft accidentally leaked the golden keys to the Windows kingdom. The keys allow hackers to unlock every Windows device, including tablets, phones and other devices that are protected by Secure Boot. The most alarming part about the leak is that it is believed that it may likely be impossible for Microsoft to fully recover from the leak." "The leakwas uncovered by two security researchers MY123 and Slipstream, who revealed in a (Star Wars-style) blog that the security flaw allowed malicious entities with admin rights or physical access to a device can bypass Secure Boot to not only run other operating systems (OS) like Linux or Android on the device but also install and execute rootkits and bootkits, at the most deeply penetrated level of the device." "The researchers wrote: "A backdoor, which MS put in to secure boot because they decided to not let the user turn it off in certain devices, allows for secure boot to be disabled everywhere! You can see the irony. Also the irony in that MS themselves provided us several nice 'golden keys' (as the FBI would say) for us to use for that purpose."The leak serves as a reminder of the potential dangers in security when tech firms are pressured by governments and law enforcement agencies into producing special keys that can be used by investigators to unlock devices, in the course of criminal investigations." "About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a 'secure golden key' is very bad!," the duo added." [end of partial quote]

5 4

Assange outs the DNC e-mail "leaker"
by Steve Kinney 12 Aug '16

12 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Julian Assange has, in a deniable and snarky way, told the world that DNC staff member Seth Rich was the source of the DNC e-mail leak. And put a $20k bounty on the head of whoever murdered him. https://www.youtube.com/watch?v=Kp7FkLBRpKg https://twitter.com/wikileaks/status/763041804652539904 As a "legal" variant on AP, crowdfunding a more than matching bounty could be a useful exercise. There would of course have to be a time limit, and an alternate beneficiary in the event that the reward goes unclaimed. Wikileaks itself seems like a good candidate for the alternative beneficiary. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXq4kdAAoJEECU6c5XzmuqCwIH/2oxCbmAWyPcEP30pd8kMfzi j8Dr4+4BzKLyibRRqO3x5uaHx802eEy0n6SDEy1w62DuWa61dOiSQ3ZyoOjkIBHP x0EZR3rw6tmp7IvIhGfsfM8QGL/RYy5aYHrq8Ah6+x62qlSy8tSyUA7FKGnRXgBB fMxtWIJbGU0lcoXx0RN32n9YPMPveGK58OoJPzCYnpFY7aJDavZiHhoyFFnjTEng cuRSy33zL9+FtuXnwUx0MHSPW5tLE8XxGbOZl9uxEX1xadCBe3DUWwbLvr5mPKp7 3VUf0DCxSoAobi3fM8BHXfstVxyVo2fAYf0dsew3rGhfSNY/CHpynQ0ZsIZjnDA= =JOXF -----END PGP SIGNATURE-----

6 8

tapping the libre world - USA steams ahead of Russia
by Zenaan Harkness 12 Aug '16

12 Aug '16

A very rare instance where the USA government is taking the initiative, in positive way, rather than just bombing and droning people to death on a daily basis. Russia legislated to "preference domestic software" in comparison. As most around here know, free-libre open source software, when even marginally funded, has an almost certain chance to dominate its sector or niche over any and all proprietary alternatives, at least over the medium term. This means that the USA government, and any companies building on government-funded libre source code, are likely to have a competitive edge over those companies and governments that do not build such a community ecosystem. It's a simple matter of the mathematical and human dynamics in play with libre software. On the libre front, Red Hat is unimpeachable, absolutely impeccable record for sticking to libre principles, and they maintain a very enviable position in the software services market. Yes Red Hat had a first mover advantage (Cygnus), but the point is, they can never be unfairly challenged on their fundamental competitive edge - libre software; at most competitors can compete and target particular sectors and offer "better" service to potential customers, but no one can ever be more competitive on the fundamental software front, since libre open source software IS a level playing field. The Russian PostgreSQL services company thread we saw here a few months ago is a great example - they are building a lead in Russia which will become unassailable in the way that Red Hat is unassailable. And in both cases, rightly so, and righteously so! (I even tried to use RedHat for a few weeks some years back, to see if it would be appealing to me, but alas my Debian muscle memory wracked my soul in an irrevocable death grip of libre file locations and command sequences...) There are other examples <AHEMCAUGH>tor<GRRMHPH> too - it is difficult to challenge hegemony, much more so a libre community-oriented "fully open source, man" hegemony :/ ------------------------------------------------------------------------ https://lwn.net/Articles/696843/ The People’s Code (White House blog) [Announcements] Posted Aug 9, 2016 18:56 UTC (Tue) by ris US Chief Information Officer Tony Scott introduces[1] the Federal Source Code Policy[2], on the White House blog. "By making source code available for sharing and re-use across Federal agencies, we can avoid duplicative custom software purchases and promote innovation and collaboration across Federal agencies. By opening more of our code to the brightest minds inside and outside of government, we can enable them to work together to ensure that the code is reliable and effective in furthering our national objectives. And we can do all of this while remaining consistent with the Federal Government’s long-standing policy of technology neutrality, through which we seek to ensure that Federal investments in IT are merit-based, improve the performance of our government, and create value for the American people." (Thanks to David A. Wheeler) [1] https://www.whitehouse.gov/blog/2016/08/08/peoples-code [2] https://sourcecode.cio.gov/

1 1

France and DE Scheme Global Fight Against Messaging Crypto
by grarpamp 11 Aug '16

11 Aug '16

http://www.reuters.com/article/us-france-internet-encryption-idUSKCN10M1KB https://yro.slashdot.org/story/16/08/11/1619254/france-says-fight-against-m… https://www.reddit.com/search?q=france+messaging+encryption&sort=new&t=week Messaging encryption, widely used by Islamist extremists to plan attacks, needs to be fought at international level, French Interior Minister Bernard Cazeneuve said on Thursday, and he wants Germany to help him promote a global initiative. He meets his German counterpart, Thomas de Maiziere, on Aug. 23 in Paris and they will discuss a European initiative with a view to launching an international action plan, Cazeneuve said.

1 0

Support the Libre Tea Computer Card
by Zenaan Harkness 11 Aug '16

11 Aug '16

OK, this looks functional enough to be useful to at least some folks around here, yet small enough to be doable, and a useful step towards RYF/libre computing hardware. I hope they are successful. Zenaan ----- Forwarded message from "Donald Robertson, III, FSF" <donald(a)fsf.org> ----- Date: Wed, 10 Aug 2016 20:49:59 -0400 From: "Donald Robertson, III, FSF" <donald(a)fsf.org> Reply-To: "Donald Robertson, III, FSF" <donald(a)fsf.org> Subject: Support the Libre Tea Computer Card **Read online: <https://www.fsf.org/blogs/licensing/support-the-libre-tea-computer-card-a-c…>.** Dear Mr Zenaan Harkness, The Earth-friendly EOMA68 Computing Devices project is a crowdfunding campaign run on Crowd Supply to produce a line of hardware products that are ecologically responsible and built based on royalty-free, unencumbered hardware standards. They write: > "Now imagine if you owned a computing device that you could easily > fix yourself and inexpensively upgrade as needed. So, instead of > having to shell out for a completely new computer, you could simply > spend around US$50 to upgrade — which, by the way, you could easily > do in SECONDS, by pushing a button on the side of your device and > just popping in a new computer card. Doesn’t that sound like the way > it should be?" [This project][1] certainly sounds appealing, but only if the computer hardware is designed and configured to run software that does as much as possible to respect your freedom and ensure your control over your device. Fortunately, one option you have when backing this project is to purchase a Libre Tea Computer Card. After working closely with the developers and reviewing a sample test board, we are confident that their plans are to create a device that can achieve our [Respects Your Freedom (RYF)][2] certification. [1]: https://www.crowdsupply.com/eoma68/micro-desktop [2]: https://www.fsf.org/ryf The project is being developed by Luke Kenneth Casson Leighton of [Rhombus-Tech][3] and is sponsored by Christopher Waid of [ThinkPenguin][4], a company that sells [multiple RYF-certified hardware products][2]. It is exciting to see passionate free software advocates in our community working with OEMs to produce a computer hardware product capable of achieving RYF certification. We hope that this is the first of many computing systems they are able to design and build that respect your freedom. [3]: http://rhombus-tech.net [4]: https://www.thinkpenguin.com/ The Libre Tea Computer Card is built with an Allwinner A20 dual core processor configured to use the main CPU for graphics; it has 2 GB of RAM and 8 GB of NAND Flash; and it will come pre-installed with [Parabola GNU/Linux-libre][5], an [FSF-endorsed fully-free operating system][6]. [5]: https://www.parabola.nu/ [6]: https://www.gnu.org/distros/free-distros We encourage you to [back the Libre Tea Computer Card][1]. We'll have to do another evaluation once it is actually produced to be sure it meets our certification standards, but we have high hopes. Their funding deadline is August 26th, so don't delay! Donald Robertson Copyright & Licensing Associate -- * Follow us at <https://status.fsf.org/fsf>. * Subscribe to our RSS feeds at <https://fsf.org/blogs/RSS>. * Join us as an associate member at <https://www.fsf.org/jf>. Sent from the Free Software Foundation, 51 Franklin St, Fifth Floor Boston, Massachusetts 02110-1335 UNITED STATES You can unsubscribe from this mailing list by visiting https://my.fsf.org/civicrm/mailing/unsubscribe?reset=1&jid=144946&qid=20563…. To stop all email from the Free Software Foundation, including Defective by Design, and the Free Software Supporter newsletter, visit https://my.fsf.org/civicrm/mailing/optout?reset=1&jid=144946&qid=20563409&h…. ----- End forwarded message -----

2 2

Media's Lack of Knowledge of Law should be Embarrassing
by jim bell 10 Aug '16

10 Aug '16

Today, there was yet another manufactured scandal involving the media. Apparently Trump made a comment about Hillary Clinton and the NRA, which the mainstream media is portraying as some sort of a threat against her. No doubt that media is unaware of the Supreme Court case Brandenburg v. Ohio (1969), https://en.wikipedia.org/wiki/Brandenburg_v._Ohio According to Wikipedia, this decision held that "The Court held that government cannot punish inflammatory speech unless that speech is directed to inciting, and is likely to incite, imminent lawless action. Specifically, it struck down Ohio's criminal syndicalism statute, because that statute broadly prohibited the mere advocacy of violence." This decision has never been overturned, although there are probably many subsequent cases, mostlydistrict court and appeals court, which cite it. This decision is important to me especially: I wrotemy Assassination Politics essay, and because of Brandenburg I am supposed to be Constitutionallyprotected even if I advocate violent crime, unless it will involve "imminent lawless action", such asa riot. I think the mainstream media (MSM) should be flailed (figuratively speaking, of course!) for"interpreting" Trump's statement, choosing the interpretation they conclude will be considered most outrageous, and then pushing that as if it is somehow accurate and relevant. Do they ever do thatfor his main opponent, Hillary Clinton? Not very often, if at all. Another thing that should be done is to criticizing the news media for implicitly valuing HillaryClinton's life higher than that of other people. While it may seem odd to value a life, courts do thisfrequently, often in the context of a civil lawsuit based on a wrongful death. For example, ifa life is 'worth" $100,000 per year and actuaries can state how much longer than life would last, say 30years, if that person wrongfully dies, the damage is 30 x $100,000, or $3 million. If, when elected, Hillary Clinton will waste, say, $500 billion per year, that amounts to theequivalent of: $500 billion/$3 million, or 167,000 lives per year. The kind of people who would criticizeDonald Trump's "NRA" statement involving Hillary would presumably claim that all human life isequal in value: If they really believe that, they should realize that they must not value Hillary's lifeover that of a typical citizen. How does the value of 1 life compare with 167,000 lives, the latter in each year over four years? (No doubt that others will believe that Trump will also waste money; however, the numerous examples of new spending Hillary has proposed would have to result in huge tax increases, or at least enormous deficit spending, which is merely delayed taxation, or inflation.) I believe that the public should be able to protect themselves against corrupt and incompetentpoliticians. Naturally, those politicians won't agree. Jim Bell

2 1

What happened to Pond?
by grarpamp 10 Aug '16

10 Aug '16

"*Pond is in stasis*, and has been for several years. I hope that some of the ideas prove useful in the future, but people should use something [better polished and reviewed](https://whispersystems.org). I've no plans to shutdown down the default server, but **new users should look elsewhere**." -- agl@github

5 8

[MONEY] Behind Closed Doors at the IMF
by Zenaan Harkness 10 Aug '16

10 Aug '16

The following provides a plain english note on a couple of foundations of the IMF which some may not have grokked before (SDRs will cause/ be blamed for future inflation ('through the back door')), although it ultimately devolves into a book advertisement (which I guess may be of interest anyway considering the topic). Its structure is mildly deceptive - the author ought to have (in my world shatteringly high opinion) been upfront that his article arises from a new book he is hawking. Zenaan ---------- Behind Closed Doors at the IMF By Jim Rickards, Strategist, Strategic Intelligence The Washington, DC, area is thick with secret agencies with ‘three-letter names’, such as CIA, FBI, NSA and less well-known outfits such as the Defense Intelligence Agency (DIA) and the Director of National Intelligence (DNI). One of the most powerful, and also most secretive, of these agencies is an institution that is not even part of the US government. It’s an autonomous part of an emerging scheme of global governance accountable only to a small elite of central bankers, finance ministers and heads of state. That institution is the International Monetary Fund, or the IMF. Everything about the IMF is designed to deceive you — beginning with the name. The IMF is not really a ‘fund’ in the sense of an endowment or mutual fund; it functions as the central bank of the world, taking deposits, called ‘borrowings’, from countries around the world and making loans to its members. It prints money like most central banks, but this world money has the opaque name of special drawing right, or SDR. Now, when I say world money, it sounds kind of spooky or scary, but special drawing right is a funny name. The global financial elites pick strange names for what they’re doing so people don’t understand what it is. The International Monetary Fund (IMF) can print these SDRs. They have in the past — there’s nothing new about it. SDRs were created in 1969, and hundreds of billions of them have been issued over the years. But the IMF only issues them when there’s a financial panic. They don’t issue them every day or when times are good. You will not be able to use them, touch them or feel them. You will not be able to spend them. You will not have them. SDRs are not going to be walking-around money. You’ll still have dollars, but the dollars will be a local currency, not a global reserve currency. So for example, when I go to Turkey, I cash in some US dollars and get some Turkish lira. I use the lira to pay for taxis in Turkey. Then when I leave, I cash them out again. That will be how the US dollar is used. You’ll use the US dollar when you come to the United States, but it’ll be like the Aussie dollar: something you use when you go there. The dollar won’t be the important global reserve currency. The SDR will be used for the settlement of the balance of payments between countries, the price of oil and perhaps the financial statements of the 100 largest global corporations. The impact on everyday investors will be inflationary. The difference, however, is that, right now, if we have inflation, everyone blames the Fed. In the future, however, you’ll have inflation coming from SDRs. That means when people try to blame the Fed, the Fed will say it’s not us; it’s those guys over there on G Street in Northwest Washington. Go blame them. No one even knows where the IMF is. So the SDR is just a way to get inflation through the back door. The IMF has a convoluted governance structure in which the highest decision-making body, the Board of Governors, has little power because the votes are weighted in favour of the largest economies, such as the US. Actual power rests with the blandly named International Monetary and Financial Committee, the IMFC. Everything about the IMF is designed to make it difficult for outsiders like you to have any idea what is going on. The insiders like that arrangement just fine. Given this culture and history, it was surprising to see the publication a few years back of a book by Liaquat Ahamed, Money and Tough Love — On Tour With the IMF . The book is the most detailed account yet from behind the scenes at IMF headquarters. The author also reports on an IMF annual meeting in Tokyo and goes on the road with IMF ‘missions’ as they monitor large and small governments around the world. These missions are the key to forcing governments to conform to the ‘rules of the game’ as established by the global monetary elites. Ahamed had difficulty getting the cooperation of the IMF and access to IMF meetings and missions he needed to write the book. In the opening section, he writes, he soon discovers that gaining access to the world behind its doors will not be easy. The fund is the repository of many secrets, which it guards ferociously. It does its work behind the scenes, out of the public eye, and has a history of being wary of the press… The fund benefits from a certain mystique that could be lost by too much openness. In the end, Ahamed was granted access by IMF Managing Director Christine Lagarde. What follows is a revealing account that is part history, part economics and part James Bond as Ahamed travels from Washington to Tokyo, Dublin, and Maputo, Mozambique. He describes IMF interactions with other members of the global power elite, as well as the IMF’s member countries in both the developed world and among the poorest. Importantly, the book is highly accessible. Ahamed avoids the arcane jargon that fills most accounts of the IMF as well as the IMF’s official publications and reports. Anyone with the slightest interest in the workings of the international monetary system will find this book an excellent guide to how the IMF goes about its business on a day-to-day basis, and how the IMF has the power to make or break sovereign governments by deciding whether or not to make loans when those governments are in financial distress. One of the book’s main takeaways is the demonstration that the IMF is just as powerful as the military and CIA when it comes to forcing regime change in governments that do not follow US orders. Of course, the IMF does this without firing a shot. They use money as a weapon just as effectively as the military uses special operations or the CIA uses drones. Second, if Western nations lose votes in the IMF and those votes are given to communist China, then the IMF money weapons may be aimed at the US in the future. In recent decades, the emerging markets and southern Europe have needed IMF bailouts. In the future, the US may be the one that needs to be bailed out, and we may have to accept conditions imposed by China using the IMF as its monetary agent. The book is also timely. While the IMF has always been opaque, its importance to global finance has waxed and waned over the decades. Now the IMF is about to enter its most powerful stage yet. Central banks bailed out the world in 2008. The next financial panic will be bigger than the ability of central banks to put out the fire. At that point, the only source of global liquidity will be the IMF itself. The issuance of five trillion SDRs, equal to US$7.5 trillion, to paper over the next financial panic will be highly inflationary. The difference between this coming inflation and those in the past is that few investors will know where the inflation is coming from. Politically, it will not be easy to hold the US Treasury or the Federal Reserve accountable, because they will just point a finger at the IMF. The one true advantage of SDRs is that very few people understand them, and there’s no political accountability. Understanding the financial world’s fire department before the next great fire will give you an advantage when it comes. Cheers, Jim Rickards, For The Daily Reckoning Editor’s Note: This article was originally published in The Daily Reckoning US http://click2.portphillippublishing.com.au/t/FA/Fdc/KX8/AAmANg/G_E/AASMFA/A… .

2 1