- cypherpunks - lists.cpunks.org

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by grarpamp 10 Jun '14

10 Jun '14

>>>> (or as Snowden demonstrated, put in a fridge to avoid scrutiny and >>>> audio capture the best idea. non-serial tower associations are an >>>> anomaly alerted and acted upon.) Faraday cages concept really depend on the freqs they are designed to inhibit, pressure, sound, radio, optic, etc. Given wide enough freqs, one cage does not service all. A fridge has plastec and magnetic gaskets, over maybe 2cm variant gap, so not a complete EM seal (at whichever specifical freqs). And grounding issue. But good at human sound deading. Microwave door shield is closer to cell phone freq shield. If you cannot simply remove the battery preferably, that is. As always, test first. And is easy to find phones to test all phone bands with. TEMPEST.

4 4

"Ephemeral" Biometrics
by Gregory Foster 09 Jun '14

09 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Federal Business Opportunities (Jun 4) - "Ephemeral Biometrics: An Alternative to Traditional, Event-based Authentication" by Sandia National Laboratories: https://www.fbo.gov/index?s=opportunity&mode=form&id=06e9abca57bdd9dac64902… > Sandia National Laboratories is engaged in ongoing research and > development into transformational upgrades in the area of cyber > identity management as well as Insider Threat Monitoring by using > Ephemeral Biometrics (EB). EB is unique because individual > identities are tied to living biometric data that is active and > continuous. The purpose of the research is to derive convenient > authentication techniques (e.g., alternatives to passwords) that > are both active and continuous while at the same time significantly > improving authenticity and integrity of cyber identities. "Ephemeral Biometrics: What are they and what do they solve?" by Sung Choi and David Zage of Sandia National Laboratories (2013): https://www.cs.purdue.edu/homes/zagedj/docs/iccst2013.pdf I'm not really sure what's ephemeral about redefining authentication to mean continuous monitoring. This work directly targets insider threat concerns raised post-Snowden, and provides further evidence that entities obsessed with secrecy will destroy their own effectiveness in pursuit of an improbable if not impossible definition of "security" which attempts to hermetically seal systems that include human beings. Good luck with that! gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTkgW/AAoJEMaAACmjGtgjxLIQALl48hrZKW1sWVWyIKcsb7hu 0ZPYm/FRrYnNHwAeAN/vWdVxrUyhRLKBCs+2H8v5C7Na2df1AqInZ1H9AGD1j84M iwZtHWMVkFvkcVDW+NMINRoHSjUdrPqIh+RP0KseMZTPTaelSD+tVEmUedSzOLgV km/OZ5URefIRSFjP3p6pA+YxZoZOU8UlwSxJFv9o4Vs/k1lwLDE+BYErabTXrFoe MWJhKhQWpisLD6QGBq+LRcTq+P+fpJlu6pRJFQR8mUIWsgZwr4OtQvXxjXFDO16K jaBVBSB0bdgQV4d8HLJE1dJek3fe1q9i9YEYBL2p91voTTKmPwkDIcmj9X9ZfNR1 lO5AXZh1H+rhO1OAfqlkvI0VYxAzO7AerKS+tPwh0lw3VSZYiBZawtJb3t/2snF9 R/02NRXfKZOFqKUQUH1bRkrFuKDRudmhtomafCek1MShVgR9BlAjFHcMjFa0gXBy FUo1D8ouzWYfwAM/0eVwDX9YAMX3tr3vl0KopFTEyFzolIapg9wbDeesIn4mu24P 8zDJUew+5wcHTc9ZPFZhdh6xGC9SoLvAPaqVTTSx3tTcxbdIouiIWyaQUOXNdteb KM9FEa+e9j5TggnaxuNuDpbBXVlKlou9oee/vge7OdS0EHqStPthckt3Vhp0Lv59 HzJ56AjJ0zh2iRLX/9Wt =KZuq -----END PGP SIGNATURE-----

5 7

Tinfoil Chat
by oottela 09 Jun '14

09 Jun '14

I'd like to share a project I came up with back in spring 2012 and begun working after the Snowden leaks started. Highlights are -OTP encryption for perfect secrecy -OTP encrypted Keccak HMACs to prevent undetectable message tampering -HW TRNG to generate truly random keys (Von Neumann whitened) -HW Data diodes to provide immunity against message exfiltration attacks originating from network. Source code and links to whitepaper and manual are available from https://github.com/maqp/tfc/ Regards, Markus

2 1

Going to jail nowadays for owning a book, wtf?
by Georgi Guninski 08 Jun '14

08 Jun '14

AFAICT someone might go to jail for owning a book (not sure if paper or electronic): >From wikipedia (old revision): https://en.wikipedia.org/w/index.php?title=Abu_Hamza_al-Masri&oldid=6095135… --- Guilty of one charge of "possessing a document containing information likely to be useful to a person committing or preparing an act of terrorism"[31] under the Terrorism Act 2000, s58. This charge under the Terrorism Act of 2000 related to his possession of an Encyclopedia of Afghan Jihad, an Al Qaeda Handbook and other propaganda materials produced by Abu Hamza.[32] ---

5 10

New vulnerability in OpenSSL
by jim bell 08 Jun '14

08 Jun '14

https://www.yahoo.com/tech/here-we-go-again-new-vulnerability-discovered-in… BOSTON — Security researchers have uncovered new bugs in the Web encryption software that caused the pernicious “Heartbleed” Internet threat that surfaced in April. Experts said the newly discovered vulnerabilities in OpenSSL, which could allow hackers to spy on communications, do not appear to be as serious a threat as Heartbleed. The new bugs were disclosed on Thursday as the group responsible for developing that software released an OpenSSL update that contains seven security fixes. Experts said that websites and technology firms that use OpenSSL technology should install the update on their systems as quickly as possible. Still, they said that could take several days or weeks because companies need to first test systems to make sure they are compatible with the update. "They are going to have to patch. This will take some time," said Lee Weiner, senior vice president with cybersecurity software maker Rapid7. OpenSSL technology is used on about two-thirds of all websites, including ones run by Amazon.com, Facebook, Google, and Yahoo. It is also incorporated into thousands of technology products from companies, including Cisco Systems, Hewlett-Packard, IBM, Intel, and Oracle. The widespread Heartbleed bug surfaced in April when it was disclosed that the flaw potentially exposed users of those websites and technologies to attack by hackers who could steal large quantities of data without leaving a trace. That prompted fear that attackers may have compromised large numbers of networks without their knowledge. Security experts said Thursday that the newly discovered bugs are more difficult to exploit than Heartbleed, making those vulnerabilities less of a threat. Still, until users of the technology update their systems, “there is a window of opportunity” for sophisticated hackers to launch attacks and exploit the newly uncovered vulnerabilities, said Tal Klein, vice president of strategy with cloud security firm Adallom.

3 2

US Army research into quantum teleportation of data
by Gregory Foster 08 Jun '14

08 Jun '14

Defense Systems (May 30) - "Teleporting information sets stage for ‘cyber secure’ communications": http://defensesystems.com/Articles/2014/05/30/ARL-Teleportation.aspx Lots of challenges to overcome, but the advantages are sufficiently self-evident and seductive to likely warrant substantial funding. A use case not mentioned: remotely piloted aircraft (drones) without network lag. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

2 1

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by grarpamp 08 Jun '14

08 Jun '14

On Sat, Jun 7, 2014 at 11:45 PM, Sidney Markowitz <sidney(a)sidney.com> wrote: > I don't know what would make me feel safer - putting the phones in a microwave > oven with the chance that the door could easily be left ajar, or getting the > acoustic insulation and masking hum of a refrigerator. Trust the microwave you tested, right, because you do not know what quality DSP is pricessing your remaining 5dB audio over your entire conversation. Or put microwave in fridge ;) aka: remove battery / crush/displace phone... be happy.

1 0

[was: Internet Giants erect barriers to spy agencies]
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 10:50 PM, jim bell <jamesdbell9(a)yahoo.com> wrote: > ... > After years of cooperating with the government, the immediate goal now is to > thwart Washington — as well as Beijing and Moscow. i'm holding my breath...

1 0

Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

---------- Forwarded message ---------- From: Michael at MuckRock <michael(a)muckrock.com> Date: Fri, Jun 6, 2014 at 7:53 AM Subject: Help investigate cell phone snooping by police nationwide Hi, Right now, we're gearing for MuckRock's biggest investigative project yet, and we need your help. First, a little context. Local police departments across America are increasingly tapping into information from your cell phone: Your location, who you're with, who you are calling. Using fake cell phone towers, often called Stingrays, they generally don't even need a warrant, and have relatively few restrictions on who, when, and what they collect. Or how they use it. Since these programs are often funded by federal grants, very few people outside of law enforcement know how, or even if, they're being used, with almost non-existent debate about if this information should be collected, and what limits should be set for for how it's used or how long it's kept. This is where you come in. We're launching this project on Beacon Reader, where a donation of just $5, about what it costs for us to successfully file a request, can make a big difference. Just like with the Drone Census, often times MuckRock is the *only* group asking for this information, which otherwise would never be made public. You can support the project at this link, and, again, even just $5 can make a huge difference: https://www.muckrock.com/ If you're not in a position to help financially, we would still really appreciate your help — share what we're up to with your friends, sending in news articles you see or tips regarding cell phone tracking, and, in a few days, sending in information regarding which departments you'd like us to file with through a special page on MuckRock. Thanks for all your support in the past, and we're looking forward to working with you to shine a light on this under-reported area. Thanks, Michael

3 5

Re: [cryptome] Re: Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 8:42 PM, <shelley(a)misanthropia.info> wrote: >.... > Unfortunately, using airplane mode is not enough to keep you from being > tracked. You must remove the battery. i can confirm this directly. a ride into Vegas for DC 20 demonstrated that Alexander's toys have the ability to inject into receive only (airplane mode) and tip to exploitation. (baseband exploits being exceptional at leaking keys, elevating privs, and erasing tracks...) battery out or faraday caged the only effective options. (or as Snowden demonstrated, put in a fridge to avoid scrutiny and audio capture the best idea. non-serial tower associations are an anomaly alerted and acted upon.)

1 0