- cypherpunks - lists.cpunks.org

Re: [tor-talk] How safe is smartphones today?
by coderman 07 Apr '14

07 Apr '14

On Thu, Apr 3, 2014 at 3:10 AM, <antispam06(a)sent.at> wrote: > ... > That made me wonder. What are the risks involved using a Tails PC and > getting online through a 3G clean Android smartphone with no apps > installed or Google accounts activated tethered through USB? as long as you assume the 3G link is as trustworthy as your neighborhood open wifi, you're fine. i can tell you that i've had malware sent down a 3G pipe to a tethered target just as you might except on any other hostile network. incidentally, this tethered mode is how i prefer to communicate: 1. a front-end sacrificial/signalling device to indicate a threat level and carry traffic. (hotspot puck, 3G phone, CPE router, etc.) 2. a packet inspecting host to passively monitor for anomalies and respond to emergencies. (emergency zeroisation+filtering) 3. the actual communicating device containing keys and terminating sessions. further hardened by defense in depth. for any decent attacker, mobile platforms are just fucked. sorry! this is true until you can implement an entire isolated SDR stack; even opaque wifi blobs are fail. [i've stated my preference for various software defined radio setups before, omitted.] > Or better yet: who can see what? > > I read the hardware is rigged (Samsungs), you wrote about the software > being rigged (the ability to remotely install apps), and surely the > phone company can do a lot of tricks from the early days of GSM. So is > it crazy to route Tor traffic through such a gateway? it's fine to route traffic over such a device as long as you assume the attacker is also watching and able to inject into your traffic over said gateway :) this means you run Tor on a different device, not the phone itself. last but not least, regarding the "Mission Impossible: Hardening Android for Security and Privacy" https://blog.torproject.org/blog/mission-impossible-hardening-android-secur… i have found the following techniques useful in the past against advanced attackers: 0.) rootkit Android kernel to trap and notify|block syscall use by user-id and process-id. anomalous calls by a privileged processes or users is a great signal of compromise. 1.) monkey patch Android API in every dalvik runtime for specific calls of interests that should not be granted. this caught the "Android Master key" vuln in practice as an updated app was behaving way out of permission and expected profile. 2.) deploy camouflage guacamole to feign vulnerability to various techniques and then use exploit attempts to signal presence of an adversary of identified capabilities. doing the above on a reference Nexus 7 platform left as exercise for the reader, *grin* best regards,

3 5

intelligence community leadership: patriarchal dicks
by coderman 07 Apr '14

07 Apr '14

"if the intelligence community thinks that the controversy over our legacy of torture is just the result of some silly girlish feelings, then we haven't even begun to deal with the consequences of those years." --- http://www.newyorker.com/online/blogs/closeread/2014/04/dianne-feinstein-em… Who's "Emotional"-- Feinstein or the C.I.A.? Who gets "emotional" about torture--or, rather, what is the proper emotional response to a history of torture and lies? On Fox News, on Sunday morning, Chris Wallace asked Michael Hayden, the former director of the C.I.A., about a report by the Senate Select Committee on Intelligence, sixty-three hundred pages long, that "says the C.I.A. misled the public about the severity and the success of the enhanced interrogation program." Hayden's first response was to talk about the feelings of Dianne Feinstein, the chair of the committee, citing an article by David Ignatius: "He said Senator Feinstein wanted a report so scathing that it would 'ensure that an un-American brutal program of detention and interrogation would never again be considered or permitted.' " Now, that sentence, that motivation for the report, Chris, may show deep emotional feeling on part of the senator. But I don't think it leads you to an objective report. "Deep emotional feelings," on the part of a woman like Feinstein, are apparently dizzying, especially when it comes to things like our integrity as a nation. But are Hayden and his former colleagues at the C.I.A., in touch with their own emotions on this one? The Senate voted on Thursday to submit the report for declassification; this process may take a while, because the White House and the C.I.A. will be involved, and the agency has fought the report. It has made its objections known feelingly, in a rebuttal that is also classified, in testimony, and in leaks to reporters about how the Senate just doesn't understand what it was like--doesn't get it, doesn't care about what bad days its agents had. Not that the C.I.A. wants to tell. When John Brennan, the current head of the C.I.A., realized that the Senate investigators had some of the agency's notes to itself--the so-called Panetta papers, in which, according to Senator Feinstein, the agency conceded points it is now denying--he had a bit of a fit. Feinstein said that the committee got the Panetta papers from the C.I.A. in a document dump; the agency said that even if it did, the committee ought to have known that those notes were private. It apparently searched the Senate's computers and tried to get a criminal investigation started. Calling the cops is, admittedly, a common fantasy when an teen-ager realizes that his journal has been read, but it's a bit unworthy of an intelligence agency when dealing with its congressional overseers. Now, not that there's anything wrong with wanting a scathing report in torture that will shock the conscience, but it's probably worth noting that the Ignatius line Hayden cited took a Feinstein quote slightly out of context. (Though the layering of emotionalism is on Hayden.) Ignatius wrote that Feinstein "wanted a report so tough that it would 'ensure that an un-American, brutal program of detention and interrogation will never again be considered or permitted,' as she put it." She had actually presented this as the reason to make the report public: If the Senate can declassify this report, we will be able to ensure that an un-American, brutal program of detention and interrogation will never again be considered or permitted. Emphasis added. It's a fine distinction, but an important one: whatever her "motivation" was, it didn't shape the writing of the report, but her feelings about who ought to get to read it. (On Saturday, Trevor Timm, of the Press Freedom Foundation, put out a "general plea" for a leak.) There are really two issues here. One is the reflexive tendency to disparage or dismiss a woman in politics (or in business, or anywhere) with a remark about her supposed susceptibility to emotion. The other is the way a certain femininity--the wilting kind--is ascribed to those who doubt that torture is good for America. The cartoon is of the clear-headed torturer who has put tenderness aside for the sake of country, against the squeamish, sensitive, can't-handle-the-truth doubters. The supposed contrast is between focussed, rational realism and a tendency to faint. (Men and women can be put in either role, as in "Zero Dark Thirty.") But fear and a desire to punish, which disabled the judgments of many in the government after 9/11, are emotions, too, and even harder to control than, say, mercy. So is a fascination with one's own power to protect or, less charitably, one's self-imagined ruthlessness. So is a tendency to be charmed by dark sides. One can argue that those who turn to the law or a moral code, in moments of crisis, can be the least flushed by feeling. That is not to make a case against inserting feeling into politics: righteous indignation and kindness can anchor, rather than discombobulate. It might be most accurate to say that various emotions serve us differently. They wake us up, and, when they do, in what can be an outraged, bleary-eyed moment, we should be careful about what we reach for. And if the intelligence community thinks that the controversy over our legacy of torture is just the result of some silly girlish feelings, then we haven't even begun to deal with the consequences of those years. There is another powerful emotion that may be at work here: shame. One source of C.I.A.'s anxiety about the Senate report is that it apparently casts a cold eye on the effectiveness of torture. It didn't do us much good, apparently. Perhaps it is painful to have compromised one's principles and not brought back anything good. But that psychological exploration should not take place entirely in classified quarters. About the same time that Hayden was on Fox News, Nancy Pelosi was on CNN, talking to Candy Crowley about the same report. Crowley asked if she blamed senior C.I.A. officials for the "misrepresentations" about torture; Pelosi went a level higher, to make a point about institutional culture, and one of our more fundamental emotions--the desire for praise. "Many people in the C.I.A. are so patriotic, they--they protect our country in a way to avoid conflict and--and, uh, violence, etc. But the attitude that was there was very--I think, it came from Dick Cheney. That's what I believe," she said. Did Cheney's shamelessness represented an absence of emotion? Not really. "I think he's proud of it," Pelosi said. "I think he's proud of it. I think he's proud of it."

1 0

reminder of mays manifesto
by Cari Machet 07 Apr '14

07 Apr '14

i post this here as a reminder of anarchist models and how they can be utilized in fascist occasions and are anti facsist but also are anti capitalist - anarchist models are found in every sector that i know of ideas of autonomy and horizontality - direct democracy but there is an overwhelming desire of some to subvert these tendencies - look for them in yourself... ++++++++++++++++++++ The Crypto Anarchist Manifesto Timothy C. May<ftp://soda.berkeley.edu/pub/cypherpunks/people/tcmay.html>< tcmay(a)netcom.com> A specter is haunting the modern world, the specter of crypto anarchy. Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. Two persons may exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other. Interactions over networks will be untraceable, via extensive re- routing of encrypted packets and tamper-proof boxes which implement cryptographic protocols with nearly perfect assurance against any tampering. Reputations will be of central importance, far more important in dealings than even the credit ratings of today. These developments will alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation. The technology for this revolution--and it surely will be both a social and economic revolution--has existed in theory for the past decade. The methods are based upon public-key encryption, zero-knowledge interactive proof systems, and various software protocols for interaction, authentication, and verification. The focus has until now been on academic conferences in Europe and the U.S., conferences monitored closely by the National Security Agency. But only recently have computer networks and personal computers attained sufficient speed to make the ideas practically realizable. And the next ten years will bring enough additional speed to make the ideas economically feasible and essentially unstoppable. High-speed networks, ISDN, tamper-proof boxes, smart cards, satellites, Ku-band transmitters, multi-MIPS personal computers, and encryption chips now under development will be some of the enabling technologies. The State will of course try to slow or halt the spread of this technology, citing national security concerns, use of the technology by drug dealers and tax evaders, and fears of societal disintegration. Many of these concerns will be valid; crypto anarchy will allow national secrets to be trade freely and will allow illicit and stolen materials to be traded. An anonymous computerized market will even make possible abhorrent markets for assassinations and extortion. Various criminal and foreign elements will be active users of CryptoNet. But this will not halt the spread of crypto anarchy. Just as the technology of printing altered and reduced the power of medieval guilds and the social power structure, so too will cryptologic methods fundamentally alter the nature of corporations and of government interference in economic transactions. Combined with emerging information markets, crypto anarchy will create a liquid market for any and all material which can be put into words and pictures. And just as a seemingly minor invention like barbed wire made possible the fencing-off of vast ranches and farms, thus altering forever the concepts of land and property rights in the frontier West, so too will the seemingly minor discovery out of an arcane branch of mathematics come to be the wire clippers which dismantle the barbed wire around intellectual property. Arise, you have nothing to lose but your barbed wire fences! -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

3 4

Github Pages now supports SSL
by Eric Mill 07 Apr '14

07 Apr '14

I know most of the people on here have transcended the earthbound, maudlin Certificate Authority system, but as services-adopting-SSL-news goes, I'm particular excited about Github Pages<https://twitter.com/benbalter/status/444555263195217920>, which started quietly supporting SSL for *.github.io domains a few weeks back. I'm excited because Github Pages is powerful, verrrrry flexible, and totally free. AFAIK, it's the only major blog/web host that gives you free SSL, backed by a high quality CDN (since everything is static files). To promote the occasion and nudge Github to take it further, I wrote up my own experience, and a little how-to for forcing redirects via Jekyll: https://konklone.com/post/github-pages-now-supports-https-so-use-it Along with Cloudflare's 2014 plan to offer SSL termination for free, and their stated plan to double SSL on the Internet by end of year, the barrier to HTTPS everywhere is dropping rapidly. -- Eric -- konklone.com | @konklone <https://twitter.com/konklone>

7 7

Frankencert - Adversarial Testing of Certificate Validation in SSL/TLS Implementations
by coderman 06 Apr '14

06 Apr '14

https://github.com/sumanj/frankencert Frankencert - Adversarial Testing of Certificate Validation in SSL/TLS Implementations What are frankencerts? Frankencerts are specially crafted SSL certificates for testing certificate validation code in SSL/TLS implementations. The technique is described in detail in the 2014 IEEE Symposium on Security and Privacy (Oakland) paper - Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations by Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, and Vitaly Shmatikov. Why is frankencert generator useful? Frankencert generator is essentially a smart fuzzer for testing SSL/TLS certificate validation code. If you are a developer who is implementing any sort of SSL/TLS certificate validation code (either as part of an SSL/TLS library or an application), you can use the frankencert generator to auto-generate different test certificates involving complex corner cases. We have successfully used frankencerts to find serious vulnerabilities in GnuTLS, PolarSSL, CyaSSL, and MatrixSSL as described in our Oakland 2014 paper. We also found several discrepancies between how different SSL/TLS implementations report errors back to the user. For example, when presented with an expired, self-signed certificate, NSS, Chrome on Linux, and Safari report that the certificate has expired but not that the issuer is invalid. How do frankencerts work? The basic idea of frankencerts is to take a bunch of certificates as seeds and use random mutations on different fields and extensions to create new test certificates (frankencerts). Using frankencerts as server-side inputs into an SSL/TLS handshake can help systematically test correctness of the certificate validation code. Installation and Usage Install OpenSSL libraries and utilities if you don't have them already. The frankencert generator needs a modified version of PyOpenSSL. We have included the source for our modified version of PyOpenSSL. You will need to install it in order to use the frankencert generator. First, uninstall any other version of PyOpenSSL that you may have installed on your computer. Go to the pyOpenSSL-0.13 directory and build/install PyOpenSSL by issuing sudo python setup.py install. Once you have the patched pyOpenSSL set up, to generate frankencerts, use the franken_generate.py script: python franken_generate.py seed_certs_dir ca_cert output_dir count [config_file]. The arguments are explained below. seed_certs_dir: Frankencert generator needs a set of seed certificates. Any SSL cert in PEM fromat can act as a seed cert. seed_certs_dir can be any directory containing the seed certs stored as PEM files. You can either use tools like ZMap (https://zmap.io/) to collect SSL seed certificates, or use some of the SSL certs available from https://www.eff.org/observatory. Please note that these are not our tools and repositories - you may want to contact their respective developers and maintainers to ensure that your usage of the certificates they collected is compatible with the intended purpose. You do not need access to the corresponding private keys to use the certs as seeds. For your convenience, we have included a tarball containing around 1000 seed certificates in utils/sample_seed_certs.tar.gz. ca_cert: You will also need to create a self-signed CA certificate to sign the frankencerts. You can either use the included sample CA certificate utils/rootCA_key_cert.pem or use the utils/create_new_ca.sh script to create your own root CA. For any root CA that you use for frankencert generation, make sure that your SSL certificate validation code treats its certificate as a trusted root certificate. VERY IMPORTANT: this root certificate should be trusted ONLY during testing. If you accidentally or intentionally deploy SSL/TLS with this certificate still among the trusted root certificates, your SSL/TLS connections may be vulnerable to server impersonation and man-in-the-middle attacks. Be sure to REMOVE this certificate from your trusted root certificates once the testing is finished. output_dir: It will contain the generated frankencerts. The frankencerts will be named as frankencert-<number>.pem. count: Number of frankencerts to be generated. config_file: An optional argument to tune the frankencert generation process. Take a look at the utils/sample_franken.conf for a sample config file. To test your SSL/TLS client with the generated frankencerts, you should use the utils/test_ssl_server.py script to set up an SSL server that can present the generated frankencerts as part of the SSL handshake. Project structure The frankengen directory contains the frankencert generator code Our patched version of pyOpenSSL is inside pyOpenSSL-0.13 directory Several useful tools are included in utils cert_print.py: a tool for printing frankencerts. It requires OpenSSL to be installed and present in the path. rootCA_key_cert.pem: private key and self-signed cert of a sample CA that can be used for signing frankencerts. create_new_ca.sh: a script for creating new CA with a self-signed cert. It creates the output cert and private key in rootCA.pem (requires OpenSSL). test_ssl_server.py: a sample SSL/TLS server for presenting frankencerts to SSL/TLS clients sample_seed_certs.tar.gz: Some sample certs that may be used as seeds for frankencert generation. sample_franken.conf: A sample config file that can be used to tune different parameters of the frankencert generation process.

1 0

Re: [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)
by coderman 06 Apr '14

06 Apr '14

On Wed, Apr 2, 2014 at 10:59 AM, Rusty Bird <rustybird(a)openmailbox.org> wrote: > ... > Maybe it can be boiled down to this: When redirecting *and* filtering, > the filtering should be done in OUTPUT (instead of INPUT), ... this is where defense in depth at the multiple-virtual machine / routing layer fails safe in ways that a single / monolithic Tor setup cannot, when applied with care. what i mean by "applied with care" is that forwarding through Tor only is the default. Anything unexpected / unsupported gets the bit bucket. the best target is actually TARPIT, not DROP, but that's another discussion... [this advice to default drop and isolate at routing level applies to Tails, Whonix, Qubes TorVM, and whoever else allows a transparent proxy model, IMHO] best regards,

1 0

DILKE-ALLEN Award
by coderman 06 Apr '14

06 Apr '14

what is the history?

1 0

Anarchism and Capitalism [was: reminder of mays manifesto]
by coderman 06 Apr '14

06 Apr '14

On Sat, Apr 5, 2014 at 5:02 AM, Cari Machet <carimachet(a)gmail.com> wrote: > i post this here as a reminder of anarchist models and how they can be > utilized in fascist occasions and are anti facsist but also are anti > capitalist anarchistic theories as anti-capitalist? the best markets are fully decentralized, with pervasive information: anarchistic to their core! the fact that nearly all systems of capitalist claim in current day are absurd perversion of an ideal does not imply the concept itself is invalid... best regards,

1 0

Re: Investigating the Investigators
by jim bell 06 Apr '14

06 Apr '14

On Tue, Apr 1, 2014, at 08:02 PM, jim bell wrote: > Group of people who burgled the FBI in 1971 > https://movies.yahoo.com/blogs/movie-news/trailer--fbi-whistleblowers-revea… >Thanks for posting this. It's so timely and historically important. >Can't wait to see it. >Hey Jim, what happened with the Yahoo account you were locked out of? >Did you ever get the lost emails and contacts restored? >-Shelley Haven't got back on jamesdbell8(a)yahoo.com. I'm convinced that Yahoo is a bunch of crooks. Bleeding-heart, do-gooder liberal crooks. Anybody who looks at Yahoo's news sees this. Jim Bell

3 4

RAND study on "Markets for Cybercrime Tools and Stolen Data"
by Gregory Foster 06 Apr '14

06 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 RAND National Security Research Division (2014) - "Markets for Cybercrime Tools and Stolen Data: Hackers' Bazaar" by Lillian Ablon, Martin C. Libicki, Andrea A. Golay: http://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND… HT Cyber Security Law and Policy Blog (Apr 2): http://blog.cybersecuritylaw.us/2014/04/02/rand-corporation-releases-report… gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTPqwjAAoJEMaAACmjGtgj4z8P/3AD6XfqlqAUKDCJ1fyAqy16 gEHylffMmt7IVjUTahi9onYDDpyI2tVEsPuJCANnqEfu/70LTLSOZimSl7uwNP1x nPMc8JjgztotWoU9jPD/r99PIp5qSmeN0VSaryVYEgihpsmZqit9/oIqKLx8xltf a+wNwn4EFAgzTsZpTxXGt/6Aki29f6MEnU1bZjpzaudN5PwXZ97gX2MZtZXOBM54 OlNW/J0E3VWXAyJ8Sx9Au5gTOOGCS3EebwAJSBeHbqwCvmcHW9rgpB1Fbny1XU8K QiM5GFM9oTEmAzdFeTvOZtwHP7hQ6/gO4dI3y3u9Vc0hgK6wycjU4wlOn8ab0SxP yAD/1UI+iXHGYbGDCHwNFAZFXae+SAJI0DxToaTPVQMVkyjW5CwoM1jlijAXxrg7 41YwZTDOLV3txNBD83MVToeAfpjBoU6MDm43rHKYfowTqykuFkATlCERxrT5igGJ 5N3RFLJMFUgrn/2MxaMRRswynHRGabq/H0T0DPwVN4s74X9A+oI5sOWCtsvgO44W FqkKq9LEOCARbobF87jGNSAph5DXQ6MZmGfUrp+IRQQrMIKLBevo+6oHfpwrjZ+t pL5/2BtPJXErl8wvnjmXRmm1R4JEeC21baTwdUXu7u7QGBTmo7lij9UkjTJk5jC/ r/tw1VwX6Ex9yemiitLV =rLdn -----END PGP SIGNATURE-----

2 1