- cypherpunks - lists.cpunks.org

cyberwarfare by lawyers
by Cari Machet 19 Mar '14

19 Mar '14

'The Jerusalem Post recently interviewed Col. Sharon Afek, formerly deputy head of the IDF's legal division, who wrote a 149-page treatise on cyber warfare law - the first treatise of that comprehensiveness by a military lawyer of his rank and stature.' http://www.jpost.com/Defense/Analysis-How-Israel-is-dealing-with-cyber-warf… 'Many are also asking more strongly than ever: "Is international law still relevant?" Afek, who views his treatise also as a "bridge" between the pre- and post-cyber world of war, answers with a resounding "yes," but then goes further to try to resolve some of the questions of how and where it applies. One debate in the new wild west of cyberwarfare law is between two schools of thought about where to draw the line of which cyber operations should be declared illegal under international law.' http://www.jpost.com/Features/Front-Lines/A-revolution-in-war-339962 -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

7 9

Re: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi
by Aaron Zauner 19 Mar '14

19 Mar '14

cates From Trust, Stores References: <5328EE7F.9070503(a)azet.org> <5328F7FC.5060802(a)iang.org> In-Reply-To: <5328F7FC.5060802(a)iang.org> X-Enigmail-Version: 1.2.3 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig2D2852BFD85FEBF952C9CE4C" Cc: cpunks <cypherpunks(a)cpunks.org> X-BeenThere: cypherpunks(a)cpunks.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: The Cypherpunks Mailing List <cypherpunks.cpunks.org> List-Unsubscribe: <https://cpunks.org/mailman/options/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=unsubscribe> List-Archive: <http://cpunks.org/pipermail/cypherpunks/> List-Post: <mailto:cypherpunks@cpunks.org> List-Help: <mailto:cypherpunks-request@cpunks.org?subject=help> List-Subscribe: <https://cpunks.org/mailman/listinfo/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=subscribe> X-List-Received-Date: Wed, 19 Mar 2014 03:52:41 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Ian, ianG wrote: > Nice! Now, if they could package up a plugin or a new root list such > that we could write in 2 lines what busy sysadms had to do, I'd say it > would make a great recommendation. >=20 > What I'm trying to get away from is the notion that we should put a > simply list in the doc and say "oh, and strip these out! You know > how, vi is your friend..." Yea. That won't work at all, there's no clear authority [sic!] on who can decide a CA is not trustworthy. Experience has to show that, and in that case a lot of the big CAs will fail an evaluation. If you ask me, it's pretty easy, my list of trusted CAs is empty. Automated generation of lists of CAs that are simply unused is just the first step. I think certificate-transparency is a good way to do that, the rest is basically automation. For example: one can provide chef, puppet, ansible recipies for linux and mac clients, a similar solution for windows and mobile devices should also be doable. Aaron --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJTKRQqAAoJEOTbZJL9ubXVB2cQAMCC6nlPTgUn86bCXi8ny+uk noYKI7XXHq0Hzl/f3Hd67oAXEX9wNh1znSBRYJ3sfSd5dgeyTfhn6NIITjdzqGc1 +1yAmyIn7Q8/+lDgSEPdsTDKFXqiTtQj9iK6t+/Ul6/l34movetvYBBI85f9yO96 4swk7obaqpRqkziVoUt0K2lopYrCxXHK7hVkXmwXgt1UlyccODHy2fWO3QWl8SWw xmrQlCJ+BGuYiV2mNFZe9w5etLwGX7wiR4xpaAHXoYZL6Kt2f//fmdb+pWnq8lE/ /NxmAQlDboPBB39uPhhsUtbrwOUS/4ZFqiA3tUSgcYZMGxYPWoUkkJpuccpWhYMf psaWrZmhz0CoL9FPiKngscv9DNAMIHfOOa0Ynku4RfBvO2Q/4F1JrW4epwCJuQiK kxKDjD2+pQ/UdIlIWSdylskaVZV+qsKWBa+4oBbGQYz9DXLgYwaPh7p6QzRcZGvA sP3p6t+aluUqCtc11cgiKfCfLs8uezTNQUYrrlu4E1G3IXkMPMmSOuheiwu+sRCJ BSlP/ys/FihB6J6EsC4i7AkLK8Ws1vfarCZDdycA++lr63Uoj0LEYv8/nTgg/GNj ZaDmuGO1sBMwEEH0nTyBDk2fJryOFjiGzzdzmEuk7fAWD6tY16mqYUptqlDmphz/ 79u6Uftx8nNa3u099JBL =7ty+ -----END PGP SIGNATURE----- --------------enig2D2852BFD85FEBF952C9CE4C--

2 1

Special Source Operations puzzles
by coderman 19 Mar '14

19 Mar '14

in the SSO overview slide there are three colors: https://peertech.org/files/sso-in-mah-tubes.jpg --- i fancy them as follows: GREEN: legally compelled and gagged plaintext access through service providers, like BLARNEY and PRISM RED: financially motivated secret agreement with "special partners" for filthy lucre. e.g. GTE fiber access. BLUE: unilateral / non-cooperative operations; covert black bag taps. --- if most facilities, like room 641A, are in RED zones, then recent ground breaking improvements in BLUE may be miniaturized and covert taps with selectors and large local cache. alternatively, new capability could be upgrades to the RED facilities where BLUE traffic is conveniently co-processed, cached, and UPSTREAM'ed. paging Top Level Telecom, ;)

1 0

Fwd: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores
by coderman 19 Mar '14

19 Mar '14

Fwd^2: ---------- Forwarded message ---------- From: Aaron Zauner ... Date: Tue, Mar 18, 2014 at 6:10 PM Subject: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores Recommended reading: https://www2.dcsec.uni-hannover.de/files/fc14_unused_cas.pdf (PDF copypasta with missing characters following): ``` 6 Conclusion In this paper we argued for the removal of CA certi cates that do not sign any certi cates used in HTTPS connections from desktop and browser trust stores. We based our analysis on an Internet-wide dataset of 48 million HTTPS certi cates and compared them to trust stores from all major browser and OS vendors. We were able to identify 140 CA certi cates included in twelve trust stores from all major platforms that are never used for signing certi cates used in HTTPS. Based on these ndings, we suggest to remove or restrict these CA certi cates. Using two months' worth of TLS handshake data from our university network, we con rmed that removing these certi cates from users' trust stores would not result in a single HTTPS warning message. Thus, this action provides a simple and low-cost real-world improvement that users can implement right now to make their HTTPS connections more secure. We are working on creating tools and scripts to automate this process for diﬀerent browsers and operating systems. Our current list of CAs we recommend for removal is a conservative one. It includes all CAs that have never signed a HTTPS certi cate. In future work,we would like to analyze the trade-oﬀ between false positives and the size of the trust store, as well as look into mechanisms to restrict the capabilities of certi cates on the Android platform. ``` Aaron _______________________________________________ Ach mailing list Ach(a)lists.cert.at http://lists.cert.at/cgi-bin/mailman/listinfo/ach

1 0

Blade Runner Mesh Networking
by Griffin Boyce 18 Mar '14

18 Mar '14

So if (spoiler) Deckard's a replicant, and he knows about Rachel's implanted memories right after meeting her, and Gaff knows about Deckard's unicorn dream right after it happens... Does that mean that the replicants are all meshing? ~Griffin

1 0

a prediction market denominated in Bitcoin
by dan＠geer.org 17 Mar '14

17 Mar '14

http://www.siliconrepublic.com/start-ups/item/33411-irish-start-up-launches/ https://www.predictious.com/ Onward, --dan

1 0

Re: Journalists Shill Sources and Secrets
by John Young 17 Mar '14

17 Mar '14

At 09:25 PM 3/16/2014, Cari Machet wrote: wait ... are you saying money corrupts ??? if you are saying that corruption is at hand then how can we trust the supposed human beings behind any of these names ? i mean i think you are saying corruption is at hand but i dont want to assume anything... Assume this promotional creed screed for national security journalism: http://cryptome.org/2014/03/sources-and-secrets-brief.pdf No, media venality is not news. What is worth examining is the long-term exploitation of "national security" as a joint gov-com-edu-org racket to manipulate secretkeeping as a wealth concentration industry. This has been commonplace since the national security state was invented after WW2 and led to need for continuous spying to manufacture enemies and to arm for diddly squat combat against fictious foes by hugely expensive but hardly ever used armaments. Cryptosystems among the black budgetary wastage. In particular cryptosystem popularization (as here and its emulators) as ostensible opposition to the national security racket, begun in the flower-child 60s to flower wildly in the 90s and rise to a kudzu crescendo with Snowden's operation to validate crypto use against illusory enemies within the state, cloaked as usual by the blanket exculpt "to do no harm to national security," then hide behind privileged natsec journalism so dirty and complicit in govenment affairs it needs protection from the public, so merely dribbles dainty tidbits of threats to privacy and to advance the favorite ACLU and EFF lawyerly fund-raising hobgobblin of constitutional violation. FISA Court jiggery-pokery by lawfare warriors indicates that lawyers and judges know diddly about comsec technology but dare not admit it and lose control of the public narrative of threat and protection obligatory in the trillion dollar national security hootenany which compares to organized religion of the medieval era which ruled heaven and earth with fantasticly frightening and pleasuring tales of evil and salvation. Adled journalists are racing to adopt encryption as crusading chain mail raiment, ignorant of how easily it can be penetrated, but no matter, what will really protect the valiant journalists is "constitutional protection," a comedy of conceit and stupidity usually associated with court jesters.

1 0

Comsec as Public Utility Beyond Illusory Privacy
by John Young 17 Mar '14

17 Mar '14

Snowden may have raised the prospect of comsec as a public utility like power, water, gas, sewage, air quality, environmental protection and telecommunications. Privacy protection has been shown to be illusory at best, deceptive at worst, due to the uncontrollable technology applied erroneously for national security. Each of the other public utilities began as private offerings before becoming commercialized and then institutionalized as necessities, many eventually near or wholly monopolies. Each also evolved into military targets for control, contamination, destruction, and in some cases excluded as too essential for civilian livelihood to target. Comsec as a right for human discourse rather than a commercial service could enforce privacy beyond easy violation for official and commercial purposes. Freedom of comsec, say, as a new entry in the US Bill of Rights could lead the way for it to be a fundamental element of Human Rights. The problem will be as ever the commercial and governmental exploiters aiming to protect their interests against that of the public. FCC and NIST, indeed, the three branches, are hardly reliable to pursue this, so beholden to the spy agencies they cannot be trusted. NSA's ubiquitous spying on everybody at home and elsewhere with technology beyond accountability does raise the chances of getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.

4 7

Journalists Shill Sources and Secrets
by John Young 17 Mar '14

17 Mar '14

Journalists Shill Sources and Secrets http://sourcesandsecrets.com/ Advertised with $20,000 full-page vanity ad in the New York Times, 16 March 2014. Coordinated with the NYT's release of its Snowden files series and books by Greenwald and Gellman, and video by Poitras, as well as capacious media roll-outs, conferences, celebrity profiles, movies, awards, prizes, law suits, mock threats, and phony investigations. Also coordinated with the rise of billionaire and corporate-funded "non-profit" journalism like ProPublica, The Intercept and The Marshall Project which pay over $500,000 top salaries, some with over $1M in total compensation packages. http://cryptome.org/2014/03/npj-14-0314.pdf See dozens of conference sponsors of commercial journalism at bottom. This conference is full. Registration is now closed for this event. Sources + Secrets A Conference on the Press, the Government and National Security Friday, March 21, 2014 at 8:00AM at The TimesCenter 242 West 41st Street New York, NY 10018 Focusing on the divide between the government and the press over coverage of national security issues, the Sources + Secrets Conference will examine the legal basis and scope of government actions that have hampered the work of journalists and offer administration representatives an opportunity to present their case for secrecy. Agenda THE LONG ARM OF THE LAW: panel on the Espionage Act, recent court decisions and Justice Department guidelines on subpoenas to reporters Ben Wizner, A.C.L.U.; David A. Schulz, First Amendment litigator; Laura R. Handman, First Amendment litigator; Jeffrey Toobin, The New Yorker. Moderator: Adam Liptak, The New York Times PERILS OF COVERING NATIONAL SECURITY: panel on the impact of government actions on confidential sources and reporting techniques Jane Mayer, The New Yorker; Mark Mazzetti, The New York Times; Peter Maass, writer; and Robert L. Deitz, former general counsel, N.S.A. and senior councillor to the C.I.A. director. Moderator: Bob Woodward, The Washington Post THE SNOWDEN REVELATIONS: Roger Cohen, The New York Times, interviews Glenn Greenwald, The Guardian; Laura Poitras, The New York Times; and Barton Gellman, The Washington Post, via Skype PROSPECTS FOR A FEDERAL SHIELD LAW: discussion of the proposed Free Flow of Information Act Bill Keller, editor in chief, The Marshall Project, interviews Senator Charles Schumer, followed by panel with Senator Schumer; Quinn Norton, freelance journalist, activist; Jonathan Landay, McClatchy; Scott Horton, reporter, Harper's Magazine; and Kenneth L. Wainstein, former assistant attorney general for national security and homeland security advisor WHERE DO WE GO FROM HERE? Panel discussion on achieving a balance between press freedom and national security Jill Abramson, executive editor, The New York Times; Martin Baron, executive editor, The Washington Post; David Remnick, editor, The New Yorker; Katrina vanden Heuvel, editor and publisher, The Nation; Robert S. Litt, General Counsel, Office of the Director of National Intelligence. Moderator: Ken Auletta, The New Yorker SUPPORTED BY ABC News; The Annenberg Center on Communication, Leadership & Policy; The Arthur L. Carter Journalism Institute at New York University; The Associated Press; CBS; The Center for Communication; the Center for Investigative Reporting; The Center for Public Integrity; CNN; Columbia Graduate School of Journalism; The Committee to Protect Journalists; The Denver Post; Frontline; The Hearst Corporation; The Huffington Post; Investigative Reporters and Editors; The Shorenstein Center on Media, Politics and Public Policy; The Los Angeles Times; The McClatchy Company; the Medill National Security Journalism Initiative; The Milwaukee Journal Sentinel; The New York Review of Books; The New Yorker; the Newspaper Association of America; The Nieman Foundation; NOLA.com/The Times-Picayune; PEN American Center; The Philip Merrill College of Journalism; The Poynter Institute; ProPublica; The Record and Herald News of North Jersey; the Reporters Committee for Freedom of the Press; Reporters Without Borders; Reuters; UC Berkeley Graduate School of Journalism; The Wall Street Journal and The Washington Post.

2 1

Re: [cryptography] 2010 TAO QUANTUMINSERT trial against 300 (hard) targets
by grarpamp 15 Mar '14

15 Mar '14

On Thu, Mar 13, 2014 at 11:13 AM, Jason Iannone <jason.iannone(a)gmail.com> wrote: > And remain undetected? That's a nontrivial task and one that I would > suspect generates interesting CPU or other resource utilization anomalies. > It's a pretty high risk activity. The best we can hope for is someone > discovering the exploit and publicly dissecting it. See, the standard defense for all this is to lock down the cert fingerprints of your real destination to prevent cert games. Then add in DNSSEC [1] and even IPSEC [1] to make sure things all match up. That does make things much harder. Problem still lies where your adversary has stolen or co-op'd the PK of your dest cert, and rigged the routing path to route-map your applicable src/dest/port IP tuples to residing off their private port in the local (to you or your dest) DC. Right??? >From which they proceed to bugger you through their transparent proxy to the real dest. It's not a bulk tool as that might tip off some non-moled-out-cert-group network groupie at the dest site that a lot of users come from some IP. And it's definitely for 'high value only' given the work/risk. But still... PKI-WOT bidirectional security between you and your dest of global bgp advert/nexthop routing infrastructure anyone? Everyone seems to trust the network to route... and even then [1]. [1] Similarly stolen/co-op'd as need be. > pg > This is relatively easy for home routers, since the self-signed certs they're > configured with are frequently CA certs. In other words they ship from the > factory in a MITM-ready state. > > > On Thu, Mar 13, 2014 at 8:50 AM, Greg Rose <ggr(a)seer-grog.net> wrote: >> >> You get the routers to create valid-looking certificates for the >> endpoints, to mount man-in-the-middle attacks. >> >> On Mar 13, 2014, at 6:28 , Jason Iannone <jason.iannone(a)gmail.com> wrote: >> >> > The First Look article is light on details so I don't know how one gets >> > from "infect[ing] large-scale network routers" to "perform[ing] >> > “exploitation attacks” against data that is sent through a Virtual Private >> > Network." I'd like to better understand that. >> > >> > >> > On Thu, Mar 13, 2014 at 7:22 AM, Jeffrey Walton <noloader(a)gmail.com> >> > wrote: >> > On Thu, Mar 13, 2014 at 9:17 AM, Jason Iannone <jason.iannone(a)gmail.com> >> > wrote: >> > > Are there details regarding Hammerstein? Are they actually breaking >> > > routers? >> > Cisco makes regular appearances on Bugtraq an Full Disclosure. Pound >> > for pound, there's probably more exploits for Cisco gear than Linux >> > and Windows combined. >> > >> > Jeff >> > >> > > On Thu, Mar 13, 2014 at 2:40 AM, Jeffrey Walton <noloader(a)gmail.com> >> > > wrote: >> > >> >> > >> On Thu, Mar 13, 2014 at 1:57 AM, coderman <coderman(a)gmail.com> wrote: >> > >> > >> > >> > >> > >> > https://s3.amazonaws.com/s3.documentcloud.org/documents/1076891/there-is-mo… >> > >> > >> > >> > "TAO implants were deployed via QUANTUMINSERT to targets that were >> > >> > un-exploitable by _any_ other means." >> > >> > >> > >> And Schneier's Guardian article on the Quantum and FoxAcid systems: >> > >> >> > >> >> > >> http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-a….

1 0