- cypherpunks - lists.cpunks.org

Re: WaPo releases details on US offensive cyber-ops
by John Young 03 Sep '13

03 Sep '13

Bart, An et al asks: How cyber ops physically take place, the architecture and engineering of the cyber architecture Snowden alludes to. Computers and networks are small pieces compared to where they housed, bunkered, trenched, drowned, aired, emitted, lofted, arrayed, hidden. Those structures of the infrastructure are as costly as the human power and much greater in scope and necessity -- and immensely targetable thanks to ostentatious appurtenances of antennas, fences, barriers, sensors, stand-offs, chopper pads, cafes, health and environmental inspections, power lines and sub-stations, and not least loose lips of contractors and disaffected employees. We know the location of some of the principal offices and HQs, but those are misleading icons, as much ruses as as leaked budget tables, congrats for those teasing leads BTW. Specifics may be withheld to "protect operations and lives" but that also leaves out how these systems function beyond stupidly idiotic slides and dissimulative photoshops, which may thrill and placate with top classification markings governmental overseers reading public but are ridiculously simple-minded to techies who are obliged to seance dot connections of mouse to LAN to WAN to Internet to hubs to hotels to White House to SE-WE-ME. Care to share those kind docs we architects can de-blueprint for you? At 08:23 PM 9/2/2013, you wrote: >Greg, et al -- I'm going to keep digging on US cyber operations, and >particularly on "computer network exploitation" and "computer >network attack." I'd be interested in theories, questions or >suggestions from the smart folks here as I think about my reporting >strategy. --Bart > >----------------- >Date: Mon, 02 Sep 2013 12:44:04 -0500 >From: Gregory Foster <gfoster(a)entersection.org> >Subject: WaPo releases details on US offensive cyber-ops > >Washington Post (Aug 30) - "U.S. spy agencies mounted 231 offensive >cyber-operations in 2011, documents show" by @BartonGellman & @nakashimae: >http://www.washingtonpost.com/world/national-security/us-spy-agencies-mount… > > > under an extensive effort code-named GENIE, U.S. computer > > specialists break into foreign networks so that they can be put > > under surreptitious U.S. control. Budget documents say the $652 > > million project has placed ?covert implants,? sophisticated > > malware transmitted from far away, in computers, routers and > > firewalls on tens of thousands of machines every year, with plans > > to expand those numbers into the millions.

1 0

building a community on RetroShare
by Eugen Leitl 03 Sep '13

03 Sep '13

One of my RS identities is -----BEGIN PGP PUBLIC KEY BLOCK----- Version: OpenPGP:SDK v0.9 xsBNBFG68IABCADXB1o49wDjL8ZF91kivo4pSMdq0xfzKMXi6ZyNt/oxhlNCBK6o PaVpo6GNu7E2Gdvh5ZQn+p6NQYE4y+2riQIsStO/ikmKaIfZ43wOOFdy52R71HHF nb3JzvS7pBhskpaBmyYiAoe9lHaOMPzpizJzbG26yFY+jizm1IcCa/vggzTSpzFc 5AfQBNwL+TXovaUi4FU4FLYlD0jikwQAVony4l3SB4cTjULVBxJyJATGwnTayAUn LQQIzdEYOIhNSVO4JEa8lmWhnWZHNUV9FwG48TiTkyMhZsS4urrwqd7KaX3T5ihC hksJPCFgFUtaIZBzQOpw2kNTYtMrEhTRRA0rABEBAAHNN0V1Z2VuIExlaXRsIChH ZW5lcmF0ZWQgYnkgUmV0cm9TaGFyZSkgPGV1Z2VuQGxlaXRsLm9yZz7CwF8EEwEC ABMFAlG68IAJEBwZ2iRKZrKNAhkBAAD9Wgf8CzCNaUoRqPqrbv5peqzrsl4Jv/wT 0dp9tvrJm7ooV5iAX81NRdwXOQ098iLoRKPaSHIcQz949nV93mUn70/7dexvrFYn P1Ugnp08f1WSH0wtwjB1C6NeN6h+RTwFtgy/92oJpbHumN+eEeFjMCLLxrJUIWFK 0np0oE7+Y1izFfuMWsfh7HzhO4E9eTMzzHHAgsDC2zI5An5W1yJ1HGmudB/EfFP3 fur+s711VE3jlfvzfx1fB7Hve8+0lWQAvwAnaJNANorZFnsieQkClmqpp4jLqAQU Ss9BlEu2REP7LZ2aWyDBqmGV1370pHNm37dfjMiEDsCsmyE146rHpH984w== =38D/ -----END PGP PUBLIC KEY BLOCK----- see you there.

3 2

what to install on a secure communication device
by Eugen Leitl 03 Sep '13

03 Sep '13

I'm looking to build a list for reasonably secure (no snake oil) ways to communicate (search, store, etc.). My ad hoc list so far is: Pidgin/OTR cables Jitsi Tor YaCy RetroShare TorChat Tahoe LAFS GnuNet No doubt I'm missing a lot. Any further suggestions?

7 7

Stego, ease of use and maximal availability
by Romana Machado 03 Sep '13

03 Sep '13

Mo, I wish your student great success. I will definitely take a look! I expect the UI for a plugin to be quite different to that of a web app. I've chosen not to build a plugin or a single platform app for obvious reasons, though it is nice to know that there are efforts in these directions that may assist my own in part. Here's the plan to create ease of use: taking note of the UIs of existing tools, collaborating with experienced UI designers, and making use of an extensive background and contacts in UI test. Romana Machado

1 0

Help with JPEG Stego app?
by Romana Machado 03 Sep '13

03 Sep '13

I've decided to upgrade my project, Stego, conceived as an easy-to-use, near-universally available, maximally browser compliant, message PGP encrypted, steganography web app, to encode JPEGs, the most universal image format today (in cell phone cameras, and all over the web). Which means I have to decipher information-dense papers, pick a suitable algorithm, and code it up in client-side Javascript. Which greatly increases the workload, but I expect I'll be a better engineer for it. It also means that I'll be reusing none of the original code. Fortunately there are a few open source Javascript JPEG libraries. I'm writing to ask for help with picking the stego algorithm, hoping that someone here has a knowledgable opinion. Romana Machado 310-940-7888

4 5

Re: WaPo releases details on US offensive cyber-ops
by otr＠riseup.net 03 Sep '13

03 Sep '13

Greg, et al -- I'm going to keep digging on US cyber operations, and particularly on "computer network exploitation" and "computer network attack." I'd be interested in theories, questions or suggestions from the smart folks here as I think about my reporting strategy. --Bart ----------------- Date: Mon, 02 Sep 2013 12:44:04 -0500 From: Gregory Foster <gfoster(a)entersection.org> Subject: WaPo releases details on US offensive cyber-ops Washington Post (Aug 30) - "U.S. spy agencies mounted 231 offensive cyber-operations in 2011, documents show" by @BartonGellman & @nakashimae: http://www.washingtonpost.com/world/national-security/us-spy-agencies-mount… > under an extensive effort code-named GENIE, U.S. computer > specialists break into foreign networks so that they can be put > under surreptitious U.S. control. Budget documents say the $652 > million project has placed ?covert implants,? sophisticated > malware transmitted from far away, in computers, routers and > firewalls on tens of thousands of machines every year, with plans > to expand those numbers into the millions.

1 0

Eccentricity: How Hard to Crack a Cryptosystem
by John Young 02 Sep '13

02 Sep '13

One of the many eccentricities of crypto is speculating on how long and how much computing power would be needed to crack a particular cryptosystem, its algorithm or "implementation." A favorite of popular writing on the topic, it is likely these claims are pure fiction fabricated to satisfy headlines and deadlines -- and, as always, to market or rididule a competitor's piece of shit. No Wikipedia entry on the phrase "crypto implementation," the all-time favorite excuse for the shit's absolute certain failure. Some examples among hundreds: No. 1 http://www.digicert.com/TimeTravel/math.htm [No date] DigiCert's base standard is to use 2048-bit keys in secure SSL certificates - that is enormously stronger than anything Lenstra et al attempted, in fact, it would require factoring a 617-digit number. RSA Labs claim (see: http://www.rsa.com/rsalabs/node.asp?id=2004) that 2048-bit keys are 2^32 (2 to the power of 32) times harder to break using NFS, than 1024-bit keys. 2^32 = 4,294,967,296 or almost 4.3 billion, therefore breaking a DigiCert 2048-bit SSL certificate would take about 4.3 billion times longer (using the same standard desktop processing) than doing it for a 1024-bit key. It is therefore estimated, that standard desktop computing power would take 4,294,967,296 x 1.5 million years to break a DigiCert 2048-bit SSL certificate. Or, in other words, a little over 6.4 quadrillion years. In putting together our video, we estimated the age of the Universe to be 13,751,783,021 years or a little over 13.75 billion years, therefore if you tried to break a DigiCert 2048-bit SSL certificate using a standard modern desktop computer, and you started at the beginning of time, you would have expended 13 billion years of processing by the time you got back to today, and you would still have to repeat that entire process 468,481 times one after the other into our far far distant future before there was a good probability of breaking the certificate. In fact the Universe itself would grow dark before you even got close. ----- No. 2 http://www.eetimes.com/document.asp?doc_id=1279619 How secure is AES against brute force attacks? Mohit Arora, Sr. Systems Engineer & Security Architect, Freescale Semiconductor 5/7/2012 05:29 PM EDT Even with a supercomputer, it would take 1 billion billion years to crack the 128-bit AES key using brute force attack. This is more than the age of the universe (13.75 billion years). If one were to assume that a computing system existed that could recover a DES key in a second, it would still take that same machine approximately 149 trillion years to crack a 128-bit AES key. ----- No. 3 http://www.computerworld.com/s/article/354997/The_Clock_Is_Ticking_for_Encr… The clock is ticking for encryption The tidy world of cryptography may be upended by the arrival of quantum computers. By Lamont Wood March 21, 2011 06:00 AM ET Today's encryption algorithms can be broken. Their security derives from the wildly impractical lengths of time it can take to do so. Let's say you're using a 128-bit AES cipher. The number of possible keys with 128 bits is 2 raised to the power of 128, or 3.4x1038, or 340 undecillion. Assuming no information on the nature of the key is available (such as the fact that the owner likes to use his or her children's birthdays), a code-breaking attempt would require testing each possible key until one was found that worked. Assuming that enough computing power was amassed to test 1 trillion keys per second, testing all possible keys would take 10.79 quintillion years. This is about 785 million times the age of the visible universe (13.75 billion years). On the other hand, you might get lucky in the first 10 minutes. But using quantum technology with the same throughput, exhausting the possibilities of a 128-bit AES key would take about six months. If a quantum system had to crack a 256-bit key, it would take about as much time as a conventional computer needs to crack a 128-bit key. A quantum computer could crack a cipher that uses the RSA or EC algorithms almost immediately. ----- No. 4 https://xkcd.com/538/ Thanks, XKCD

1 0

Lavabit and End-point Security
by Sean Alexandre 02 Sep '13

02 Sep '13

I find some comfort in the fact that they had to serve papers to Lavabit to get the information they wanted. To me this says Lavabit's security was so good they couldn't back door his machines. Or, maybe it was cover-up, to get the information "legally." But I'm guessing they really couldn't get what they wanted. I'd love to see some kind of write-up by Ladar about how he did this...maybe even a book. I expect he was just doing all the standard things any sys-admin should be doing. It would be great to see it all written down in one place, though, as a case study with details. Even better: Edward Swowden as a co-author.

12 23

WaPo releases details on US offensive cyber-ops
by Gregory Foster 02 Sep '13

02 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Washington Post (Aug 30) - "U.S. spy agencies mounted 231 offensive cyber-operations in 2011, documents show" by @BartonGellman & @nakashimae: http://www.washingtonpost.com/world/national-security/us-spy-agencies-mount… > under an extensive effort code-named GENIE, U.S. computer > specialists break into foreign networks so that they can be put > under surreptitious U.S. control. Budget documents say the $652 > million project has placed “covert implants,” sophisticated > malware transmitted from far away, in computers, routers and > firewalls on tens of thousands of machines every year, with plans > to expand those numbers into the millions. ... > The NSA designs most of its own implants, but it devoted $25.1 > million this year to “additional covert purchases of software > vulnerabilities” from private malware vendors, a growing > gray-market industry based largely in Europe. gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJSJM5iAAoJEMaAACmjGtgjdbIP/12OFrDd3Hjp8vnmT8gj39Ke BuNqryCsN1yrJtDmDfUjjXoQ5L/Hkd5wxavmEOLd+ujJHle3hYhzaOcbYhCJxXmO Yh/8T1VRxjthxCloZhF4o+y3cd9/Hroq98wN+i6lNQMSfWgJcOnOmTxukkjE+W5+ dz/BuFuwyKH+A7nCdFLyvsBThq9vciIstEAY4aBgFODD7is373qWaJ/rbCTg4Q0R ySkaW1jSiyds8fbro4y8MLJDktRuDoG6Y8iimwiiab0nBl/2Emhrjl59Bgr1kZEw C6zn1yD8ZCdR4asAGyObLOByu2wcSycTAeVRwVMI0Jd9jAE3jh2XZpk7KJ8hV3+7 iNblmunYi3JbmYqzuByRqGNEr/Dr1lNqKJYEPh1wk7xtb5Tidta+m4yfc2zToHX6 evlHkhxDNuDzS9SulZ0/a7X7cFFDhnsg649H1HLCzSq85SvwsRDs50OFD4IO8sw3 UaIz4Mxa+HHBuTaOUtYgPl8OEtB+TiVRgsSWvp5H0IOAFS3hfWF8Qa+fim3X0aXu Iboh8NxX0tbx95mvVo98IZfor++cXY3PvIDRZFHHvFphoYWjp7o2LZTEWzb+zVub 6Ph4iSZ3xQCqxDsKCxU51DwQZXf5UpCGGq3BbmmSCj3XSAP0KPLmrs/qrt/3W9qe C7PeIi/toTCeJPMRdCN0 =ihTp -----END PGP SIGNATURE-----

2 1

Wikileaked Stratfor admin talks crypto. Nonsense?
by Sylvia Ganush 02 Sep '13

02 Sep '13

'Any encryption based on an algorithm can be decrypted with the resources available to a government.' These are words of Michael Mooney, the hapless system administrator of Stratfor, a private intelligence agency that got hacked, doxed, and wikileaked in 2011-2012: http://search.wikileaks.org/gifiles/?viewemailid=3424010 Is Mr Mooney correct? On the one hand he's proven his incompetence by storing clients' credit card numbers in the clear. On the other hand, Stratfor sell themselves as spooks well-versed in security questions and hence could know better. What do cypherpunks think of Mr Mooney's statement? Does it really take a government only one month to crack a 2048-bit key? Sylvia

2 2