- cypherpunks - lists.cpunks.org

Re: VMs without Administrator rights [was: Threat model: Parents]
by coderman 10 Jun '15

10 Jun '15

On 5/31/15, Barton Gellman <otr(a)riseup.net> wrote: > ... > * A virtual machine may be possible on the monitored host, if the required > drivers are already present. Probably not. See http://www.vbox.me/. If > anyone knows a VM that works without admin rights, speak up. in the Tor VM experiment from years back (2007) Qemu was used because it could be run as a restricted user once the Windown Tap and Pcap drivers were installed. throughput was poor, and this is the crux of a non-admin virtualization environment - performance demands privileges! less a problem for headless network appliances - a real big problem for interactive graphical user interfaces... best regards,

2 2

Re: [Cryptography] Proposed US ITAR changes would require prepublication approval for most crypto research
by Alfie John 10 Jun '15

10 Jun '15

Thanks for the comments Adrian. What concerns me is that from what I've seen, it only talks about Australian academics publishing novel ideas. What is completely missing is how these ammendments may affect Australian open source developers, who are also non-academics, working on cryptosystems. If they publish a novel cipher on GitHub without getting approval by DECO, is that a GOTO Jail card? Alfie On Wed, Jun 10, 2015, at 04:15 PM, Adrian McCullagh wrote: > Dear All, > > > I with 4 colleagues of mine (3 at the Queensland University of > Technology (Cryptographers all)and one from the University of > Queensland (Legal E-commerce researcher) have been working on a paper > dealing with the Australian Defence Trade Control Act which > corresponds to the proposed US ITAR changes. > > > Without giving everything away on our forthcoming paper, it appears to > me that if this type of regulation had been in place in Germany in > 1938, then it is highly likely that Einstein would never have read the > Hahn - Strassmann paper dealing with splitting a uranium atom. That > paper written in 1938 (December I believe) was read by Einstein in > March 1939 and it directly lead to Einstein sending a letter to > Roosevelt, which in turn resulted in 1942 to the establishment of the > Manhattan project. Now if NAZI Germany had restricted that > publication NAZI Germany could have developed the bomb itself which > could have completely altered the outcome. > > > Basically, if regimes like the ITAR rules are expanded then it works > both ways and there could be a stifling of publication research due to > bureaucratic mishandling. Though it could assist in the spy business > as in the cold war. > > > > > > > Dr. Adrian McCullagh Ph.D. LL.B.(Hons) B. App. Sc. (Computing) ODMOB > Lawyers Mobile 0401 646 486 Skype. Admac57 > E: ajmccullagh57(a)gmail.com > E: amccullagh(a)live.com The contents of this email are confidential > between the sender and the intended recipient. If you are not the > intended recipient then no rights are granted to you because of > this error and as such you are requested to promptly inform the > sender of the error and to promptly destroy all copies of the email > in your power, possession or control. The sender reserves all > rights concerning this email and its contents including any > privilege, copyright and confidentiality associated with this > email. Even though an email signature block has been appended to > this email, and notwithstanding the Electronic Transactions Act > (Qld) or the Electronic Transactions Act (Cth), the signature block > does not exhibit the senders intention to be bound by an offer > previously sent by the intended recipient, unless the email in its > body specifically indicated that the sender hereby accepts such an > offer previously sent by the intended recipient. > > > > > > From: Alfie John Sent: ‎Wednesday‎, ‎10‎ ‎June‎ ‎2015 ‎1‎:‎54‎ ‎PM To: > Cryptography Mailing List, cypherpunks(a)cpunks.org > > > > > > Snap, from Australia: > > http://www.smh.com.au/it-pro/security-it/dangerous-minds-are-maths-teachers… > > "Australian academics who teach mathematics may need to run new > ideas by the Department of Defence before sharing them or risk > imprisonment. > > Some academics are set to become much more familiar with the > department's Defence Export Control Office (DECO), a unit that > enforces the Defence Trade Control Act 2012, Australia's end of a > 2007 pact with the US and UK over defence trade. > > Until recently, DECO only regulated physically exported weapons > and so-called "dual use" items such as encryption, computing > hardware and biological matter. > > However in March the act was updated to include "intangible > supply", which is intended to prohibit the transfer of knowledge > from Australia that could be used to produce weapons." > > Alfie > > On Tue, Jun 9, 2015, at 05:36 PM, pete wrote: > > Proposed US ITAR changes. New regs, for comment, not yet in law or > > in force. > > > > http://www.washingtonexaminer.com/nra-gun-blogs-videos-web-forums-threatene… > > > > www.gpo.gov/fdsys/pkg/FR-2015-06-03/pdf/2015-12844.pdf > > > > > > Actually, it says, for the first time explicitly, that publishing > > widely on the internet would be enough to put data into the public > > domain > > [000]. Sounds good? > > > > However, there is a great big kicker: posting ITAR technical data > > for the first time would be an export, and you wouldn't be allowed > > to do it without prior authorization [17]. > > > > Reposting already-posted technical data is also making it available, > > and you wouldn't be allowed to do that unless the initial posting > > was authorised. > > > > Neither would you be allowed to sell a book or magazine or > > periodical, even within the US, unless it had been made available > > with an authorisation [23]. > > > > Phil Zimmerman's trick, publishing the source to PGP in printed form > > to put it in the public domain, would no longer work. > > > > > > > > > > > > There is also some trickery about redefining software as an item, > > rather than as data; one effect of which is to put software which is > > the result of fundamental research into the control regime. > > > > Of course, as "fundamental research" only means research done in the > > US by US centers of learning, or US Government funded .. > > > > I get confused, but it would seem to me that eg if there is a crypto > > conference in the US with published proceedings, the publishers > > would need export permission for the work of foreign authors, but > > not the work of most US authors. > > > > > > > > > > > > [000] "Public domain" here is not the same thing as "public domain" > > in copyright law. The use the same words, but they are defined > > completely differently. > > > > [17] To get pernickity: data which has been made publicly > > available, including by widespread posting, would be exempt. > > > > However, data which hadn't been made available with proper > > authorisation would not be exempt. This would apply to data which is > > now in the public domain too. > > > > If you saw some posted data or data in a book, and you didn't > > actually know that it hadn't been released with proper > > authorisation, you couldn't be prosecuted for reposting it, or > > selling the books it was in. Though you could be prevented from > > doing it again, if someone told you its initial release has not been > > authorised. > > > > > > [23] the relevant bits: > > > > > > § 120.11 Public domain. > > > > (a) Except as set forth in paragraph (b) of this section, > > unclassified information and software are in the public domain, > > and are thus not technical data or software subject to the ITAR, > > when they have been made available to the public without > > restrictions upon their further dissemination such as through > > any of the following: > > > > (1) Subscriptions available without restriction to any individual > > who desires to obtain or purchase the published information; > > > > (2) Libraries or other public collections that are open and > > available to the public, and from which the public can obtain > > tangible or intangible documents; > > > > (3) Unlimited distribution at a conference, meeting, seminar, trade > > show, or exhibition, generally accessible to the interested > > public; > > > > (4) Public dissemination (i.e., unlimited distribution) in any form > > (e.g.,not necessarily in published form), including posting on > > the Internet on sites available to the public; or > > > > (5) Submission of a written composition, manuscript or presentation > > to domestic or foreign co-authors, editors, or reviewers of > > journals, magazines, newspapers or trade publications, or to > > organizers of open conferences or other open gatherings, with > > the intention that the compositions, manuscripts, or > > publications will be made publicly available if accepted for > > publication or presentation. > > > > > > (b) Technical data or software,whether or not developed with > > government funding, is not in the public domain if it has been > > made available to the public without authorization from: > > > > (1) The Directorate of Defense Trade Controls; > > > > (2) The Department of Defense’s Office of Security Review; > > > > (3) The relevant U.S. government contracting entity with authority > > to allow the technical data or software to be made available to > > the public; or > > > > (4) Another U.S. government official with authority to allow the > > technical data or software to be made available to the public. > > > > > > > > § 127.1 Violations. [...] > > (6) To export, reexport, retransfer, or otherwise make available to > > the public technical data or software if such person has > > knowledge that the technical data or software was made publicly > > available without an authorization described in § 120.11(b) of > > this subchapter. > > > > > > > > > > > > ps: there is yet another ITAR change on the way about exploits and > > technical data concerning security and hacking tools. see eg; > > http://www.theregister.co.uk/2015/06/06/whats_up_with_wassenaar/ > > > > -- Peter Fairbrother > > > > _______________________________________________ > > The cryptography mailing list cryptography(a)metzdowd.com > > http://www.metzdowd.com/mailman/listinfo/cryptography > > > -- > Alfie John alfiej(a)fastmail.fm > _______________________________________________ > The cryptography mailing list cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography -- Alfie John alfiej(a)fastmail.fm

1 0

Encryption article from Yahoo
by jim bell 10 Jun '15

10 Jun '15

By Richard CowanWASHINGTON (Reuters) - As Washington weighs new cybersecurity steps amid a public backlash over mass surveillance, U.S. tech companies warned President Barack Obama not to weaken increasingly sophisticated encryption systems designed to protect consumers' privacy.In a strongly worded letter to Obama on Monday, two industry associations for major software and hardware companies said, "We are opposed to any policy actions or measures that would undermine encryption as an available and effective tool."The Information Technology Industry Council and the Software and Information Industry Association, representing tech giants, including Apple Inc, Google Inc, Facebook Inc, IBM and Microsoft Corp, fired the latest salvo in what is shaping up to be a long fight over government access into smart phones and other digital devices.Obama administration officials, led by the FBI, have pushed the companies to find ways to let law enforcement bypass encryption to investigate illegal activities, including terrorism threats, but not weaken it so that criminals and computer hackers could penetrate the defenses.So far, however, the White House has not spelled out specific regulatory or legislative steps it might seek.View gallery Some cybersecurity experts are skeptical that Congress will take legislative action to expand the administration's powers anytime soon, noting recent lopsided votes in the House of Representatives to rein in surveillance.White House spokesman Josh Earnest, responding to Reuters' inquiries, said the administration "firmly supports the development and robust adoption of strong encryption."But he added there were concerns about "the use of encryption by terrorists and other criminals to conceal and enable crimes and other malicious activity."FBI'S INTENTIONS KEYKate Martin, director of the Center for National Security Studies, a civil liberties watchdog group, said, "The ultimate question is whether the FBI is going to seek legislation that would put limits on development of encryption tools."View gallery The Obama administration is in the midst of an internal debate on the matter. Martin said the recent naming of Ed Felten, a computer science and public affairs expert, as deputy U.S. chief technology officer was an indication that Obama "takes seriously the privacy concerns."But at the same time, she noted, "Technology, and especially the globalization of communications, has outpaced U.S. law."The debate over whether there should be limits on encryption should include the question of whether there should be limits on when the government can lawfully get access to people's private information, Martin said.The industry letter to Obama also was sent to FBI Director James Comey, Homeland Security Secretary Jeh Johnson, Attorney General Loretta Lynch and other Cabinet heads.Days earlier, the United States enacted legislation that will curtail the government's ability to scoop up huge volumes of data related to records of Americans' telephone calls.View gallery At the same time, Washington is being battered by computer hacks. Last week a massive breach was disclosed at the U.S. Office of Personnel Management, with records of up to 4 million current and former federal employees possibly compromised.An explosion in government surveillance was an outgrowth of the Sept. 11, 2001, attacks on the United States and was exposed by former National Security Agency contractor Edward Snowden.The industry groups noted that online commerce has flourished in part because consumers believed their payment information would be secure."Consumer trust in digital products and services is an essential component enabling continued economic growth of the online marketplace," the industry wrote."Accordingly, we urge you not to pursue any policy or proposal that would require or encourage companies to weaken these technologies, including the weakening of encryption or creating encryption 'work-arounds'."(Additional reporting by Roberta Rampton; Editing by Kevin Drawbaugh and Tom Brown)

1 0

Re: [Cryptography] Proposed US ITAR changes would require prepublication approval for most crypto research
by Alfie John 10 Jun '15

10 Jun '15

Snap, from Australia: http://www.smh.com.au/it-pro/security-it/dangerous-minds-are-maths-teachers… "Australian academics who teach mathematics may need to run new ideas by the Department of Defence before sharing them or risk imprisonment. Some academics are set to become much more familiar with the department's Defence Export Control Office (DECO), a unit that enforces the Defence Trade Control Act 2012, Australia's end of a 2007 pact with the US and UK over defence trade. Until recently, DECO only regulated physically exported weapons and so-called "dual use" items such as encryption, computing hardware and biological matter. However in March the act was updated to include "intangible supply", which is intended to prohibit the transfer of knowledge from Australia that could be used to produce weapons." Alfie On Tue, Jun 9, 2015, at 05:36 PM, pete wrote: > Proposed US ITAR changes. New regs, for comment, not yet in law or > in force. > > http://www.washingtonexaminer.com/nra-gun-blogs-videos-web-forums-threatene… > > www.gpo.gov/fdsys/pkg/FR-2015-06-03/pdf/2015-12844.pdf > > > Actually, it says, for the first time explicitly, that publishing > widely on the internet would be enough to put data into the > public domain > [000]. Sounds good? > > However, there is a great big kicker: posting ITAR technical data for > the first time would be an export, and you wouldn't be allowed to do > it without prior authorization [17]. > > Reposting already-posted technical data is also making it available, > and you wouldn't be allowed to do that unless the initial posting was > authorised. > > Neither would you be allowed to sell a book or magazine or periodical, > even within the US, unless it had been made available with an > authorisation [23]. > > Phil Zimmerman's trick, publishing the source to PGP in printed form > to put it in the public domain, would no longer work. > > > > > > There is also some trickery about redefining software as an item, > rather than as data; one effect of which is to put software which is > the result of fundamental research into the control regime. > > Of course, as "fundamental research" only means research done in the > US by US centers of learning, or US Government funded .. > > I get confused, but it would seem to me that eg if there is a crypto > conference in the US with published proceedings, the publishers would > need export permission for the work of foreign authors, but not the > work of most US authors. > > > > > > [000] "Public domain" here is not the same thing as "public domain" in > copyright law. The use the same words, but they are defined > completely differently. > > [17] To get pernickity: data which has been made publicly available, > including by widespread posting, would be exempt. > > However, data which hadn't been made available with proper > authorisation would not be exempt. This would apply to data which is > now in the public domain too. > > If you saw some posted data or data in a book, and you didn't actually > know that it hadn't been released with proper authorisation, you > couldn't be prosecuted for reposting it, or selling the books it was > in. Though you could be prevented from doing it again, if someone told > you its initial release has not been authorised. > > > [23] the relevant bits: > > > § 120.11 Public domain. > > (a) Except as set forth in paragraph (b) of this section, unclassified > information and software are in the public domain, and are thus > not technical data or software subject to the ITAR, when they have > been made available to the public without restrictions upon their > further dissemination such as through any of the following: > > (1) Subscriptions available without restriction to any individual who > desires to obtain or purchase the published information; > > (2) Libraries or other public collections that are open and available > to the public, and from which the public can obtain tangible or > intangible documents; > > (3) Unlimited distribution at a conference, meeting, seminar, trade > show, or exhibition, generally accessible to the interested > public; > > (4) Public dissemination (i.e., unlimited distribution) in any form > (e.g.,not necessarily in published form), including posting on the > Internet on sites available to the public; or > > (5) Submission of a written composition, manuscript or presentation to > domestic or foreign co-authors, editors, or reviewers of journals, > magazines, newspapers or trade publications, or to organizers of > open conferences or other open gatherings, with the intention that > the compositions, manuscripts, or publications will be made > publicly available if accepted for publication or presentation. > > > (b) Technical data or software,whether or not developed with > government funding, is not in the public domain if it has been > made available to the public without authorization from: > > (1) The Directorate of Defense Trade Controls; > > (2) The Department of Defense’s Office of Security Review; > > (3) The relevant U.S. government contracting entity with authority to > allow the technical data or software to be made available to the > public; or > > (4) Another U.S. government official with authority to allow the > technical data or software to be made available to the public. > > > > § 127.1 Violations. [...] > (6) To export, reexport, retransfer, or otherwise make available to > the public technical data or software if such person has knowledge > that the technical data or software was made publicly available > without an authorization described in § 120.11(b) of this > subchapter. > > > > > > ps: there is yet another ITAR change on the way about exploits and > technical data concerning security and hacking tools. see eg; > http://www.theregister.co.uk/2015/06/06/whats_up_with_wassenaar/ > > -- Peter Fairbrother > > _______________________________________________ > The cryptography mailing list cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography -- Alfie John alfiej(a)fastmail.fm

1 0

Re: Threat Model: Parents
by Softy 09 Jun '15

09 Jun '15

Arguably a category of child which would benefit from a concerned adults supervision. I would never assert an alcoholic should choose a bar as their favourite hangout - nor would I claim they have no right to choose to do so. However, I would assert (to the alcoholic) they would be better off going to said bar with a helpful supervisor/friend. > Their specific situation is that they're about 15, autistic and bipolar, > > >

11 22

IMEI changed - any RTL-SDR sniff way to check it was properly changed?
by Virilha 05 Jun '15

05 Jun '15

Due to the recent events envolving planes and FBI, I was wondering. Changing SIMs (so IMSI) is an easy task. Change IMEI with some knowledge I believe its too. There are some tutorials on IMEI changing on rooted android, I dont known if actually works, suppose yes: http://www.technostall.com/how-to-change-imei-number-android/ http://www.plusdroid.com/Blogandnews/how-to-change-restore-imei-no-on-andro… Knowing we can get TMSI / IMSI (sometimes) via RTL-SDR software + proper dongles: http://www.rtl-sdr.com/rtl-sdr-cell-phone-imsi-tmsi-key-sniffer/ https://ferrancasanovas.wordpress.com/cracking-and-sniffing-gsm-with-rtl-sd… And knowing the IMEI is used / exchanged with the network before authentication is granted to a certain phone (network can block IMEIs, so they are sent/exchanged) Do someone know if is it possible to check if the original IMEI was really changed and is not being exchanged with the provider, by using RTL-SDR + proper device to sniff the frequency? http://www.rtl-sdr.com/ regards, --Virilha

1 0

New Snowden docs on domestic Internet spying
by Shelley 04 Jun '15

04 Jun '15

https://www.propublica.org/article/new-snowden-documents-reveal-secret-memo… As always, Keith Alexander is a lying bastard. Big surprise!

1 0

DEA bulk spying, FBI Spy Planes, IMEI Catchers, NIST cryptography standards, and ALPR amendments to HR 2578
by Jah Love 04 Jun '15

04 Jun '15

There's some amazing stuff going into the US House of Representative's HR2578. Here's some links to some of it: You can read the discussion on the amendment to ban the DEA from bulk surveillance here at page 83: http://www.gpo.gov/fdsys/pkg/CREC-2015-06-02/pdf/CREC-2015-06-02.pdf It passed! I got the link to that PDF at the Recent Sessions On-Demand tab at this link which also has archived videos of the proceedings: http://houselive.gov/ These other amendments also just passed a few hours ago: 3:16:54 P.M. H.R. 2578 An amendment, offered by Mr. Massie, to prohibit the use of funds by the National Institute of Standards and Technology to consult with the National Security Agency or the CIA to alter cryptographic or computer standards, except to improve information security. 3:16:56 P.M. H.R. 2578 DEBATE - Pursuant to the provisions of H. Res. 287, the Committee of the Whole proceeded with 10 minutes of debate on the Third Massie amendment. 3:26:26 P.M. H.R. 2578 POSTPONED PROCEEDINGS - At the conclusion of debate on the Third Massie amendment, the Chair put the question on adoption of the amendment and by voice vote, announced that the ayes had prevailed. Mr. Massie demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until a time to be announced. 3:35:34 P.M. H.R. 2578 An amendment, offered by Mr. Issa, to prohibit the use of funds to operate or disseminate a cell-site simulator or IMSI catcher in the United States except pursuant to a court order that identifies an individual, account, address, or personal device. 3:37:29 P.M. H.R. 2578 DEBATE - Pursuant to the provisions of H. Res. 287, the Committee of the Whole proceeded with 10 minutes of debate on the Issa Amendment. 4:06:04 P.M. H.R. 2578 An amendment, offered by Mr. Lamborn, to prohibit the use of funds to collect information about individuals attending gun shows, by means of an automatic license plate reader, or to retain any information so collected. 4:06:06 P.M. H.R. 2578 DEBATE - Pursuant to the provisions of H. Res. 287, the Committee of the Whole proceeded with 10 minutes of debate on the Lamborn amendment, pending a reservation of a point of order. 4:12:43 P.M. H.R. 2578 Mr. Farr raised a point of order against the Lamborn amendment. Mr. Farr stated that the amendment seeks to change existing law and constitutes legislation in an appropriations bill. The Chair sustained the point of order.

3 2

Taking Odds on the Content Bomb, and other Election Cycle Wonders
by grarpamp 04 Jun '15

04 Jun '15

Assholes like this love to stand up and lie to you... https://i.ytimg.com/vi/S61eL_06RZ4/hqdefault.jpg One of their lies that many observers consider to be a true component of programs is that content is in fact being bulk collected, picked, sifted, sorted, stored and used against national and other laws. What are the odds that we'll see leak of documented proof of somesuch major lie being exposed in the run up to the US 2016 election? What major new categories of as yet untold wonders are standing by in the Snowden and other caches? Who's running the prediction market on these things?

1 0

Re: NSA/FBI monitoring
by yotm 04 Jun '15

04 Jun '15

_The NSA provides data to the FBI and DEA, among others. Although it was known previously, this is part of what Snowden released with corroborating documentation. That it hasn't gotten more attention, by Greenwald, Snowden, et al, is one of the major credible complaints since the releases began in June 2013. _ Thanks M373, this was what I couldn't put my finger on, it's all been NSA, NSA so far... if the FBI has its own capacity to monitor phone, email, chats, etc., in addition to whatever NSA shares with them, that's a whole other data-sucking structure that needs attention. Nigel

3 2