- cypherpunks - lists.cpunks.org

Moscow Metro says new tracking system is to find stolen phones; no one believes them
by Eugen Leitl 30 Jul '13

30 Jul '13

http://arstechnica.com/tech-policy/2013/07/moscow-metro-says-new-tracking-s… Moscow Metro says new tracking system is to find stolen phones; no one believes them Experts: Russians are probably using fake cell tower devices for surveillance. by Cyrus Farivar - July 29 2013, 11:10pm +0200 On Monday, a major Russian newspaper reported that Moscow’s metro system is planning what appears to be a mobile phone tracking device in its metro stations—ostensibly to search for stolen phones. According to Izvestia (Google Translate), Andrey Mokhov, the operations chief of the Moscow Metro system’s police department, said that the system will have a range of five meters (16 feet). “If the [SIM] card is wanted, the system automatically creates a route of its movement and passes that information to the station attendant,” Mokhov said. Many outside experts, both in and outside Russia, though, believe that what local authorities are actually deploying is a “stingray,” or “IMSI catcher”—a device that can fool a phone and SIM into reading from a fake mobile phone tower. (IMSI, or an International Mobile Subscriber Identity number, is a 15-digit unique number that sits on every SIM card.) Such devices can be used as a simple way to see what phone numbers are being used in a given area or even to intercept the audio of voice calls. The Moscow Metro did not immediately respond to our request for comment. “Many surveillance technologies are created and deployed with legitimate aims in mind, however the deploying of IMSI catchers sniffing mobile phones en masse is neither proportionate nor necessary for the stated aims of identifying stolen phones,” Eric King of Privacy International told Ars. “Likewise the legal loophole they claim to be using to legitimize the practice—distinguishing between tracking a person from a SIM card—is nonsensical and unjustifiable. It's surprising it's being discussed so openly, given in many countries like the United Kingdom, they refuse to even acknowledge the existence of IMSI catchers, and any government use of the technology is strictly national security exempted.” These devices are in use, typically by law enforcement agencies worldwide, including some in the United States. Portable, commercial IMSI catchers are made by Swiss and British companies, among others, but in 2010, security researcher Chris Paget announced that he built his own IMSI catcher for only $1,500. Still, mobile security remains spy-versus-spy to some degree, each measure matched by a countermeasure. In December 2011, Karsten Nohl, another noted mobile security researcher, released "Catcher Catcher"—a piece of software that monitors network traffic and looks at the likelihood an IMSI catcher is in use. Keir Giles, of the Conflict Studies Research Centre, an Oxford-based Russian think tank, told Ars that Russian authorities are claiming a legal technicality. "They are claiming that although they are legally prohibited from indiscriminate surveillance of people, the fact that they are following SIM cards which are the property of the mobile phone operators rather than the individuals carrying those SIM cards makes the tracking plans perfectly legal," he said, adding that this reasoning is "weaselly and ridiculous." The Russian newspaper also quoted Alexander Ivanchenko, executive director of the Russian Security Industry Association, who pointed out that even to be effective, such a system would need these devices every 10 meters (32 feet). “It is obvious that the cost of the system is not commensurate with the value of all the stolen phones,” he said. “Also, effective anti-theft technology is already known: in the US, for example, the owner of the stolen phone knows enough to call the operator—and the stolen device stops working, even if another SIM-card is inserted.” Two major Russian mobile providers, Beeline and Megafon, have told Russian media (Google Translate) that they are unaware of this supposed anti-theft measure. On the other hand, BBC Russian reports (Google Translate) that the system is due to come online in late 2013 or early 2014.

1 0

[Cryonet_AP] Lawyers in Thailand ban Bitcoin
by Eugen Leitl 30 Jul '13

30 Jul '13

----- Forwarded message from John de Rivaz <John(a)deRivaz.com> ----- Date: Tue, 30 Jul 2013 09:07:32 +0100 From: John de Rivaz <John(a)deRivaz.com> To: Cryonet_AP(a)yahoogroups.com Subject: [Cryonet_AP] Lawyers in Thailand ban Bitcoin X-Mailer: Microsoft Windows Live Mail 16.4.3505.912 Reply-To: Cryonet_AP(a)yahoogroups.com Thailand has become the first country to ban bitcoins after the central bank ruled it is not a currency. In a statement on its website , Bitcoin said it had given a presentation to the Bank of Thailand about how the currency works in a bid to operate in the country. However, at the end of the meeting, "senior members of the Foreign Exchange Administration and Policy Department advised that due to lack of existing applicable laws, capital controls and the fact that Bitcoin straddles multiple financial facets... Bitcoin activities are illegal in Thailand". more on http://uk.finance.yahoo.com/news/bitcoins-banned-thailand-203840004.html -- Sincerely, John de Rivaz: http://John.deRivaz.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

NSA Utah Data Center Cabling, Emanations and Bizarre Planning
by John Young 29 Jul '13

29 Jul '13

Not much publicly available on the cabling and emanations protection of the NSA Utah Data Center. Surely highly advanced measures are being applied. Google Earth shows a couple of stages of construction, Bing Maps a couple more. AP has published a dozen or so hi-rez photos of construction. A lot of earthwork was done to create a flat site on a mountain side (preceded by a small air field). No indication of underground construction except pits and trenches under the buildngs. With none on the surface there must be trenches for power and signal cable. No antenna have appeared on the site for transceiving data like those of other of its data centers, so presumably it is done by UG fiber optic (or antenna are hidden or remote). Photos of construction progress of the two data buildings show windowless envelopes made of panels and flat roofs without various rooftop ductwork, grilles, piping and the like which appear on roofs of other NSA and TLA facilities which might emanate signal although not likely. (Some are littered with the stuff which might be decoy.) Steel structural framing is shown at Utah despite its known transmittal of inadvertent signal, compared to say, reinforced concrete, metalized fabric or synthetics. although are ample countermeasures available. The pairing of structures at Utah, two of each type, data center, generator, AC, fuel tanks, etc., show redundancy also not seen elsewhere. Not much to see of protection against missiles and aerial attack but that is the same at other NSA facilities. Wonder what supports that confidence. The odd bent shape of the site plan, with buildings not parallel to one another is intriguing. Could be aesthetic but may have another role, say to disperse richochet of inadvertent emanations. Quite a few recent government buildings avoid the traditional rectilinear site planning of buildings long considered to be most cost effective and authoritarian. Some like NGA HQ, NSA Utah and several at Ft. Meade look almost byzantine in layout, if not a shrewd design to limit echo, amplification, richochet, or best, to befuddle satellite peepers.

3 2

Re: [p2p-hackers] Dealing with malicious nodes in decentralized p2p network
by Eugen Leitl 29 Jul '13

29 Jul '13

----- Forwarded message from Michael Rogers <michael(a)briarproject.org> ----- Date: Mon, 29 Jul 2013 16:46:35 +0100 From: Michael Rogers <michael(a)briarproject.org> To: theory and practice of decentralized computer networks <p2p-hackers(a)lists.zooko.com> Subject: Re: [p2p-hackers] Dealing with malicious nodes in decentralized p2p network User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 Reply-To: theory and practice of decentralized computer networks <p2p-hackers(a)lists.zooko.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm not sure whether your message just came through to the list or whether I just noticed it. Either way, I hope it's not too late to reply. The following papers describe attacks that can be carried out by malicious nodes in structured P2P networks: E. Sit and R. Morris. Security considerations for peer-to-peer distributed hash tables. 1st International Workshop on Peer-to-Peer Systems (IPTPS ?02), Cambridge, MA, USA, March 2002. http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.11.7175 M. Castro, P. Druschel, A. Ganesh, A. Rowstron, and D.S. Wallach. Secure routing for structured peer-to-peer overlay networks. 5th Symposium on Operating Systems Design and Implementation, Boston, MA, USA, December 2002. http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.118.1870 I'd recommend checking out the papers that cite those papers, some of which propose solutions to some of the attacks. Cheers, Michael On 13/03/13 05:44, offbynull wrote: > Hi, > > Does anyone know of any strategies to prevent, identify, or > work-around malicious nodes in a structured overlay? I'm > specifically interested in Chord's ring overlay. It seems like > there are a lot of things a malicious node could to to interfere > with normal operations (e.g. routing / lookup / etc..), or to > bypass certain regions of the ring. > > Examples of things that a malicious node could do ... > > 1. Imagine someone wanted to prevent others from accessing a > key-value pair. That person would create a malicious node with an > id of hash(key), ensuring that queries for that key would end up at > the malicious node. When the malicious node receives queries for > that key, it simply ignores them or responds that the key was never > set. > > 2. This is similar to the one above. Imagine someone wanted to > prevent others from accessing a key-value pair, but a legitimate > node already existed with an id of hash(key). That person would > create a malicious node with an id of hash(key) - 1. When other > nodes ask the malicious node to be routed to that key, the > malicious node would respond with a node other than it's successor, > ensuring that the request never gets routed to its true > destination. > > 3. Imagine someone wanted to cut out a portion of the nodes in the > overlay. That person would create a malicious node that has its > finger table set to skip over a bunch of existing nodes in front of > it. > > > Are there strategies to deal with this, or is this just something > that's expected with Chord's design (as in peers can't be untrusted > nodes)? > > _______________________________________________ p2p-hackers mailing > list p2p-hackers(a)lists.zooko.com > http://lists.zooko.com/mailman/listinfo/p2p-hackers > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJR9o5bAAoJEBEET9GfxSfMj0AIALZ+lSnA7GDh+Y3iifdVotwK YXdjGjv+qJcvOIO/rHtTEyPMzp7yqz0X0VxeiC8XIjXP6rwvFGOXuClqd0NAjFW9 lHYtO9tHBkCV/LOU5hHrD3510Ry6gYkuDnyDeWBlwQ2i/zUU160PqGr+Esd1IpNP zu5JKSHHq61wr5GisXOB+pWOxrKEEKtQAtv3ibFNBDXhGyJwg+U/LCe9Q14V9Q4t BiOKgce8xHhbytY8B/5t3HW6cCavQAq/TR0CfjpWRtz823hs0lTdepJJXPnKVYIo HD0u+cwnCGr7LNF5szMvkvdEkyXsbXGLYX+2cK7aHBPO4kGoXw5DrNAhS2Gkh+g= =xMmD -----END PGP SIGNATURE----- _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

how much havoc can a compromised baseband do to a Guardian ROM device?
by Eugen Leitl 29 Jul '13

29 Jul '13

Anyone knows whether a Nexus 4 baseband processor has r/w access to system memory? The firmware doesn't seem to be loaded at boot, so I presume it's entirely out of reach/ reversing?

2 1

Stronghold, revisited
by tz 29 Jul '13

29 Jul '13

Way back when I was writing SSLeay encrypting proxies so Lynx could use them, there was a commercial product called StrongHold. I apologize for my insufficient memory. However much of the problem with forcing browsers to update might be solved with an encryption proxy (on a raspi if needed). For those who are too young to remember, during the "crypto is munitions" period where the source to strong crypto needed to be sent via FAX, Stronghold was a proxy that would take ordinary sessions (or I assume 40 bit - yes, 40 bit, that was "export" strength) crypto on the browser end and transform it to the maximum strength on the remote end. IE apparently has some problems with PFS. One way to maybe fix this is to create an encrypting proxy that would do full strength, PFS encryption and remove the other weaknesses, and run on the local machine or LAN (if that isn't secure there are bigger problems). And it would refuse or at least complain if the strength wasn't up to snuff, and could itself add things like cert/CA validation management - trust on first time and the rest as options. If I had a box (DD-WRT?) that would warn me if something was amiss, I would be in a better position.

2 1

Redecentralize podcast on the Cryptosphere
by Tony Arcieri 28 Jul '13

28 Jul '13

Ohai various lists. Here's what I've been working on. Hope you like it. If you want to chat and you happen to be coming to DEFCON, hit me up. https://www.youtube.com/watch?v=NjOqYZzWqI0 Links: - Cryptosphere: http://cryptosphere.org - Celluloid: http://celluloid.io/ - Oasis.js: http://oasisjs.com/ - Conductor.js: https://github.com/tildeio/conductor.js - Xanadu: https://en.wikipedia.org/wiki/Project_Xanadu - Tahoe-LAFS: https://tahoe-lafs.org/trac/tahoe-lafs -- Tony Arcieri

1 0

<nettime> John Naughton: Edward Snowden's not the story. The fate of the
by Eugen Leitl 28 Jul '13

28 Jul '13

----- Forwarded message from Patrice Riemens <patrice(a)xs4all.nl> ----- Date: Sun, 28 Jul 2013 09:47:11 +0200 From: Patrice Riemens <patrice(a)xs4all.nl> To: nettime-l(a)kein.org Subject: <nettime> John Naughton: Edward Snowden's not the story. The fate of the Reply-To: a moderated mailing list for net criticism <nettime-l(a)mail.kein.org> original to: http://www.guardian.co.uk/technology/2013/jul/28/edward-snowden-death-of-in… Edward Snowden's not the story. The fate of the internet is John Naughton The Observer, Sunday 28 July 2013 The press has lost the plot over the Snowden revelations. The fact is that the net is finished as a global network and that US firms' cloud services cannot be trusted Repeat after me: Edward Snowden is not the story. The story is what he has revealed about the hidden wiring of our networked world. This insight seems to have escaped most of the world's mainstream media, for reasons that escape me but would not have surprised Evelyn Waugh, whose contempt for journalists was one of his few endearing characteristics. The obvious explanations are: incorrigible ignorance; the imperative to personalise stories; or gullibility in swallowing US government spin, which brands Snowden as a spy rather than a whistleblower. In a way, it doesn't matter why the media lost the scent. What matters is that they did. So as a public service, let us summarise what Snowden has achieved thus far. Without him, we would not know how the National Security Agency (NSA) had been able to access the emails, Facebook accounts and videos of citizens across the world; or how it had secretly acquired the phone records of millions of Americans; or how, through a secret court, it has been able to bend nine US internet companies to its demands for access to their users' data. Similarly, without Snowden, we would not be debating whether the US government should have turned surveillance into a huge, privatised business, offering data-mining contracts to private contractors such as Booz Allen Hamilton and, in the process, high-level security clearance to thousands of people who shouldn't have it. Nor would there be -- finally -- a serious debate between Europe (excluding the UK, which in these matters is just an overseas franchise of the US) and the United States about where the proper balance between freedom and security lies. These are pretty significant outcomes and they're just the first-order consequences of Snowden's activities. As far as most of our mass media are concerned, though, they have gone largely unremarked. Instead, we have been fed a constant stream of journalistic pap -- speculation about Snowden's travel plans, asylum requests, state of mind, physical appearance, etc. The "human interest" angle has trumped the real story, which is what the NSA revelations tell us about how our networked world actually works and the direction in which it is heading. As an antidote, here are some of the things we should be thinking about as a result of what we have learned so far. The first is that the days of the internet as a truly global network are numbered. It was always a possibility that the system would eventually be Balkanised, ie divided into a number of geographical or jurisdiction-determined subnets as societies such as China, Russia, Iran and other Islamic states decided that they needed to control how their citizens communicated. Now, Balkanisation is a certainty. Second, the issue of internet governance is about to become _very_ contentious. Given what we now know about how the US and its satraps have been abusing their privileged position in the global infrastructure, the idea that the western powers can be allowed to continue to control it has become untenable. Third, as Evgeny Morozov has pointed out, the Obama administration's "internet freedom agenda" has been exposed as patronising cant. "Today," he writes, "the rhetoric of the 'internet freedom agenda' looks as trustworthy as George Bush's 'freedom agenda' after Abu Ghraib." That's all at nation-state level. But the Snowden revelations also have implications for you and me. They tell us, for example, that no US-based internet company can be trusted to protect our privacy or data. The fact is that Google, Facebook, Yahoo, Amazon, Apple and Microsoft are all integral components of the US cyber-surveillance system. Nothing, but nothing, that is stored in their "cloud" services can be guaranteed to be safe from surveillance or from illicit downloading by employees of the consultancies employed by the NSA. That means that if you're thinking of outsourcing your troublesome IT operations to, say, Google or Microsoft, then think again. And if you think that that sounds like the paranoid fantasising of a newspaper columnist, then consider what Neelie Kroes, vice-president of the European Commission, had to say on the matter recently. "If businesses or governments think they might be spied on," she said, "they will have less reason to trust the cloud, and it will be cloud providers who ultimately miss out. Why would you pay someone else to hold your commercial or other secrets, if you suspect or know they are being shared against your wishes? Front or back door -- it doesn't matter -- any smart person doesn't want the information shared at all. Customers will act rationally and providers will miss out on a great opportunity." Spot on. So when your chief information officer proposes to use the Amazon or Google cloud as a data-store for your company's confidential documents, tell him where to file the proposal. In the shredder. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

SSLegance
by tz 27 Jul '13

27 Jul '13

For the interim, the solution might be to have an extension that besides pushing PFS (and alerting when it doesn't work) would cache the Cert hashes or more and allow a browser (e.g. firefox) to run with all CAs as untrusted, but then do a verification on a per-site basis. The big hole in web page security is that there is the web page, then there is the extra info like javascript and css. So, for example, https://amazon.com might be accepted, but https://images-na.cdn.azws.com is in the background ready to rewrite the entire page. And the page will be broken until you manually "view source" and open a link and allow the cert/CA/page for the javascript/css/images/metadata.

5 7

EFF presentation at SIGINT
by Gregory Foster 27 Jul '13

27 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 EFF (Jul 5) - "The Politics of Surveillance: Understanding the National Security Agency" by @RaineyReitman: http://www.youtube.com/watch?v=OESf9y-638k Kudos to EFF for fighting the good fight, and kudos to Rainey for synthesizing and presenting a lot of useful information. Mentioned in the talk, Freedom of the Press Foundation (Jul 2) - "Encryption Works: How to Protect Your Privacy in the Age of NSA Surveillance" by @micahflee: https://pressfreedomfoundation.org/encryption-works gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJR80dJAAoJEMaAACmjGtgj9PwP/2O6erOD9Zciwh1wEWe/RpAm av4b9ZDQhcIwkMbCBKL7ptlKYe5lHIlTXqsrfdOJFRCekJYBoenKbyex2qHGi/S+ 1w0C3Qc2CNtjsIOmynDGS2dNa6YeuaRvZkQZ/BkxG5VTV703+JafaCmS2+bGL3uD oWdlbEgLIn/pGM8Hc0Epa7hsrkKt8CuQWSmqu74uuOtzUfCBYQ77/ojDlcOD/CG4 FQVNyB/PyrXXJKg/gPbhRxoWyEQ3DtfFE5/NwVKnpxCJmYeFQy3XV2ZRvGg63xat m4e49c5irQy4MOsJ6eXCvCy+uWIp7/+ce1BFHVS2SxsdAjpsyT2ZnSi9XwGJ0nGd mp9It1cbZ44N+NbrBOOC6nN3tzdFS/jbnaq2GKjnssRAamEdNG/2cYQUtK8EGtMd nWy6rKuJwNxrk8IIqJFNaACPxyeEkhckkajKoUUJRqGOth7LDv0zZI8Y0mEU07OW cZIIBr5KOn1PhPGbqNbPMJjba3cdBVAOauHmlFlWB/0vqv0x3fv8tUhji5hoZOgC Vb2YyfcdkKcvu4m7iKkLOXtLdbwITmzC8iavYFcrurUh3jdvDNcr4aw2+gJFeFBR p/+yMSfb29hW2/5G3QZUNK24+eFAsiGaUG7XFgS480PvTJV0fFxFDzkW0KTFx9qF vbug+icoNC2cBwG1Ju3o =gnIq -----END PGP SIGNATURE-----

2 1