- cypherpunks - lists.cpunks.org

Re: Google has been stealth downloading audio listeners onto every computer that runs Chrome
by Shelley 22 Jun '15

22 Jun '15

Acknowledged; I know it's a trade-off. However, TLAs just tap the backbone and take everything upstream anyway. If I were ever a true target, there wouldn't be much I could do. ---------- On June 21, 2015 6:28:20 PM Travis Biehn <tbiehn(a)gmail.com> wrote: > Hosts that dont behave like all the other swans end up looking like ugly > ducklings ;) > > On Sun, Jun 21, 2015, 9:13 PM Shelley <shelley(a)misanthropia.org> wrote: > > > On June 21, 2015 3:25:07 PM Travis Biehn <tbiehn(a)gmail.com> wrote: > > > > > *Cough* AFAIK if 'OK google' works anything like on Android (and it > > should) > > > it locally processes for the trigger phrase, then provides both audio and > > > visual queues its recording your voice. They aren't constantly recording > > > everything you say and uploading it. > > > > > > It's not exactly the 1984 two-way A/V system its made out to be. Inspect > > > the source for yourself rather than relying on fantastical reporting. > > > > > > Google's products and services are not free, I don't find it surprising > > > that they datamine voice, they've been offering 'free' PBX systems for > > > years in exchange for all voice traffic that transits through it - > > directly > > > using this to train voice recognition along with YouTube videos and so > > on. > > > > > > Anything on your machine can be tapping you. Your attackers don't need to > > > bake it into the browser - doing so would be idiotic. Your attackers can > > > piggy on updates, TAO in, use an exploit or simply bug you. It's way > > easier > > > to pop a 10$ bug in the room rather than risking burning some 0day worth > > > infinitely more on you. > > > > > > > That's why I root and gut my android devices of bloatware and everything > > google (as much as is technologically possible), and block access to > > google/failbook etc. tracking BS in my hosts file (all those idiotic 'like' > > and 'share' buttons too. Pages load much quicker.) > > > > I side load everything and stick to FOSS. I've disabled voice search, and > > nothing uses data or accesses the net without my knowledge. It's certainly > > no blackphone, but it's about as secure as any civilian 24/7 tracking > > device can be and meets my needs. > > > > Also, it's easy to run debian on most devices, but there's always CM if > > someone prefers. > > > > -S > > > > > > > On Sun, Jun 21, 2015, 5:46 PM Kurt Buff <kurt.buff(a)gmail.com> wrote: > > > > > > > That's pretty easy. Fire up wireshark, look for packets heading to > > > > google-owned addresses. > > > > > > > > Kill off processes one by one until you see those packets stop. > > > > > > > > You have found your culprit. > > > > > > > > Kurt > > > > > > > > On Sun, Jun 21, 2015 at 2:28 PM, Tim Beelen <tim(a)diffalt.com> wrote: > > > > > How do I find out what program is listening to my microphone? > > > > > > > > > > > > > > > On 6/21/2015 4:55 PM, Shelley wrote: > > > > >> > > > > >> ---------- > > > > >> On June 21, 2015 1:14:32 PM Seth <list(a)sysfu.com> wrote: > > > > >> > > > > >>> from > > > > >>> > > > > >>> > > > > > > > > > > https://www.privateinternetaccess.com/blog/2015/06/google-chrome-listening-… > > > > >>> > > > > >>> > > > > >>> Posted on June 18, 2015 by Rick Falkvinge > > > > >>> > > > > >>> Google Chrome Listening In To Your Room Shows The Importance Of > > Privacy > > > > >>> Defense In Depth > > > > >> > > > > >> > > > > >> > > > > >> Wow, this is exactly the kind of bullshit- and bullshit response- > > I'd > > > > >> expect from this duplicitous NSA asset. > > > > >> > > > > >> I keep a seldom-used, older version of chromium on one of my debian > > > > >> laptops so I'll check for this. My webcam and microphone are > > physically > > > > >> disconnected anyway, but I still want to see if their spyware has > > > > infected > > > > >> my system. Fuckers. > > > > >> > > > > >> Thanks for posting this; I've been out of the news loop for a > > couple of > > > > >> days. > > > > >> > > > > >> -S > > > > >> > > > > >> > > > > >>> > > > > >>> Yesterday, news broke that Google has been stealth downloading > > audio > > > > >>> listeners onto every computer that runs Chrome, and transmits audio > > > > data > > > > >>> back to Google. Effectively, this means that Google had taken > > itself > > > > the > > > > >>> right to listen to every conversation in every room that runs > > Chrome > > > > >>> somewhere, without any kind of consent from the people > > eavesdropped on. > > > > >>> In > > > > >>> official statements, Google shrugged off the practice with what > > amounts > > > > >>> to > > > > >>> “we can do that”. > > > > >>> > > > > >>> It looked like just another bug report. "When I start Chromium, it > > > > >>> downloads something." Followed by strange status information that > > > > notably > > > > >>> included the lines "Microphone: Yes" and "Audio Capture Allowed: > > Yes". > > > > >>> > > > > >>> chrome-voicesearch > > > > >>> > > > > >>> Without consent, Google’s code had downloaded a black box of code > > that > > > > – > > > > >>> according to itself – had turned on the microphone and was actively > > > > >>> listening to your room. > > > > >>> > > > > >>> A brief explanation of the Open-source / Free-software philosophy > > is > > > > >>> needed here. When you’re installing a version of GNU/Linux like > > Debian > > > > or > > > > >>> Ubuntu onto a fresh computer, thousands of really smart people have > > > > >>> analyzed every line of human-readable source code before that > > operating > > > > >>> system was built into computer-executable binary code, to make it > > > > common > > > > >>> and open knowledge what the machine actually does instead of > > trusting > > > > >>> corporate statements on what it’s supposed to be doing. Therefore, > > you > > > > >>> don’t install black boxes onto a Debian or Ubuntu system; you use > > > > >>> software > > > > >>> repositories that have gone through this source-code > > audit-then-build > > > > >>> process. Maintainers of operating systems like Debian and Ubuntu > > use > > > > many > > > > >>> so-called “upstreams” of source code to build the final product. > > > > >>> > > > > >>> Chromium, the open-source version of Google Chrome, had abused its > > > > >>> position as trusted upstream to insert lines of source code that > > > > bypassed > > > > >>> this audit-then-build process, and which downloaded and installed a > > > > black > > > > >>> box of unverifiable executable code directly onto computers, > > > > essentially > > > > >>> rendering them compromised. We don’t know and can’t know what this > > > > black > > > > >>> box does. But we see reports that the microphone has been > > activated, > > > > and > > > > >>> that Chromium considers audio capture permitted. > > > > >>> > > > > >>> This was supposedly to enable the “Ok, Google” behavior – that > > when you > > > > >>> say certain words, a search function is activated. Certainly a > > useful > > > > >>> feature. Certainly something that enables eavesdropping of every > > > > >>> conversation in the entire room, too. > > > > >>> > > > > >>> Obviously, your own computer isn’t the one to analyze the actual > > search > > > > >>> command. Google’s servers do. Which means that your computer had > > been > > > > >>> stealth configured to send what was being said in your room to > > somebody > > > > >>> else, to a private company in another country, without your > > consent or > > > > >>> knowledge, an audio transmission triggered by… an unknown and > > > > >>> unverifiable > > > > >>> set of conditions. > > > > >>> > > > > >>> Google had two responses to this. The first was to introduce a > > > > >>> practically-undocumented switch to opt out of this behavior, which > > is > > > > not > > > > >>> a fix: the default install will still wiretap your room without > > your > > > > >>> consent, unless you opt out, and more importantly, know that you > > need > > > > to > > > > >>> opt out, which is nowhere a reasonable requirement. But the second > > was > > > > >>> more of an official statement following technical discussions on > > Hacker > > > > >>> News and other places. That official statement amounted to three > > parts > > > > >>> (paraphrased, of course): > > > > >>> > > > > >>> 1) Yes, we’re downloading and installing a wiretapping black-box to > > > > your > > > > >>> computer. But we’re not actually activating it. We did take > > advantage > > > > of > > > > >>> our position as trusted upstream to stealth-insert code into > > > > open-source > > > > >>> software that installed this black box onto millions of computers, > > but > > > > we > > > > >>> would never abuse the same trust in the same way to insert code > > that > > > > >>> activates the eavesdropping-blackbox we already downloaded and > > > > installed > > > > >>> onto your computer without your consent or knowledge. You can look > > at > > > > the > > > > >>> code as it looks right now to see that the code doesn’t do this > > right > > > > >>> now. > > > > >>> > > > > >>> 2) Yes, Chromium is bypassing the entire source code auditing > > process > > > > by > > > > >>> downloading a pre-built black box onto people’s computers. But > > that’s > > > > not > > > > >>> something we care about, really. We’re concerned with building > > Google > > > > >>> Chrome, the product from Google. As part of that, we provide the > > source > > > > >>> code for others to package if they like. Anybody who uses our code > > for > > > > >>> their own purpose takes responsibility for it. When this happens > > in a > > > > >>> Debian installation, it is not Google Chrome’s behavior, this is > > Debian > > > > >>> Chromium’s behavior. It’s Debian’s responsibility entirely. > > > > >>> > > > > >>> 3) Yes, we deliberately hid this listening module from the users, > > but > > > > >>> that’s because we consider this behavior to be part of the basic > > Google > > > > >>> Chrome experience. We don’t want to show all modules that we > > install > > > > >>> ourselves. > > > > >>> > > > > >>> If you think this is an excusable and responsible statement, raise > > your > > > > >>> hand now. > > > > >>> > > > > >>> Now, it should be noted that this was Chromium, the open-source > > version > > > > >>> of > > > > >>> Chrome. If somebody downloads the Google product Google Chrome, as > > in > > > > the > > > > >>> prepackaged binary, you don’t even get a theoretical choice. You’re > > > > >>> already downloading a black box from a vendor. In Google Chrome, > > this > > > > is > > > > >>> all included from the start. > > > > >>> > > > > >>> This episode highlights the need for hard, not soft, switches to > > all > > > > >>> devices – webcams, microphones – that can be used for > > surveillance. A > > > > >>> software on/off switch for a webcam is no longer enough, a hard > > shield > > > > in > > > > >>> front of the lens is required. A software on/off switch for a > > > > microphone > > > > >>> is no longer enough, a physical switch that breaks its electrical > > > > >>> connection is required. That’s how you defend against this in > > depth. > > > > >>> > > > > >>> Of course, people were quick to downplay the alarm. “It only > > listens > > > > when > > > > >>> you say ‘Ok, Google’.” (Ok, so how does it know to start listening > > just > > > > >>> before I’m about to say ‘Ok, Google?’) “It’s no big deal.” (A > > company > > > > >>> stealth installs an audio listener that listens to every room in > > the > > > > >>> world > > > > >>> it can, and transmits audio data to the mothership when it > > encounters > > > > an > > > > >>> unknown, possibly individually tailored, list of keywords – and > > it’s no > > > > >>> big deal!?) “You can opt out. It’s in the Terms of Service.” (No. > > Just > > > > >>> no. > > > > >>> This is not something that is the slightest amount of permissible > > just > > > > >>> because it’s hidden in legalese.) “It’s opt-in. It won’t really > > listen > > > > >>> unless you check that box.” (Perhaps. We don’t know, Google just > > > > >>> downloaded a black box onto my computer. And it may not be the same > > > > black > > > > >>> box as was downloaded onto yours. ) > > > > >>> > > > > >>> Early last decade, privacy activists practically yelled and > > screamed > > > > that > > > > >>> the NSA’s taps of various points of the Internet and telecom > > networks > > > > had > > > > >>> the technical potential for enormous abuse against privacy. > > Everybody > > > > >>> else > > > > >>> dismissed those points as basically tinfoilhattery – until the > > Snowden > > > > >>> files came out, and it was revealed that precisely everybody > > involved > > > > had > > > > >>> abused their technical capability for invasion of privacy as far > > as was > > > > >>> possible. > > > > >>> > > > > >>> Perhaps it would be wise to not repeat that exact mistake. Nobody, > > and > > > > I > > > > >>> really mean nobody, is to be trusted with a technical capability to > > > > >>> listen > > > > >>> to every room in the world, with listening profiles customizable > > at the > > > > >>> identified-individual level, on the mere basis of “trust us”. > > > > >>> > > > > >>> Privacy remains your own responsibility. > > > > >>> > > > > >>> Rick Falkvinge > > > > >>> ABOUT RICK FALKVINGE > > > > >>> Rick is the founder of the first Pirate Party and is a political > > > > >>> evangelist, traveling around Europe and the world to talk and write > > > > about > > > > >>> ideas of a sensible information policy. He has a tech entrepreneur > > > > >>> background and loves whisky. Read more of his articles on his > > website. > > > > >>> > > > > >>> Twitter |More Posts (91) > > > > >>> > > > > >> > > > > >> > > > > > > > > > > > > > > > > > > >

1 0

POC || GTFO 08[.pdf]
by Tim Beelen 21 Jun '15

21 Jun '15

> This issue is a polyglot that can be meaningfully interpreted as a ZIP, a PDF and a Shell script featuring the weird cryptosystem described in 8:12. We are the technical debt collectors! https://diffalt.com/pocorgtfo08.pdf SHA256 (pocorgtfo08.pdf) = 7a942c425f471f99d8cba8da117cc4a53cddb3551e4b16c8b9feae31b5654a33 MD5 (pocorgtfo08.pdf) = 257fc8f01fa20e21f8bd5577639ff596 Massively in-depth and usually low-level, but generally very informative. https://www.alchemistowl.org/pocorgtfo/ There are the rest of them, if you're new to these. Sincerely, Tim -- This email/fax message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of this email/fax is prohibited. If you are not the intended recipient, please destroy all paper and electronic copies of the original message.

1 0

U S A, U S A - John Oliver on USA torture report
by Zenaan Harkness 18 Jun '15

18 Jun '15

http://www.youtube.com/watch?v=zmeF2rzsZSU http://bgr.com/2015/06/15/last-week-tonight-john-oliver-torture/ Censored to be not accessible in Australia (and therefore presumably elsewhere), but most folks around here ought find that no barrier. I guess this is about as humorous as this topic can be presented. Sad as it is.

4 3

Re: Privacy advocates resign over facial recognition plans
by John Young 18 Jun '15

18 Jun '15

"The Dark Net: Inside the Digital Underworld," Jamie Bartlett, examines the options for escaping observation -- for a while. Cypherpunks is featured for promoting privacy with technology; crypto, anonymizers, digital currency, unauthorized disclosures and more. And how escaping observation very often involves criminal activity, although as Tim May and others claimed, that is the price paid for cloaking from prying eyes. That Tor cloaks 415-1230% of child porn sites, 550-7000% of drug sales, and the like, is allegedly seen by the rebellious undergrounders as "so what, personal freedom is not free." So the richest have the greatest personal freedom, "so what," declared Judge Loretta Preska sentencing shackled hackers for violating the private enclaves of her kind's lawfully-bending relatives and unjudicials. Security of any kind is always bleak, not just due to NSA, its the Devil, why else would religion exist except to forecast the worst imaginable and preach slim chances of avoiding prying eyes of homicidal deity. Crypto bent-back prayer leads the day in fashionable cloaks against inevitable deitific spying -- mostly done by the same devils who espouse cryptosystems which inevitably fail like perpetual motion machinic faiths of all kinds. To the rescue upgrades offer a tad more dreadless illusion while injecting sand and rust into the sanctuaries, desktops, laptops, handhelds, clouds, national security, 4-rotored ski lifts to heaven. Hey, wake up, faithless cypherpunks will not be fooled, remember this when cold dead hands clamber into windows of Ecuadorian embassies, run skirted circles at Fort Leavenworth, dream of languid days key-signig in Hawaii from scrotum-iced pole dancing in Moscow, incise 365x24 days x 10 years to go on large sceen cell walls. Remember too where the grandfathers of cpunks loll, picking fleas from their cats, rueing STDs on their bitches, grooming authors of Deep and Dark Web tomes of horrific beasts lurking inside electronic frontiers of children's Kindles. At 08:46 AM 6/18/2015, you wrote: >2015-06-18 13:28 GMT+09:00 grarpamp ><<mailto:grarpamp@gmail.com>grarpamp(a)gmail.com>: >Cypherpunks... when / where will it all end? > > >The cost of observation is ever dropping. With improved processing >capability (hardware and software) the value of data is ever rising. >There is only one logical conclusion: permanent, global observation. > >Resistance is effective but eventually futile, you cannot reverse >time, you cannot reverse progress. > >More fruitful is managing the inevitable future. Will we go gently >into corporate hell? Will we let power games rule us? Do the wealthy >buy privacy, and the people's data? Will you, at the very least, own >the data about you? Will populism be managed by algorithms? Do our >current systems still work in such a future? How will the developed >areas relate to the underdeveloped? Etc. etc. etc.

1 0

Hearn vs Bitcoin-over-Tor / anonets?
by grarpamp 18 Jun '15

18 Jun '15

Wasn't there a group of folks or posts that were suggesting colored coins / relay censorship or some other type things as a good idea? Hearing people dismiss particular use cases of anonymity networks as moot, even though such uses are possible and being done (without need for much code or protocol development), or suggesting lesser alternatives, well... doesn't seem like words of support for those users, their principles and needs... and seems possibly against them. Of course the interpretation should really be left to others more closely following these few specific issues than I. https://www.youtube.com/watch?v=8JmvkyQyD8w&t=24m00s Recall that bitcoin-core added support for Tor and I2P a few years back thus helping to affirm the use case of anonets by [users of] digital currencies. And that those running traditional government currencies usually wish neither privacy or independant currencies, unless it's for and by themselves. IBM of course has a digital currency partnership proposition. Similar issues would apply there as well.

1 0

Matryoshka (fill traffic in networks?) [was: Are TOR holes intentional?]
by grarpamp 18 Jun '15

18 Jun '15

On Thu, Jun 18, 2015 at 12:51 AM, Roger Dingledine <arma(a)mit.edu> wrote: > but it sure looks like another case of somebody not understanding the > research field, and thinking that solving the traffic confirmation > attack is easy, without actually thinking through the engineering side, > the scaling side, or the statistics side. There's certainly no easy solution to all problems. Though there could be value in those that put more odds in your favor, even though they do not yield 100% solution or protection. If you rarely tx but then emit something [unique or timely] that pops out at some [rare] destination, you're done for. I think we've seen posts from some people who slow crawl the web 24x7 when their client is running just to add cover at their end for their interspersed real web activity. By the way, does metrics report the saturation level of the net as a whole in terms of bandwidth and processing load for exit and non exit relays as both one [and two] summed aggregate group[s]? > But even full scale padding, ignoring the practical side of how to get a > Tor network that can afford to waste so much bandwidth Waste is an incorrect, negative term for designed in padding (fixed set of lengths) or fill (empty links) or chaff (ratio) or whatever this is. A design where fill traffic gets out of the way when real data is being sent might have periods of congestion or underutilization of the link depending on the distance in hops the fill is managed over, and the speed of the sensing and feedback controls. Seems that might need to be as fast as you could initiate a first packet across, unless you inhibit that packet until ready. Yes, an individual relay or end node may be subject to various billing policies (transfer vs bitrate), but see thread in reply to Titov here... https://lists.torproject.org/pipermail/tor-talk/2015-May/037987.html https://lists.torproject.org/pipermail/tor-talk/2015-June/038027.html > doesn't provide > protection in the face of active attacks where you induce a gap on one > side and then observe the gap on the other side. And it might even be > the case that these gaps happen naturally by themselves, due to network > congestion and so on, so maybe passive observers will be winners even > against a design that does full padding. I've said that fill seems useful against passives, not actives. However a design may actually be possible such that any disturbance or deficiency in fill might be possible to make up from other sources. In other words, if I knock you off the net, the remaining path your data would have taken to your endpoint will still be filled so as not to expose the far end as being tied to you (if the fill management scope of the network is finer grained than just the end nodes negotiating end-to-end with each other (ie: I think the entire net will need to negotiate their own mesh of fill peers as an underlying management layer, with possible cues from above)). You get knocked off, your former peers sense this and recalc their fill sources and sinks. > Also, to make it really work in practice, all users are going to need > to pad not just while fetching their web page or iso or whatever, but > sufficiently before and after that too, else an attacker can match up > start times and end times: > http://freehaven.net/anonbib/#murdoch-pet2007 Well duh, that's necessary :) > tl;dr the whole premise of this person's blog post is flawed, since > their design likely does not work as they think it does. While someone's design may be insufficient to solve some problem, it does add value in the form of talk of possible solutions and trialing them. Thereby others can try different / related avenues to a solution. > For background see e.g. > http://freehaven.net/anonbib/#danezis:pet2004 > This is a great area for further research: > http://freehaven.net/anonbib/#ShWa-Timing06 > http://freehaven.net/anonbib/#active-pet2010 I don't mean that Tor specifically needs to investigate or implement fill, but that since the research area is probably not complete, and that no operational net is trying it, it's worth continued work. If anyone knows a good list that does or would serve as home for such work, please say so as I'm unaware of any. [Bcc'd to matryoshka as FYI]

2 1

Bitcoin: It's all about the Kolions...
by grarpamp 18 Jun '15

18 Jun '15

http://qz.com/429536/the-absurd-trial-of-a-russian-farmer-who-invented-his-… At the local court in Yegorevsk, a town outside Moscow, the case of local farmer Mikhail Shlyapnikov is being heard. Shlyapnikov is accused of creating his own alternative currency, which he calls “kolions,” in honor of the village of Kolionovo, where his farm is located. Shlyapnikov maintains that kolions simply assist a form of barter between him and his friends. The Central Bank and tax inspectorate both claim that Shlyapnikov has violated the constitution, several tax and civic legal codes, and a host of federal laws. Meduza’s special correspondent, Andrei Kozenko, was present at a rather unusual court hearing. “I don’t understand what’s going on here,” Shlyapnikov complains to the circle of TV journalists assembled, “Where is this all heading? This is my first time in court in my whole life. Clearly something’s gotten the prosecutor worked up and he’s brought this case.” ...

2 1

Terrist Favorite Messaging App SureSpot Under Govt Duress
by grarpamp 18 Jun '15

18 Jun '15

https://antipolygraph.org/blog/2015/06/07/developers-silence-raises-concern… http://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/0617/Opinion-I… https://www.surespot.me/documents/how_surespot_works.html https://www.surespot.me/documents/threat.html https://github.com/surespot https://www.eff.org/secure-messaging-scorecard Note that as with most new projects, SureSpot is unaudited, centralized, run by relative unknowns, nor is it known whether anyone is publicly validating the supposed source code to the distributed binaries and server protocols with each version.

1 0

Darknet Citizens Crowdfund Sekrit Rockit Programz To Shoot Down Pesky Spy Platforms
by grarpamp 18 Jun '15

18 Jun '15

http://qz.com/429946/these-are-the-first-full-color-hd-videos-of-earth-from… http://f9xr874n.........onion/giveBTC/

1 0

links - Assange now to be questioned - some choice comments at yank dot for giggles
by Zenaan Harkness 18 Jun '15

18 Jun '15

With plenty of references to our 'favourite' three letter agencies no less :) The, ahem, cypherpunks amongst us may enjoy this, just a little: http://yro.slashdot.org/story/15/06/15/2211259/julian-assange-to-be-intervi… But hey, don't let me spoil the CIA's parade.

3 2