- cypherpunks - lists.cpunks.org

Physical Key Extraction Attacks on PCs
by Zenaan Harkness 17 Jun '16

17 Jun '16

Fwd: Subject: [ PFIR ] Physical Key Extraction Attacks on PCs Physical Key Extraction Attacks on PCs http://cacm.acm.org/magazines/2016/6/202646-physical-key-extraction-attacks… Our research thus focuses on two main questions: Can physical side-channel attacks be used to nonintrusively extract secret keys from PCs, despite their complexity and operating speed? And what is the cost of such attacks in time, equipment, expertise, and physical access? Results. We have identified multiple side channels for mounting physical key-extraction attacks on PCs, applicable in various scenarios and offering various trade-offs among attack range, speed, and equipment cost. The following sections explore our findings, as published in several recent articles.

1 0

The Memory Hole 2
by grarpamp 17 Jun '16

17 Jun '16

http://thememoryhole2.org/ Back for round 2.

1 0

Re: [tor-talk] Bittorrent starting to move entirely within anonymous overlay nets
by grarpamp 17 Jun '16

17 Jun '16

On 6/10/16, Mirimir <mirimir(a)riseup.net> wrote: > But there's still the traffic load. Or maybe, one could consider it as > chaff. Just sort of, though. Right? If that's the old "OMG, too much" argument... load re anon overlay nets may be more like bitcoin's interrelated variables... difficulty, txfees, reward, watts, price, txrate, etc... they'll slide nicely around to compensate until some unsolveable fundamental limit is reached. ie: Private (non-exit/I2P) use of these nets... if they slow, users will start talking urging more nodes, which they'll readily deploy themselves since private is low risk and satiates their use case. If the required node count to support n-million users starts blowing up CPU/RAM, devs will start getting poked to work on layering that. Even parallel nets with usage charters may arise by then as a given networks adversary resistance begets users begets trust begets honoring narrower charter. Besides, load happens to useful nets, no point trying to stave it off (nets are anon so staving is a no anyway), and trying to stave makes the stavers look stupid. A little education helps too, users will self regulate if they sense that, "Oh shit, I know this net is used for <insert activism I like>, but I can't even get my own <whatever> through, so I better ease up on variable <x>". Is it chaff, and good as to filling otherwise quiet parts of the net? Perhaps. But as in other GPA threads, I think fill traffic may need to be actively managed to defeat that, rather than just flooded.

1 0

The Law of the Log [was: tor webmail/vpn/hosting providers]
by grarpamp 17 Jun '16

17 Jun '16

On 6/7/16, Артур Истомин <art.istom(a)yandex.ru> wrote: > On Tue, Jun 07, 2016 at 03:40:37PM +0200, carlo von lynX wrote: >> I don't understand why people still use mail services under >> Patriot Act.. er.. I mean Freedom Act jurisdiction? It's >> like searching with DuckDuckGo.. even if the majority of >> employees is sooo convinced that they are not collaborating >> with authorities, the law says they are. > > Exactly my thoughts. Duckduckgo and other services under US jurisdiction > *by law* saving logs, mails etc. There are laws - 'must' log / save, in fucked up countries - 'must not', in nicer countries - 'may' or 'no such law', in other weird / free / limbo places In the context, the US is actually largely the third case. In that situation, human nature trends toward saving, which then gets abused, whether by the saver and their lineage, or by an authority over, or adversary of, the saver. >> Laws are one of the few things on earth that still tell the >> truth. Once you read them, you understand why the earth is shite. >> The fact, only a minority does, allows general population (and >> the media by reflection) to think of reality as something else >> than what it is. See also: Reality TV programming

1 0

Fwd: [Discuss-gnuradio] IMSI Catcher Catcher?
by grarpamp 17 Jun '16

17 Jun '16

---------- Forwarded message ---------- From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Date: Thu, 16 Jun 2016 18:15:14 -0700 Subject: [Discuss-gnuradio] IMSI Catcher Catcher? To: discuss-gnuradio(a)gnu.org [[ Up front confession: I know essentially nothing about radio. ]] Just a short while ago, I saw a Vice News video titled "State of Surveillance" in which Snowden brought up the fact that some journalists had found and outted some stingrays (IMSI Catchers) which had, apparently, been operating in some very sensitive areas of Oslo, Norway, for an unknown amount of time, managed by unknown people, for unknown purposes. That was the first that I personally had ever heard about that, so I googled it and found a lot of information about it online. I started to wonder about the fact that these Norwegian journalists were able to pull together the hardware and software necessary to detect the various anomalies that indicated the presence of these multiple stingrays in the Oslo city center. I googled some more and found the following blog article, written by Bruce Schneier, in which he notes that these days, pretty much anybody could easily build their own stingray, presumably out of an off-the- shelf computer and a reasonably cheap ($330 USD) little box called a "HackRF": https://www.schneier.com/blog/archives/2015/04/the_further_dem_1.html So, after that I was thinking that perhaps someone already has! Or better yet, perhaps someone has already written the code necessary to turn, for example, an ordinary laptop plus a HackRF box into a portable device that could *detect* the presence of stingrays, i.e. an "IMS-Catcher Catcher". For me at least it would be really a lot of fun to have one of those, i.e. an IMS-Catcher Catcher (stingray detector). I am not far from the State Capitol in California, and I, for one, would love nothing better than to wardrive down around the Capitol (and associated state government buildings), checking to see if there are any active stingrays operating in the area. (In the Oslo incidents, it was reported that several of the stringrays seemed to be strategically placed near major government building, including the Prime Minister's residence.) Of course, if I found any, I would immediately try to share that info with the few journos I know... and everybody else who I could get to pay attention. So, anyway, finally, my quuestion: Do any of you folks here know if anybody has created any publically available software (copyleft or otherwise) that would allow, e.g. a HackRF or any other inexpensive SDR to be turned into a stingray detector? If so, I'd love to receive a link to that. I have a laptop and $330 USB burning a hole in my pocket. Regards, rfg P.S. I did do some googling for what I'm asking for (before posting here) but the closest thing I found way an academic paper from Q3 2014 that seemed to say that the software these guys developed wasn't even up to what could be called "Beta quality": https://www.sba-research.org/wp-content/uploads/publications/DabrowskiEtAl-… They made their code freely available, but it appears that it has been stagnant and languishing since they did their paper in Q3 2014. :-( https://sourceforge.net/projects/icc/ P.P.S. In an ideal world, I'd like to see great massive hoards of people running around city centers all over the world... wardriving for a new generation... triangulating the exact locations of any stingrays they find, and then making all that info public someplace, e.g. on some single web site. I mean nobody knows where these things are *or* who might be operating them! (Anybody can buy one now for only $1800 USD off of alibaba.com... or probably build one themselves for much less with a laptop and a HackRF.) P.P.P.S. It really is too bad that the journalists who broke the Oslo stingrays story didn't do the sensible thing and follow-up properly on their initial finding, i.e. by *triangulating* until they had the exact locations of the various stingrays they found. If they had done that, then it might have been a LOT harder for the Powers That Be to just dismiss and deny their published findings, as they did, thus effectively sweeping the whole thing under the rug as far as the public was concerned. _______________________________________________ Discuss-gnuradio mailing list Discuss-gnuradio(a)gnu.org https://lists.gnu.org/mailman/listinfo/discuss-gnuradio

1 0

Shit The FBI Says...
by grarpamp 16 Jun '16

16 Jun '16

https://www.reddit.com/r/privacy/comments/4o8q8s/fbi_says_utility_pole_surv… http://arstechnica.com/tech-policy/2016/06/fbi-says-utility-pole-surveillan… The US Federal Bureau of Investigation has successfully convinced a federal judge to block the disclosure of where the bureau has attached surveillance cams on Seattle utility poles. https://www.eff.org/deeplinks/2016/06/fbi-can-search-400-million-face-recog… Today the federal Government Accountability Office (GAO) finally published its exhaustive report on the FBI’s face recognition capabilities. The takeaway: FBI has access to hundreds of millions more photos than we ever thought. And the Bureau has been hiding this fact from the public—in flagrant violation of federal law and agency policy—for years. https://www.aclu.org/blog/free-future/industry-dominated-group-writes-drone… An industry-dominated “multistakeholder process” convened by the Commerce Department recently produced a set of voluntary privacy “best practices” for commercial drones that are so riddled with exceptions and vague language that companies could engage in all sorts of practices that would violate the public's privacy expectations, while still claiming to comply with these guidelines.

6 5

Enemy Of The State... Under Ur Bus, Rushin Ur Home [was: crypto anonymity]
by grarpamp 16 Jun '16

16 Jun '16

On 6/7/16, Rayzer <rayzer(a)riseup.net> wrote: > But honestly. If you use tails with tor on a public library computer > miles from where you live to deliver documentation there's no physical > trace on any computer anywhere and even IF the exit entrance and ALL THE > TOR NODES were pwned by the FBI's DITU crew they STILL wouldn't know who > you are or be able to geolocate you accurately. All nodes?... then even with your e2e-TLS they still know your endpoint, time and bytes. They see that, pull your face from the library video and roadways of your plate, fingerprints from that book you picked up, DNA from the fuck all mess you left in the loo, the IMEI from the towers, your facebook gps presence via your phone, bounce it all around Lexis and IAFIS Part Deux, etc... and you're rushed and zeroed all for doxing some corruption... or maybe just buyin a lil weed off darkmarket to smoke in ur VW bus while talkin harmless shit about the man... man. lol. > How secure do you need to be Juan? As in swimming, coding, and locksport, everyone should practice opsec... just in case they need it. https://www.youtube.com/watch?v=MJQ30fPYec8 https://www.youtube.com/watch?v=LpHhPaVHhxw Keep in mind that was *18 years ago*... Today it's more than real... https://www.youtube.com/watch?v=oS-BQF1X7Qw https://www.youtube.com/watch?v=Tant0AMirJ8 https://www.youtube.com/watch?v=QlSAiI3xMh4 Other takes on the EOS phrase that came up in youtube... https://www.youtube.com/watch?v=zvLf2gqSJ98 http://www.fullmoon.nu/book/side_issues/IdentityCards.htm https://www.youtube.com/watch?v=_sTfpj-IF_Y https://www.youtube.com/results?search_query=enemy+of+the+state

1 0

Only nine of the 29 Windows VPN clients that I tested didn't leak
by Mirimir 16 Jun '16

16 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 https://vpntesting.info/ I tested 29 Windows VPN clients for DNS, IPv4 and IPv6 Leaks. Six (AirVPN, FrootVPN, IVPN, Mullvad, Perfect Privacy and SlickVPN) performed perfectly. Three others (CyberGhost, oVPN.to and SecureVPN.to) hit VPN-specified nameservers directly while reconnecting after uplink interruption. But that's not a huge issue, in that they didn't hit other nameservers. The other 20 Windows VPN clients failed in various ways. Over half leaked IPv6 packets whenever the machine was connected to the Internet. After uplink interruption, some failed to reconnect automatically, and some leaked IPv4 packets. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXYjtvAAoJEGINZVEXwuQ+DrQH/2KZYuuj8Gy9uW0txWL/JInP s2VxNZGV7q3glqW25tgjGDEXSCV7wS6z7YGBgoORYgv9VgsG27ISdVvmSKTGeKuN zvDghFv5uHjGBMCLqOeb06sAVqBb6neldnwqNOOIgyK0pRRdET0/j1lbw8LkxyGD pr+Ne1ura3yywAl4OwjOGEENhmFGqboF9m8b99/Jeznr+fMHvi5oJwrCMurIJ41n ojpOtYgNZU4boEh8osUZV+Q9+WGVV2xrZSL/FQUbjyibM6gjXI+cfXJnYOg0T7QV wE13FOAaFE7nJypEC0HiEDEZPmJ0jH9JcMCDgn0cMQmdcWFbG0eYjSaQ2M6kS5A= =2eVp -----END PGP SIGNATURE-----

2 2

current issues re the potential of Kurdistan
by Zenaan Harkness 16 Jun '16

16 Jun '16

By Retaking Raqqa Syrian Army May Upset 'Federalization' Plan http://sputniknews.com/politics/20160610/1041140173/syria-raqqa-kurds-feder… I don't think Kurdistan in any form will come out from this particular CIA initiated war in Syria - there are too many regional fears of an expanding Kurdistan (into Turkey and Iran for example, not to mention Iraq and Syria of course), and there appears to be some genuine understanding that religious based government becomes quite intolerant of minorities, and therefore a greater desire in the people for a separation of religion and state, if nothing else than for to maximise longer term stability. In all areas of Jihadistan, I can only agree. And it's hard to not oppose Exceptionalistan (USA) on principle these days... And it certainly does not look like Russia will let Syria 'fall', being a long term strategic partner. Doesn't change the fact though of the existence of the YPJ and the potential longer term cultural catalytic effects they may cause - here's hoping. Good luck humans Rojava https://en.wikipedia.org/wiki/Rojava YPJ https://en.wikipedia.org/wiki/Women%27s_Protection_Units

2 4

one man's freedom - romantic snapshot
by Zenaan Harkness 16 Jun '16

16 Jun '16

>From the American Prairies to the Russian Steppes (Video) An American Sioux flees America to find freedom and a new life in Russia Alexei Ovchinnikov Simon North A Native American from South Dakota, USA, has left the land of the free to find what he considers to be true freedom in Russia’s countryside. The narrator notes the physical resemblance of Justin Irwin, or Big Wolf, to his Sioux warrior ancestors as described by adventure novelists of the time like Thomas Mayne Reid and James Fenimore Cooper:“Quite a hard face with an aquiline nose, strong chin, high cheekbones and dark hair in a plait at the nape of his neck.” As to what removed Big Wolf from his native prairies to place him in the Russian hinterland, Irwin bewails the place of money in American culture and the corporatism it entails, leading to what he describes as a fascist, police state. http://www.youtube.com/watch?v=7kbrvxsOX-8

1 0