May 2022 - cypherpunks@lists.ogf.org

Mong was one of the very few cypherpunks to ever worry the USG
by professor rat 06 May '22

06 May '22

So what if he was a fascist? Nobody's perfect. http://classic.austlii.edu.au/au/journals/PrivLawPRpr/1996/26.html

1 0

Tim and Rat
by zeynepaydogan 06 May '22

06 May '22

He's been sharing Tim may's quote for years: TIM " I guess now that the Pentagon is setting up a murder pool it can't be illegal for us to do it " MAY. 2003 He probably wants to encourage the people here.He's clearly making goverment propaganda, just like Tim.Soon,He'll say “ I'm an anarchist”

1 0

Dawn of the dead
by professor rat 06 May '22

06 May '22

Deadpool Creator Rob Liefeld on His Controversial Career in Comics https://decrypt.co/99578/deadpool-creator-rob-liefeld-walking-nft TIMOTHY " An anonymous computerized market will even make possible abhorrent markets for assassinations and extortion " C. MAY 1992 TIM " I guess now that the Pentagon is setting up a murder pool it can't be illegal for us to do it " MAY. 2003

1 0

Cryptocurrency: Litecoin-LTC Gets A Privacy Mode, Privacy Rising
by grarpamp 06 May '22

06 May '22

https://twitter.com/SatoshiLite/status/1521370708105859073 https://twitter.com/LTCFoundation/status/1521366615715049472 https://github.com/litecoin-project https://www.coinbureau.com/education/what-is-mimblewimble/ https://github.com/ltc-mweb https://medium.com/beam-mw/how-mimblewimble-works-18ea3980cffe There are more privacy-enabled projects every day... Monero, Zcash, Bitcoin Cash Fusion, Litecoin, Zcoin, Pirate Coin, Deep Onion, Dero, etc ... Some others may even be importing the Bitcoin-BTC UTXO set again. An entire project could be made to evaluate their privacy and other properties. Early days... privacy-enabled cryptocurrencies finally rising! Bitcoin-BTC will be coming under fire from them, and their maxi's will be panicking with no face-saving way out of utterly refusing to enable any privacy for over 13 years now.

1 0

Cryptocurrency: Get Free Coin Privacy Research Results Via FOIA
by grarpamp 06 May '22

06 May '22

Where are the FOIA's for all these contract results and related things...? https://news.bitcoin.com/chainalysis-and-integra-win-1-25-million-irs-contr… US20200160344A1 “Blockchain Transaction Analysis and Anti-Money Laundering Compliance Systems and Methods”

1 0

Cryptocurrency: State and ASIC Hashpower Is Not In Your Interests
by grarpamp 06 May '22

06 May '22

State hashpower, and State sponsored subsidied tax-abated permitted regulated etc hashpower, ASIC hashpower, especially as seen in Western States, is a pending nightmare. The Western cabal will force all commercial miners to be compliant... censored, KYC, AML, OFAC, no-fly, childrens unlicensed Kool-Aid stands. Then they can 51% the rest of the world, it's also part of the push to PoS, they have more money to spend and print towards that attack. Commercial miners have already begun testing transaction censorship. ASIC miners, already insanely expensive, will become licensed and customs-blocked goods, end users won't be able to obtain them. ASIC-hard CPU-PoW privacy-enabled coins solve this. No one can see it, all users around the world can fairly mine it.

2 1

Powell Says Fed Doesn’t Have a Credibility Problem with the American People – Despite Gallup Poll Showing Lowest Confidence Since 2008 Financial Crisis
by professor rat 06 May '22

06 May '22

You say "the national security and economic future of the United States hangs in the balance " like that's a BAD thing. Going by the XRP-Ripple circus the USG is so weak and worthless it can't even regulate a centralized shitcoin. It seems uncontroversial to say the ' American Century ' is over - and has been for some time. So there's no tension. No suspense. No drama. Score is Cryptoanarchy 1 - USG 0 VIVA LA REVOLUTION.

2 1

JPMorgan Chase’s Rap Sheet
by Gunnar Larson 06 May '22

06 May '22

https://wallstreetonparade.com/12259-2/ *JPMorgan Chase’s Rap Sheet* *(Highlights)* April 21, 2011, JPMorgan Chase agreed to settle a civil lawsuit <https://webcache.googleusercontent.com/search?q=cache:CfSUwB2l7yoJ:https://…> and pay $56 million to settle claims that it overcharged members of the military service on their mortgages in violation of the Service Members Civil Relief Act and the Housing and Economic Recovery Act of 2008. February 7, 2012, JPMorgan Chase agreed to pay $110 million <https://www.reuters.com/article/us-jpmorgan-overdraft-settlement/jpmorgan-s…> to settle consumer litigation that claimed it overcharged customers for overdraft fees. February 9, 2012, JPMorgan Chase reaches an agreement with the OCC <https://www.occ.treas.gov/news-issuances/news-releases/2012/nr-occ-2012-20.…> to pay $113 million for unsafe and unsound mortgage servicing and foreclosure practices. August 10, 2012, JPMorgan Chase agreed to pay $1.2 billion <https://webcache.googleusercontent.com/search?q=cache:Haiu_nV-yUcJ:https://…> to settle claims that it, along with other banks, conspired to set the price of credit and debit card fees. November 16, 2012, JPMorgan Chase agreed to pay $296.9 million to the SEC <https://www.sec.gov/news/press-release/2012-2012-233htm> to settle claims that it misstated information about the delinquency status of its residential mortgage portfolio. July 2013, a unit of JPMorgan Chase agreed to pay $410 million <https://webcache.googleusercontent.com/search?q=cache:qsHNf-iV-3QJ:https://…> to the Federal Energy Regulatory Commission to settle claims of bidding manipulation of California and Midwest electricity markets. September 19, 2013, JPMorgan Chase agreed to pay <https://www.consumerfinance.gov/about-us/newsroom/cfpb-orders-chase-and-jpm….> $80 million in combined fines to the Consumer Financial Protection Bureau (CFPB) and Office of the Comptroller of the Currency (OCC) and $309 million in refunds to customers whom the bank billed for credit monitoring services that the bank never provided. September 19, 2013, JPMorgan Chase agreed to pay $920 million <https://money.cnn.com/2013/09/19/investing/jpmorgan-london-whale-fine/index…> to U.S. and U.K. regulators for its unsafe and unsound banking practices in using bank depositors’ money to trade in derivatives in London. It lost at least $6.2 billion in the trades. This was known as the “London Whale” scandal. November 15, 2013, JPMorgan Chase announced that it had agreed to pay $4.5 billion <https://webcache.googleusercontent.com/search?q=cache:MYOnVBZWdV4J:https://…> to settle claims by private investors that it defrauded them in mortgage-backed securities. November 19, 2013, JPMorgan agreed to pay $13 billion <https://www.justice.gov/opa/pr/justice-department-federal-and-state-partner…> to settle claims by the Department of Justice; the FDIC; the Federal Housing Finance Agency; and various State Attorneys General over its fraudulent practices with respect to mortgage-backed securities. JPMorgan acknowledged it made serious misrepresentations to the public. December 4, 2013, JPMorgan Chase agreed to pay 79.9 million Euros <https://money.cnn.com/2013/12/04/news/companies/libor-europe-fines/?iid=EL> to settle claims of the European Commission relating to illegal rigging of benchmark interest rates. In December 2013, JPMorgan Chase agreed to pay $22.1 million <https://www.classaction.org/blog/22m-settlement-reached-in-chase-force-plac…> to settle claims that the bank imposed expensive and unnecessary flood insurance on homeowners whose mortgages the bank serviced. January 7, 2014 the U.S. Department of Justice charged JPMorgan Chase with two criminal counts <https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-and-fbi-assistan…> for its banking conduct in the Bernard Madoff Ponzi scheme. The bank admitted to the charges; agreed to pay $1.7 billion to a Madoff victim fund and agreed to a Deferred Prosecution Agreement. May 20, 2015, JPMorgan Chase pleaded guilty to one criminal count <https://www.justice.gov/opa/pr/five-major-banks-agree-parent-level-guilty-p…> brought by the U.S. Department of Justice for its role with other banks in rigging the foreign exchange market. The bank agreed to a fine of $550 million. December 18, 2015 the bank agreed to charges by the SEC <https://www.sec.gov/news/pressrelease/2015-283.html> that it had steered its customers into in-house products where it reaped higher profits without disclosing this conflict to the customer. It paid $267 million to settle these charges. On January 20, 2017 JPMorgan Chase agreed to pay $53 million to settle charges that it had discriminated <https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-settles-lending-…> against minority borrowers by charging them more for a mortgage than white customers. October 2018 JPMorgan Chase agreed to pay $5.3 million to settle U.S. Treasury allegations that “it violated Cuban Assets Control Regulations, Iranian sanctions and Weapons of Mass Destruction sanctions 87 times,” according to Reuters <https://www.reuters.com/article/us-jpmorgan-sanctions/j-p-morgan-to-settle-…> . December 26, 2018 JPMorgan Chase settled claims with the SEC for $135 million <https://www.marketwatch.com/story/jpmorgan-chase-settles-sec-claims-for-135…> over charges that it had improperly handled thousands of transactions involving the shares of foreign companies. May 16, 2019, JPMorgan Chase settled charges for 228.8 million Euros <https://webcache.googleusercontent.com/search?q=cache:4Sz4v2DC2Z0J:https://…> with the European Commission that it rigged the foreign exchange market. (Other banks were also fined.) September 16, 2019, the U.S. Department of Justice indicted <https://www.justice.gov/opa/pr/current-and-former-precious-metals-traders-c…> two current and one former precious metals traders at JPMorgan Chase for turning the precious metals desk at the bank into a “racketeering” enterprise. September 29, 2020, the U.S. Department of Justice brings two counts of wire fraud <https://www.justice.gov/opa/pr/jpmorgan-chase-co-agrees-pay-920-million-con…> against JPMorgan Chase involving “tens of thousands of episodes of unlawful trading in the markets for precious metals futures contracts, and the second involving thousands of episodes of unlawful trading in the markets for U.S. Treasury futures contracts and in the secondary (cash) market for U.S. Treasury notes and bonds.” The bank admits to the charges and agrees to pay $920 million in fines and restitution to various regulators. December 17, 2021, the securities unit of JPMorgan Chase admits its traders and their supervisors were using personal communications devices to conduct company business. The firm failed to record and retain messages from these devices as required under the law. These violations occurred despite similar conduct in the bank’s participation in the rigging of the foreign exchange market, where traders used unauthorized electronic chat rooms, called “The Cartel” and “The Mafia.” That case brought a criminal felony charge against the bank by the Justice Department in May of 2015. In the current case, the SEC fined the firm $125 million <https://www.sec.gov/news/press-release/2021-262>. -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

2 1

Re: Entropy code
by zeynepaydogan 06 May '22

06 May '22

Notice, as an unrelated side note, that in c++ you can't pass full arrays to functions as you would in managed languages, you have to pass a pointer to the first byte of an array to be processed and the return a pointer to the first byte of the resulting processed array. The function copies the chunks of high entropy code to a new array and inserts a pattern of ascending bytes starting by a initial random byte. Not all bytes can be random because the entropy would not be reduced, so only the first one is. There rest will follow a pattern and here of course you can select many different patterns. For this example I used a simple incremental pattern. Final task will restore the original byte array by eliminating the inserted low entropy chunks of code. PBYTE restore_original(PBYTE high_ent_payload) { constexpr int payload_size = (payload_size_after_entropy_reduction + 1) / 2; // re-calculate the original payload size BYTE low_entropy_payload_holder[payload_size_after_entropy_reduction] = {0}; // create a new array to hold the bytes to be processed memcpy_s(low_entropy_payload_holder, sizeof low_entropy_payload_holder, high_ent_payload, payload_size_after_entropy_reduction); // move the array to be processed to the newly created array // Create an empty array which will contain the restored data static BYTE restored_payload[payload_size] = {0}; int offset_of_hi_entropy_payload = 0; int offset_of_original_payload = 0; // Because high and low entropy chunks are of the same size, then simply copy the high entropy ones to the restored array and skip the low entropy ones for (size_t i = 0; i < number_of_chunks; i++) { for (size_t j = 0; j < chunk_size; j++) { restored_payload[offset_of_original_payload] = low_entropy_payload_holder[offset_of_hi_entropy_payload]; offset_of_hi_entropy_payload++; offset_of_original_payload++; } for (size_t k = 0; k < chunk_size; k++) { offset_of_hi_entropy_payload++; } } // Copy the remaining bytes if (remaining_bytes) { for (size_t i = 0; i < sizeof remaining_bytes; i++) { restored_payload[offset_of_original_payload++] = high_ent_payload[offset_of_hi_entropy_payload++]; } } return restored_payload; } So lets explain this graphically. Suppose a byte belonging to a high entropy chunk is represented by the letter "H" and a low entropy byte belonging to a low entropy chunk is represented by the letter "L", and the remaining never modified bytes are represented by the letter "R" The original high entropy array is something like this: HHHHHHHHHHHHHHHHHRRR The processed low entropy array is something like this: HHHHLLLLHHHHLLLLHHHHLLLLHHHHRRR So to restore the original high entropy array from the low entropy processed array we simply eliminate the low entropy "L" bytes and we finally append the remaining "R" bytes. The restored high entropy array is something like this after low entropy chunks elimination: HHHHHHHHHHHHHHHHHRRR Finally we can explain the main function that will use the previous two functions to perform all the jobs, and to make sure that all of this works, we will calculate the Shannon entropy at each step to corroborate entropy is high at the beginning, then reduced and finally its increased once more.

1 1

Entropy code
by zeynepaydogan 06 May '22

06 May '22

Entropy is a measure of randomness in a set of data. The more random your data is, the more entropy it has. When we talk of entropy we are generally referring to Shannon Entropy which is an algorithm that will produce a result between 0 and 8, where 8 means there is no pattern in the data, thereby its very random and 0 means data follows a pattern. When you are used to evaluate digital data its very easy to see these patterns without even doing any calculation. Its the analog of the movie The Matrix when you can see what is going on in the Matrix Code without the translator. Random high entropy digital data looks very chaotic while low entropy data looks more organized, even you may be able to see some symmetric patterns formed by the array of bytes in the data, though it is still not readable in any known language, and again, no calculation is needed in general. It turns out that one of the techniques, I would say, almost universally used to hide malicious code is packing the code or encoding it to change its byte pattern signature to fool security products. The problem of this approach is also universal. As you pack or obfuscate the malicious code, its entropy increases. In fact, studies have demonstrated that entropy can be used very effectively to separate none malicious code from malicious one based on its entropy. Malicious samples will typically have an entropy over 7.2 while legitimate software ranges from 4.8 to 7.2. An entropy close to 8 will be seen in 30% of malicious samples but only in 1% of innocent code. More than half of malicious samples will have an entropy over 7.2 while only one out of ten legitimate applications will have such high entropy. In conclusion, not all malicious samples have high entropy (but a great majority will) and not all legitimate applications will have a low entropy (but the majority will). The reason why legitimate samples can have high entropy is related to the fact that packing is a valid technique used to decrease the size of executables, protect resources, and many applications take advantage of this. So even though entropy is not enough to differentiate malicious code from normal innocent code, malware analysis tools have used high entropy as one of the main elements in their malicious scoring systems to flag samples. If you have been in the crypters world, you can corroborate this by scanning your stub alone and then your stub with the encoded payload stored in the data section or resources section. Detection immediately increases. Anti-malware solutions will look for high entropy not only as a global value on the entire executable but also section by section and there is little that we can do to counter it. Even though this has been a problem for many years, the proposed techniques are not definitive. If you read on the topic, malware authors propose to increase the amount of normal code versus obfuscated code as first solution. Evidently then the stub has to be bigger and full of unused code. So although possible I don't see this as a good solution. Second solution is even more inconvenient because it would require to reduce the amount of obfuscated code meaning that the malicious code would have to be smaller in comparison to the stub. Unfortunately in most situations, its the opposite. The stub is greatly smaller than the payload. This, therefore will limit the possible payloads to the very few small ones. Another possibility is obfuscate the code using an algorithm that does not increase entropy (like XORing and Base64 encoding). This last one I think is the more convenient, which does not mean that is perfect. XORing as well as Base64 encoding can be easily decrypted to unmask the real purpose of the code. Also signatures can be created directly, both against the XORed as well as the Base64 encoded data. Finally, Some anti-malware solutions can even decode these simple schemes during the emulation phase of the analysis. Thinking in better possible alternatives I came up with an interesting idea that I have seen applied to some few malware samples in the past. If the problem is randomness, then why not try to disguise the malicious obfuscated code by inserting patterns to reduce its randomness and therefore its global entropy. In this way you are not limited to obfuscate the code with simple algorithms and yet stay under the radar of anti-malware solutions; also the obfuscated code could be of any size. With this in mind I created a POC to reduce the Shannon entropy of an obfuscated malicious array of bytes. The idea is to break the array in chunks and insert a low entropy pattern of bytes between one chunk and the next. When the sample is to be executed we have to rebuild the original payload in memory and at this point we have bypassed the static detection of the high entropy code. I want to stop in the pattern to follow for the low entropy bytes because you can create different patterns in order to avoid signature detections. Using several mathematical equations you could come up with many different low entropy patterns but for the purpose of the article we will use a simple one. The second needed task is the one that will put together the high entropy chunks of bytes with the low entropy ones. Not much to say about it. The third task will restore the original array of bytes by eliminating the low entropy patterns, because after all, we need to restore the obfuscated code to what it was originally in order to proceed to the de-obfuscation phase.

1 1