- cypherpunks - lists.cpunks.org

messing with XKeyScore
by Eugen Leitl 04 Jul '14

04 Jul '14

http://blog.erratasec.com/2014/07/jamming-xkeyscore_4.html?m=1 Errata Security Advanced persistent cybersecurity Friday, July 04, 2014 Jamming XKeyScore Back in the day there was talk about "jamming echelon" by adding keywords to email that the echelon system was supposedly looking for. We can do the same thing for XKeyScore: jam the system with more information than it can handle. (I enumerate the bugs I find in the code as "xks-00xx"). For example, when sending emails, just send from the address "bridges(a)torproject.org" and in the email body include: https://bridges.torproject.org/ bridge = 0.0.0.1:443 bridge = 0.0.0.2:443 bridge = 0.0.0.3:443 ... Continue this for megabytes worth of bridges (xks-0001), and it'll totally mess up XKeyScore. It has no defense against getting flooded with information like this, as far as I can see. Note that the regex only cares about 1 to 3 digit numbers, that means the following will be accepted by the system (xks-0002): bridge = 75.748.86.91:80 The port number matches on 2 to 4 digits ([0-9]{2,4}). Therefore, bridges with port numbers below 10 and above 9999 will be safe. I don't know if this code reflect a limitation in Tor, or but assuming high/low ports are possible, this can be used to evade detection (xks-0011). Strangely, when the port number is parsed, it'll capture the first non-digit character after the port number (xks-0012). This is normally whitespace, but we could generate an email with 256 entries, trying every possible character. A character like < or ' might cause various problems in rendering on an HTML page or generating SQL queries. You can also jam the system with too many Onion addresses (xks-0003), but there are additional ways to screw with those. When looking for Onion addresses, the code uses a regex that contains the following capture clause: ([a-z]+):\/\/) This is looking for a string like "http://" or "https://", but the regex has no upper bounds (xks-0004) and there is no validation. Thus, you can include "goscrewyourself://o987asgia7gsdfoi.onion:443/" in network traffic, and it'll happily insert this into the database. But remember that "no upper bounds" means just that: the prefix can be kilobytes long, megabytes long, or even gigabytes long. You can open a TCP connection to a system you feel the NSA is monitoring, send 5 gigabytes of lower-case letters, followed by the rest of the Onion address, and see what happens. I mean, there is some practical upper bound somewhere in the system,, and when you hit it, there's a good chance bad things will happen. Likewise, the port number for Onion address is captured by the regex (d+), meaning any number of digits (xks-0005). Thus, we could get numbers that overflow 16-bits, 32-bits, 64-bits, or 982745987-bits. Very long strings of digits (megabytes) at this point might cause bad things to happen within the system. There is an extra-special thing that happens when the schema part of the Onion address is exactly 16-bytes long (xks-0006). This will cause the address and the scheme to reverse themselves when inserted into the database. Thus, we can insert digits into the scheme field. This might foul up later code that assumes schemes only contain letters, because only letters match in the regex. In some protocol fields, the regexes appear to be partial matches. The system appears to match on HTTP servers with "mixminion" anywhere in the name. Thus, we start causing lots of traffic to go to our domains, such as "mixminion.robertgraham.com", that will cause their servers to fill up with long term storage of sessions they don't care about (xks-0007) Let's talk X.509, and the following code: fingerprint('anonymizer/tor/bridge/tls') = ssl_x509_subject('bridges.torproject.org') or ssl_dns_name('bridges.torproject.org'); Code that parses X.509 certificates is known to be flaky as all get out. The simplest thing to do is find a data center you feel the NSA can monitor, and then setup a hostile server that can do generic fuzzing of X.509 certificates, trying to crash them. It's likely that whatever code is parsing X.509 certificates is not validating them. Thus, anybody can put certificates on their servers claiming to be 'bridges.torproject.org' (xks-0008). It's likely that the NSA is parsing SSL on all ports, so just pick a random port on your server not being used for anything else, create a self-signed CERT claiming to be "bridges.torproject.org', then create incoming links to that port from other places so at least search-engines will follow that link and generate traffic. This will cause the NSA database of bridges to fill up with bad information -- assuming it's not already full from people screwing with the emails as noted above :). <img src="http://www.google.com/?q=tails+usb" /> Putting the above code in a web page like this one will cause every visitor to trigger a search for TAILS in the XKeyScore rules. The more people who do this, the less useful it becomes to the NSA (xks-0009) in labeling people as suspicious. Likewise, putting <title>tails.boum.org/<.title> in your webpages will cause the same effect, even when CSS/JavaScript makes such a title invisible. In theory, the NSA should only be monitoring foreign traffic, and not traffic originating from the United States (or, apparently, the other five-eyes). So here is the fun thing (xks-0010): run your jamming tools from United States IP addresses against those servers in Iran you know the NSA is monitoring. Since the code should already be ignoring the traffic because it originates from the United States, then they can't complain if you've filled up their databases full of Tor Onion and bridge addresses. Robert Graham

6 5

[tor-dev] XKeyscore rules probably are from Snowden, after all
by Eugen Leitl 04 Jul '14

04 Jul '14

----- Forwarded message from Maxim Kammerer <mk(a)dee.su> ----- Date: Fri, 4 Jul 2014 15:40:01 +0300 From: Maxim Kammerer <mk(a)dee.su> To: liberationtech <liberationtech(a)lists.stanford.edu> Cc: tor-dev(a)lists.torproject.org Subject: [tor-dev] XKeyscore rules probably are from Snowden, after all Message-ID: <CAHsXYDBdwVu6dcmY1NETphzPa6PBLBsEaVT2rH0nCkrZ4b2SJg(a)mail.gmail.com> Reply-To: tor-dev(a)lists.torproject.org There has been some speculation that the recent XKeyscore rule leaks [1] do not come from Snowden — particularly, by Schneier [2]. I believe that there is a good case that the leaks do come from Snowden, since it is possible to pinpoint the date range when the rule sources [3] have been last updated. The earliest possible date is 2011-08-08, when the Linux Journal writeup about Tails [4], referenced by the glob pattern "linuxjournal.com/content/linux*" has been published. The pattern is not a generic Linux Journal filter, as implied in [1]. The likely latest possible date is 2012-02-28, when "maatuska" directory authority has changed its IP [5]. A less likely upper bound is 2012-09-21, when "Faravahar" directory authority has been added [6]. NSA either took the 8 authorities from the actual consensus, or picked them from Tor's sources [7]. However, Tor sources list more than 8 authorities, and are not properly maintained (e.g., see entry for "moria1" wrt. its last .34/.39 octet tweaks), so I doubt NSA would use that. Moreover, it is hard to miss the port number in the sources, whereas NSA did miss that some authorities do not (and did not) use ports 80/443. E.g., "moria1" (the MIT campus server mentioned in [1]) would not be matched as a Tor authority by the rules. Snowden most likely tried to contact Greenwald at the end of 2012 [8], which is entirely consistent with the above. Another NSA employee leaking XKeyscore rules after being inspired by Snowden's leaks, would have probably downloaded a more up-to-date rules file. Cross-posting to tor-dev, in case I got any historical directory authority changes wrong. [1] http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [2] https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html [3] http://daserste.ndr.de/panorama/xkeyscorerules100.txt [4] http://www.linuxjournal.com/content/linux-distro-tales-you-can-never-be-too… [5] https://lists.torproject.org/pipermail/tor-dev/2012-February/003312.html [6] https://trac.torproject.org/projects/tor/ticket/5749 [7] https://gitweb.torproject.org/tor.git/blob/HEAD:/src/or/config.c [8] http://www.nytimes.com/2013/08/18/magazine/laura-poitras-snowden.html -- Maxim Kammerer Liberté Linux: http://dee.su/liberte _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message -----

1 0

Re: Fwd: [tor-talk] according to leaked XKeyScore source NSA marks all Tor users as extremists, puts them on a surveillance list
by coderman 04 Jul '14

04 Jul '14

On Thu, Jul 3, 2014 at 8:13 AM, -John <john(a)johnlgrubbs.net> wrote: > I thought JY at cryptome.org was already doing what you suggest. i presume you mean as below: (more a translation than additional QUELLCODE info though ;) --- http://cryptome.org/2014/07/nsa-tor-de.htm Donate for the Cryptome archive of files from June 1996 to the present ________________________________ 3 July 2014 NSA Hacks TOR in Germany, Calls Users Extremists ________________________________ Original German: http://www.tagesschau.de/inland/nsa-xkeyscore-100.html https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie= UTF-8&u=http%3A%2F%2Fwww.tagesschau.de%2Finland%2Fnsa-xkeyscore- 100.html&edit-text= German named an extremist targeted by U.S. intelligence from the NSA Published: 07.03.2014 05:00 clock The NSA peeks specifically from German that deal with encryption on the Internet. This emerges from a secret source, the NDR and WDR exists. NSA victim can thus be identified by name. One of them is a student from Erlangen. By Lena Kampf, Jacob Appelbaum and John Goetz, NDR [Images omitted.] It is one of the most sensitive secrets of the NSA, the engine of the global monitoring machine: the source code of the XKeyscore program, the most comprehensive Ausspähprogramm of U.S. foreign intelligence. NDR and WDR have excerpts of the source code. Parts of the collection infrastructure ie, so-called software rules that define the intelligence, what or who they want to investigate. There are only a few numbers and characters to string together the programmer. But when the program executes XKeyscore these rules, get people and their data in their sights. The connections from computers to the Internet are identified and stored in a database type. The users are quasi marked. It is the dragnet of the 21st century. Download the video file Users of the Tor network aim of penetration In the present source is about the spying infrastructure and the users of the Tor network. Tor stands for "the onion router" - a program in which Internet traffic, such as a query to a search engine, is passed through various servers and lie encryption layers like an onion to make the request. Thus, the origin of the request, so obscures the IP address. The IP address is like a mailing address and reveals among other things, the location of the computer. There are about 5,000 Tor servers worldwide which are operated by volunteers. It is an anonymizing infrastructure, which is often used, especially in countries where it is dangerous to abandon the regime, which websites you visited or where they retrieve. In Iran and Syria, for example. Tor is used by journalists, human rights activists and lawyers worldwide. Popular German IP addresses in Fort Meade The reporting of the "Guardian" on PowerPoint presentations from the Snowden archive has shown in the past year that the Tor network the NSA is a particular thorn in the side. The top-secret documents and the first time published the source code show that the NSA is making significant efforts to deanonymisieren users of the Tor network. Search of the NDR and WDR show: German IP addresses are defined in the source code of the NSA as a unique destination. The IP 212 212 245 170 leads to a gray, factory-like building, whose high walls are fenced with barbed wire. "On the Tower" is the street in an industrial area near Nürnberg. There is a computer center with Mietservern in long shelves. They all look the same. But one is spied on by the NSA. Sebastian Hahn, a student and employee of the computer science department in Erlangen has rented this server. The program goal: TOR a thorn in the NSA. Momentous commitment to the Internet community In his spare time he is involved in the Tor network, as well as one of the authors of this paper. The gate community trusts Sebastian Hahn especially: He may run one of nine so-called "Directory Authorities". On his server is a list, in which all Tor servers are listed. Users who connect to the Tor network, automatically access to one of the nine "Directory Authorities" to download the latest list. Hundreds of thousands of hits a day there are at Sebastian Hahn. All of these accesses are marked by the NSA and land according to research by the NDR and WDR then in a special NSA database. In the source code appeared even the name of the server on tap: "Gabelmoo" had called him cock predecessor, Frankish for "fork man," as the Bamberger call a Poseidon statue lovingly. "This is shocking," says Hahn. Because: "The connection data of millions of people are listed every day." Sebastian Hahn found next to "Gabelmoo" all other names of "Directory Authorities" in Berlin, the Netherlands, Austria, Sweden and the USA. They are also target of the NSA. Second notably known NSA victims Although he is only a means to an end for the NSA - finally, the intelligence want to filter on its server who uses the Tor network - Hahn feels violated his privacy. Because he wanted to do something good, he random "in the focus of the intelligence agencies," he says, visibly shocked. He is now probably after German Chancellor Angela Merkel, the second known by name German surveillance victims of American intelligence. The lawyer specializing in IT law, Thomas Stadler, sees a "suspicion of intelligence agents work". The Attorney General expressed only in general terms: you examine all instructions. On request, the NSA shares only generally, we consider strictly to the law: "privacy and civil liberties always be considered in the computer monitor." What you want to anonymize is deanonymized Ironically, it is in accordance with the special rules that NDR and WDR present, so just people with the desire for anonymity that are the target of the NSA. In the eyes of the Secret Service: extremists. This is not rhetoric, no journalistic escalation. The term is even in the Comment column of the source text, quoted by programmers of the NSA. Extremists? The opposite is the case, as the search point. The German victims are politically to find not at the outer edge. Extreme they are alone on one point: They are concerned about the security of their data. And that's what makes them suspect in the eyes of the U.S. Secret Service. How quickly do you become a "Extremist" "Tails" is an operating system that uses the Tor network to post on the Internet any traces, but nothing saves the user on the computer from which it is, for example, on a USB stick, booted. Darko Medic, 18, short brown hair, sitting in front of his laptop. He is "Tails" and "USB" in the mask its search engine. What Darko not know: He's just so also landed in a database of the NSA. Marked as one of the extremists, they seek the secret service so diligently. Limitless espionage How the NSA spying friends and enemies and the consequences of that. Because what the rules of the source code also revealed: The NSA observed on a large scale search queries worldwide - also in Germany. Just the simple search for encryption software, such as "Tails" is enough to get into the grid of the NSA. The connection of the request with search engines makes suspicious. His search for "Tails" opens a door, access to Darko and his world. Once in the database, any inquiry from Darko can be accessed selectively. Darko is under observation. This Darko has traveled in the computer-AG so he learns how to protect themselves from the spying by the NSA. "I do not think anyone is reading my e-mails," he says. His seatmate has opened the website of the Tor project. His connection to the site is now marked and stored in a database. For the entire Web page of the Tor project is under observation. Everyone who visits them, like the Neukölln students ends with a marker. The NSA peeks specifically from people who deal with encryption on the Internet. It's not just about metadata In addition, it can be shown beyond reasonable doubt through the source code for the first time, that the NSA is not only so-called metadata, ie connection data reads. According programming command, e-mails used to connect to the Tor network, then the contents of the so-called e-mail body, analyzed and stored. The relevant quote from the source code reads: "email_body ('https://bridges.torproject.org/': c + + extractors" William Binney, 70, was technical director of the NSA until he left in 2001 because the machines he invented, were directed against its own people. Today he is testifying before the NSA Untersuchungssauschuss. In an interview with NDR and WDR, he explains why the secret service have calculated it apart to users of the Tor network: "There shall be no free, anonymous rooms give," he says. "They want to know everything about everyone." Only a few are excluded: Registered in the source code, the NDR and WDR exists, is the differentiation between the partner countries of the United States, the so-called "Five Eyes", in New Zealand, Australia, Britain and Canada, and other countries. Compounds that are made from the "Five Eyes" countries on the Tor website, according to the present rule should not be marked. From all other countries, however, already. Without exception. More on the topic tonight at Panorama, 21.45 clock in the First ________________________________

4 5

SSL Co-op
by rysiek 04 Jul '14

04 Jul '14

So, this has been proposed: http://www.hezmatt.org/~mpalmer/blog/2014/06/05/ssl-certificate-cooperative… http://www.hezmatt.org/~mpalmer/blog/2014/06/25/moving-forward-with-an-ssl-… http://www.sslcoop.org/ "The vision of the SSL Co-operative is to be a professionally-operated, member-controlled globally-trusted Certification Authority, serving the identity verification and management needs of its members. At present, this initiative is in the analysis and planning stage. Investigation is underway to determine the full set of costs involved, both financial and temporal. If you think a member-controlled CA that puts the interests of its members, and that of the Internet community, ahead of profits is a good idea, and might consider being a member if it gets off the ground, I would appreciate it if you would fill out a short survey letting me know a little bit about your organisation, to ensure that the co-op best serves your needs." -- Pozdr rysiek

2 1

Re: PayPal and Proton Mail
by grarpamp 03 Jul '14

03 Jul '14

>>> The slumbering cypherpunk spirit has awakened. >> http://entersection.com/posts/1238-charlie-chaplin-on-the-patrimony-of-gree… > [Why this quotation] Machinery, liberty, democracy, torture, humanity, kindess, unity of fight, etc... Perhaps memes of, or thoughts for, the cypherpunk.

2 1

Re: cypherpunks Digest, Vol 13, Issue 4
by Cindy 03 Jul '14

03 Jul '14

cypherpunks-request(a)cpunks.org schrieb: > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. XKeyscore-Quellcode: more english details requested (coderman) > 2. Re: [tor-talk] XKeyscore-Quellcode: more english details > requested (Jacob Appelbaum) > 3. Re: XKeyscore-Quellcode: more english details requested > (Eugen Leitl) > 4. tools used by intelligence analysts (Eugen Leitl) > 5. Re: tools used by intelligence analysts (Griffin Boyce) > 6. Re: Fwd: [tor-talk] according to leaked XKeyScore source NSA > marks all Tor users as extremists, puts them on a surveillance > list (Seth) > 7. NSA targets the privacy-conscious (Eugen Leitl) > 8. Re: [tor-talk] Tor Exit Operator convicted in Austrian lower > court (Zenaan Harkness) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 3 Jul 2014 04:35:09 -0700 > From: coderman <coderman(a)gmail.com> > To: cpunks <cypherpunks(a)cpunks.org>, tor-talk(a)lists.torproject.org > Subject: XKeyscore-Quellcode: more english details requested > Message-ID: > <CAJVRA1SnFGvCc38Mfma0Se8gkdJUaDLHrHxTfU1VLQC4xLCbMw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > request for more (english speaking) details on QUELLCODE part of XKeyScore(XKS) > > http://www.bild.de/politik/ausland/nsa/us-geheimdienst-spionierte-deutschen… > > specifically subsequent tasking associated with selected anonyms... > > > ------------------------------ > > Message: 2 > Date: Thu, 3 Jul 2014 12:01:15 +0000 > From: Jacob Appelbaum <jacob(a)appelbaum.net> > To: tor-talk(a)lists.torproject.org > Cc: cpunks <cypherpunks(a)cpunks.org> > Subject: Re: [tor-talk] XKeyscore-Quellcode: more english details > requested > Message-ID: > <CAFggDF0sbtjRnOzM7tyYn8Ks+z5GhdaXUs-7hZsNRqqU1EZJEQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > > On 7/3/14, coderman <coderman(a)gmail.com> wrote: >> request for more (english speaking) details on QUELLCODE part of >> XKeyScore(XKS) >> >> http://www.bild.de/politik/ausland/nsa/us-geheimdienst-spionierte-deutschen… >> >> specifically subsequent tasking associated with selected anonyms... >> -- > More information will be published shortly, including a long technical > English story with source code and a video this evening on German TV. > > Here are the first bits of our story: > > http://www.tagesschau.de/inland/nsa-xkeyscore-100.html > http://www.daserste.de/information/politik-weltgeschehen/morgenmagazin/poli… > http://daserste.ndr.de/panorama/archiv/2014/Quellcode-entschluesselt-Beweis… > > Stay tuned for the next two publications which will happen in the next > twelve hours. > > All the best, > Jacob > > > ------------------------------ > > Message: 3 > Date: Thu, 3 Jul 2014 14:46:48 +0200 > From: Eugen Leitl <eugen(a)leitl.org> > To: cypherpunks(a)cpunks.org > Subject: Re: XKeyscore-Quellcode: more english details requested > Message-ID: <20140703124648.GG26986(a)leitl.org> > Content-Type: text/plain; charset=us-ascii > > On Thu, Jul 03, 2014 at 04:35:09AM -0700, coderman wrote: >> request for more (english speaking) details on QUELLCODE part of XKeyScore(XKS) >> >> http://www.bild.de/politik/ausland/nsa/us-geheimdienst-spionierte-deutschen… >> >> specifically subsequent tasking associated with selected anonyms... > According to fefe who's seen the source it's just a selector > http://blog.fefe.de/?ts=ad4bdd72 > > > ------------------------------ > > Message: 4 > Date: Thu, 3 Jul 2014 15:16:13 +0200 > From: Eugen Leitl <eugen(a)leitl.org> > To: cypherpunks(a)cpunks.org > Subject: tools used by intelligence analysts > Message-ID: <20140703131613.GJ26986(a)leitl.org> > Content-Type: text/plain; charset=us-ascii > > > *ORA for network analysis http://www.casos.cs.cmu.edu/projects/ora/ > Pentaho for data transformation http://www.pentaho.com/ > Rapid Miner for data mining http://sourceforge.net/projects/rapidminer/ > Orange for data visualisations and analysis http://orange.biolab.si/ > Maltego for the analysis of networks between people, companies, websites, etc. http://www.paterva.com/web6/products/maltego.php > Apache Hadoop for large-scale, distributed computing and analysis > > Axis Pro http://www.textronsystems.com/products/advanced-information/axis-pro > Starlight http://starlight.pnnl.gov/ > Analyst's Notebook http://www-03.ibm.com/software/products/en/analysts-notebook-family > Palantir http://www.palantir.com/products/ > > XPLR witk Reddit plugin https://pay.reddit.com/r/TheoryOfReddit/comments/1um89b/preddit_a_subreddit… > Tiny Tiny Rss http://tt-rss.org/redmine/projects/tt-rss/wiki > Pligg http://pligg.com/ > Twitter, Reddit, ... > > ARC GIS > CPOF http://en.wikipedia.org/wiki/Command_Post_of_the_Future > > Metasploit > > Oryon http://sourceforge.net/projects/oryon/ (?) > Investigative Dashboard https://investigativedashboard.org/ (?) > > > ------------------------------ > > Message: 5 > Date: Thu, 03 Jul 2014 09:56:07 -0400 > From: Griffin Boyce <griffin(a)cryptolab.net> > To: cypherpunks(a)cpunks.org > Subject: Re: tools used by intelligence analysts > Message-ID: <26ebfd1e9a4edd4756866edf60622452(a)cryptolab.net> > Content-Type: text/plain; charset=UTF-8; format=flowed > > This is very useful, thanks for sharing. I'd also add MATLAB to the > list of tools used -- keep in mind that "intelligence analyst" is > extremely broad as a descriptor. Some of these people are low-level > ex-military 35F types, some have a classical statistics research > background, some are social scientists, some are dataviz experts, some > are linguists. So try to distinguish between these and offer sources > when you can. > > Oh, and Cellebrite devices for mobile data collection. > > best, > Griffin > > > On 2014-07-03 09:16, Eugen Leitl `wrote: >> *ORA for network analysis http://www.casos.cs.cmu.edu/projects/ora/ >> Pentaho for data transformation http://www.pentaho.com/ >> Rapid Miner for data mining http://sourceforge.net/projects/rapidminer/ >> Orange for data visualisations and analysis http://orange.biolab.si/ >> Maltego for the analysis of networks between people, companies, >> websites, etc. http://www.paterva.com/web6/products/maltego.php >> Apache Hadoop for large-scale, distributed computing and analysis >> >> Axis Pro >> http://www.textronsystems.com/products/advanced-information/axis-pro >> Starlight http://starlight.pnnl.gov/ >> Analyst's Notebook >> http://www-03.ibm.com/software/products/en/analysts-notebook-family >> Palantir http://www.palantir.com/products/ >> >> XPLR witk Reddit plugin >> https://pay.reddit.com/r/TheoryOfReddit/comments/1um89b/preddit_a_subreddit… >> Tiny Tiny Rss http://tt-rss.org/redmine/projects/tt-rss/wiki >> Pligg http://pligg.com/ >> Twitter, Reddit, ... >> >> ARC GIS >> CPOF http://en.wikipedia.org/wiki/Command_Post_of_the_Future >> >> Metasploit >> >> Oryon http://sourceforge.net/projects/oryon/ (?) >> Investigative Dashboard https://investigativedashboard.org/ (?) > > ------------------------------ > > Message: 6 > Date: Thu, 03 Jul 2014 08:26:37 -0700 > From: Seth <list(a)sysfu.com> > To: cpunks <cypherpunks(a)cpunks.org>, coderman <coderman(a)gmail.com> > Subject: Re: Fwd: [tor-talk] according to leaked XKeyScore source NSA > marks all Tor users as extremists, puts them on a surveillance list > Message-ID: <op.xifg6nx1bgbjo9(a)work-pc.lan> > Content-Type: text/plain; charset="iso-8859-15"; delsp="yes"; > format="flowed" > > On Thu, 03 Jul 2014 04:11:45 -0700, coderman <coderman(a)gmail.com> wrote: > >> Subject: [tor-talk] according to leaked XKeyScore source NSA marks all >> Tor users as extremists, puts them on a surveillance list > I use Tor for just about all my daily web browsing. > > I also run a Tor relay from home. Even run my own mail server, XMPP and > Friendica nodes from home. > > Guess that makes me an ultra-extremist. > > The irony? I only decided to start using Tor by default for everything > once I became aware of the near total nature of passive surveillance. > > So if using Tor makes me an 'extremist' well, please accept this heartfelt; > _ _____ _____ _ __ __ ____ __ ____ _ _ > _____ _ _ _____ > | | |_ _/ ____| |/ / | \/ \ \ / / | _ \ /\ | | | | / > ____| | \ | |/ ____| /\ > | | | || | | ' / | \ / |\ \_/ / | |_) | / \ | | | | | > (___ | \| | (___ / \ > | | | || | | < | |\/| | \ / | _ < / /\ \ | | | | > \___ \ | . ` |\___ \ / /\ \ > | |____ _| || |____| . \ | | | | | | | |_) / ____ \| |____| |____ > ____) | | |\ |____) / ____ \ > |______|_____\_____|_|\_\ |_| |_| |_| |____/_/ > \_\______|______|_____/ |_| \_|_____/_/ \_\ > > Really there's nothing to lose at this point by encrypting and anonymizing > every bit that leaves every computer you own. > > If NSA wants to own my devices I'll keep cycling them out on a regular > basis with new and used gear I pay for in cash and pick up in person. > >> Conclusion: the world needs way more extremists. If they want cake, they >> should get it in abundance. > I remember reading somewhere that on any given day in the 'United State' > there are a couple hundred thousand active Tor users. We should add > GnuNET, I2P, CJDNS, CurveCP and many more to that list. > > I am Spartacus!!! https://www.piratenpartei.de/2014/07/03/neuer-piraten-geschaeftsfuehrer-sic… Best regards Pirate Party Germany Cindy

1 0

Re: [tor-talk] Tor Exit Operator convicted in Austrian lower court
by Zenaan Harkness 03 Jul '14

03 Jul '14

(Thread start: https://lists.torproject.org/pipermail/tor-talk/2014-July/033573.html ) On 7/3/14, Anders Andersson <pipatron(a)gmail.com> wrote: > On Thu, Jul 3, 2014 at 5:53 AM, Moritz Bartl <moritz(a)torservers.net> wrote: >> On 07/02/2014 11:00 PM, Anders Andersson wrote: >>> Unfortunately he doesn't seem to want to take this further, so the >>> ruling will stand. It's his choice, but it could be a very bad >>> deterrent to other potential exit node operators in Austria. >> >> We are in contact with William, and quite possibly there is the option >> of following this further with another Austrian operator who >> self-reports himself, with our help. Please everyone give us time to >> look into this together with some lawyers. > > Thank you! That's amazing! I'm quite sure that the support you get > from the Tor community when running an exit node really helps in > giving people the courage to do so. Agreed, great news. In hindsight, it is clear that we as a community have an interest to build a resource of amicus curiae briefs - friend of the court briefs. So PLEASE make moves in the direction of contributing and collecting documents which may be relevant to future cases - at the least a simple collection of legal docs. We have an interest in protecting our free-speech networks (Tor, I2P etc), legally as well as technologically and politically. The Torproject.org website does a good job IMHO of presenting the social case for free-speech networks. No matter the circumstances of a particular case (a particular free speech node operator), we the global free-speech promoting and free-speech facilitating community, have an interest to advise the courts regarding matters of technology and free speech, in order to maximise the sanity of the outcomes brought about by our courts (and yes, another operators courts are as good as mine, in terms of global impact). For example a tor-network node operator charged for actual illegal activity, should not cause legal suppression of free-speech networks in general. To kick things off, here's the gist of what I have in mind (this is in no way directly responsive to the case that started this thread, which I know nothing about): " In this matter an individual has been charged with a [criminal] offence. The case of a matter of an individual committing a proven criminal defamation or incitement must not be used by the court to suppress free speech generally by way of the court's power of judicial sanction. Similarly in this case the [Defendant] was the operator of a 'digital communications facility' which facility was a node in a free-speech network, in particular the [Tor|I2P} free speech network; where the operator is found by this court to have committed unlawful acts, then this court must only target those unlawful acts when it makes its determinations, by way of this court's power of judicial sanction exercised according to law; and this court must not reach beyond those unlawful acts in its determinations/ rulings/ sanctions; if the court exercises its power in reaching beyond those unlawful acts then such exercise of judicial power is likely to undermine confidence in the court by all other operators of the free-speech network and by users of the free speech network. A ruling by this court will be seen by many humans around the world, both operators of free speech nodes in the free speech networks, as well as by users and by potential users of free speech networks around the world. In this case, the rulings of this court are visible globally, and shall be watched by many; there is therefore a great burden upon this court in this case, and this court therefore has a special duty of care when it makes its rulings/ determinations, to be conservative and cautious, in particular regarding any general deterrents this court might ordinarily be minded to create by its rulings which deterrents might unintentionally dampen confidence in this court and/ or confidence in the courts generally to protect our human rights including freedom of communication. This court must be especially careful in its rulings in this matter, since the court is in a position to bring about chilling effects upon the liberties of not only those humans within its immediate jurisdictions, but also upon the broader global community. " (A glosary, localisation, much enhancement and other legal polishing would be required of course, along with subroutined/ separate submissions regarding each relevant law, and regarding each relevant precedent in the jurisdiction in question and/ or in jurisdictions relevant (some cases/precedents are so poignant, so timeless, that they apply all over the world, e.g. the Credit River Decision, as well as the trial of William Penn).) Such advice or briefs to the court are ideally tailored to each particular country/jurisdiction. However, even a brief prepared for some country other than the country at issue, is likely to be useful to those attempting to create a brief for a particular case in another country, and may even be directly useful as a filing in its own right, at least if the language is the same :) Regarding the filing of briefs, we need standing to file; that is, we need an interest in the matter which interest is seen by the court. In some countries particular organisations may be ideal for the filing of such briefs, such as the FSF and EFF (USA) and EFA (Australia). In other countries, if there is no directly applicable organisation, then a "designated representative of the Torproject" who is resident in that country, may have standing to make such a filing. Alternatively, a local human-rights-friendly politician may be amenable to making the filing on behalf of their constituent(s) (that's us). Finally, in general any individual should have standing to make such a filing, since we have an interest in our own human rights - free speech is a fundamental human right - so we should also aim for the preparation and collection of briefs file-able by ourselves. Take notice, we HAVE A DUTY OF CARE to each other, and to the broader community, to contact Torproject and/ or others in this community, if ever we find ourselves in a court case involving the operation of any free speech network node (I2P, Tor, exit or relay), in order that those in the community who have an interest, ie the rest of us (at least those of us in the same country), are given the opportunity to make our interest known to the respective court(s) in that jurisdiction, by way of filing appropriate and standardized briefs. Zenaan

1 0

Re: Fwd: [tor-talk] according to leaked XKeyScore source NSA marks all Tor users as extremists, puts them on a surveillance list
by Seth 03 Jul '14

03 Jul '14

On Thu, 03 Jul 2014 04:11:45 -0700, coderman <coderman(a)gmail.com> wrote: > Subject: [tor-talk] according to leaked XKeyScore source NSA marks all > Tor users as extremists, puts them on a surveillance list I use Tor for just about all my daily web browsing. I also run a Tor relay from home. Even run my own mail server, XMPP and Friendica nodes from home. Guess that makes me an ultra-extremist. The irony? I only decided to start using Tor by default for everything once I became aware of the near total nature of passive surveillance. So if using Tor makes me an 'extremist' well, please accept this heartfelt; _ _____ _____ _ __ __ ____ __ ____ _ _ _____ _ _ _____ | | |_ _/ ____| |/ / | \/ \ \ / / | _ \ /\ | | | | / ____| | \ | |/ ____| /\ | | | || | | ' / | \ / |\ \_/ / | |_) | / \ | | | | | (___ | \| | (___ / \ | | | || | | < | |\/| | \ / | _ < / /\ \ | | | | \___ \ | . ` |\___ \ / /\ \ | |____ _| || |____| . \ | | | | | | | |_) / ____ \| |____| |____ ____) | | |\ |____) / ____ \ |______|_____\_____|_|\_\ |_| |_| |_| |____/_/ \_\______|______|_____/ |_| \_|_____/_/ \_\ Really there's nothing to lose at this point by encrypting and anonymizing every bit that leaves every computer you own. If NSA wants to own my devices I'll keep cycling them out on a regular basis with new and used gear I pay for in cash and pick up in person. > Conclusion: the world needs way more extremists. If they want cake, they > should get it in abundance. I remember reading somewhere that on any given day in the 'United State' there are a couple hundred thousand active Tor users. We should add GnuNET, I2P, CJDNS, CurveCP and many more to that list. I am Spartacus!!! -- Seth I <3 nicely trimmed email replies

1 0

XKeyscore-Quellcode: more english details requested
by coderman 03 Jul '14

03 Jul '14

request for more (english speaking) details on QUELLCODE part of XKeyScore(XKS) http://www.bild.de/politik/ausland/nsa/us-geheimdienst-spionierte-deutschen… specifically subsequent tasking associated with selected anonyms...

3 2

Fwd: [tor-talk] according to leaked XKeyScore source NSA marks all Tor users as extremists, puts them on a surveillance list
by coderman 03 Jul '14

03 Jul '14

---------- Forwarded message ---------- From: Eugen Leitl <eugen(a)leitl.org> Date: Thu, Jul 3, 2014 at 2:42 AM Subject: [tor-talk] according to leaked XKeyScore source NSA marks all Tor users as extremists, puts them on a surveillance list http://www.heise.de/newsticker/meldung/XKeyscore-Quellcode-Tor-Nutzer-werde… </kraut> All accesses (several 100 k/day) to Tor directory authorities (at least some IPs hardcoded, Sebastian Hahn one of the targets) intercepted and logged, Tor users are considered extremists (hello, self-fullfilling prophecy at work here, no doubt intended for further justify operation budgets) according to comments in the source and shortlisted for further surveillance (email intercept explicitly mentioned) and attempted deanonymization. Conclusion: the world needs way more extremists. If they want cake, they should get it in abundance. Further suggestion: we need an online database to deanonymize intelligence operatives. We need their faces, their license plates, their home addresses, and any dirt you can get on them. Name them, and shame them.

1 0