- cypherpunks - lists.cpunks.org

RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
by coderman 22 Sep '14

22 Sep '14

first and foremost: WPA2 does NOT prevent an adversary able to inject packets at you from downgrading crypto to flawed RC4. due to odd forgotten legacy protocol bits, every implementation of WPA2 that i have tested is vulnerable to an active downgrade to TKIP/RC4 while still being "WPA2" and still showing all signs of using strongest security settings. let me re-iterate: _WPA2 only_ as a setting on router or client device does not prevent an active RC4 downgrade when using WPA2. AES-CCMP must be explicitly checked for, and this is not straightforward in end-user configuration or management utilities. RECOMMENDATION: use a wireless packet capture utility to specifically check for and alert on the presence of TKIP in a WPA2 session. this never happens under legitimate circumstances. [if you know of one, please tell me!] TKIP in WPA2 == Active injection attack by "well funded" adversary[0] --- i missed the renewed speculation that periodically swirls around RC4, e.g. "I feel but cannot prove that the day is coming when we learn that everything we ever encrypted with RC4 is very practical to decrypt" - https://twitter.com/marshray/status/505586082461655040 "Kind of annoyed SHA-1 is a "crypto emergency" when most of the web was encrypted with RC4 last year and almost no one cared" - https://twitter.com/bascule/status/509239990216163330 "This attack also applies directly to WPA/TKIP, with similar success rates, because of its use of per-packet keys for RC4. Here, the particular structure of WPA/TKIP keys means that a different set of biases are obtained in the first 256 bytes of RC4 keystream... For WPA/TKIP, the only reasonable countermeasure is to upgrade to WPA2." - http://www.isg.rhul.ac.uk/tls/ --- i have an advisory pending to full-disclosure with details on this WPA2 force downgrade to TKIP attack and a rant about Kaminsky's DEF CON 22 talk. advisory includes timeline indicating "in the wild" discovery of this technique late 2013. any earlier indications welcome! to be clear, this issue is with backwards compatibility in WPA2, and the manner in which a local attacker (8 miles or more with power and directional emission) can force the WPA2 protected session to use TKIP/RC4 while appearing to both client and network management equipment to be using WPA2 and best security configuration. (not WEP, not WPA) this is not about how RC4 is broken; i have no idea about the nature of the RC4 weaknesses enabling decryption, and this as yet unknown attack is certainly more effective than the attack described in CVE-2013-2566: "The attacks can only be carried out by a determined attacker who can generate sufficient sessions for the attacks. They recover a limited amount of plaintext. In this sense, the attacks do not pose a significant danger to ordinary users of TLS or WPA/TKIP in their current form. However, it is a truism that attacks only get better with time, and we anticipate significant further improvements to our attacks." the attacks observed in the wild did not rely on any additional or excessive packet creation to reach effectiveness. best regards, 0. About TKIP with WPA2... some tools know that TKIP is backwards compatible in WPA2, having written to spec. E.g. airodump-ng: "Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2." in my testing i have never seen a device that could do WPA2 but not AES-CCMP. if you find one i'd like to know about it! if you ever see a device+router pair that used to speak AES-CCMP over WPA2 suddenly using TKIP you are under active attack. finally, i mention "advanced attacker" because utilizing this downgrade also means applying an as yet unknown attack on the RC4 cipher to decrypt.

2 4

Re: [tor-talk] Article: Best Alternatives to Tor
by grarpamp 22 Sep '14

22 Sep '14

On Mon, Sep 22, 2014 at 7:45 AM, Colin Mahns <colinmahns(a)riseup.net> wrote: > I like how a couple of the alternatives to "Tor" in this article are > Tails and Whonix. What do they use for anonymity again? Oh yeah, Tor... > > They also list Disconnect and Tox as an alternative, and then quickly > say they aren't alternatives. I'd say this writer was hoping for clickbait. >>> http://www.idigitaltimes.com/best-alternatives-tor-12-programs-use-nsa-hack… As mostly a list of OS wrappers around things, the entries include the usual list of apps: Tor, I2P, Freenet, JonDo, Tox, Pond, etc. The list of OS wrappers is typical, but includes one unique entry... from US Air Force: Anti-Tamper - Software Protection Initiative: LPS - Lightweight Portable Security http://www.spi.dod.mil/lipose.htm There are some crypto tools and docs on the SPI site and you can even watch the SPI Show (in Letterman style)... http://spi.dod.mil/docs/Top_Ten_640x360.wmv

1 0

salty axolotl
by stef 22 Sep '14

22 Sep '14

you might like to use this, or you might want to improve on it, or enjoy ridiculing me for it and its bugs: axolotl ratched implemented with libsodium and scrypt (maybe the latter has been over-used a bit): https://github.com/stef/saxolotl -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

3 4

GoldBug SF projects [was: Bittorrent Bleep]
by grarpamp 22 Sep '14

22 Sep '14

1 1

Re: [Dailydave] Protecting your code versions.
by coderman 22 Sep '14

22 Sep '14

hi Dave, long time fan. first time feedbacker, well: On 9/19/14, Dave Aitel <dave(a)immunityinc.com> wrote: > ... > Everyone is sick of the Kaspersky guys doing three hundred page PDFs > with a long listing of which versions of some trojan they found were > installed when, and what features each trojan had, and what possible > code reuse there was. And of course, if there's an 0day in some random > trojan, everyone likes to rip that out and spend years pontificating > about it. no doubt. i prefer my salty rants Aitel stylez! all of us in the game have lineage to a tee... but i digress, > But even if I'm not using 0day, I often want to protect my escalation of > privilege attacks from the defenders. I don't want them able to track my > code versions, and I don't want them knowing the details of my > exploitation methods so they can add more features to EMET or KAV. yeah, fuck those guys trying to make my shit fuck them less! > That's why INNUENDO allows you to put a password in that protects as > much of your implant deployment package as possible. i asked a friend, Volatility, and they said "please to re state in terms of cryptographic digest for code version and instruction sequence in terms of exploitation method." because every consideration they pose evaluates to a "as much as possible" equivalent to zero. there was agreement from VM recording and bus lane recording, as well. best regards,

1 0

Fwd: [Cryptography] Shaming sites that send sensitive information over HTTP
by grarpamp 22 Sep '14

22 Sep '14

---------- Forwarded message ---------- From: Jerry Leichter <leichter(a)lrw.com> Date: Fri, Sep 19, 2014 at 12:03 PM To: Cryptography <cryptography(a)metzdowd.com> My favorite: The NSA's web site *redirects HTTPS to HTTP*. Some kind of back-handed acknowledgement of what they do? http://httpshaming.tumblr.com

4 3

Re: [cryptography] RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
by coderman 22 Sep '14

22 Sep '14

On 9/21/14, Daniel <kyhwana(a)gmail.com> wrote: > Hey coderman, > has this been released anywhere? I asked because I discovered > http://people.cs.kuleuven.be/~mathy.vanhoef/papers/wpatkip.pdf again. > (Where with TKIP, if you can inject packets on the air, you can get > back unencrypted traffic that was headed towards the client..) hi Daniel! please continue posting relevant material. this is released plus or minus Full Disclosure moderation queue. you are smart enough to see why this is a dead end, and "optional" TKIP will live in WPA2 forever. you may also want to keep in touch with K. Paterson who wrote about another TKIP issue as mentioned earlier in this thread. i have not heard of any further input from K. i have not seen any further public confirmation of active TKIP downgrade or implications. silence the story, per usual. best regards,

1 0

Unraveling NSA's TURBULENCE Programs
by coderman 20 Sep '14

20 Sep '14

https://robert.sesek.com/2014/9/unraveling_nsa_s_turbulence_programs.html ''' The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed. Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is an attempt to do so, using leaked and declassified documents... '''

2 1

Russia moves date when personal data law came into force to 1st Jan 2015
by Anton Nesterov 20 Sep '14

20 Sep '14

Today Duma have passed in first reading bill which moves date when personal data law came into force from 1st Sep 2016 to 1st Jan 2015. Original law forbid storing any personal data of Russian users outside of Russia. "We need to speed up the law, it's not a secret that personal data is the object of attention of criminals and special services of Western countries." — says one of the authors, Alexandr Yushenko from Communists party. "And maybe we need to forbid all that social networks, as in Iran? Let everyone involved in amateur, go to the cinema, museums. They sit alone in that networks, or acquaint with somebody, and then follows sexual promiscuity. It's indeed dangerous, you just say an extra word — and then claim on you in court!" — says Vitaliy Zolochevsky, member of LDPR party. 438 votes for, 0 against, 0 abstained. Bill http://asozd2.duma.gov.ru/main.nsf/%28Spravka%29?OpenAgent&RN=596277-6&02 Voting results http://vote.duma.gov.ru/vote/87314 Report http://rublacklist.net/8662/ (in Russian) Another one http://www.rosbalt.ru/main/2014/09/19/1317343.html (in Russian) -- https://komachi.github.io GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0