- cypherpunks - lists.cpunks.org

What NSA Is Doing to Improve Security Post-Snowden
by George W. Maschke 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 NSA Director Mike Rogers spoke at Stanford University's Hoover Institute this past weekend, and a faculty member asked him what the NSA is doing with regards to personnel security to stop another incident like Edward Snowden's release of classified documents. Interestingly, the first and primary measure that the NSA director mentioned was polygraph testing. It's interesting because polygraphy is a thoroughly discredited pseuodoscience. It depends on the person being "tested" being ignorant of the trickery on which the procedure relies. How ironic that America's most technologically sophisticated intelligence agency relies on early 20th century pseudoscience as the keystone of its personnel security program. For additional commentary, see "NSA Director Mike Rogers on Polygraph Screening" on the AntiPolygraph.org blog: https://antipolygraph.org/blog/2014/11/04/nsa-director-mike-rogers-on-polyg… George Maschke PGP Public Key: 316A947C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUWf25AAoJEEYqwKuPDNWqPMgP/3QDCJH5epob6MKlYYTAH30A gYQBfIkIa93Wufhmt+Od2zlbQSxkshEnD/mNnujqih/bybrvj+OSLR2ejCwzoaL1 PMoR07E1kJRjKw0wEIbxnf0SLVGJedOHhUsu6/WUJ9DWYZ7mCiSyVgH+AOIhaQDy SUFoi9Nl3dZvUBN8FqRPeL4tHp0LG6QIV3N0pZZddOw68qIeI53HQ8Rv14VAFgix oAIzHJ77Y+0gcyp1WIxFyopVfnioezf15YVSl3hC0z+m1V/lRFUullHJWWbG4nm9 xenuqWwVF5T6wj4Lstep5seKBoKobr1+haGPkVfggNcfOMAY4PCjolzmA4j8yOci Sn8vx7U1eVGAwdPkppT33ug+GWzj5yXMVCjH95U+JyO6My4cY97YOhtQe5fUn0ep vhbPMRy+Q1lvtRYd9lZI/ZLRVOUp1652IqjhgCmIMCCR3ZtSPWq3RQmreepf6XgA tCU2u6SkpgK7N2+NvMMFe+lrcBUIxO6MTBW61xl6CHmw3WIsPTUfstwGwcUkm2Im jjnQuLNqE+IMEsaZ0202r9791DnohXOtbg7epGSayk35oBA4xvCZm0/A4vStgCSO Dt8jSht5ULJZJ1jqnSkkAzfXrKHxlCFRlRkrNWn7qcTKGm2Iza0DCA5513cU80xj AD3rPiQBA0/r6N78GYaY =9xb+ -----END PGP SIGNATURE-----

3 3

Wind River Security Features and Cryptography Libraries
by John Young 05 Nov '14

05 Nov '14

Wind River Security Features and Cryptography Libraries (which appear to be the basis of the $750,000 fine by BIS) http://cryptome.org/2014/11/wind-river-security-crypto.pdf

2 1

Crypto War Redux
by John Young 04 Nov '14

04 Nov '14

USG enforcing crypto export controls: "Intel Subsidiary Agrees to $750,000 Penalty for Unauthorized Encryption Exports" (Oct 8) http://www.bis.doc.gov/index.php/about-bis/newsroom/press-releases/107-abou… A story to go with that: "Software Companies Now on Notice That Encryption Exports May Be Treated More Seriously: $750,000 Fine Against Intel Subsidiary" (Oct 15) http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/10… My source: http://www.reddit.com/r/snowden/comments/2l5fnm/software_companies_now_on_n… (posted by "platypusmusic", who often has very good posts on Reddit, especially in the /r/snowden: http://www.reddit.com/r/snowden/ ) ----- Contraband crypto welcomed: cryptome(a)earthlink.net

3 2

Privacy has always been a fight against rulers and funders
by John Young 04 Nov '14

04 Nov '14

Verifying US-UK concordance, with FBI head, Director of NSA said much the same as GCHQ to the US Chamber of Commerce on October 28, 2014: https://www.nsa.gov/public_info/speeches_testimonies/28oct14_dirnsa.shtml These heads of spy and LE agencies are proposing that companies and citizens continue to serve and become spies, agents, informers, coverts in mirroring their enemies of their security states. And not only are asking for patriotic volunteers by sticks of fear and aiding the enemy but contracting for services by carrots of privileged briefings, access, profits and tax write-offs. No wonder oligarchs are increasing and are rushing to aid and abet spies in all countries. Will First Look's Racket magazine come to life to join The Intercept, so buzzworthily named to fit what they do: front for First Look Media's invention and distribution of comsec products which if true to the ancients' practice will spy on the populace with everylasting panoptic look. This is hardly new, indeed is as old as governments and their precursor "lawful" rulers of the populace which cannot be trusted with anarchic self-rule, much less armed with treasonous cryptoanarchy for absolute right to privacy from rulers. Even this list of rogues was founded and struggles to survive on its impossible mission to resist this ancient history and current fervor of duplicity and dual-use of the ever growing family of securities -- personal, home, clan, region, nation, global, religion, ideology -- deployed to simultaneously attack and protect the populace by declaring who is insider and who is outsider, take your pick, save your life. Us or them. Divide and conquer. Praise and smear. Lop heads and drone. Imprison and exile. Significantly for this clan, comsec remains an essential tool for attacking and protecting. It annoys the masters of comsec no end for rogues to mess with their command and control communications and ubiquitous civic spying operations. It requires recruitment of comsec rogues to mess with rogues, as amply demonstrated here and other security fora where coders and hackers are prime candidates for quietly switching sides, remaining in place, covertly informing, sabotaging, implanting, faulting, I/O erroring, pretending opposition to the state, stashing their fees, teaching cryptology, advising NGOs, counseling dissidents, whistling Dixie for media and audiences, advocating openness, disclosing shallow vulns to hide the deeper. This list goes on, as evidenced here and on the gobs of freedom of information outlets which have spread as widely as the Internet, black net, deep net, chats, OTRs, Tor, and now cellphone webs and swarms of earnest instigators indistinguishable from TLAs taking 100% and giving back at best 50%, with bountiful support from freedom-loving oligarchs, soliciting volunteers, paying overseers of volunteers, accruing profits by shifting taxation to the populace for their protection and spying on it to assure system security, oiled with bounties, bonuses and Sabu-grade walk-frees awards for whistleblowing on the whistleblowing, and not least, enduring legal fees for ACLU- grade justice tipped against oppostion to civil liberties racketeering aided and abetted by backdoored comsec also known as rule of law.

1 0

Fwd: [seL4 Announce] seL4-based "RefOS" released
by coderman 04 Nov '14

04 Nov '14

---------- Forwarded message ---------- From: Announcements about seL4 — low volume list <announce(a)sel4.systems> Date: Tue, 4 Nov 2014 06:12:54 +0000 Subject: [seL4 Announce] seL4-based "RefOS" released Today we announce the release of the RefOS project. RefOS is an OS personality that runs on seL4. RefOS stands for "Reference OS", the aspirational goal of the project, which is to provide a reference OS personality for seL4. RefOS is a student project built as a case study to explore more dynamic virtual memory (VM) management systems than the typical static systems architected on separation kernels. When compared to statically allocated systems, a key difference (and complexity) of dynamic VM management is relaxing the assumption that virtual memory (and memory objects) are managed by a single task upon the microkernel (or by the microkernel itself). RefOS has a distributed VM framework inspired by the Sawmill VM framework [1], though differing in the centralisation of some core book-keeping into a single server (mainly fault forwarding and mapping authorisation). An additional goal of the project was to create tension between user-level and kernel-level VM primitives to enable ongoing kernel experimentation in the area of higher-level VM abstractions. The current functionality of RefOS consists of processes, an in-memory boot-image file server, and console support. Additionally, some games and test applications have been ported to the system. RefOS is available at https://github.com/seL4/refos-manifest under a "BSD 2-Clause" license. [1] Mohit Aron, Jochen Liedtke, Kevin Elphinstone, Yoonho Park, Trent Jaeger, and Luke Deller. 2001. The sawmill framework for virtual memory diversity. In Proceedings of the 6th Australasian conference on Computer systems architecture (ACSAC '01). IEEE Computer Society, Washington, DC, USA, 3-10.

1 0

Privacy has never been “an absolute right”
by coderman 04 Nov '14

04 Nov '14

“To those of us who have to tackle the depressing end of intelligence community behaviour on the internet, it can seem that all governments, telcos, and computing companies are in denial about its misuse." [ paraphrased for relevance ] - http://www.theguardian.com/uk-news/2014/nov/03/privacy-gchq-spying-robert-h… --- GCHQ chief accuses US tech giants of becoming terrorists' 'networks of choice' New director of UK eavesdropping agency accuses US tech firms of becoming ‘networks of choice’ for terrorists Privacy has never been “an absolute right”, according to the new director of GCHQ, who has used his first public intervention since taking over at the helm of Britain’s surveillance agency to accuse US technology companies of becoming “the command and control networks of choice” for terrorists. Robert Hannigan said a new generation of freely available technology has helped groups like Islamic State (Isis) to hide from the security services and accuses major tech firms of being “in denial”, going further than his predecessor in seeking to claim that the leaks of Edward Snowden have aided terror networks. GCHQ and sister agencies including MI5 cannot tackle those challenges without greater support from the private sector, “including the largest US technology companies which dominate the web”, Hannigan argued in an opinion piece written for the Financial Times just days into his new job. Arguing that GCHQ needed to enter into the debate about privacy, Hannigan said: “I think we have a good story to tell. We need to show how we are accountable for the data we use to protect people, just as the private sector is increasingly under pressure to show how it filters and sells its customers’ data. “GCHQ is happy to be part of a mature debate on privacy in the digital age. But privacy has never been an absolute right and the debate about this should not become a reason for postponing urgent and difficult decisions.” Hannigan, who was born in Gloucestershire, not far from GCHQ’s base, has advised the prime minister on counter-terrorism, intelligence and security policy, goes on to take aim at the role of major technology companies. A senior Foreign Office official, Hannigan succeeded Sir Iain Lobban at the Cheltenham-based surveillance agency. While not naming any company in particular, the GCHQ director writes: “To those of us who have to tackle the depressing end of human behaviour on the internet, it can seem that some technology companies are in denial about its misuse. “I suspect most ordinary users of the internet are ahead of them: they have strong views on the ethics of companies, whether on taxation, child protection or privacy; they do not want the media platforms they use with their friends and families to facilitate murder or child abuse.” Hannigan asserts that the members of the public “know” the internet grew out of the values of western democracy and insists that customers of the technology firms he criticises would be “comfortable with a better, more sustainable relationship between the agencies and the technology companies.” Heading towards the 25th anniversary of the creation of the world wide web, he calls for a “new deal” between democratic governments and the technology companies in the area of protecting citizens. “It should be a deal rooted in the democratic values we share. That means addressing some uncomfortable truths. Better to do it now than in the aftermath of greater violence.” In the same piece, Hannigan says Isis differs from its predecessors in the security of its communications, presenting an even greater challenge to the security services. He writes: “Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. “Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are ‘Snowden approved’. There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.” Among the advocates of privacy protection who reacted to Hannigan’s comments, the deputy director of Privacy International, Eric King, said: “It’s disappointing to see GCHQ’s new director refer to the internet – the greatest tool for innovation, access to education and communication humankind has ever known – as a command-and-control network for terrorists.” King added: “Before he condemns the efforts of companies to protect the privacy of their users, perhaps he should reflect on why there has been so much criticism of GCHQ in the aftermath of the Snowden revelations. GCHQ’s dirty games – forcing companies to handover their customers’ data under secret orders, then secretly tapping the private fibre optic cables between the same companies’ data centres anyway – have lost GCHQ the trust of the public, and of the companies who services we use. Robert Hannigan is right, GCHQ does need to enter the public debate about privacy - but attacking the internet isn’t the right way to do it.” The Electronic Frontier Foundation (EFF) meanwhile rejected the notion that an agreement between companies and governments was needed. Jillian York, director of international free expression at EFF said: “A special “deal” between governments and companies isn’t necessary - law enforcement can conduct open source intelligence on publicly-posted content on social networks, and can already place legal requests with respect to users. Allowing governments special access to private content is not only a violation of privacy, it may also serve to drive terrorists underground, making the job of law enforcement even more difficult.” Welcoming Hannigan’s participation in the public debate, the Labour Party MP Tom Watson said it helped to map out where we should draw the line on privacy and helps the same agencies “to rebuild their legitimacy post-Snowden”. But he added: “I hope they do not confuse the use of public propaganda through social media by extremists with the use of the covert communications. It is illogical to say that because Isis use Twitter, all our metadata should be collected without warrant.” Hannigan’s comments come after the director of the FBI, James Comey, called for “a regulatory or legislative fix” for technology companies’ expanding use of encryption to protect user privacy. Reacting last month to the introduction of strong default encryption by Apple and Google on their latest mobile operating systems, Comey said “the post-Snowden pendulum has swung too far in one direction - in a direction of fear and mistrust.” “Justice may be denied because of a locked phone or an encrypted hard drive,” said Comey. Without a compromise, “homicide cases could be stalled, suspects could walk free, and child exploitation victims might not be identified or recovered.”

1 0

on list moderation of great justice [was: [oss-security] list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) ]
by coderman 04 Nov '14

04 Nov '14

> On Tue, Oct 14, 2014 at 10:48:00PM -0700, Walter Parker wrote: >> What is this list's policy on Full Disclosure? >... as one who enjoys a significant moderation delay on Full-Disclosure, i feel qualified to pontificate on this subject. [0] per the monthly statistics summarized at http://seclists.org/fulldisclosure/ one can easily see how the careful pruning of noise on this channel has resulted in double digit density goodness, e.g. Aug 2014 at 89 posts; a new record of brevity and decorum! i for one gladly await the day a more properly, more aggressively moderated full-disclosure reaches single digits and utmost conciseness. you can do it, Fyodor! On 10/15/14, Solar Designer <solar(a)openwall.com> wrote: > Looks like I need to comment on the specific questions on list policy: > ... > Whatever is sent to the list, if on-topic and otherwise appropriate > ... is posted with no artificial delay... the only difference from the > Full-Disclosure mailing list (as far as I understand how it's run) is > that oss-security is limited to / focused on Open Source. i for one agree with Full-Disclosure's policy that active monkey-in-the-middle attacks are of zero interest. spectrum hi jinx? how cross site... [ "The Internet Threat Model" finds your privacy not cost effective. sorry! ] given such undeniable logic, i must fully support the ongoing total moderation with infinite delay of coderman(a)gmail.com on the full-disclosure list. never again from coderman is too soon! finally, regarding other aspects of full-disclosure, i must disclose that i have nothing further to say on the conspiracy in the information security industry to assist various intelligence agencies, including Attrition.org collaboration with NSA TAO [1] and Fyodor's relationship with GCHQ's HACIENDA scanner [2]. best regards, 0. see "RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4" - moderated on F-D since Sept. , also "Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]][still confusing]" moderated days to Aug 4 post send on 1st. 1. "Tailored Access Operations ... Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host." - https://en.wikipedia.org/wiki/Tailored_Access_Operations#Virtual_locations 2. "GCHQ project HACIENDA [...] uses [nmap] port scanning to find vulnerable systems for Five Eyes intelligence agencies." - https://en.wikipedia.org/wiki/TCP_Stealth

1 0

RC4 still sucks in the year 2014 - A Practical Attack Against the HIVE Hidden Volume Encryption System
by coderman 03 Nov '14

03 Nov '14

""" A Practical Attack Against the HIVE Hidden Volume Encryption System Kenneth G. Paterson and Mario Strefler Abstract: The HIVE hidden volume encryption system was proposed by Blass et al. at ACM-CCS 2014. Even though HIVE has a security proof, this paper demonstrates an attack on its implementation that breaks the main security property claimed for the system by its authors, namely plausible hiding against arbitrary-access adversaries. Our attack is possible because of HIVE's reliance on the RC4 stream cipher to fill unused blocks with pseudorandom data. While the attack can be easily eliminated by using a better pseudorandom generator, it serves as an example of why RC4 should be avoided in all new applications and a reminder that one has to be careful when instantiating primitives. """ - http://eprint.iacr.org/2014/901

1 0

are USB floppies toxic?
by Eugen Leitl 03 Nov '14

03 Nov '14

We know USB flash is is Biosafety 4, what about other sneaker-net suitable storage media? USB floppies are still around, as well as media, which are write-protectable. How easy to hop the air gap with these?

9 10

Brain decoder can eavesdrop on your inner voice
by Eugen Leitl 03 Nov '14

03 Nov '14

http://www.newscientist.com/article/mg22429934.000-brain-decoder-can-eavesd… Brain decoder can eavesdrop on your inner voice 29 October 2014 by Helen Thomson Magazine issue 2993. Subscribe and save For similar stories, visit the The Human Brain Topic Guide As you read this, your neurons are firing – that brain activity can now be decoded to reveal the silent words in your head TALKING to yourself used to be a strictly private pastime. That's no longer the case – researchers have eavesdropped on our internal monologue for the first time. The achievement is a step towards helping people who cannot physically speak communicate with the outside world. "If you're reading text in a newspaper or a book, you hear a voice in your own head," says Brian Pasley at the University of California, Berkeley. "We're trying to decode the brain activity related to that voice to create a medical prosthesis that can allow someone who is paralysed or locked in to speak." When you hear someone speak, sound waves activate sensory neurons in your inner ear. These neurons pass information to areas of the brain where different aspects of the sound are extracted and interpreted as words. In a previous study, Pasley and his colleagues recorded brain activity in people who already had electrodes implanted in their brain to treat epilepsy, while they listened to speech. The team found that certain neurons in the brain's temporal lobe were only active in response to certain aspects of sound, such as a specific frequency. One set of neurons might only react to sound waves that had a frequency of 1000 hertz, for example, while another set only cares about those at 2000 hertz. Armed with this knowledge, the team built an algorithm that could decode the words heard based on neural activity aloneMovie Camera (PLoS Biology, doi.org/fzv269) The team hypothesised that hearing speech and thinking to oneself might spark some of the same neural signatures in the brain. They supposed that an algorithm trained to identify speech heard out loud might also be able to identify words that are thought. Mind-reading To test the idea, they recorded brain activity in another seven people undergoing epilepsy surgery, while they looked at a screen that displayed text from either the Gettysburg Address, John F. Kennedy's inaugural address or the nursery rhyme Humpty Dumpty. Each participant was asked to read the text aloud, read it silently in their head and then do nothing. While they read the text out loud, the team worked out which neurons were reacting to what aspects of speech and generated a personalised decoder to interpret this information. The decoder was used to create a spectrogram – a visual representation of the different frequencies of sound waves heard over time. As each frequency correlates to specific sounds in each word spoken, the spectrogram can be used to recreate what had been said. They then applied the decoder to the brain activity that occurred while the participants read the passages silently to themselves (see diagram). Despite the neural activity from imagined or actual speech differing slightly, the decoder was able to reconstruct which words several of the volunteers were thinking, using neural activity alone (Frontiers in Neuroengineering, doi.org/whb) The algorithm isn't perfect, says Stephanie Martin, who worked on the study with Pasley. "We got significant results but it's not good enough yet to build a device." In practice, if the decoder is to be used by people who are unable to speak it would have to be trained on what they hear rather than their own speech. "We don't think it would be an issue to train the decoder on heard speech because they share overlapping brain areas," says Martin. The team is now fine-tuning their algorithms, by looking at the neural activity associated with speaking rate and different pronunciations of the same word, for example. "The bar is very high," says Pasley. "Its preliminary data, and we're still working on making it better." The team have also turned their hand to predicting what songs a person is listening to by playing lots of Pink Floyd to volunteers, and then working out which neurons respond to what aspects of the music. "Sound is sound," says Pasley. "It all helps us understand different aspects of how the brain processes it." "Ultimately, if we understand covert speech well enough, we'll be able to create a medical prosthesis that could help someone who is paralysed, or locked in and can't speak," he says. Several other researchers are also investigating ways to read the human mind. Some can tell what pictures a person is looking at, others have worked out what neural activity represents certain concepts in the brain, and one team has even produced crude reproductions of movie clips that someone is watching just by analysing their brain activity. So is it possible to put it all together to create one multisensory mind-reading device? In theory, yes, says Martin, but it would be extraordinarily complicated. She says you would need a huge amount of data for each thing you are trying to predict. "It would be really interesting to look into. It would allow us to predict what people are doing or thinking," she says. "But we need individual decoders that work really well before combining different senses." This article appeared in print under the headline "Hearing our inner voice"

2 1