- cypherpunks - lists.cpunks.org

Re: [FD] So You Like Pain and Vulnerability Management? New Article.
by coderman 13 May '14

13 May '14

On Mon, May 12, 2014 at 9:09 AM, Pete Herzog <lists(a)isecom.org> wrote: > "Hi, I’m your friend and security researcher, Pete Herzog. we're almost family Pete, no need to introduce yourself! ... was starting to wonder how you've been... you never call, you rarely write, regarding your piece published at: http://www.tripwire.com/state-of-security/vulnerability-management/so-you-l… this reply is a little long, as i took the time to respond in depth to each of the issues i observed in your piece; i hope you view this as the best of intentions and sincere desire for thoroughness it is. any criticism is entirely constructive. if you feel despondent or hopeless about the future where you have been so wrong and so ill equipped to secure digital systems, see the end of this thread for crisis hotline resources in your area. > But I’m here today to take a moment and talk to you about the pain of > neglect, isolation, abuse, and infection, better known as > “vulnerability management”. you might be interested in the other thread on treating addiction. my own empirical study linking INFOSEC/COMSEC responsibilities with ethanol abuse, clandestine chemical poisonings, and a rapidly escalating habit for high fiber lifestyle is progressing nicely, but not yet ready for publication. (DWDM not ingested fiber) > In many ways vulnerability management can > be part of a healthy system and over-all good security. agreed! i find it very helpful to find vulns first, use them for early signalling of adversary capabilities and interest, weaponize them for great justice, and distribute them in limited fashion toward end of life cycle to friends and peers, where again they serve as useful feedback on third party OPSEC and integrity. > That's how my new article starts. 5 points on the pain of > vulnerability management and how to make it hurt less. unfortunately in previous private vulnerability assessments all social media platforms failed to survive our common criteria for credible computing contract services. at least you're not paying for them? ... i will however provide my feedback via this medium: 0. "how to make it hurt less" first off, you may be interested in my research on the best synth routes for clandestine medicating and near term memory cleansing with common chemicals or seedy suppliers. this information was cultivated during my research into INFOSEC/COMSEC professional who are clearly exceptionally capable in this domain. 1. "You can’t manage vulnerabilities in closed software any more than you can manage tunnel construction in an ant nest." this is not true. by actively managing the execution of all processes on all your systems and the communication they make between each other and remote (networked or bus connected services) peers. blocking and altering shared library methods, system calls, and network communication is effective against open source, closed source, promiscuous source, and other development practices. 2. "Managing vulnerabilities will not get you security. Especially since patched vulnerabilities is a subset of found vulnerabilities which is assumed (for far too many) to be a subset of having security." this is why it is critical to find as many vulnerabilities as possible in the systems you use before others do. use the vulnerabilities you find as a model of class of weakness upon which to defend in depth. more to do after this, but for another discussion... ;) 3. "But if you wanted to have all the domesticated animals on your new arc you can’t do it by only looking house pets as that would exclude goats, cows, horses, yetis, and many animals maybe you don’t know or didn’t consider. So when scanning for vulnerabilities you can only, at best, find the vulnerabilities the scanner knows about." i for one wish they omitted the goats. they make great work on the blackberry bushes, but the pasture fences are challenge and escalating war of attrition they so far show no difficulty defeating with clever goat skillz. more to the point above, this is why it is critical to employ not just all existing scanners, fuzzers, frameworks, and toolsets but also to improve them internally while also developing your own infrastructure for vulnerability discovery, defense, and weaponization. (this is called "big vuln" or "big vuln dev" by our team for lack of a better allegory) 4. "It Can Feel a Lot Like Doing Dishes. Vulnerability management is an endless race that can’t be won." so true! however, this is why complete and continuous automation is mandatory at the moment of analyst discovery or developer prototype. thus the repetitiveness is delegated to the machines who do our bidding without tire or negligence. 5. "when you manage operational controls as part of vulnerability management you can actually take yourself out of the rat race of patch vs. exploit. That’s huge!" patch vs. exploit is a false dichotomy. if you're not solving for both concurrently you're doing it wrong. (don't feel bad, this is a common failure.) 6. "Filling a Hole Has Never Been So Dirty ... We think vulnerability management is straight-forward: there’s a hole and you fill it and the hole is gone." who are these "we" you speak of? the last time i saw that mindset in play was a sales associate for a security consulting firm hawking some weird devops / continuous integration like thing i don't remember too well. anyone who thinks vulnerability management is easy is unaware of their ignorance, risk, and update latencies in their organization. 7. "In the end, playing dirty is the only way most vulnerability managers can keep their heads above water. But let’s just call that a risk decision." what you call "playing dirty" is just decision making in the midst of a series of one crises after another in an endless procession. crisis mitigation and resolution should not be cast in a negative air of "playing dirty". rather, take this as opportunity to find the exceptionally rare operations crew who runs a ship so tight there are no crises, only prioritized opportunities for even further improvement. 8. "closely followed by NATO, NIST, FBI, NASA, NSA, all branches of armed forces, and the White House." this is just awefull! i suffered through a number of years with a stalker intent on making me into a skin cover for a realdoll in some psychotic delusion he was compelled by. i know the unease and fear and stress that a malicious stalker can have on the psyche. i presume you've looked into local resources to prosecute or order to be restrained. if they're unable or unwilling to resolve the issue, contact me off list for more extreme methods to handle this. i got your back Pete; and we'll get these rogue's off your back one way or another! 9. "don’t forget to see me in Richmond, VA from June 4 – 6 at RVAse" sorry Pete, i quit going east of the mississippi given the fallout that inevitably follows. as a US tax payer, i try to limit the resources expended to violate my privacy and presume a threat where none exists. and frankly it diminishes the intimacy of my memories knowing that they've surveiled my masturbatory sessions in remote locales. i am taking this moment to segue into one last observation in your piece, but it deals with adult subject matter that may not be appropriate for all audiences. if you are not mature enough for the discussion below, please don't read it! . . . - this break intentionally inserted for decency - . . . Z. "... the adult film star process which pretty much gets you from film star to adult film star by doing just one thing on film." i don't often discuss my personal past in these lists or online in general. for a while i had a career in INFOSEC but came to a realization that there must other line of work supporting a upper middle class salary which were not so terribly detrimental to my mental and physical health. i transitioned into gonzo group gay porn which met the cost of living requirements but still had above average physical demands even if a great improvement over the dark INFOSEC years. after five years building a library of over 1,782 different scenes stretching to 12 days of continuous copulation my career in porn was ended in a crippling accident while testing a prototype manbian machine fucking investment that was my doom rather than return on investment. don't write me, the rights have already been sold for a moving drama with A list cast. my point is that i published a greatest "best-of coderass at 1.75 FPS, abridged" anthology as career end salute on a 180 minute collector s edition BluRay paid for by the sale of creative rights mentioned above. this video release rocketed to the top of all the best seller lists and made me a household name and continues to feed me a torrent of franchise fees, recurring profit share, and ongoing royalties which can only be described as obscene and ridiculous. for some reason every other effort was just not enough to bump me up above obscure D list status... it's a funny world. TL;DR: my adult film star process required 1,782 scenes, 45,000 minutes of film, and spanned 73%* of known sex acts possible to act out between two or more humans but less than twenty humans at once. this is as far removed from "doing just one thing" as i can imagine, and frankly it disrespects the strenuous effort and creative acting myself and other sex workers practice in mostly thankless service to others. you should be ashamed! [* automatic identification and categorization of sex acts is surprisingly complicated! the corresponding language theoretic effort to map 1 to 20 human bodies in movement for 15 minutes or less into a formal language to exhaustively delineate all the possible perversions possible to commit under the sun was gargantuan in terms of earth human hours and the resulting corpus. we are close to proving that not everything which can be done has been. if you would be interested in performing a provably unique sex act for a large sum of money and only modest surgical modification, please get in touch] P.P.S. some people ask me what i do now for a living since confined to robotic wheelchair and bed rest. the truth is, i could never turn my back entirely on the INFOSEC community in which i started my first career and sojourn into the great world alone. so now i am busking at conferences doing INFOSEC comedy routines, selling nerdcore rap put to chiptunes on independent labels, and manning the crisis hotlines for substance abuse and domestic violence victims, who strangely enough overlap to a non trivial degree with the set of self confessed INFOSEC professionals. my time spent replying to INFOSEC threads on mailing lists is gratis, as no one pays me for it, and no one like what i say enough to tip me. "have you hugged your data spill incident responder today?" best regards, friend of Pete and former pr0n star, codermange

2 1

### Two Open Source Apps for data protection ###
by Jose Damico 12 May '14

12 May '14

Hi All, I've developed 2 small/simple/open-source Android apps that can be useful for data protection in mobile devices: ============= Yapea: Yet Another Picture Encryption Application https://play.google.com/store/apps/details?id=org.jdamico.yapea https://github.com/damico/yapea ============= SecNote: Encrypted Notepad for Android https://play.google.com/store/apps/details?id=org.jdamico.secnote https://github.com/damico/SecNote ============= Both applications, has these features: * Encryption Algorithms: Symetric encryption: AES (CBC/PKCS5Padding) Blowfish (CFB/NoPadding) The Initialization Vectors are generated based on unique data from the smartphone. * Type of encryption key: Length: 256 bits Generated through key derivation (from user-defined password) with PBKF2 algorithm. The salt are generated based on unique data from the smartphone. The key is stored inside a configuration file, at smartphone file system. This file is used for password verification at first time of application use. After that the key is encripted and stored inside smartphone memory (cache). But at anytime the user can choose to delete the encrypted key from memory (Clear cache). * Application reset: At anytime the user can choose to dump ALL application data, including encrypted images and configuration. * Panic password: A password that can be used to delete all encrypted images. In a case where user is forced to give its key. (If you're traveling overseas, across borders or anywhere you're afraid your smartphone might be tampered with or examined). * Languages: English and Portuguese ============= Best Regards, Damico

3 3

Cryptome Archive Over 71,000 Files
by John Young 09 May '14

09 May '14

Donate for the Cryptome Archive of over 71,000 files from June 1996 to 6 May 2014 on 1 USB (23.8GB): <http://t.co/zbsl0nmvRE>http://cryptome.org/donations.htm

1 0

Dan Geer on IoT
by John Young 09 May '14

09 May '14

https://securityledger.com/2014/05/security-and-internet-of-things-can-we-t… Attendees will hear an address by Dr. Dan Geer, the Chief Security Officer at In-Q-Tel, the U.S. Central Intelligence Agency's investment arm. Dan is one of the smartest and most prescient thinkers in the security world, who has made headlines by warning about the dangers of our reliance of technology monocultures like Microsoft's Windows operating systems. Most recently, Dan has been sounding similar alarms about an (emerging) monoculture of "small devices and the chips that run them." In other words: just because the network of the future doesn't have a Windows sticker and "Intel Inside" logo on it, doesn't mean that the same kinds of problems don't exist. Many of you who have been following this blog know that the Security Ledger is particularly interested in covering the (fast) evolving border line between "traditional" IT security and the terra incognito of the Internet of Things. This week, we're taking that discussion to the next level with our first-ever event: The Security of Things Forum (or SECoT for short). SECoT is going to be an amazing day of discussion and debate about what I consider one of the foremost challenges facing the technology community in the next decade: securing a rapidly expanding population of intelligent and Internet-connected devices.

1 0

OpenSSH memory leak
by Matej Kovacic 08 May '14

08 May '14

Hi, (NOT OpenSSL!) in case you didn't came aroud this: http://pastebin.com/gjkivAf3 Unfortunately, there is no patch yet... Regards, M.

5 4

“General Keith.. so great to see you.. !”
by coderman 07 May '14

07 May '14

http://america.aljazeera.com/articles/2014/5/6/nsa-chief-google.html Exclusive: Emails reveal close Google relationship with NSA National Security Agency head and Internet giant’s executives have coordinated through high-level policy discussions May 6, 2014 5:00AM ET by Jason Leopold @JasonLeopold Email exchanges between National Security Agency Director Gen. Keith Alexander and Google executives Sergey Brin and Eric Schmidt suggest a far cozier working relationship between some tech firms and the U.S. government than was implied by Silicon Valley brass after last year’s revelations about NSA spying. Disclosures by former NSA contractor Edward Snowden about the agency’s vast capability for spying on Americans’ electronic communications prompted a number of tech executives whose firms cooperated with the government to insist they had done so only when compelled by a court of law. But Al Jazeera has obtained two sets of email communications dating from a year before Snowden became a household name that suggest not all cooperation was under pressure. On the morning of June 28, 2012, an email from Alexander invited Schmidt to attend a four-hour-long “classified threat briefing” on Aug. 8 at a “secure facility in proximity to the San Jose, CA airport.” “The meeting discussion will be topic-specific, and decision-oriented, with a focus on Mobility Threats and Security,” Alexander wrote in the email, obtained under a Freedom of Information Act (FOIA) request, the first of dozens of communications between the NSA chief and Silicon Valley executives that the agency plans to turn over. Alexander, Schmidt and other industry executives met earlier in the month, according to the email. But Alexander wanted another meeting with Schmidt and “a small group of CEOs” later that summer because the government needed Silicon Valley’s help. “About six months ago, we began focusing on the security of mobility devices,” Alexander wrote. “A group (primarily Google, Apple and Microsoft) recently came to agreement on a set of core security principles. When we reach this point in our projects we schedule a classified briefing for the CEOs of key companies to provide them a brief on the specific threats we believe can be mitigated and to seek their commitment for their organization to move ahead … Google’s participation in refinement, engineering and deployment of the solutions will be essential.” Jennifer Granick, director of civil liberties at Stanford Law School’s Center for Internet and Society, said she believes information sharing between industry and the government is “absolutely essential” but “at the same time, there is some risk to user privacy and to user security from the way the vulnerability disclosure is done.” The challenge facing government and industry was to enhance security without compromising privacy, Granick said. The emails between Alexander and Google executives, she said, show “how informal information sharing has been happening within this vacuum where there hasn’t been a known, transparent, concrete, established methodology for getting security information into the right hands.” The classified briefing cited by Alexander was part of a secretive government initiative known as the Enduring Security Framework (ESF), and his email provides some rare information about what the ESF entails, the identities of some participant tech firms and the threats they discussed. The classified briefing cited by Alexander was part of a secretive government initiative known as the Enduring Security Framework (ESF), and his email provides some rare information about what the ESF entails, the identity of some participant tech firms and the threats they discussed. Alexander explained that the deputy secretaries of the Department of Defense, Homeland Security and “18 US CEOs” launched the ESF in 2009 to “coordinate government/industry actions on important (generally classified) security issues that couldn’t be solved by individual actors alone.” “For example, over the last 18 months, we (primarily Intel, AMD [Advanced Micro Devices], HP [Hewlett-Packard], Dell and Microsoft on the industry side) completed an effort to secure the BIOS of enterprise platforms to address a threat in that area.” “BIOS” is an acronym for “basic input/output system,” the system software that initializes the hardware in a personal computer before the operating system starts up. NSA cyberdefense chief Debora Plunkett in December disclosed that the agency had thwarted a “BIOS plot” by a “nation-state,” identified as China, to brick U.S. computers. That plot, she said, could have destroyed the U.S. economy. “60 Minutes,” which broke the story, reported that the NSA worked with unnamed “computer manufacturers” to address the BIOS software vulnerability. But some cybersecurity experts questioned the scenario outlined by Plunkett. “There is probably some real event behind this, but it’s hard to tell, because we don’t have any details,” wrote Robert Graham, CEO of the penetration-testing firm Errata Security in Atlanta, on his blog in December. “It”s completely false in the message it is trying to convey. What comes out is gibberish, as any technical person can confirm.” And by enlisting the NSA to shore up their defenses, those companies may have made themselves more vulnerable to the agency’s efforts to breach them for surveillance purposes. “I think the public should be concerned about whether the NSA was really making its best efforts, as the emails claim, to help secure enterprise BIOS and mobile devices and not holding the best vulnerabilities close to their chest,” said Nate Cardozo, a staff attorney with the Electronic Frontier Foundation’s digital civil liberties team. He doesn’t doubt that the NSA was trying to secure enterprise BIOS, but he suggested that the agency, for its own purposes, was “looking for weaknesses in the exact same products they’re trying to secure.” The NSA “has no business helping Google secure its facilities from the Chinese and at the same time hacking in through the back doors and tapping the fiber connections between Google base centers,” Cardozo said. “The fact that it’s the same agency doing both of those things is in obvious contradiction and ridiculous.” He recommended dividing offensive and defensive functions between two agencies. The government has asked for Silicon Valley’s help. Adam Berry / Getty Images Two weeks after the “60 Minutes” broadcast, the German magazine Der Spiegel, citing documents obtained by Snowden, reported that the NSA inserted back doors into BIOS, doing exactly what Plunkett accused a nation-state of doing during her interview. Google’s Schmidt was unable to attend to the mobility security meeting in San Jose in August 2012. “General Keith.. so great to see you.. !” Schmidt wrote. “I’m unlikely to be in California that week so I’m sorry I can’t attend (will be on the east coast). Would love to see you another time. Thank you !” Since the Snowden disclosures, Schmidt has been critical of the NSA and said its surveillance programs may be illegal. Army Gen. Martin E. Dempsey, chairman of the Joint Chiefs of Staff, did attend that briefing. Foreign Policy reported a month later that Dempsey and other government officials — no mention of Alexander — were in Silicon Valley “picking the brains of leaders throughout the valley and discussing the need to quickly share information on cyber threats.” Foreign Policy noted that the Silicon Valley executives in attendance belonged to the ESF. The story did not say mobility threats and security was the top agenda item along with a classified threat briefing. A week after the gathering, Dempsey said during a Pentagon press briefing, “I was in Silicon Valley recently, for about a week, to discuss vulnerabilities and opportunities in cyber with industry leaders … They agreed — we all agreed on the need to share threat information at network speed.” Google co-founder Sergey Brin attended previous meetings of the ESF group but because of a scheduling conflict, according to Alexander’s email, he also could not attend the Aug. 8 briefing in San Jose, and it’s unknown if someone else from Google was sent. A few months earlier, Alexander had emailed Brin to thank him for Google’s participation in the ESF. “I see ESF’s work as critical to the nation’s progress against the threat in cyberspace and really appreciate Vint Cerf [Google’s vice president and chief Internet evangelist], Eric Grosse [vice president of security engineering] and Adrian Ludwig’s [lead engineer for Android security] contributions to these efforts during the past year,” Alexander wrote in a Jan. 13, 2012, email. “You recently received an invitation to the ESF Executive Steering Group meeting, which will be held on January 19, 2012. The meeting is an opportunity to recognize our 2012 accomplishments and set direction for the year to come. We will be discussing ESF’s goals and specific targets for 2012. We will also discuss some of the threats we see and what we are doing to mitigate those threats … Your insights, as a key member of the Defense Industrial Base, are valuable to ensure ESF’s efforts have measurable impact.” A Google representative declined to answer specific questions about Brin’s and Schmidt’s relationship with Alexander or about Google’s work with the government. “We work really hard to protect our users from cyberattacks, and we always talk to experts — including in the U.S. government — so we stay ahead of the game,” the representative said in a statement to Al Jazeera. “It’s why Sergey attended this NSA conference.” Brin responded to Alexander the following day even though the head of the NSA didn’t use the appropriate email address when contacting the co-chairman. “Hi Keith, looking forward to seeing you next week. FYI, my best email address to use is [redacted],” Brin wrote. “The one your email went to — sergey.brin(a)google.com — I don’t really check.”

3 2

NSA good guys
by Cypher 04 May '14

04 May '14

I wonder how long the good but misunderstood people over at NSA knew about Heartbleed and didn't disclose? I mean, certainly "protecting" us would necessitate them coming forward, right? The wouldn't deliberately leave the entire country vulnerable just so the could keep spying, right? Good people, my ass. Cypher Sent from my mobile device

21 53

NSA TEMPEST NONSTOP Document Released
by John Young 02 May '14

02 May '14

Just declassified and released after 8 years from FOIA request: NSA TEMPEST 01-02 NONSTOP Evaluation Standard (Oct 2002): <http://cryptome.org/2014/05/nsa-tempest-01-02-oct-02.pdf>http://cryptome.org/2014/05/nsa-tempest-01-02-oct-02.pdf (3.2MB) Compare NONSTOP Techniques from 1975: <http://cryptome.org/nacsem-5112.htm>http://cryptome.org/nacsem-5112.htm Both heavily redacted but comparison may fill in missing. The TEMPEST researchers at Cambridge may have full documents. What say? Our compilation: http://cryptome.org/nsa-tempest.htm

1 0

Ubuntu bug 1308572
by Georgi Guninski 30 Apr '14

30 Apr '14

Ubuntu bug 1308572 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 ----- affects ubuntu Hello, I am running Ubuntu 14.04 with all the packages updated. When the screen is locked with password, if I hold ENTER after some seconds the screen freezes and the lock screen crashes. After that I have the computer fully unlocked. -- Marco Agnese This bug is about the lockscreen being bypassed when unity crashes/restarts, which is a critcal security issue. The crash will be handled from bug 1308750 -----

2 2

DoJ tried to stop Barrett Brown's criticism of gov
by Douglas Lucas 28 Apr '14

28 Apr '14

This morning WhoWhatWhy published my new article, "Silencing Barrett Brown." I obtained the transcript of the hacktivist journo's September 4 gag hearing, which revealed bench conference conversations that were inaudible from the gallery when I attended. The transcript shows the prosecution asked the judge to stop Brown's wide-ranging criticism of the government in general, claiming that his anti-authority "tone" in one of his Guardian articles was "problematic." My article also provides an update on his case and plea deal. http://whowhatwhy.com/2014/04/28/silencing-barrett-brown/

1 0