- cypherpunks - lists.cpunks.org

Unredacted SecureDrop 0.3.4 audit report
by Steve Kinney 06 Mar '16

06 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An independent audit found a substantial deficiency in one of the dependencies of the SecureDrop document submission / management protocol. SecureDrop gave the devs time to fix it before publishing, but so far the issue remains unresolved: Publishing the unredacted SecureDrop 0.3.4 audit report https://freedom.press/blog/2015/12/publishing-unredacted-securedrop- 034-audit-report vs. https://tinyurl.com/hgeyab8 FTA: SecureDrop uses OSSEC, a popular open source host-based intrusion detection system (HIDS). The OSSEC architecture consists of a single central server, called the Manager, which monitors one or more systems. The monitored systems have programs called Agents, which collect a variety of information and forward it to the Manager for analysis and correlation. The Manager and the Agents may communicate with one of two protocols: "syslog" or "secure". The "secure" protocol is a custom crypto protocol based on shared secret keys that are set up during OSSEC deployment. NCC Group reviewed the custom protocol and found two serious issues in its cryptographic design: Protocol messages are encrypted with the shared secret key using Blowfish in CBC mode. Unfortunately, the protocol uses a static initialization vector (IV) to encrypt and decrypt all messages. This essentially reduces CBC mode to ECB mode and fails to achieve semantic security. Protocol messages are not authenticated. Each message includes an MD5 hash of the plaintext payload with the encrypted content, but this is not a strong authenticator. Among other things, it violates Moxie Marlinspike's "Cryptographic Doom Principle". For more detail, see the finding in the unredacted audit report. NCC Group did not take the time to investigate a proof of concept (PoC) attack based on this vulnerability, but that is not surprising given the limited duration of their engagement and the fact that their focus was on SecureDrop, not OSSEC. Nonetheless, these are serious cryptographic design flaws that could lead to a practical attack in the future. We encourage all OSSEC users to examine their current deployments, consider the level of exposure of any OSSEC "secure" protocol traffic to potential adversaries, and make changes accordingly. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAEBAgAGBQJW24ZTAAoJEDZ0Gg87KR0LJHAP/ihVjalG8ZNc8kvIQxgSCRro DtwCzakkNSxPzCSjX28UMhDy2nnBkz6IIBBcMP7A7p40lQHKmRRhg34ceGgk1rOw 1SGrPZWeZCZH+s2T30mGHZDGskpe6tmnlZTajbZ5oEe3qSNW1soRqsYTa3K4vNC6 ezPV28SNIwUaqKZ3JWu1Z+QMnHW6lLsbmIpGmCRByAI5tYOYoxpyXEoxRb4sA9Iq //B1vJgfhkAdE7eES2aVGwAidOfPGUHi6M3mWy5TP912yMUok9YW2kyIqDisBpjr BMJRutGCiK9ih0OFiJig/kcHpENGROQVtD0cAa7mEJhBLUB/Mt4brYHT2+XQFSC6 rpjEBbm4iHr+0mn4JBZC+Op4ImJpU8Bhx26EaDU2t5xVZ3m3GFMTQal7PuMieZS+ 05vKIFHMJhkg0tOS6SqC62wKYuxy9XcvlaUlpXcAfnKn9E3tYXP1P2Ez5Ahuqhml WXiIX+JCbE9nLcvuK6IFUvTvWe62JTP3IXv38vP1tFi7j2OWlnYd5PsVsvJecT/U ibiUb/uw8gdsmLHmcAXEJ/YgWsIC7zOul8ORL7MGwa2rcytOf8i3ckUbA6dGM9iA 6nzM//V/H91DsHicngwZ9+zMQRtm3vmp+biXPsSv+fXGdRhxOGiePbrbeeEuVvqq d67XJxo5T/IpitF2L4j0 =gRP3 -----END PGP SIGNATURE-----

1 0

Re: [Cryptography] EFF amicus brief in support of Apple
by grarpamp 05 Mar '16

05 Mar '16

> Bottom line: if FBI/DoJ can strongarm Apple into electronically > signing malware, then we have entered into a truly new imperial > era, where trillion-dollar companies can be rubber-hosed into > misusing their private crypto keys. > > No amount of technology, per se, can prevent this particular > MITM attack. We're now going to have to have multiple keys > from multiple "trusted" sources prior to accepting a firmware > update. Forget visiting Switzerland or the Cayman Islands > for access to $$$; you may now have to physically go there to > get your iPhone securely updated. See this is a problem. All this trust in single entities, singular and closed systems you keep needing to place. Why in the fuck do you keep doing this? You compute hardware should be completely open. You compute software should be completely open. You should fuse your own keys into your own hardware for software builds you reproducibly build sign and install yourself from distributed opensource software. Open designs, open fabs, open products, open source. You are NOT going to solve these problems without it. And quit crying profit... the work of your plumber is all in the open and profitable. Or quality... all quality is currently shit, but at least you stand a chance of seeing the flies on it if it's open. > I'm sure that Microsoft/HP/Dell are looking upon these > proceedings with mixed feelings, as I suspect that they've > *already* provided their code-signing keys to the govt Like all those call and other data... just for the asking, thus retroactive immunity for them, thus rolled up for absorption and enacted by an unaccountable government. > -- perhaps under FISA NSL > -- or perhaps out of a misplaced sense of patriotism. These two are one and the same. > Apple's digital signature is tied to their credible responsibility that software > they sign is theirs Yes it's theirs, which they can fuck you with at any time... because you trusted them, oops. > and in the best interest of their customers and Apple's business. These are in tenacious conflict. > As a minimum the existence of compelled software lays waste to the EULA. Shrinkwrap hardware / software EULAs offer you nothing concrete, trustworthy, or compensatable. All to them, none to you. Negotiated contracts are different but just as tricky.

2 1

Do punks denounce anti-prostitution, anti-pimping and anti-trafficking policies invariably used to repress women?
by Zenaan Harkness 05 Mar '16

05 Mar '16

A new and compelling perspective for me... https://www.opendemocracy.net/beyondslavery/sws/gail-pheterson/at-long-last… At long last, listen to the women! Gail Pheterson 2 March 2016 State entrapment, extortion, imprisonment and slander sharpen the consciousness of sex workers who denounce anti-prostitution, anti-pimping and anti-trafficking policies invariably used to repress women and undermine feminist liberation struggles. 'Proud to be whores'. Prostitutes demonstrate in Paris in 2008. philippe leroyer/Flickr. (CC 2.0 by-nc-nd) --- Gail Pheterson began organising with the sex workers of COYOTE in San Francisco in 1984 during a sabbatical year at the Institute for the Study of Social Change, University of California, Berkeley. While in San Francisco she designed an alliance project of whores, wives and dykes that transformed into a network of Bad Girl Rap Groups. Co-facilitated with Margo St. James, Scarlot Harlot/Carol Leigh, Priscilla Alexander, Sharon Kaiser, E. Kitch Childs, Gloria Locket and others, the Bad Girl Rap Groups were open to "any woman who had ever been stigmatised as bad by her work, colour, class, sexuality, history of abuse, or just plain gender". Upon her return to Europe, she co-founded the Red Thread and Pink Thread, two interwoven Dutch organisations of sex workers and allies, with Margot Alvarez, Ans van der Drift, Martine Groen, Violet and others. She also co-organised with Margo St. James the First World Whores’ Congress in Amsterdam and the Second World Whores’ Congress at the European Parliament in Brussels, and co-founded the International Committee for Prostitutes' Rights. Gail Pheterson edited the transcripts of the Whores' Congresses for publication in A Vindication of the Rights of Whores (released in Spanish under the title Nosotras Las Putas) and published a series of essays titled The Prostitution Prism (also in Spanish and French), including her most known and widely translated essay, ‘The Whore Stigma: Female Dishonor and Male Unworthiness’. --- Women mobilised a grassroots liberation movement fifty years ago in defiant resistance against oppression. Those feminists knew their struggle was dangerous but they were unrelenting in claiming rights for women as autonomous persons. Where are we now in this crusade for freedom? The idea of equality between the sexes has moved into the global limelight over the past decades, but women's liberation is still a far cry from home. Government authorities, world organisations, and social reformers continue to undermine radical analysis of pervasive sexism with emotionally-charged rhetoric of individual female misfortune and male misconduct. Exposés of criminal and perverse men capturing helpless women ignite public outrage while leaving intact institutional obstacles to women’s mobility, work, and bodily self-determination. This rhetoric sabotages liberation strategies by taking women-on-the-run into protective custody of the status quo. Anti-violence discourse then serves to reinforce state repression of women. Knowingly or unknowingly, the establishment has succeeded in wrenching the feminist agenda from its subversive fibre. The result is effective camouflage of the political cause for women's flight and disregard for women's material needs, social choices and, most insidiously, agency in thinking and shaping their destinies. All women have reason to seek liberty, but all do not face the same life conditions. The contemporary foot soldiers of our movement are rightless migrant women disallowed from leaving home, crossing borders, earning money, or living independently. Without rights, they are forced to bargain their survival with abusive profiteers inside and outside the law. In legislation, popular media, police records, UN conventions, and even ill-founded feminist tracts, they are branded trafficked women, trapped in the nexus of global power relations, and categorised as this or that kind of victim or tramp. Savvy feminists Sex worker activists are savvy feminist analysts of these machinations, their consciousness undoubtedly sharpened by daily trials of (escaping) state entrapment, extortion, imprisonment, and slander. As intimates of both backroom and front stage men, prostitutes are solicited by government officials to serve as undercover agents and informants. Their advantage over socially reputable women is their exclusion from polite society and direct experience of institutional vice. Mainstream feminists would do well to listen to their word in public as male authorities do in private. Their first demand is decriminalisation of sex work. This implies repealing prohibitions against negotiations and services attached to the sex industry, including the hiring of third parties to facilitate management of businesses and travel to foreign markets. In other words, sex workers demand the abolition of anti-prostitution, anti-pimping and anti-trafficking laws. They know that such laws invariably translate into discriminatory surveillance, fines, arrest, detention, and expulsion of migrant women. Since popular opinion equates pimping and trafficking with the vile use and abuse of women, well-intentioned reformers persist in promoting restrictive legislation that curtails women's sexual negotiations and geographic displacements. Most existing criminal laws against pimping and trafficking are about sex, money, and travel – not about violence. Some countries do require evidence of force to proceed with prosecution, but women are nonetheless subject to discriminatory surveillance rationalised as preventive measures ‘for their own good’. Violence, coercion, and deceit do, of course, occur in prostitution, as elsewhere in the sex class system. Certainly sex workers should have the same recourse to laws against those crimes as any legitimate plaintiff would have in cases of battery, rape, fraud, kidnapping, or other offense against their person. But equal juridical treatment is incompatible with prejudicial classification as prostitute or trafficked woman. Sex workers demand generic, gender-neutral consideration undifferentiated from other workers, citizens, or human beings. Crimes against women are not crimes against incapacitated dependents, property, or morality; they are crimes against individuals. Criminalise marriage? Women have ample cause for class action to claim compensation for a host of injustices, whether unpaid labour, insult, assault, or discrimination. Reparation could be a feminist collective demand. Matrimony and maternity are clearly the key historical sites of subjugation for women in terms of toil and sacrifice. But feminists have never called for prohibition of marriage or pregnancy, regardless of the risks and documented damages. Feminists have fought to give women alternatives or escapes from heterosexual coercions with divorce rights, battered women shelters and lesbians legitimacy. And they have fought to give women escapes from forced pregnancy or forced sterilisation by demanding reproductive choice and by facilitating access to contraception and abortion. But surely they would not deny women the right to decide for themselves whether to marry or bear a child or even whether to remain with an abusive husband. And they would not deny the rewards and satisfactions some women experience as wives or mothers. Why do sex workers not receive the same respect? There could also be a feminist class action to claim compensation for injustices in the sex industry. And clearly, alternatives and escape channels depend upon feminist struggles for migrant rights, labour rights, and residency permits for independent women. But there is no justification for denying the right to negotiate payment for sexual services. Individually we are each in the grip of specific realities, each a unique person, and each entitled to our own thought processes and life choices. Collectively we can shape visions and common liberatory goals without judging any individual woman for her meanderings in the sex class system. This article is published as part of the 'Sex workers speak: who listens?' series on Beyond Trafficking and Slavery, generously sponsored by COST Action IS1209 ‘Comparing European Prostitution Policies: Understanding Scales and Cultures of Governance' (ProsPol). ProsPol is funded by COST. The University of Essex is its Grant Holder Institution. About the author Gail Pheterson is currently Associate Professor [Maître de conférences] of social psychology, Université de Picardie Jules Verne, Amiens, France, and Researcher at the Centre de recherches sociologiques et politiques de Paris, CNRS/University Paris 8. In alliance with sex workers, she organised the International Committee for Prostitutes' Rights and the World Whores' Congresses in 1985-86. She is editor of A Vindication of the Rights of Whores, and author of The Prostitution Prism and Femmes en flagrant délit d'indépendance. Related Articles We speak but you don’t listen: migrant sex worker organising at the border x:talk project Ava Caradonna What gives them the right to judge us? Roses d'Acier Sex workers speak: who listens? P.G. Macioti Giulia Garofalo Geymonat Read On bracelet-280.jpg Sexual surveillance and moral quarantines: a history of anti-trafficking JESSICA R. PLILEY Convenient conflations: modern slavery, trafficking, and prostitution JULIA O’CONNELL DAVIDSON Speaking of “dead prostitutes”: how CATW promotes survivors to silence sex workers JASON CONGDON Anti-trafficking campaigns, sex workers and the roots of damage CAROL LEIGH Decriminalising sex work in New Zealand: its history and impact FRASER CRICHTON Amnesty’s proposal to decriminalise sex work: contents and discontents SIMANTI DASGUPTA Why decriminalise sex work? GLOBAL NETWORK OF SEX WORK PROJECTS Amnesty International: adopt the proposed policy on sex work INTERNATIONAL COMMITTEE ON THE RIGHTS OF SEX WORKERS IN EUROPE Subjects Sex workers speak: who listens? Related Articles We speak but you don’t listen: migrant sex worker organising at the border https://www.opendemocracy.net/beyondslavery/sws/ava-caradonna-x-talk-projec…

1 0

Lavabit's and Snowden's Solos
by John Young 05 Mar '16

05 Mar '16

Lavabit's brief for Apple has the gutsiest skin in the game, going solo, no joining a pack. None of the fattest of strutting corporate cats rushed to defend Lavabit against absence of FBI corporate-coddling, Congress-stroking, corraling the frightened herd for taking down mavericks like Lavabit and Snowden. https://cryptome.org/2016/03/usg-apple-102-105.pdf

1 0

According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus
by Georgi Guninski 05 Mar '16

05 Mar '16

According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus. Would someone confirm or deny this? Warning: DO NOT OPEN THE .DOC! Discalimer: Nothing personal against Debian https://lists.debian.org/debian-consultants/2016/01/msg00000.html links to: https://lists.debian.org/debian-consultants/2016/01/docyrW4BlUhzH.doc Submitting the last .doc URL at: https://www.virustotal.com and then going to: Go to downloaded file analysis gives: https://www.virustotal.com/en/file/c7210dc26e00a0d9f9bf8fb3b4850d52b62bb583… SHA256: c7210dc26e00a0d9f9bf8fb3b4850d52b62bb5836a7fa34bb669fc1b1553005e File name: docyrW4BlUhzH.doc Detection ratio: 17 / 54 the first few results are: AVG W97M/Downloader 20160303 AVware Trojan-Downloader.O97M.Adnel.n (v) 20160303 AegisLab W97M.Gen!c 20160303 Arcabit HEUR.VBA.Trojan.e 20160303 Avast VBA:Downloader-ABC [Trj] 20160303 ESET-NOD32 VBA/TrojanDownloader.Agent.AOM 20160303 and some report it as clean. The .doc is downloadable with the same checksum.

2 3

USG v. Apple - Amici Applications Through 3 March 2016
by John Young 04 Mar '16

04 Mar '16

https://cryptome.org/2016/03/usg-apple-025-049.pdf (179 pp, 20MB) Few of the applications have been ordered by the court. Thumbnail descriptions provide rationale for each case. Most are lazy, thin and repetitious in argument, not much that's new from previous battles. Faintheatedness suggests riskless PR is the intent, or worse, fear of antagonizing the biggest customer for crypto, govs, reduxing all crypto strutting, mock battles, gov-com-org business conducted in secrecy, public left to believe duplicitous comsec mandated by natsec, or not, usually not.

1 0

Research Paper on The Eternal Life of Cryptocurrencies.
by Chris Magistrado 04 Mar '16

04 Mar '16

I've been reading this mailing list for quite some time now, and usually don't message or write here much. Maybe one other time. I'm writing a paper on the vitality of Cryptocurrencies. My argument is that they are here to stay, and will only continue to rise as our technology becomes better. Some of the statistics I plan to use are the growth in market value, not only in BTC, but in Altcoins as well, the pros of BTC and how altcoins can do what BTC cannot, and lastly the versatility of exchanging coins via places like Shapeshift.io. Any suggestions on data or stats that might be useful? Shamir just said at RSA, "Yet to see a use case for blockchain that can't be solved with an existing simpler technology" I simply disagree. I believe the use of Cryptocurrencies are not only a statement against government control, but also a currency used by people whom want to remain private. (obviously, again, better coins than btc).

3 2

Re: [Cryptography] More Apple news
by grarpamp 04 Mar '16

04 Mar '16

On 3/3/16, Viktor Dukhovni <cryptography(a)dukhovni.org> wrote: > > http://arstechnica.com/tech-policy/2016/03/san-bernardino-da-says-seized-ip… > > "The iPhone is a county owned telephone that may have connected to > the San Bernardino County computer network. The seized iPhone may > contain evidence that can only be found on the seized phone that > it was used as a weapon to introduce a lying dormant cyber pathogen > that endangers San Bernardino's infrastructure," according to a court > filing (PDF) by Michael Ramos, the San Bernardino County District > Attorney. > > This seems so far beyond remotely plausible that one wonders whether > the responsible lawyers can be disbarred for blatant fabrication... If these 31337 criminals wanted to pathogenically jack the county systems they would have jacked in their own USB firmware sploits to fubar the systems starting with any workstations in reach. This lawyers own kids and himself have probably messed with and installed so much shit on his issued iphone to consider it compromised and warranting search. LOL totally made my day.

1 0

Crypto Individualism Required For Civilization To Reach The Stars?
by grarpamp 04 Mar '16

04 Mar '16

> Embedding crypto to, for, and in conscience of society as > a private and personal tool... is a race condition. > And one you want to win. > So do it... nao !!! Will humanity be able to advance and even reach the stars unless they are able to cryptographically securely extend and embed some portion of both the private and computational function of their brains... in the same private way brains function today... into devices and systems both large and small? bitcoin:16xRaqrjBwckR7HiqVKdKEmRDpb3dnJmSb Because... philosophy.

1 0

Re: [Cryptography] Two more Apple amicus briefs
by grarpamp 04 Mar '16

04 Mar '16

On 3/3/16, Allen <allenpmd(a)gmail.com> wrote: > On Thu, Mar 3, 2016 at 9:19 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: >> https://assets.documentcloud.org/documents/2746620/Apple-Amicus-Brief-by-Ai… >> https://assets.documentcloud.org/documents/2746626/Apple-Amicus-Brief-From-… >> >> > Someone should file an amicus brief that basically says the FBI violated > federal contracting rules by not putting the hacking work out to > competitive bid through the RFP process, and therefore it's request to > force Apple to do this work violates federal law and should be struck down > as against public policy. I'm not actually familiar enough with the > federal contracting process to know if that is true or not, but it seems > plausible, and it also seems there are many companies that would like to > have a crack at doing this work instead of being forced to do it. At > minimum, the FBI would find out through the RFP process if what it seeks > might be available through another channel and therefore Apple's assistance > is not required. And in the meantime RFP and results are out in the open giving makers more time to roll out and get embedded in society per and for customer interest, impenetrable crypto schemes. Embedding crypto to, for, and in conscience of society as a private and personal tool... is a race condition. And one you want to win. So do it... nao !!!

1 0