- cypherpunks - lists.cpunks.org

Re: [tor-talk] PrivateCore Demonstrates Industry’s First PRISM-Proof Tor Server in Public Cloud
by Seth David Schoen 28 Oct '13

28 Oct '13

Michael Wolf writes: > It still runs in a VM on stock x86 hardware... what stops the > NSA/provider from viewing the virtual CPU's state, retrieving the > encryption keys, and decrypting the memory? "PRISM-Proof" my tail. Preventing the provider from viewing the virtual CPU's state is the main goal of their PrivateCore software. They encrypt the RAM that contains the VM and they try to ensure that the key used to encrypt it never leaves the CPU and that the providers don't get to see that key. Evidently right now they use a TPM for bootstrapping, so the weak link is probably the TPM: the provider could try to reboot the host while attacking the TPM in some way. If they had a completely fake or cracked TPM that other people accepted as genuine, they could try to make it boot the PrivateCore instance itself in a (provider-controlled) VM pretending to be native hardware. (The other potential weak link is exploiting the OS running inside the VM. Then even if you don't know the crypto keys that encrypt the memory, you can tell the OS to let you monitor its processes or disk.) There should be at least a brief discussion of this in the liberationtech archives. -- Seth Schoen <schoen(a)eff.org> Senior Staff Technologist https://www.eff.org/ Electronic Frontier Foundation https://www.eff.org/join 815 Eddy Street, San Francisco, CA 94109 +1 415 436 9333 x107 -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Re: [cryptome] Re: CIA-NSA Special Collection Service for Unnatural Gas
by John Young 28 Oct '13

28 Oct '13

Spain's phone interceptions is less than 5% of the 125 billion total. Far more in the Middle East and rest of the economically exploited world which is hardly alarmed like the economic and military imperial Europeans since they know the EU is doing what the US is doing, thus are not pretending shock, shock, shock as cover-up of digital-internet-undersea-cable-satellite predations. Interesting to compare petroleum and natural gas exploitation to that of digital and spectrum exploitation. Limit production and cut off oil to raise prices and battle competitors, cut off the internet, cables and spectrum, what's so different. At 08:53 AM 10/28/2013, you wrote: >Also::: Report: NSA spying and listening to more than 60 million >calls in Spain > The Associated Press published in the Spanish newspaper El > Mundo document that displays the national security of the U.S. > spying on me more than 60 million phone calls in Spain in just one month. >Report comes a week after Le Monde reported similar claims about >U.S. espionage matters in France, as well as the German magazine Der >Spiegel reported that the Washington listened to the mobile phone of >Chancellor Angela Merkel. ><http://www.elmundo.es/espana/2013/10/28/526dcbad61fd3d07678b456b.html>http://www.elmundo.es/espana/2013/10/28/526dcbad61fd3d07678b456b.html

1 0

CIA-NSA Special Collection Service for Unnatural Gas
by John Young 28 Oct '13

28 Oct '13

As Eugen knows the image is from Der Spiegel illustrating the CIA-NSA Special Collection Service, apparently from the slowly dribbling allegedly vast Snowden reservoir of unnatural gaseous once-secrets now being secretly pipelined to commercial fuel stations for lucrative mark-ups due to the allegedly limiited amount of natural gas inside national capitals: http://cryptome.org/2013/10/nsa-cia-berlin-spy-nest.pdf Cryptome on the CIA-NSA Special Collection Service unnatural gaseous exploration since 2000: http://cryptome.org/2013/10/cia-nsa-scs.htm At 08:19 AM 10/28/2013, you wrote: >Gentlemen's I trust you in this I believe you have better knowledge ,,,, > > >On Mon, Oct 28, 2013 at 3:39 AM, Eugen Leitl ><<mailto:eugen@leitl.org>eugen(a)leitl.org> wrote: >On Sun, Oct 27, 2013 at 06:52:09PM -0400, Haim Barak wrote: > > > <http://cdn4.spiegel.de/images/image-561283-galleryV9-evyw.jpg>http://cdn4.spiegel.de/images/image-561283-galleryV9-evyw.jpg > >Wow, an image. A jpg, even. It looks like sigint intercept, >but we'll never know what it's for, because Haim assumes we're >telepathic.

1 0

Armed agents seize records of reporter, Washington Times prepares legal action
by Eugen Leitl 28 Oct '13

28 Oct '13

http://www.washingtontimes.com/news/2013/oct/25/armed-agents-seize-records-… Armed agents seize records of reporter, Washington Times prepares legal action ** FILE ** Associated Press** FILE ** Associated Press By Guy Taylor-The Washington Times Friday, October 25, 2013 The Washington Times Maryland state police and federal agents used a search warrant in an unrelated criminal investigation to seize the private reporting files of an award-winning former investigative journalist for The Washington Times who had exposed problems in the Homeland Security Department's Federal Air Marshal Service. Reporter Audrey Hudson said the investigators, who included an agent for Homeland's Coast Guard service, took her private notes and government documents that she had obtained under the Freedom of Information Act during a predawn raid of her family home on Aug. 6. SEE ALSO: Judicial Watch sues IRS for stonewalling on tea party FOIA The documents, some which chronicled her sources and her work at the Times about problems inside the Homeland Security Department, were seized under a warrant to search for unregistered firearms and a “potato gun” suspected of belonging to her husband, Paul Flanagan, a Coast Guard employee. Mr. Flanagan has not been charged with any wrongdoing since the raid. The warrant, obtained by the Times, offered no specific permission to seize reporting notes or files. The Washington Times said Friday it is preparing legal action to fight what it called an unwarranted intrusion on the First Amendment. “While we appreciate law enforcement’s right to investigate legitimate concerns, there is no reason for agents to use an unrelated gun case to seize the First Amendment protected materials of a reporter,” Times Editor John Solomon said. “This violates the very premise of a free press, and it raises additional concerns when one of the seizing agencies was a frequent target of the reporter’s work. “Homeland’s conduct in seizing privileged reporters notes and Freedom of Information Act documents raises serious Fourth Amendment issues, and our lawyers are preparing an appropriate legal response,” he said. Maryland State Police declined comment, except to say that “evidence and information developed during this investigation is currently under review by both the Anne Arundel County State's Attorney's Office and the United State's Attorney's Office,” and that a determination has yet to be made on any charges. PHOTOS: Families suspect SEAL Team 6 crash was inside job The U.S. Coast Guard confirmed it seized and reviewed Ms. Hudson’s documents but insisted it did nothing wrong. Capt. Tony Hahn, a spokesman at Coast Guard headquarters in Washington, said the Coast Guard Investigative Service (CGIS) was involved in the case because Mrs. Hudson’s husband, Mr. Flanagan, is a Coast Guard employee. During the search of the home, said Capt. Hahn, “the CGIS agent discovered government documents labeled ‘FOUO’ — For Official Use Only and ‘LES’ — Law Enforcement Sensitive.” “The files that contained these documents were cataloged on the search warrant inventory and taken from the premises,” he said. “The documents were reviewed with the source agency and determined to be obtained properly through the Freedom of Information Act.” Ms. Hudson described a harrowing ordeal the morning her family home was raided. The agents, who had arrived a 4:30 a.m. in full body armor, collected several small arms during the raid, although no charges have been filed against Mr. Flanagan, 54, during the nearly three months since. Mrs. Hudson, 50, says that while the authorities were raiding her house, Coast Guard investigator Miguel Bosch — who formerly worked at the marshal service — began asking questions about whether she was the same “Audrey Hudson” who had written “the air marshal stories” for The Washington Times. Mrs. Hudson says she responded that she was. It was not until roughly a month later, Mrs. Hudson says, that she realized the agents had quietly seized five files from her private office — including handwritten and typed notes from interviews with numerous confidential sources related to her exclusive reporting on the air marshals service. The search warrant for the raid, issued to Maryland State Trooper Victor Hodgin by a district court judge, made no reference to the documents. A copy obtained by The Times indicates that the search was to be narrowly focused on the pursuit of “firearms” and their “accessories and/or parts,” as well as any communications that that might be found in Mrs. Hudson and Mrs. Flanagan’s home related to “the acquisition of firearms or accessories.” David W. Fischer, a private attorney contacted by the couple, says that the raid is a potential violation of Mrs. Hudson’s constitutional rights. “Obviously, the warrant is about a gun, nothing about reporters notes,” he said. “It would be a blatant constitutional violation to take that stuff if the search warrant didn’t specifically say so.” “This is a situation where they picked very specifically through her stuff and took documents that the Coast Guard, or the Department of Homeland Security, would be very interested in,” he added. The raid could constitute illegal search and seizure under the Fourth Amendment — and the fact that the materials were related to her work as a reporter could First Amendment freedom of the press protections. Once the documents had been “cleared,” Homeland decided to return the documents to Mr. Flanagan and Mrs. Hudson, Capt. Hahn said. The Coast Guard, like the Federal Air Marshal Service is an agency within the U.S. Department of Homeland Security. A Reporter’s Word What concerns Mrs. Hudson and The Times is the fact that private reporting documents were seized during the search being conducted on totally unrelated grounds. While Mr. Flanagan has a police record from the mid-1980s related to the unlawful possession of firearms, including automatic weapons, Mrs. Hudson fears her private documents may have been the real target of the search. “They tore my office apart more than any other room in my house,” she said, adding agents did not take other potentially non-TSA-related documents from the office. “I had a box full of [Department of Defense] notes,” she said. “They didn’t touch those.” Some of the files included notes that she had used to expose how the Federal Air Marshal Service had lied to Congress during the years after the Sept. 11, 2001, terrorist attacks about the number of airline flights that the service was actually protecting against another terrorist attack. A story written by Mrs. Hudson for The Times in March 2005, revealed how air marshals were protecting less than 10 percent of domestic and international flights during the month of December 2004, and that the number of flights Homeland Security officials were providing to Congress was higher than the actual number of marshals it employed. Mrs. Hudson says that the experience of having “a half-dozen armed officers rifle through my personal belongings for the three-hour search was traumatizing.” “But when the files were returned to me and I saw all the notes that had been in their possession for a month, it was gut-wrenching,” she said. That her private files were seized, says Mrs. Hudson, is particularly disturbing because of interactions that she and her husband had during the search of their home, as well as months afterwards, with Coast Guard investigator Miguel Bosch. According to his profile on the networking site LinkedIn, Mr. Bosch worked at the Federal Air Marshal Service from April 2001 through November 2007. It was Mr. Bosch, Mrs. Hudson says, who asked her during the Aug. 6 search if she was the same Audrey Hudson who had written the air marshal stories. It was also Mr. Bosch, she says, who phoned Mr. Flanagan a month later to say that documents taken during the search had been cleared. During the call, according Mrs. Hudson, Mr. Bosch said the files had been taken to make sure that they contained only “FOIA-able” information and that he had circulated them to the Transportation Security Administration, which oversees the Federal Air Marshal Service, in order to verify that “it was legitimate” for her to possess such information. “Essentially, the files that included the identities of numerous government whistleblowers were turned over to the same government agency and officials who they were exposing for wrongdoing,” Mrs. Hudson said. Reached on the telephone by a reporter for The Times, Mr. Bosch refused to comment on whether or not journalist-related documents were seized during the search of Mrs. Hudson’s home. “I got to get on the phone with Coast Guard legal before I talk with you,” Mr. Bosch said. “It’s still an open investigation.” Asked specifically whether documents related to Mrs. Hudson’s reporting activities were taken during the search, he responded: “There was a lot of stuff taken.” Legitimate Case? The U.S. Coast Guard maintains that it has done nothing wrong in the case and that the investigation into Mrs. Hudson’s husband is based on legitimate suspicion that he was illegally in possession of firearms. The warrant outlines how Mr. Flanagan was found guilty in 1985 — when he was 25 — of resisting arrest in Prince George’s County, Maryland. The charge of carrying a concealed deadly weapon was dropped, but a year later, the U.S. Marshal Service arrested Mr. Flanagan for possession of a machine gun. The warrant also indicates that Mr. Flanagan was also arrested in 1996 by police in Anne Arundel County, Maryland,for possessing a handgun in his vehicle. The warrant outlines how sometime this year Mr. Flanagan drew the interest of the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives after allegedly attempting to purchase “possible machine gun parts from a Swedish national.” The warrant says the information was handed to the Coast Guard’s investigative service — since Mr. Flanagan worked at the agency — which conducted an interview during which “Flanagan was evasive but stated he did receive a ‘potato gun’ but it was defective and it was thrown away.” The term “potato gun” is “slang used during the illegal importation of silencers,” according to the warrant. Mrs. Hudson says the “potato gun” claim is outrageous. She says that her husband did in fact purchase a “potato launcher” from an online company based in Sweden five years ago as a novelty item, but it was discarded within as few weeks because it did not work. She noted that the law enforcement agents who raided her home did not take a “golf ball launcher” that also belonged to her husband as a novelty item. They did, however, confiscate small arms belonging to Mrs. Hudson that she had legally registered with the Maryland State Police as far back as 2005. The search warrant allowed for the weapons to be confiscated, and Mrs. Hudson says the agents told her that because her husband had pled guilty to a resisting arrest charge nearly 30 years ago, she was not allowed to possess the guns under state law. The guns she owned were for recreational shooting, she says, as well as for security concerns resulting from many of her investigations. “I swear to God, we’re not smuggling machine gun parts from Sweden,” said Mrs. Hudson, adding that the potato launcher in question “didn’t even work.” Mrs. Hudson has been a reporter in Washington, D.C. for nearly 15 years, and covered Homeland Security for the Times after the Sept. 11, 2001, terrorist attacks through December 2009. Her investigations have sparked numerous congressional investigations that led to laws signed by former Presidents George W. Bush and Bill Clinton. She has won numerous journalism awards for her investigations, including the prestigious Sigma Delta Chi bronze medal for public service, the Society of Professional Journalists Dateline Award in Investigative Reporting, and was nominated twice by The Times for the Pulitzer Prize. “Protecting confidential sources is a part of my honor and hits me at my ethical core,” said Mrs. Hudson. “To have someone steal my source information and know it could impact people’s careers, is disgusting, a massive overreach. This kind of conduct is intimidation clearly aimed at silencing a vigorous press.” Read more: http://www.washingtontimes.com/news/2013/oct/25/armed-agents-seize-records-… Follow us: @washtimes on Twitter

1 0

Another Snowden News Story. Another Lesson in Proper Whistleblowing.
by coderman 28 Oct '13

28 Oct '13

[ED.: given some states pursuing severe charges for merely reporting this information, it seems not entirely disingenuous to position ones self in positive light] --- http://ohtarzie.wordpress.com/2013/10/25/another-snowden-news-story-another… """ Among the many things I have grown to detest about the Snowden Leaks spectacle is that for every heavily redacted page that’s been revealed — a meagre ~300 pages in five months according to Cryptome.org — we rubes seem to get at least twenty, sometimes very stern, lessons in proper whistleblowing from the the Leaker, the Leak Keepers, the Leak Keeper inner circle, and soldiers in the sycophant army that doltishly parrot and hype everything these people say. The lesson is as follows: 1. Don’t ever just dump your leaks on the internet. 2. Make sure your leaks are properly vetted and mediated by proper mainstream journalists. This lesson is often, perhaps even usually, stated as, or with, some variation of the following: Don’t be like Chelsea Manning and Wikileaks, that is, indiscriminate, reckless and dangerous to both national security and human life... """

7 6

TS crypto disclosure
by brian carroll 28 Oct '13

28 Oct '13

perusing the NSA Borders of Cryptology diagram¹ from long ago i kept thinking-- something all pervasive in culture is missing here.... and lo and behold i uncover an undocumented secret military program based both in encoded sound and electromagnetic data transmission, and now i feel it is time to blow the whistle in the public interest::: COVERT OPERATIONS - UNDOCUMENTED CRYPTO PROGRAM https://www.dropbox.com/s/glcoyi4m4p5864f/top_secret_program.gif [modified diagram, attached. fair use of copyright] ¹ http://cryptome.org/2013/09/nsa-cryptology-borders.pdf

3 3

[guardian-dev] Perception of cryptography being to complicated to use...
by Kai Krueger 28 Oct '13

28 Oct '13

Hello everyone, you have likely all heard about the scandal regard the NSA listening in on calls of various heads of states, particularly that of the German Chancellor Angela Merkel's phone. What ever your opinion might be regarding the issue of bugging phones of friendly partner nations politician and whether you may consider it as "normal and everyone does it" or "unheard of", there seems to be another dimension to the scandal that I think might be of interest to this list. Although I don't think there are yet enough information publicly available to say what actually happened and what phones exactly were effected, but all indications appear to point to that it wasn't the Chancellors highly secured official government phone, but a private party phone that she uses all the time. Again, I am not aware of details yet of how that phone was secured, but media reports appear to suggest it might have been a standard smartphone using entirely unsecured plain phone lines and text messaging. So despite the German government spending 10s of millions of Euros to develop and purchase highly secure phones, it appears many of the ministers aren't actually using them. Indeed, the German secretary of commerce (Philip Roesler) was supposedly quoted as saying "Everyone knows that we are using our private phones, despite it being illegal" [my own translation from an indirect quote in German]. The media have so far mostly given as explanations for this astounding ignorance towards the risks of data security amongst politicians to be due to the "complicated and tedious procedures" involved in using cryptographically secured communications channels. The media are writing about how terribly complicated and inconvenient using secure phones are and I have read claims that e.g. the security features add latency of up to 1s or more and one has to "learn how to speak correctly to overcome such high latencies". Furthermore, because secure phones are so expensive (several 1000s of Euro's per phone), "no one" has them and because obviously both communications partners need them, secure phones are "close to useless". None of these claims and news articles are likely to help get more people to secure their electronic communication. Unfortunately, I haven't seen the main stream media ever talk about some of the great software out there like that of the guardian project, and that e.g. using CSipSimple or Jitsi via ostel to get an encrypted phone call is actually really pretty simple. Or how TextSecure or ChatSecure allow to use encrypted messaging with very little additional overhead. Do people know if there are efforts underway to try and counter this general impression of "cryptography is too hard and cumbersome to use"? And try and convince the media to report more positively about the available tools to secure ones communication? Are there other ways to influence public opinion that cryptography isn't that difficult to use and it is worthwhile doing? And that thanks to various opensource projects there are various high quality, standards compliant / inter-operable solutions available at no extra cost? Kai _______________________________________________ Guardian-dev mailing list Post: Guardian-dev(a)lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To Unsubscribe Send email to: Guardian-dev-unsubscribe(a)lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/eugen%40leitl.org You are subscribed as: eugen(a)leitl.org

1 0

hide & seek (url)
by brian carroll 28 Oct '13

28 Oct '13

(potentially lots of relevance here to security issues, esp perhaps mimicry, limits or parameters, insecurity via looped evaluation of shared technique...) 1-Trick Chameleon: Predators Learn to See Through Camouflage // via digg http://nautil.us/blog/1_trick-chameleon-predators-learn-to-see-through-camo… "...the researchers found that it took their participants longest to spot the [prey] when they were using disruptive coloration rather than the other strategies, and that was especially true when the pattern was of high contrast. However, as the [preys’] contrast levels increased above the level of the background, they became easier to spot. In the middle was an ideal contrast level."

1 0

[tor-talk] x.509 for hidden services
by Gregory Maxwell 28 Oct '13

28 Oct '13

==Background== (you can skip to the Tor section if you don't care) The Bitcoin universe is in the process of creating a specification for digital invoices called "the bitcoin payment protocol". (More info: https://bitcointalk.org/index.php?topic=300809.msg3225143#msg3225143) The payment protocol allows someone to request someone else pay Bitcoin for specific things, instructing them to pay specific amounts in specific ways, and allows the receiver to provide things like instructions for sending a refund if the transaction is for some reason aborted... all sorts of extra metadata which doesn't belong in the public Bitcoin network for scalability and privacy reasons. One of the things these invoices have is an optional signing mechanism for authentication and non-repudiation. Normally these requests would be sent over an authenticated and encrypted channel which provides confidentiality and authentication, but not non-repudiation. The non-repudiation will provide cryptographic evidence to the participants which can be used to resolve disputes: e.g. "He didn't send me my alpaca socks!" "Thats not the address I told you to pay!" "He told me he'd send my 99 red-balloons, not just one!" "No way, that was the price for 1 red-balloon!" The payment protocol is extensible and may someday commonly support many kinds of signatures, but the initial implementations only support signing with internal x.509 certificates and verifying those certificates with standard CAs. As _horrible_ as this is, it's better than nothing, and the primary users asking for this functionality have SSL websites today. We don't believe that any other PKI mechenism is actually functional enough to be usable (e.g. as evidenced by the fact that downloads of our GPG signatures, is on the order of 1% of the downloads of the Bitcoin software; and probably only a small portion of those users have actually done anything to verify the signing keys) today, so other options haven't been a priority. However, the need to use the known insecure CA infrastructure for this (optional!) feature has seriously spazzed out some people. A lot of this is pure confusion, e.g. people thinking that all payment requests would have to go via the CA (no kidding!), but its surprisingly hard to convince people who are responding emotionally of the subtle tradeoffs involved especially when they have the luxury of saying "it's your problem to go figure out, figure it out and go write a bunch extra of software for me". So having some alternative on day one would be useful in helping the more conspiracy minded understand that this isn't some effort to cram the use of CAs down their throat. ==Where Tor comes in== One of the downsides if using x.509 certs to non-repudiate here is that sites hosted as tor hidden services can't participate. It occurred to me that this could be fixed with very little code: Take the HS pubkey, pack it into a self-signed x.509 cert with the cn=pubkeybase32.onion. And specify that .onion certs have a special hostname validation rule that hashes and encodes the key. Then the whole process would work for .onion, we'd have a non-CA option available and working, etc. I'm aware that HS pubkeys have been used for application level authentication in Tor elsewhere (e.g. I believe torchat does this) so it's not entirely unprecedented. I'm not aware of anyone packing them in x.509 certificates. If anyone has, I'd like to use the same encoding style for greater compatibility. The biggest reason I can see not to do this is that it will not be compatible with future editions of hidden services which aren't based on RSA keys. (e.g. the EC point addition stuff to protect against enumeration attacks wouldn't fit into this model). I don't think this is a serious concern: if HS x.509s do become widely used we could add a new authentication type for the new onion addresses when those are introduced. Does anyone else see any other reasons not to do this? Are there other applications which would benefit from having x.509 certs for onion names? -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

3 3

[liberationtech] A Public Statement Regarding Ubiquitous Encryption on the XMPP Network
by Moritz Bartl 28 Oct '13

28 Oct '13

-------- Original Message -------- Subject: [jdev] TLS Everywhere Date: Sun, 27 Oct 2013 21:23:08 -0600 From: Peter Saint-Andre <stpeter(a)stpeter.im> Reply-To: Jabber/XMPP software development list <jdev(a)jabber.org> To: jdev(a)jabber.org Almost 15 years have passed since my friend Jeremie Miller released the initial version of the jabberd IM server, launching the Jabber open-source community and the technology we know today as XMPP. Yet, all that time, hop-by-hop encryption using SSL/TLS has been optional on the XMPP network. A number of server operators and software developers in the XMPP community have decided that needs to change for the better. Based on discussions at the XMPP Summit last week in Portland, Oregon, I have drafted a plan for upgrading the XMPP network to always-on, mandatory, ubiquitous encryption. You can find it here: https://github.com/stpeter/manifesto In short: we owe it to those who use XMPP technologies to improve the security of the network (and thanks to Thijs Alkemade, we now have better ways to test such security, using the newly-launched "IM Observatory" at xmpp.net) Although we know that channel encryption is not the complete answer, it's the right thing to do because it will help to protect people's communications from prying eyes. If you or your organization develop XMPP-compatible software or run a service that's connected to the XMPP network, I encourage you to sign the statement by following the instructions in the README at the URL shown above. Thanks! Peter _______________________________________________ JDev mailing list Info: http://mail.jabber.org/mailman/listinfo/jdev Unsubscribe: JDev-unsubscribe(a)jabber.org _______________________________________________ -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

1 0