- cypherpunks - lists.cpunks.org

[qubes-users] Persistent firmware backdoors possible across major hard drive brands
by Eugen Leitl 18 Feb '15

18 Feb '15

----- Forwarded message from Axon <axon(a)openmailbox.org> ----- Date: Tue, 17 Feb 2015 14:44:30 +0000 From: Axon <axon(a)openmailbox.org> To: "qubes-users(a)googlegroups.com" <qubes-users(a)googlegroups.com> Subject: [qubes-users] Persistent firmware backdoors possible across major hard drive brands Message-ID: <54E353CE.7040202(a)openmailbox.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2015-02-16, Kaspersky Lab announced[1]: > GReAT has been able to recover two modules which allow > reprogramming of the hard drive firmware of more than a dozen of > the popular HDD brands. This is perhaps the most powerful tool in > the Equation group’s arsenal and the first known malware capable of > infecting the hard drives. > > By reprogramming the hard drive firmware (i.e. rewriting the hard > drive’s operating system), the group achieves two purposes: > > 1. An extreme level of persistence that helps to survive disk > formatting and OS reinstallation. If the malware gets into the > firmware, it is available to “resurrect” itself forever. It may > prevent the deletion of a certain disk sector or substitute it with > a malicious one during system boot. “Another dangerous thing is > that once the hard drive gets infected with this malicious payload, > it is impossible to scan its firmware. To put it simply: for most > hard drives there are functions to write into the hardware firmware > area, but there are no functions to read it back. It means that we > are practically blind, and cannot detect hard drives that have > been infected by this malware” warns Costin Raiu, Director of the > Global Research and Analysis Team at Kaspersky Lab. > > 2. The ability to create an invisible, persistent area hidden > inside the hard drive. It is used to save exfiltrated information > which can be later retrieved by the attackers. Also, in some cases > it may help the group to crack the encryption: “Taking into account > the fact that their GrayFish implant is active from the very boot > of the system, they have the ability to capture the encryption > password and save it into this hidden area,” explains Costin Raiu. Affected HDD brands include[2] (but are probably not limited to): * Western Digital * Maxtor * Seagate * Hitachi * Micron * OCZ * OWC * Corsair * Mushkin * Samsung * Toshiba This is bad news for everyone, including Qubes users, since there's nothing we can really do at the OS/software level to protect ourselves from this kind of persistent HDD firmware infection (or compromised firmware and hardware in general). Measures like AEM don't help if the drives are already infected before we even purchase them. If we want freedom and safety in the future, our best bet is probably to (continue to) push for open-source firmware and hardware. [1]http://www.kaspersky.com/about/news/virus/2015/equation-group-the-crown-c… [2]https://securelist.com/files/2015/02/Equation_group_questions_and_answers… -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU41O4AAoJEJh4Btx1RPV85wcP/RK7mPG3HhdPpFt19yNTKE0c ETJ+93S7iRg7VZV+f8okFzQWn+ER6+OY0bl2shzwBJKXhxqneVYctXBJJLGk2KLd NuqIURNwDgISXhtjtNK2eeCRDeMdyAUtWceG+kxwZqXN8jXkZvBW0DrN7UEaPb8s Zib8GfsqvOr1HSkw67P4z48pU7sdN7gF4rLTcA7el/JH98m0ltlIHmurbma4XLgp RGnJSgsFwoViD4BgOHk4gmavgctoiBUgDuKjJ3O2nFaCFIlUT6hF/6TB7MsIqOZh 0OrsSr3OsXkKGlIxbjoDt4mlo7FC64diKq5JzRd9KS+68zmU9V7ocaq7ehfIJjq3 xyXX85Ly7MgREwwPf4uQEgLqNew77prG3pNYeAhBVmcsr2cJeBrpvT+i56hvTkcS 07anQjf2C2o0NW0UAqpzNTHuLhl4Jdts9ra/k6oiy05fj8EdU8WQYW4iaznEFu4V IkYS5tF7EPjyBmtqwVuWPQMNjW5rKUOq4KRWY2fXXeV+lYExpqfuZoCh8SNE/eYz WtTDVnxS5hTOq4Fy74GA4qpGYjYl0VhdM0EYpHBrn9xiI2HDYN6/L9R4TI+M5vCI fF3BkjvvzJgYjBAZx133n+WWdPlyykeyQahKfHUgT0qXGN2TD6Lo8sWZE1+NBJbo GlihcbnDLrcUtul23CrE =ugr/ -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscribe(a)googlegroups.com. To post to this group, send email to qubes-users(a)googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/54E353CE.7040202%40openmailbo…. For more options, visit https://groups.google.com/d/optout. ----- End forwarded message -----

2 1

Re: [cryptography] [Cryptography] Equation Group Multiple Malware Program, NSA Implicated
by grarpamp 18 Feb '15

18 Feb '15

>>>> Here's an interesting comparison. Most academic cryptographers believe >>>> that the NSA has lost its lead: While for years they were the only ones >>>> doing cryptography, and were decades ahead of anyone on the outside, but >>>> now we have so many good people on the outside that we've caught up to, >>>> and perhaps even surpassed, the NSA. I've always found this reasoning a >>>> bit too pat. But getting actual evidence has been impossible. >>> >> What evidence is there for this? > > Snowden saying "encryption works." This is probably quite true... from his particular vantage/access point and social network. Yet however much we may know about that side being relatively open and shary and the capabilities there, it is not an exclusive answer to the crypto question. None of the Snowden docs to date are or show any real details about the crypto side of the house. He either had no interest (unlikely), had no time, found it too risky (whether to pull off without being caught, or over concern about some element of grave damage), or simply had no access. > FBI complaining about going dark, we need backdoors - they only ever > complain at that level as proxy for NSA, and same complaint is repeated in > rapid succession in UK, DE. These sort of things may be important indicators. Yet to prove them as such you'd also have to analyse the history of FUD making, grab attempts and so on to interpret. It could be that selective crypto is not dark, but merely expensive to scale into being "see all" as desired with the old in clear. So you would have to analyse the costs there. Electricity, rainbow disk storage, real estate, cooling. How do you know the disk makers and their suppliers do not have black wing budgets. Or that there is not a multi billion fab lab buried under some mountain powered by a ground radiator / aquifer cooled nuke reactor? > This is exactly how organizations win over smart individuals: > They build a database of expertise over many years, and they are > patient and can keep at it indefinitely. Yes, that's one... who is tracking where all the brilliant maths and others go after high school? The student names in known friendly colleges and programs? The ones that seem to drop from the public scene? What media is publishing interviews with them? Where are known adversary retirees that may have something to say when invited? >> It's not that I have evidence the other way. We just don't know. > At one level, this all comes down to your model of science. > ... > thinking of the question as a murder investigation - clues, hypotheses, > correlations, etc. To know the adversary you must continual analyse all potential aspects, and not just aspect itself but their inputs, dependencies and output/result chains. Then maybe you can answer some questions. After all, the adversary is doing analysis upon you. > Right. I'm surprised Android sells any phones in USA market. It's surprising that maybe no one has yet reverse engineered the binary blobs/drivers in android to provide a fully open software stack there. And although more difficult, same goes for the firmware blobs. Regardless of effectiveness, it would show market demand. >> New models for large >> corporations only started to arise in the late 1960's, with the development >> of so-called "knowledge organizations". Knowledge, and knowledge dichotomy within capacity of biology as a whole to adapt evenly, seems quite a potential for scary outcomes... http://yro.slashdot.org/story/15/02/17/2229240/oregon-residents-riled-over-… http://science.slashdot.org/story/15/02/17/030208/game-theory-calls-coopera… http://yro.slashdot.org/story/15/02/17/0025237/att-to-match-google-fiber-in… http://tech.slashdot.org/story/15/02/16/2332217/the-software-revolution >>> In sum, I'd say they are ahead in the pure math, but you'd be hard >>> pressed to find an area where it mattered. >> >> Maybe. It's really impossible to say. Two days ago, I would probably >> have agreed with you. Now ... I'm not so sure. As with Google, they hire a lot of Maths and others, and have been at it for decades longer. Even generations of maths born into now. There is too much silence from these workers. Especially when society could probably get along just as well without so many organizational level secrets everywhere (wars), and now potentially against peoples if you believe that sort of thing. More Snowdens Please.

2 2

Face Recognition Breakthrough - Why develop nukes?
by grarpamp 18 Feb '15

18 Feb '15

http://tech.slashdot.org/story/15/02/18/0024203/breakthrough-in-face-recogn… Face recognition software underwent a revolution in 2001 with the creation of the Viola-Jones algorithm. Now, the field looks set to dramatically improve once again: computer scientists from Stanford and Yahoo Labs have published a new, simple approach that can find faces turned at an angle and those that are partially blocked by something else. The researchers "capitalize on the advances made in recent years on a type of machine learning known as a deep convolutional neural network. The idea is to train a many-layered neural network using a vast database of annotated examples, in this case pictures of faces from many angles. To that end, Farfade and co created a database of 200,000 images that included faces at various angles and orientations and a further 20 million images without faces. They then trained their neural net in batches of 128 images over 50,000 iterations. ... What's more, their algorithm is significantly better at spotting faces when upside down, something other approaches haven't perfected." ... Why, like nukes, does society insist on developing tech whose primary purpose upon analysis seems only to be destructive, or of control, or in removing rights from individuals and groups, or just plain [ab]using them for profit? What possible quantifiable significant individualized benefit would a single human have from such things, when in fact they are pointed at them, instead of being wielded in their own hands? This isn't crypto or a weapon a human can also use to protect themselves beforehand. Do you really need to facial recognize your friends, your boss, doctor, or even to seek justice [aka: revenge] after someone's already done damage to you? Do you really care if another face has your name so long as if the cops come, society, laws and process are done right such that you are declared as innocent error and formally expunged from all db's and news and even compensated? Where is the FR in your hands? For that matter, do any individuals in your network really need to FR you either? In individual paired contexts, FR seems pointless. And any benefit when used to say hunt in a group seems thoroughly washed out by negatives on balance. When the camera comes to your face, instinct tells to put a mask to protect yourself. So there's something obviously wrong with the "picture" being developed here. Maybe it is the developers that need more cameras in their face to get a feel for the more likely uses.

2 1

Firmware exploits summary
by grarpamp 18 Feb '15

18 Feb '15

http://spritesmods.com/?art=hddhack http://s3.eurecom.fr/~zaddach/ https://www.ibr.cs.tu-bs.de/users/kurmus/ https://www.schneier.com/blog/archives/2014/01/iratemonk_nsa_e.html http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and… https://srlabs.de/badusb/ https://en.wikipedia.org/wiki/NSA_ANT_catalog http://inertiawar.com/microcode/ https://wiki.archlinux.org/index.php/microcode http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-3… https://en.wikipedia.org/wiki/Intel_Active_Management_Technology http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Eq… http://arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-…

1 0

BitTorrent, VPS and no DMCA
by Virilha 18 Feb '15

18 Feb '15

just had found being able to run a torrent seed box (in a medium bandwidth VPS, cheap) without getting DMCA requests, restarting daemon every 240 seconds - new randomized port on each restart. Using Deluge as torrent program and 8 lines of bash script to do the restart job. i forgot the restart script once and, next day, DMCA arrived. didnt bothered to found the optimal value since 240 seconds is ok for my needs. any other experiences? -Virilha

1 0

Broad coalition pushes for Minnesota data privacy amendment
by grarpamp 18 Feb '15

18 Feb '15

A move to change the Minnesota Constitution to protect text messages, e-mails and other electronic data from warrantless searches is getting enthusiastic support from a broad coalition of lawmakers and privacy advocates, but could face roadblocks from key DFL Senate leaders. The “My Life, My Data” movement would make Minnesota the second state to amend its Constitution by adding the words “electronic communications and data” to Section 10 of the document, which guarantees “the right of the people to be secure in their persons, houses, papers and effects against unreasonable searches and seizures.” If approved, the amendment would appear on the November 2016 election ballot. A similar measure passed in Missouri last year with 75 percent of voter support... Continues at... http://www.startribune.com/politics/statelocal/292136831.html http://yro.slashdot.org/story/15/02/18/0046200/mn-legislature-introduces-am…

1 0

Encryption used to secure transports is used to hide data exfiltration
by John Young 16 Feb '15

16 Feb '15

"The very encryption used to secure transports is used to hide data exfiltration." http://46qasb3uw5yn639ko4bz2ptr8u.wpengine.netdna-cdn.com/files/2015/02/IMG… http://blog.kaspersky.com/kaspersky-security-analyst-summit-2015-the-live-b…

2 1

Equation Group Multiple Malware Program, NSA Implicated
by John Young 16 Feb '15

16 Feb '15

Kaspersky Q and A for Equation Group multiple malware program, in use early as 1996. NSA implicated. <https://t.co/bByx6d25YF>https://securelist.com/files/2015/02/Equation_group_questions_and_answers.p… Dan Goodin: How omnipotent hackers tied to NSA hid for 14 yearsand were found at last <http://t.co/0n1D05GOFN>http://ars.to/1EdOXWo

1 0

Hackers can’t solve Surveillance
by stef 15 Feb '15

15 Feb '15

i think this is related and relevant to recent discussions. src: http://www.dmytri.info/hackers-cant-solve-surveillance/ quoted in full for your convenience: > Hackers can’t solve Surveillance > > Médecins Sans Frontières (MSF), also known as Doctors without Borders, is > an organization that saves lives in war-torn and underdeveloped regions, > providing health care and training in over 70 different countries. MSF > saves lives. Yet, nobody thinks that doctors can “solve” healthcare. It’s > widely understood that healthcare is a social issue, and universal health > care can not be achieved by either the voluntary work of Doctors or by way > of donations and charity alone. > > Just as Doctors can’t solve healthcare, Hackers can’t solve surveillance. > Doctors can’t make human frailty disappear with some sort of clever medical > trick. They can help mitigate issues, fight emergencies, they can be > selfless, heroic. but they can’t, on their own, solve healthcare. > > One of the ways that Hackers can fight surveillance is to develop better > cryptographic communications tools, and train people how to use them.. This > is certainly critical work that hackers can contribute to, but we can’t, on > our own, solve surveillance. > > Nothing that Hackers can do on their own can eliminate surveillance. Just > as universal healthcare is only something that can be achieved by social > means, privacy respecting mass communications platforms can only be > achieved by social means. Safe mass communications platforms can not be > created by private interests, neither commercially, nor voluntarily. > > As we well know, private medical provisioning provides unequal health care. > The reason is obvious, health needs and the ability to pay are not usually > corelated. Private provisioning means that those who can’t pay, wont be > served by profit-driven institutions, and though this can be mitigated by > voluntarism and charity, it can’t be fully overcome. > > Likewise, mass communications that are built for the profit motive either > need to charge a fee, and thereby be exclusive, or be advertising > supported. Other options can exist for connected and technically savvy > users, but these will be niche by necessity. For the masses, the main > options available will always be well funded platforms with employees to do > support, development, and marketing, without wich, it’s impossible to > build-up a mass user base. > > The lucrativeness of advertising-based platforms, makes it difficult even > for fee-based systems to compete, since they don’t generally produce enough > revenue to invest significantly in support, development and marketing, > which makes them less attractive even to users who could or would pay, but > the major issue that kills such platforms is that the fee means that some > people will not be able to use it at all. > > Thus, commercial mass platforms tend to be advertising driven. This means > that the business of platforms operators is selling audience commodity. > Commodities are sold by measure and grade. You can buy 10lbs of Fancy Grade > Granny Smith Apples, or two dozen Grade A free range eggs. Or 2 million > clicks from age 18-35 white males. > > Audience commodity, the users of the platform, are sold to advertisers, by > measure of clicks or conversion, and by grade. For advertisers, audience is > graded by specifications that include age, sex, income level, family > composition, location, ethnicity, home or automobile ownership, credit card > status, etc. The Demographics, as they say. > > Since an advertising funded platform must grade audience commodity, it must > collect data on it’s users in order to grade them. This means that the one > thing such a platform can not offer its users is privacy. At least not > privacy from the platform operators and their advertisers. > > And so long as the platform operators collect such data, there is no way > that this data will not be made available to local and foreign intelligence > agencies. > > This hard reality has been hard to grapple with, especially for a hacker > community who saw the Internet as a new realm, as John Perry Barlow wrote > in the Declaration of the Independence of Cyberspace: “We are creating a > world where anyone, anywhere may express his or her beliefs, no matter how > singular, without fear of being coerced into silence or conformity.” His > colleague, John Gilmore, famously claimed “The Net interprets censorship as > damage and routes around it.” > > Those two quotations, born of the 90s hey-day of net.culture, contrast > starkly with what Adam Curtis describes in his BBC documentary All Watched > Over By Machines of Loving Grace: > > “The original promise of the Californian Ideology, was that the computers > would liberate us from all the old forms of political control, and we would > become Randian heroes, in control of our own destiny. Instead, today, we > feel the opposite, that we are helpless components in a global system, a > system that is controlled by a rigid logic that we are powerless to > challenge or to change” > > Oddly, the film doesn’t credit Richard Barbrook and Andy Cameron who coined > the term the “Californian Ideology” in there seminal 1995 text, which was > among the first to identify the libertarian ideology endemic in Silicon > Valley culture. > > The visions of a free, uncensorable cyberspace envisioned by Barlow, > Gilmore and others was incompatible with the needs of Capital, and thus the > libertarian impulses that drives Silicon valley caused a change in tune. > Cyberspace was no longer a new world, declared independent with its own > unalienable rights, it was now an untamed frontier, a wild-west where > spooks and cypherpunks do battle and your worth is measured by your crypto > slinging skills and operational security. Rather than united denizens of a > new terrain, we are now crypto individualists homesteading in hostile > territory. > > This, as Seda Gurses argues, leads to Responsibilization, “Information > systems that mediate communications in a way that also collects massive > amounts of personal information may be prone to externalizing some of the > risks associated with these systems onto the users.” > > Users themselves are responsible for their privacy and safety online. No > more unalienable rights, no more censorship resistant mass networks, no > more expressing beliefs without fear of being silenced. Hack or be hacked. > > Since libertarian ideology is often at odds with social solutions, holding > private enterprise as an ideal and viewing private provisioning as best, > the solutions presented are often pushing more entrepreneurship and > voluntarism and ever more responsibilization. We just need a new start-up, > or some new code, or some magical new business model! This is what Evgeny > Morozov calls Solutionism, the belief that all difficulties have benign > solutions, often of a technocratic nature. Morozov provides an example > “when a Silicon Valley company tries to solve the problem of obesity by > building a smart fork that will tell you that you’re eating too quickly, > this […] puts the onus for reform on the individual.” > > Karl Marx makes a similar argument in Eighteenth Brumaire of Louis > Bonaparte: > > “The proletariate […] gives up the task of revolutionizing the old world > with its own large collective weapons, and, on the contrary, seeks to bring > about its emancipation, behind the back of society, in private ways, within > the narrow bounds of its own class conditions, and, consequently, > inevitably fails.” > > Solutionism underestimates social costs and assumes that social issues can > be solved by individuals and private interests, and some may be, but where > universality, equality and fairness need to be provided regardless of skill > or wealth this is not the case. These sorts of things can only be provided > socially, as public goods. > > Many Hackers have always known this. In a excellent Journal of Peer > Production essay Maxigas quotes Simon Yiull: > > “The first hacklabs developed in Europe, often coming out of the traditions > of squatted social centres and community media labs. In Italy they have > been connected with the autonomist social centres, and in Spain, Germany, > and the Netherlands with anarchist squatting movements.” > > Early hacklabs didn’t view their role as being limited to solutionism, > though hackers have alway helped people understand how online > communications works and how to use it securely, hackers where embedded > within social movements, part of the struggle for a fairer society. Hacker > saw themselves as part of affinity groups fighting against privatization, > war, colonialism, austerity, inequality, patriarchy and capitalism, they > understood that this was the way to a new society, working shoulder to > shoulder with mass movements fighting for a new society, and that here > their knowledge of networks and communications systems could be of service > to these movements. > > Yet, as Maxigas goes on to argue,, “hackerspaces are not embedded in and > not consciously committed to an overtly political project or idea.” > > Instead, hackerspaces often focus on technological empowerment, which is > certainly beneficial and important, but like community health centers that > teach health maintenance practices are beneficial, they can’t solve larger > social issues, such each-one-teach-one projects can not, on their own, > solve social issues like privacy or health. > > Hackers need to understand that there is no business model for secure mass > communications. In order to achieve a society where we can expect privacy > we need more hackers and hackerspaces to embrace the broader political > challenges of building a more equal society.

4 8

Re: [tor-talk] REAL-ID Internet Access Coming Soon
by grarpamp 15 Feb '15

15 Feb '15

On Wed, Feb 11, 2015 at 5:00 PM, Yuri <yuri(a)rawbw.com> wrote: > > On 02/11/2015 13:17, goofyzrnssm(a)vfemail.net wrote: >> >> If a `REAL-ID Internet Access' law were to gain traction in the U.S., how >> would such a law be enforced exactly? Use your imagination. > Real ID enforcement would violate people's anonymity rights, which are very > well protected in US (https://en.wikipedia.org/wiki/Anonymity#United_States) We're not talking about books and soapboxing today, class. We're talking about "papers please" being required for everything you do. Including, among other things, your internet access at home, mobile, in the library, coffee shop and so on. Today you can somewhat preserve your right to be anonymous and bigdata free, by manipulating inputs to some of these things. If you haven't noticed, that's become steadily harder over time. > So there is no > chance of this happening in US. Hah! That's what you think. Pending some games in the Supreme Court (if there are any brave souls left), it's already done... https://en.wikipedia.org/wiki/REAL_ID_Act > The OP was primarily concerned about other countries. No. China and Facebook were referenced as two that were already doing a semantic equivalent of REAL-ID for certain usage contexts of the internet. And it was described what will happen if you don't act. (If you know anything about history, it should be clear that that applies to all places on the planet, and that failure to act gets you what they want, not what you want.) You can add Russia to the list now too... http://yro.slashdot.org/story/15/02/11/2245240/russia-seeking-to-ban-tor-vp…

3 2