- cypherpunks - lists.cpunks.org

Re: Reinventing the Wheel
by wirelesswarrior＠Safe-mail.net 25 Aug '15

25 Aug '15

Jim, I'm more than a bit surprised that Ari says he's surprised. I think he's been around in the digital currency arena for decades and perhaps is only feigning surprise that social outliers and criminals are early adopters of disruptive technology. If one acknowledges that governments routinely exempt themselves from many of the criminal statutes applied to citizens (including murder) then the ability of those outside the halls of power to use these new services to their upmost can only be to the long term benefit to society even if some "elite's eggs are broken" to make new social compact omlettes. WW -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> Apparently from: cypherpunks-bounces(a)cpunks.org To: Cpunks List <cypherpunks(a)cpunks.org> Subject: Reinventing the Wheel Date: Tue, 25 Aug 2015 05:32:57 +0000 (UTC) > https://twitter.com/antonioregalado/status/631840159466696704 > > citing > > http://www.technologyreview.com/news/540151/bitcoins-dark-side-could-get-da… > > Partial quote: > "Some of the earliest adopters of the digital currency Bitcoin were criminals, who have found it invaluable in online marketplaces for contraband and as payment extorted through lucrative ransomware that holds personal data hostage. A new Bitcoin-inspired technology that some investors believe will be much more useful and powerful may be set to unlock a new wave of criminal innovation. > That technology is known as smart contracts small computer programs that can do things like execute financial trades or notarize documents in a legal agreement. Intended to take the place of third-party human administrators such as lawyers, which are required in many deals and agreements, they can verify information and hold or use funds using similar cryptography to that which underpins Bitcoin. > Some companies think smart contracts could make financial markets more efficient, or simplify complex transactions such as property deals (see The Startup Meant to Reinvent What Bitcoin Can Do ). Ari Juels, a cryptographer and professor at the Jacobs Technion-Cornell Institute at Cornell Tech, believes they will also be useful for illegal activity and, with two collaborators, he has demonstrated how. > In some ways this is the perfect vehicle for criminal acts, because it s meant to create trust in situations where otherwise it s difficult to achieve, says Juels. > In a paper to be released today, Juels, fellow Cornell professor Elaine Shi, and University of Maryland researcher Ahmed Kosba present several examples of what they call criminal contracts. They wrote them to work on the recently launched smart-contract platform Ethereum. > One example is a contract offering a cryptocurrency reward for hacking a particular website. Ethereum s programming language makes it possible for the contract to control the promised funds. It will release them only to someone who provides proof of having carried out the job, in the form of a cryptographically verifiable string added to the defaced site. > Contracts with a similar design could be used to commission many kinds of crime, say the researchers. Most provocatively, they outline a version designed to arrange the assassination of a public figure. A person wishing to claim the bounty would have to send information such as the time and place of the killing in advance. The contract would pay out after verifying that those details had appeared in several trusted news sources, such as news wires. A similar approach could be used for lesser physical crimes, such as high-profile vandalism. > It was a bit of a surprise to me that these types of crimes in the physical world could be enabled by a digital system, says Juels. He and his coauthors say they are trying to publicize the potential for such activity to get technologists and policy makers thinking about how to make sure the positives of smart contracts outweigh the negatives. > We are optimistic about their beneficial applications, but crime is something that is going to have to be dealt with in an effective way if those benefits are to bear fruit, says Shi. > Nicolas Christin, an assistant professor at Carnegie Mellon University who has studied criminal uses of Bitcoin, agrees there is potential for smart contracts to be embraced by the underground. It will not be surprising, he says. Fringe businesses tend to be the first adopters of new technologies, because they don t have anything to lose. > [end of partial quote] > > >

1 0

Fwd: [cryptome] The Gloves are Off: Diana Roark back in the Fray:
by coderman 24 Aug '15

24 Aug '15

---------- Forwarded message ---------- From: Douglas Rankine2001 <douglasrankine2001(a)yahoo.co.uk> Date: Sat, 22 Aug 2015 21:49:38 +0100 Subject: [cryptome] The Gloves are Off: Diana Roark back in the Fray: See url: https://cryptome.org/2015/08/drake-001.pdf Is there no stopping this woman... J. Now, William Binney, J Kirk Wiebe, Ed Loomis and Tim Drake, And Diane Roark, all of those involved in Thin Thread fame have got together to mount a law suit against the US intelligence establishment Has enough evidence come out from the likes of Snowden and other whistleblowers to sufficiently destroy the credibility of the leaders of the US intelligence services, and their hangers on, one wonders? Will the curtain open on the National Security stage and divulge the incompetent capers and conspiracies and corruptions which hide those affairs of the leading actors, who are dressed up in the clothing of secrecy, like transvestites at Cinderella's Ball... A lot of civil servants have turned to Ashley Madison to conduct their external affairs, now that posting messages on a Yahoo account is so well known... J. Interesting times...Well worth a read... As I have said before, court cases...no matter the outcome, can throw some interesting light on those areas of the dark web of intelligence.J. Certainly opening up new aspects of trailblazing. Enjoy... J. ATB Dougie.

1 0

Re: NSA Spying Relies on AT&T'S "Extreme Willingness to Help"
by Softy 23 Aug '15

23 Aug '15

> > > appears to stand up well. I believe it's very possible that > Snowden never obtained access to the useful and relevant technical > documents that seem to be missing from his dump: > > http://www.globalresearch.ca/nsa-deception-operation-questions-surro > und-leaked-prism-documents-authenticity/5338673 > > :o/ > This speaks to the success of the SCI model, more than anything about Snowden. He had widespread network access - but not specific compartmental access. I would guess rather than risk exposing himself he intentionally didn't (or couldn't) attempt an active spoof of credentials needed to gain SCI access - which is where the technical details live. Everything I have seen dumped from his trove is purely presentational/summary reports handed around between offices/echelons and posted on intranets for dissemination. Granted in much detail, but it's not the the source, as it were. I have been curious since the start to see if any of the future releases from the Snowden Cache reveal any actual technical source documentation. There might well be some, and not being released for a variety of legit (and not) reasons. Conversely as per above, it's more than likely there isn't any whatsoever. In the big picture those details don't change the validity of the trove -- any criticism based on the 'lack of code' is purely an apologist or diversion tactic. I think the situation speaks for itself: Managerial reporting to higher speaks to tech capabilities just as great as actual tech source. Similarly, intent is very difficult to discern from knowing technical ability, however is readily gleaned from managerial planning/status updates - especially at higher echelons.

3 2

Truecrypt container hacked?
by Tomas Overdrive Petru 23 Aug '15

23 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This one has been puzzling me for several days. Since I have not yet been able to figure it out, I thought I would "bleg" for assistance from our encryption-savvy readership. According to the Sun Sentinel <http://www.sun-sentinel.com/news/fl-christopher-glenn-sentenced-20150731-st…>, a South Florida man was recently convicted of stealing military secrets. I am less concerned with what he stole or why than with what the story says about how the evidence against him was identified and used. Here is the relevant part of the story: https://www.lawfareblog.com/puzzling-encryption-story - -- “Borders I have never seen one. But I have heard they exist in the minds of some people.” ― Thor Heyerdahl projects...................https://brmlab.cz/user/overdrive twitter....................https://twitter.com/#!/over2393 GnuPG key FingerPrint......08EA E4DC EF85 0F02 9267 5B48 2E58 6902 C5F8 794C -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJV2PKdAAoJEC5YaQLF+HlMTP0QAKEDUE5WcEXNPU35Rzd/FsDa WujrzPcsp4M9yCqBc5ycALmYHoeAkrEgvvDtH8rAgh5wnoEWV8eKnbLJvPxRHbM7 81LJehw9lA0Wuh2TouxISAPkAFnk1B1fwHoMOsS05I9CqbnjUR3o9Nh4cqbMmOfL sZL8WuuoUiQd/NGATXtu9c9166xeJIYljrHOl+YuLIkmQ1ne56J7NNTzEbJmrGCv ny1tGaIRaNs4kZ9QeWiEAWY6yXqRzmaGbDRr8JHy6fDvD8xUi8PmtqE8YMYx4Dnw j06k+VbPHyToDncOBB62/mb/rmddcM1/84bk/S8vVedkVjsLjWLMvX0EWghtMLRj 3X8q/lqNMmtC1Q2MydqGzmXQabkoddC6wutQzXsusqXSIt0a43irvql8bSXBhn3G bDUTKU7dyhKJnl0URWWoeY/s6O+KimQhj9nEoE8a5jUHJN3mteVjmSZigRSjxnF2 uahHQLMs2J4g/cQd5M3HHIJDOybV9JWchrSZxpN6x7nscRPIAK5zxVcCsZS6A7By kQNzMP3wmzuzfSoauqmkf8m0Xs8HBRTnlR8gaGGr/D3pRyjaIPZ6xSLHZqSRbWgN 8sgSb47wKAp90EnOvIQJOZd/CnApOtvsAoWNxe+r2m3Vvi9KegJSDw0qPOecpQiT pFfnecTukts6LdjSfFLp =k/HW -----END PGP SIGNATURE-----

5 4

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 22 Aug '15

22 Aug '15

On 8/21/15, Mike Perry <mikeperry(a)torproject.org> wrote: ... >> For those into researching other flow capabilities... >> There are also some probes in OS kernels and >> some other opensource taps, they're not as well known >> or utilized as nProbe. >> Other large hardware vendors include Brocade, Avaya, >> Huawei, and Alcatel-Lucent. > > Out of all of these, I was only able find info on Alcatel-Lucent. It > uses cflowd, which appears to be a common subcomponent. It's timeout > ranges are the same as Cisco IOS. for posterity, it would also be useful to scrutinize behavior of: - Arbor Peakflow SP - Narus Insight Manager - Lancope StealthWatch Xe with respect to soft or hard fixed NetFlow limits within analysis or as pushed to tapped switches. best regards,

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 22 Aug '15

22 Aug '15

On Sat, Aug 22, 2015 at 1:09 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > As such, I was only able to discover that its default inactive/idle > timoeut is 30s. I couldn't find a range. > What I really need now is any examples of common routers that have a > default inactive/idle timeout below 10s, or allow you to set it below 10s. Not common unless you consider all the places where software is being used as a network tap, whether by legit operator, or by adversary. nProbe can timestamp in milliseconds. [ 21] %LAST_SWITCHED %flowEndSysUpTime SysUptime (msec) of the last flow pkt [ 22] %FIRST_SWITCHED %flowStartSysUpTime SysUptime (msec) of the first flow pkt [152] %FLOW_START_MILLISECONDS %flowStartMilliseconds Msec (epoch) of the first flow packet [153] %FLOW_END_MILLISECONDS %flowEndMilliseconds Msec (epoch) of the last flow packet Some define and assignment logic sets the defaults. It's software so anyone could adjust the options to at least fall within the "hardcoded" integer type... 1 to u_short. That doesn't mean it's sensible or that other bits in the code won't need munged, I didn't look. u_short idleTimeout, lifetimeTimeout, sendTimeout; #define DUMP_TIMEOUT 30 /* seconds */ readOnlyGlobals.idleTimeout = DUMP_TIMEOUT; readOnlyGlobals.lifetimeTimeout = 4*DUMP_TIMEOUT; readOnlyGlobals.idleTimeout = atoi(optarg); readOnlyGlobals.lifetimeTimeout = atoi(optarg); if(readOnlyGlobals.lifetimeTimeout == 0) { readOnlyGlobals.lifetimeTimeout = 1; printf("[--lifetime-timeout|-t] <timeout> | It specifies the maximum (seconds) flow\n" " | lifetime [default=%d]\n", readOnlyGlobals.lifetimeTimeout); printf("[--idle-timeout|-d] <timeout> | It specifies the maximum (seconds) flow\n" " | idle lifetime [default=%d]\n", readOnlyGlobals.idleTimeout); > I think these devices are wandering into the "adversarial admin" > territory (see section 3 of the proposal). I want to focus on the case > where the adversary demands/sniffs/exploits routers likely to be > installed in most networks. Sniffs... Lavabit was [nearly/actually] forced to install devices on his network for some while, so I see no "Sorry, my vendors config range doesn't support it" distinction here. Telecoms like AT&T don't fight, and Vampires don't care. Demands... The point with the NICs is that even 100Gbit taps are old news. With that comes deployment of flow / bro / etc like things that use them and the logs get saved because humans love to create collect and save useless stuff... to supply on demand. Software taps are popular, probably moreso at the network edges... universities, corp, regional / city, colo, etc. But costs are dropping, tech is rising, depts are doing these things. Yes, a legit operator may be unlikely to adjust, or to set the timeouts too low on their own free will since: 1) why, 2) storage space, 3) processing cpu / bandwidth Exploits... It's all software in the end. I know, I'm partly diverging from legit operator context.

1 0

Brothers at Arms: Jeb Bush says no to crypto
by grarpamp 22 Aug '15

22 Aug '15

https://firstlook.org/theintercept/2015/08/19/jeb-bush-comes-encryption/ Jeb Bush Comes Out Against Encryption Jenna McLaughlin Aug. 19 2015, 3:40 p.m. Getty Images Republican presidential candidate Jeb Bush said Tuesday that encryption makes it harder for law enforcement to track down “evildoers” — and called for a “much better, more cooperative relationship” with Apple, Google, and other tech companies that are building uncrackable private communication apps into their new products. “If you create encryption, it makes it harder for the American government to do its job — while protecting civil liberties — to make sure that evildoers aren’t in our midst,” Bush said in South Carolina at an event sponsored by Americans for Peace, Prosperity, and Security, a group with close ties to military contractors. Bush said, “We need to find a new arrangement with Silicon Valley in this regard because I think this is a very dangerous kind of situation.” But when the event moderator, former CNN anchor Jeanne Meserve, brought up scientists’ conclusions that giving law enforcement special access to communications also gives hackers more access, Bush didn’t explain his position any further. “Good point, except we ought to have much more cooperation when it comes to cybersecurity,” he said.

3 2

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 22 Aug '15

22 Aug '15

On 8/21/15, Mike Perry <mikeperry(a)torproject.org> wrote: > ... > What I really need now is any examples of common routers that have a > default inactive/idle timeout below 10s, or allow you to set it below > 10s. So far I have not found any. i recall a switch vendor that used overflow condition to trim timeouts lower, but this is different from a hard, low limit by configuration. i'll see what i can dig up... best regards, P.S. flow tracking systems always make me point at c++ & scapy userspace driven raw injection around massive flow sybils as retort in their raw take and analytics. most efficient state representation of TCP behavior in memory? it's a fun challenge :P [ P.P.S. this may just crash your in-path, rather than DoS. keep a backup route! ]

1 0

NSA Spying Relies on AT&T'S "Extreme Willingness to Help"
by Shelley 22 Aug '15

22 Aug '15

Nothing we didn't know or expect, just more confirmation/proof that AT&T & Verizon are all too eager to get on their knees for the NSA. https://www.propublica.org/article/nsa-spying-relies-on-atts-extreme-willin… Also worth a look: how they connected the dots, supporting documents. https://www.propublica.org/article/a-trail-of-evidence-leading-to-atts-part… (Apologies for not including the article text, I'm currently mobile.) -S

5 5

Re: Defcon slides
by John Young 21 Aug '15

21 Aug '15

Someone else got a 402. Good Housekeeping Mr Clean machines do not get a 402. Most likely the Kaspersky-Krebs-Schneier-TCMay-Muppets- JPMorgan-In-Q-Tel-in-YourBox v.12 exploit is MiTM by DoD-BBG-Tor. Pay the ransom. No BTC, Rai only. At 05:14 AM 8/21/2015, you wrote: >On Thu, Aug 20, 2015 at 5:03 PM, <wirelesswarrior(a)safe-mail.net> wrote: > > My slides are now online. There is a link from the front page of > cryptome.org under the "Offsite" section. > >http://defcon-wireless-village.com/docs/Defcon23-Covert-Wireless.pdf >http://www.wirelessvillage.ninja/ > >402 Payment Required >Just kidding. Unless you really want to pay us. Chances are, if you >got this page, that means the server doesn't like something about you. >You may be using an invalid HTTP option, or an evil browser string, or >maybe just from a country we are leery of. If you want to access the >page, and you are not attempting to index/hack/inject/pwn it, DM Us to >get it looked at. > >tor so leery.

2 1