- cypherpunks - lists.cpunks.org

Apple at BlackHat: Reopening the "Going Dark" Debate (Lawfare)
by Rayzer 12 Aug '16

12 Aug '16

Just over a week ago, at the BlackHat hacker convention in Las Vegas, Ivan Krstić, Head of Security Engineering and Architecture at Apple gave a talk entitled “Behind the scenes of iOS Security,” the slides of which are available here. It’s a historic talk for a couple of reasons. First, Apple is traditionally very secretive about how it technically does security on its devices. Apple also announced its first bug bounty program. So far, so newsworthy. But something else happened at that talk. Unbeknownst to the presenter or anybody in the audience, Apple just reopened the “Going Dark” dispute between the FBI and the privacy community, and it turned the entire dispute on its head. In the cold light of day, I suspect Apple, the US government, and privacy activists are going to be rather unhappy when they digest the sobering implications of the talk, though they will likely be upset for entirely different reasons. In short, Apple built the very thing that they and the privacy community have been saying for years is reckless, dangerous or impossible: a high-value encryption key secured in a vault such that the key can’t be stolen or misused by hackers or malicious insiders. And without a hint of self-awareness Apple’s head of security engineering and architecture went all the way to BlackHat in Las Vegas to boast about how they did it. But I’m getting ahead of myself. Let’s start at the beginning... https://lawfareblog.com/apple-blackhat-reopening-going-dark-debate

1 0

Quantum entangled-photon Chinese satellite.
by jim bell 12 Aug '16

12 Aug '16

http://www.dailymail.co.uk/sciencetech/article-3720772/China-launch-unbreak… [quote] China to launch unbreakable quantum spy satellite - and it could one day lead to a megascope the size of Earth that could 'spot a license plate on Jupiter's moons' - Satellite produces entangled photon pairs which form an encryption key - These photons will theoretically remain linked over great distances - This means that any attempts to listen in will be detected on the other side - Scientists say this could one day make for a secure global network Scientists in China are set to launch the world’s first ‘quantum satellite,’ which could one day make for an ultra-secure global communications network.The 1,300 pound craft contains a crystal that produces pairs of entangled photons, which will be fired to ground stations in China and Austria to form a ‘secret key.’Entangled photons theoretically maintain their link across any distance, and according to the scientists, any attempts to breach this type of communication would be easily detectable.[end of portion quoted] Jim Bell (I have big questions about some of these statements in this article. But given the subject matter, quantum entanglement, confusion by lay individuals is to be expected.)

11 75

Data transferred over air gap.
by jim bell 12 Aug '16

12 Aug '16

http://arstechnica.com/security/2016/08/new-air-gap-jumper-covertly-transmi… "Researchers have devised a new way to siphon data out of an infected computer even when it has been physically disconnected from the Internet to prevent the leakage of sensitive information it stores. The method has been dubbed "DiskFiltration" by its creators because it uses acoustic signals emitted from the hard drive of the air-gapped computer being targeted. It works by manipulating the movements of the hard drive's actuator, which is the mechanical arm that accesses specific parts of disk platter so heads attached to the actuator can read or write data. By using so-called seek operations that move the actuator in very specific ways, it can generate sounds that transfer passwords, cryptographic keys, and other sensitive data stored on the computer to a nearby microphone. The technique has a range of six feet and a speed of 180 bits per minute, fast enough to steal a 4096-bit key in about 25 minutes. "An air-gap isolation is considered to be a hermetic security measure which can prevent data leakage," Mordechai Guri, a security researcher and the head of research and development in the cyber security labs at Israel's Ben-Gurion University, told Ars. "Confidential data, personal information, financial records and other type of sensitive information is stored within isolated networks. We show that despite the degree of isolation, the data can be exfiltrated (for example, to a nearby smart phone)." Besides working against air-gapped computers, the covert channel can also be used to steal data from Internet-connected machines whose network traffic is intensively monitored by intrusion prevention devices, data loss prevention systems, and similar security measures. The technique is documented in a technical paper titled DiskFiltration: Data Exfiltration from Speakerless Air-Gapped Computers via Covert Hard Drive Noise, which was published Thursday night. Guri and the other Ben-Gurion University researchers who devised the covert channel created the video demonstration below." [end of partial quote]

3 2

Western Digital self-encrypting drives have security flaws.
by jim bell 12 Aug '16

12 Aug '16

http://arstechnica.com/security/2015/10/western-digital-self-encrypting-har… "Several versions of self-encrypting hard drives from Western Digital are riddled with so many security flaws that attackers with physical access can retrieve the data with little effort, and in some cases, without even knowing the decryption password, a team of academics said. The paper, titled got HW crypto? On the (in)security of a Self-Encrypting Drive series, recited a litany of weaknesses in the multiple versions of the My Passport and My Book brands of external hard drives. The flaws make it possible for people who steal a vulnerable drive to decrypt its contents, even when they're locked down with a long, randomly generated password. The devices are designed to self-encrypt all stored data, a feature that saves users the time and expense of using full-disk encryption software. "After researching the inner workings of some of the numerous models in the My Passport external hard drive series, several serious security vulnerabilities have been discovered, affecting both authentication and confidentiality of user data," the researchers wrote. "We developed several different attacks to recover user data from these password protected and fully encrypted external hard disks." Most of the disks studied encrypt and decrypt data using a USB bridge that connects a computer to the external drive's SATA interface. The interface is supposed to be off limits until after the computer user has entered the correct password, and to prevent cracking attacks that try billions of password guesses each second, the plain-text passcode is cryptographically salted and subjected to 1,000 iterations of the SHA256 hash function. But a constellation of errors makes it possible to crack the password in a short amount of time. In one case, the underlying key was predictable because the random numbers used to generate it was derived from the current time on the computer clock. That flaw was fixed last year, but it's likely many people with vulnerable drives have no idea they're at risk. In other cases, it was possible to extract the hash off the drive and load it onto a computer so it could be subjected to off-line cracking." [end of partial quote]

1 0

Someone leaked Microsoft Keys
by jim bell 12 Aug '16

12 Aug '16

http://www.ibtimes.co.uk/microsoft-accidentally-leaks-golden-keys-that-unlo… [partial quote] "Microsoft accidentally leaked the golden keys to the Windows kingdom. The keys allow hackers to unlock every Windows device, including tablets, phones and other devices that are protected by Secure Boot. The most alarming part about the leak is that it is believed that it may likely be impossible for Microsoft to fully recover from the leak." "The leakwas uncovered by two security researchers MY123 and Slipstream, who revealed in a (Star Wars-style) blog that the security flaw allowed malicious entities with admin rights or physical access to a device can bypass Secure Boot to not only run other operating systems (OS) like Linux or Android on the device but also install and execute rootkits and bootkits, at the most deeply penetrated level of the device." "The researchers wrote: "A backdoor, which MS put in to secure boot because they decided to not let the user turn it off in certain devices, allows for secure boot to be disabled everywhere! You can see the irony. Also the irony in that MS themselves provided us several nice 'golden keys' (as the FBI would say) for us to use for that purpose."The leak serves as a reminder of the potential dangers in security when tech firms are pressured by governments and law enforcement agencies into producing special keys that can be used by investigators to unlock devices, in the course of criminal investigations." "About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a 'secure golden key' is very bad!," the duo added." [end of partial quote]

5 4

Assange outs the DNC e-mail "leaker"
by Steve Kinney 12 Aug '16

12 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Julian Assange has, in a deniable and snarky way, told the world that DNC staff member Seth Rich was the source of the DNC e-mail leak. And put a $20k bounty on the head of whoever murdered him. https://www.youtube.com/watch?v=Kp7FkLBRpKg https://twitter.com/wikileaks/status/763041804652539904 As a "legal" variant on AP, crowdfunding a more than matching bounty could be a useful exercise. There would of course have to be a time limit, and an alternate beneficiary in the event that the reward goes unclaimed. Wikileaks itself seems like a good candidate for the alternative beneficiary. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXq4kdAAoJEECU6c5XzmuqCwIH/2oxCbmAWyPcEP30pd8kMfzi j8Dr4+4BzKLyibRRqO3x5uaHx802eEy0n6SDEy1w62DuWa61dOiSQ3ZyoOjkIBHP x0EZR3rw6tmp7IvIhGfsfM8QGL/RYy5aYHrq8Ah6+x62qlSy8tSyUA7FKGnRXgBB fMxtWIJbGU0lcoXx0RN32n9YPMPveGK58OoJPzCYnpFY7aJDavZiHhoyFFnjTEng cuRSy33zL9+FtuXnwUx0MHSPW5tLE8XxGbOZl9uxEX1xadCBe3DUWwbLvr5mPKp7 3VUf0DCxSoAobi3fM8BHXfstVxyVo2fAYf0dsew3rGhfSNY/CHpynQ0ZsIZjnDA= =JOXF -----END PGP SIGNATURE-----

6 8

tapping the libre world - USA steams ahead of Russia
by Zenaan Harkness 12 Aug '16

12 Aug '16

A very rare instance where the USA government is taking the initiative, in positive way, rather than just bombing and droning people to death on a daily basis. Russia legislated to "preference domestic software" in comparison. As most around here know, free-libre open source software, when even marginally funded, has an almost certain chance to dominate its sector or niche over any and all proprietary alternatives, at least over the medium term. This means that the USA government, and any companies building on government-funded libre source code, are likely to have a competitive edge over those companies and governments that do not build such a community ecosystem. It's a simple matter of the mathematical and human dynamics in play with libre software. On the libre front, Red Hat is unimpeachable, absolutely impeccable record for sticking to libre principles, and they maintain a very enviable position in the software services market. Yes Red Hat had a first mover advantage (Cygnus), but the point is, they can never be unfairly challenged on their fundamental competitive edge - libre software; at most competitors can compete and target particular sectors and offer "better" service to potential customers, but no one can ever be more competitive on the fundamental software front, since libre open source software IS a level playing field. The Russian PostgreSQL services company thread we saw here a few months ago is a great example - they are building a lead in Russia which will become unassailable in the way that Red Hat is unassailable. And in both cases, rightly so, and righteously so! (I even tried to use RedHat for a few weeks some years back, to see if it would be appealing to me, but alas my Debian muscle memory wracked my soul in an irrevocable death grip of libre file locations and command sequences...) There are other examples <AHEMCAUGH>tor<GRRMHPH> too - it is difficult to challenge hegemony, much more so a libre community-oriented "fully open source, man" hegemony :/ ------------------------------------------------------------------------ https://lwn.net/Articles/696843/ The People’s Code (White House blog) [Announcements] Posted Aug 9, 2016 18:56 UTC (Tue) by ris US Chief Information Officer Tony Scott introduces[1] the Federal Source Code Policy[2], on the White House blog. "By making source code available for sharing and re-use across Federal agencies, we can avoid duplicative custom software purchases and promote innovation and collaboration across Federal agencies. By opening more of our code to the brightest minds inside and outside of government, we can enable them to work together to ensure that the code is reliable and effective in furthering our national objectives. And we can do all of this while remaining consistent with the Federal Government’s long-standing policy of technology neutrality, through which we seek to ensure that Federal investments in IT are merit-based, improve the performance of our government, and create value for the American people." (Thanks to David A. Wheeler) [1] https://www.whitehouse.gov/blog/2016/08/08/peoples-code [2] https://sourcecode.cio.gov/

1 1

France and DE Scheme Global Fight Against Messaging Crypto
by grarpamp 11 Aug '16

11 Aug '16

http://www.reuters.com/article/us-france-internet-encryption-idUSKCN10M1KB https://yro.slashdot.org/story/16/08/11/1619254/france-says-fight-against-m… https://www.reddit.com/search?q=france+messaging+encryption&sort=new&t=week Messaging encryption, widely used by Islamist extremists to plan attacks, needs to be fought at international level, French Interior Minister Bernard Cazeneuve said on Thursday, and he wants Germany to help him promote a global initiative. He meets his German counterpart, Thomas de Maiziere, on Aug. 23 in Paris and they will discuss a European initiative with a view to launching an international action plan, Cazeneuve said.

1 0

Support the Libre Tea Computer Card
by Zenaan Harkness 11 Aug '16

11 Aug '16

OK, this looks functional enough to be useful to at least some folks around here, yet small enough to be doable, and a useful step towards RYF/libre computing hardware. I hope they are successful. Zenaan ----- Forwarded message from "Donald Robertson, III, FSF" <donald(a)fsf.org> ----- Date: Wed, 10 Aug 2016 20:49:59 -0400 From: "Donald Robertson, III, FSF" <donald(a)fsf.org> Reply-To: "Donald Robertson, III, FSF" <donald(a)fsf.org> Subject: Support the Libre Tea Computer Card **Read online: <https://www.fsf.org/blogs/licensing/support-the-libre-tea-computer-card-a-c…>.** Dear Mr Zenaan Harkness, The Earth-friendly EOMA68 Computing Devices project is a crowdfunding campaign run on Crowd Supply to produce a line of hardware products that are ecologically responsible and built based on royalty-free, unencumbered hardware standards. They write: > "Now imagine if you owned a computing device that you could easily > fix yourself and inexpensively upgrade as needed. So, instead of > having to shell out for a completely new computer, you could simply > spend around US$50 to upgrade — which, by the way, you could easily > do in SECONDS, by pushing a button on the side of your device and > just popping in a new computer card. Doesn’t that sound like the way > it should be?" [This project][1] certainly sounds appealing, but only if the computer hardware is designed and configured to run software that does as much as possible to respect your freedom and ensure your control over your device. Fortunately, one option you have when backing this project is to purchase a Libre Tea Computer Card. After working closely with the developers and reviewing a sample test board, we are confident that their plans are to create a device that can achieve our [Respects Your Freedom (RYF)][2] certification. [1]: https://www.crowdsupply.com/eoma68/micro-desktop [2]: https://www.fsf.org/ryf The project is being developed by Luke Kenneth Casson Leighton of [Rhombus-Tech][3] and is sponsored by Christopher Waid of [ThinkPenguin][4], a company that sells [multiple RYF-certified hardware products][2]. It is exciting to see passionate free software advocates in our community working with OEMs to produce a computer hardware product capable of achieving RYF certification. We hope that this is the first of many computing systems they are able to design and build that respect your freedom. [3]: http://rhombus-tech.net [4]: https://www.thinkpenguin.com/ The Libre Tea Computer Card is built with an Allwinner A20 dual core processor configured to use the main CPU for graphics; it has 2 GB of RAM and 8 GB of NAND Flash; and it will come pre-installed with [Parabola GNU/Linux-libre][5], an [FSF-endorsed fully-free operating system][6]. [5]: https://www.parabola.nu/ [6]: https://www.gnu.org/distros/free-distros We encourage you to [back the Libre Tea Computer Card][1]. We'll have to do another evaluation once it is actually produced to be sure it meets our certification standards, but we have high hopes. Their funding deadline is August 26th, so don't delay! Donald Robertson Copyright & Licensing Associate -- * Follow us at <https://status.fsf.org/fsf>. * Subscribe to our RSS feeds at <https://fsf.org/blogs/RSS>. * Join us as an associate member at <https://www.fsf.org/jf>. Sent from the Free Software Foundation, 51 Franklin St, Fifth Floor Boston, Massachusetts 02110-1335 UNITED STATES You can unsubscribe from this mailing list by visiting https://my.fsf.org/civicrm/mailing/unsubscribe?reset=1&jid=144946&qid=20563…. To stop all email from the Free Software Foundation, including Defective by Design, and the Free Software Supporter newsletter, visit https://my.fsf.org/civicrm/mailing/optout?reset=1&jid=144946&qid=20563409&h…. ----- End forwarded message -----

2 2

Media's Lack of Knowledge of Law should be Embarrassing
by jim bell 10 Aug '16

10 Aug '16

Today, there was yet another manufactured scandal involving the media. Apparently Trump made a comment about Hillary Clinton and the NRA, which the mainstream media is portraying as some sort of a threat against her. No doubt that media is unaware of the Supreme Court case Brandenburg v. Ohio (1969), https://en.wikipedia.org/wiki/Brandenburg_v._Ohio According to Wikipedia, this decision held that "The Court held that government cannot punish inflammatory speech unless that speech is directed to inciting, and is likely to incite, imminent lawless action. Specifically, it struck down Ohio's criminal syndicalism statute, because that statute broadly prohibited the mere advocacy of violence." This decision has never been overturned, although there are probably many subsequent cases, mostlydistrict court and appeals court, which cite it. This decision is important to me especially: I wrotemy Assassination Politics essay, and because of Brandenburg I am supposed to be Constitutionallyprotected even if I advocate violent crime, unless it will involve "imminent lawless action", such asa riot. I think the mainstream media (MSM) should be flailed (figuratively speaking, of course!) for"interpreting" Trump's statement, choosing the interpretation they conclude will be considered most outrageous, and then pushing that as if it is somehow accurate and relevant. Do they ever do thatfor his main opponent, Hillary Clinton? Not very often, if at all. Another thing that should be done is to criticizing the news media for implicitly valuing HillaryClinton's life higher than that of other people. While it may seem odd to value a life, courts do thisfrequently, often in the context of a civil lawsuit based on a wrongful death. For example, ifa life is 'worth" $100,000 per year and actuaries can state how much longer than life would last, say 30years, if that person wrongfully dies, the damage is 30 x $100,000, or $3 million. If, when elected, Hillary Clinton will waste, say, $500 billion per year, that amounts to theequivalent of: $500 billion/$3 million, or 167,000 lives per year. The kind of people who would criticizeDonald Trump's "NRA" statement involving Hillary would presumably claim that all human life isequal in value: If they really believe that, they should realize that they must not value Hillary's lifeover that of a typical citizen. How does the value of 1 life compare with 167,000 lives, the latter in each year over four years? (No doubt that others will believe that Trump will also waste money; however, the numerous examples of new spending Hillary has proposed would have to result in huge tax increases, or at least enormous deficit spending, which is merely delayed taxation, or inflation.) I believe that the public should be able to protect themselves against corrupt and incompetentpoliticians. Naturally, those politicians won't agree. Jim Bell

2 1