- cypherpunks@lists.ogf.org

Stealing Amazon cloud RSA keys cross VM
by Georgi Guninski 03 Oct '15

03 Oct '15

http://www.theregister.co.uk/2015/10/02/amazon_boards_windows_against_leet_… Amazon has patched a vulnerability that could have let users to steal the RSA keys of other co-located customers. The paper: https://eprint.iacr.org/2015/898.pdf

1 0

No MITM attack on Cryptome
by Michael Best 02 Oct '15

02 Oct '15

A week or two ago, a new Snowden was released that shows information about a visitor to Cryptome. James Atkinson looked at the slide and concluded that it was proof of a man in the middle (MITM) attack against Cryptome. He sent his concerns to John and Deborah who then posted them on Cryptome.org - https://cryptome.org/2015/09/gchq-illegal-spying-us.htm I'm doing a little bit of research on the slide and decided to compare notes with what had already been written about it, including Mr. Atkinson's post. While examining his remarks about the alleged MITM attack, I noticed that he seemed to be missing a piece of information that led him to a faulty conclusion. I've copied and pasted the relevant bits below. But here is the thing -- and this is crucial -- the address for Cryptome is > listed to be the location of a fiber optic cable junction in Sterling, VA > (next to an Amusement Machine company)... which is quite some distance away > from your location in NYC, and a considerable distance from your ISP who > hosts your file, and it is located away from any signal switching systems > use in the area, but it is virtually next door to fiber that goes to a > large NSA listening post nearby. The reason it is notable, is that someone at or near the location in > Sterling, VA is performing a MITM attack on Cryptome visitors, and this > image out of the slidedeck with the two GPS coordinates is the U.S. > Government performing a MITM attack against Cryptome and sharing the > collected intelligence with the Brits, or the U.S. Government giving the > British government backdoor access into the U.S. (illegal) collection > systems. This isn't a sign of a MITM attack, but rather of a misunderstanding. The Cryptome servers aren't located in New York at the address listed for Cryptome as a business. The servers are hosted by Network Solutions, which is who the IP address appears to belong to, as shown below. NetRange: 205.178.128.0 - 205.178.191.255 CIDR: 205.178.128.0/18 NetName: NTSL-01 NetHandle: NET-205-178-128-0-1 Parent: NET205 (NET-205-0-0-0-0) NetType: Direct Allocation OriginAS: AS14441, AS19871, AS6245 Organization: Network Solutions, LLC (NETWO-59) RegDate: 1999-02-09 Updated: 2012-03-02 Ref: http://whois.arin.net/rest/net/NET-205-178-128-0-1 A reverse DNS search shows that the IP address is used to host over 1,100 domains. I've attached two PDFs that include more detailed information showing that there is no indication of a MITM attack against Cryptome. Live versions of the PDFs can be found at http://www.iptodomain.com/ip-205-178-146-236.php and http://www.tcpiputils.com/browse/ip-address/205.178.146.236 I hope this will help soothe some fears and paranoia about this particular alleged MITM attack. Monitoring, almost certainly. Other MITM attacks at other times, perhaps. The GCHQ slide just isn't any sort of proof that there was a MITM attack on Cryptome.org during the times referenced by the slide.

1 0

Subject: Re: Bitnation system. Looks interesting.
by tigrutigru＠gmail.com 02 Oct '15

02 Oct '15

It seems like there's a confusion between contracts and cryotocontracts? > On 10 Sep 2015, at 7:19 am, cypherpunks-request(a)cpunks.org wrote: > > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: Bitnation system. Looks interesting. > (Lodewijk andré de la porte) > 2. Re: Bitnation system. Looks interesting. (Bryan Bishop) > 3. Re: Bitnation system. Looks interesting. (Martin Becze) > 4. Repbin release v0.0.2 (ryan.pear(a)ownbay.net) > 5. Re: Repbin release v0.0.2 (jim bell) > 6. Re: How Putin Controls the Internet and Popular Opinion in > Russia (rysiek) > 7. Re: How Putin Controls the Internet and Popular Opinion in > Russia (Juan) > 8. Re: Repbin release v0.0.2 (rysiek) > 9. Hostages for Sale on Telegram (Rich Jones) > 10. Re: Hostages for Sale on Telegram (Ben Mezger) > 11. John McAfee Runs For US President In 2016 Under Cyber Party > (grarpamp) > 12. Re: Hostages for Sale on Telegram (grarpamp) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Sep 2015 18:30:53 +0200 > From: Lodewijk andré de la porte <l(a)odewijk.nl> > To: Mirimir <mirimir(a)riseup.net> > Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> > Subject: Re: Bitnation system. Looks interesting. > Message-ID: > <CAHWD2r+C+NXJ3Q-W=Bt5T+9=3ncfUwjvQVmT7Gqdn56MDydvyA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > It's documentation is overly verbose, speculative, assuming and unclear. > > I love the idea of providing services that the government usually tends to. Everyone loves ideas that Bitnation put their brand on. > > I somewhat know what marriage before God means. I somewhat know what > marriage before the State means. I have no idea what marriage before the > Blockchain means. Probably no more than lovers' tree-carvings. Exactly. Proof-of-existence. I don't understand what it has to do with Bitnation brand. Someone just wants to look cool. What exactly Bitnationare building? > > Relationship to reality is the hardest part - it's also where things like > enforcement starts turning it's ugly head. > > I'd argue marriage before state is an artifact of the marriage between > church and state. Relationships, commitments, etc, these would be better > explained in contract. Yes. Obligations can be explained. Still people go to courts and dispute contracts. These are text. > Contracts can go onto a blockchain. Contracts which go on the blockchain have nothing to do with legal contracts. Parts of the text (legal) contracts can be hooked to a smart contract I guess. I guess if a married couple has a dispute over digital property or btc in a wallet, let's say a script can manage it, but how the script (smart contract) will know who in this particular dispute did what. Even with no details and subtleties involved. > Generic. Neat. > Unpretentious. > > Bitnation is fascinating, thought provoking, but it seems somewhat off. Ideas are nice. They're not necessarily coming from Bitnation. Proof of existence, or Blockchain ID for example were existing ideas which had functioning prototypes. They just don't make it sound grandiose. Bitnation has a claim to be a software project and afaik has a presale of a currency - either premined or non existent - I don't remember. I'm fine with that type of crowdfunding if there is some sort of product or a service behind it or an attempt to build it. I don't think that contemporary art project should pretend to be a software project or pretend that it can realistically offer serious services or replace existing ones. It's cool as a concept project. >

2 2

Qubes 3.0 out
by Eugen Leitl 02 Oct '15

02 Oct '15

http://blog.invisiblethings.org/2015/10/01/qubes-30.html Qubes 3.0 Oct 1, 2015 • Joanna Rutkowska About 5 months after the initial release of Qubes 3.0-rc1, we're now releasing the final 3.0 today! Let me quickly recap the main "killer features" of Qubes OS 3.0 compared to the Release 2: Qubes is now based on what we call Hypervisor Abstraction Layer (HAL), which decouples Qubes logic from the underlying hypervisor. This will allow us to easily switch the underlying hypervisors in the near future, perhaps even during the installation time, depending on the user needs (think tradeoffs between hardware compatibility and performance vs. security properties desired, such as e.g. reduction of covert channels between VMs, which might be of importance to some users). More philosophically-wise, this is a nice manifestation of how Qubes OS is really "not yet another virtualization system", but rather: a user of a virtualization system (such as Xen). We upgraded from Xen 4.1 to Xen 4.4 (now that was really easy thanks to HAL), which allowed for: 1) better hardware compatibility (e.g. UEFI coming soon in 3.1), 2) better performance (e.g. via Xen's libvchan that replaced our vchan). Also, new Qubes qrexec framework that has optimized performance for inter-VM services. We introduced officially supported Debian templates. And finally: we integrated Whonix templates, which optimize Tor workflows for Qubes. As explained in our Release Cycle Documentation (something we finally created and been polishing through this 3.0 branch development), there is almost no new features in 3.0 compared to 3.0-rc1, essentially only bugfixes, intermixed with a few minor improvements. But, while the 3.0 branch was "maturing", and getting bugfixes merged, most of our work has been focused on the 3.1 branch, which is adding a bunch of exciting new features, as indicated on our high-level roadmap, specifically: UEFI support (see this ticket for more info and test images). Live USB edition (preview for which we already released earlier this summer, now it will get merged into the master branch for 3.1) Management/pre-configuration stack: The Big Killer Feature of the upcoming 3.1 release, which will make it easy to provide out of the box configurations for things such as: out of the box Whonix/Tor, or Split GPG, or default USB sandboxing VM, which currently the user must do manually. We're planning to release the first candidate for 3.1 as early as the end of October, actually. But development of any serious project is not just adding new features, although that's admittedly the most exciting thing for any developer to do. In R3 we have finally started implementing this golden thought, and the first tangible outcome of this change of attitude is the automated testing framework which we have been using for all the releases in this 3.0 branch already. We hope this results in much more polished, stable code. Other things we've started to be increasingly prioritizing recently, and only plan to intensify in the coming year are: 1) making Qubes more accessible to people (think easier to get hardware that can run Qubes OS), and 2) easier to use (better UX and UI). I think this is also pretty exciting, actually. As previously announced earlier this summer, we have decided to dedicate this release of Qubes OS to the memory of Caspar Bowden: Caspar's dedication screenshot Caspar has been a proud user, supporter, and advocate for Qubes OS, and also a friend. I think he would have liked that dedication. The Qubes 3.0 ISO can be downloaded from here. We have also released another scheduled Qubes Canary today. I would like to thank all the people who have contributed to this huge effort of creating a new "reasonably secure" desktop OS. I believe we're making together an important and meaningful thing here. Let's keep this going!

1 0

Allegedly Volkswagen cheated to both governments and lusers
by Georgi Guninski 02 Oct '15

02 Oct '15

http://www.theregister.co.uk/2015/09/25/vw_pollution_just_the_tip_of_the_ic… <quote> Volkswagen is being rightly condemned from all directions, as its methods were particularly cynical: its engine software would sense when the car was in a test environment and cut back NO_x output temporarily. As soon as the car was no longer under test, the car would change mode and emit huge amounts of NO_x. This wasn't done for no reason – if a machine is allowed to generate NO_x freely, it can be very fuel-efficient – and thus, of course, its carbon emissions can be very low too. </quote> Comment: Probably best defense for VW lawyers is: "We got hacked and the hack made this. We take sickyouareity seriously"

5 13

Re: [tor-talk] KARMA POLICE
by Ryan Carboni 02 Oct '15

02 Oct '15

http://routersecurity.org/ It just simply doesn't matter. To have a modern lifestyle, depends upon having devices of dubious or poor security. The government has shown a willingness to accumulate dossiers (seemingly including IRC chats), and then leak them when it serves their own needs. Our Congress is criminally incompetent. The chairman of the House Oversight committee just had his secret service application leaked, and there is no threat of the the most powerful tools that Congress has: appropriations micromanagement (famously done in Congressional reconstruction) or impeachment. The same goes for Benghazi (which probably was a meeting with a rebel group that went sour). I think our government is more malicious and less competent than Hoover's FBI. For comparison: “Another early Bureau practice was to index names on lists when the list reflected possible association with a subversive group (e.g. Communist Party petitions or subscriptions to the Daily People's World), or where the names might have future reference value (American Legion contacts, loyalty forms). The heavy demands on staff time and resources, however, and the absence of substantial information about the individuals whose names appeared in the this context caused the Bureau to limit indexing in these areas. In 1949 the Executive Conference decided that names on Communist Party petitions and subscription lists to the Daily Worker and Daily People's World be indexed in the appropriate field office only.”

1 0

tox
by Juan 02 Oct '15

02 Oct '15

I've been playing with tox(thanks rysiek!) and it looks rather interesting. I noticed however that it's not listed here https://www.eff.org/secure-messaging-scorecard Maybe somebody who knows somebody at eff could drop them a message? Also, apart from retroshare (and tox), is there any other p2p messaging network?

9 22

Re: [tor-talk] KARMA POLICE
by Zenaan Harkness 01 Oct '15

01 Oct '15

On 10/1/15, Ryan Carboni <ryacko(a)gmail.com> wrote: > http://arstechnica.com/tech-policy/2013/06/exclusive-in-2009-ed-snowden-sai… > > https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-o… > > Yep. > > Time to create a massive donation drive for Tor. I applaud and share your enthusiasm and intention. But. The assumption that "enough money will solve the problem" is generally false. What is needed is a supra-tor or supra-"supplied by the govt/ isp" physical network layer - or at least enough nodes in a 'slightly new design' network which can use those nodes (assuming there are enough of them, which might be large number, I have no idea). That means individuals setting up their own links between them and their neighbors. Neighbors is a loose concept - wireless links can hop a fair distance. The principle is: - if you don't control it, if you did not physically set it up, it monitors you; - if you don't install and 'control' the software running on the hardware, it monitors you; - if your hardware is backdoored before you receive it (e.g. built in hidden other-than-wifi radio, keylogging cpu microcode, full hidden net sniffing computer in your ethernet port), notwithstanding the software you install on it, it monitors you. There is so much room for necessary improvement that the situation is depressingly grim. TBB/Tor is at least something - just be sure you understand what it is, and what it is not. Good luck and surf safe, Zenaan

1 0

CloudFlare Keyless SSL WAS Re: Snowden on the Twitters
by Travis Biehn 01 Oct '15

01 Oct '15

An oldie, somewhat OT. I enjoyed CF's bit of engineering here - of course CF is still a point where they are working with injectable plaintext. At least they don't have your private key material. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ What would be solid is if there were a browser module that did several things: Eliminated JavaScript dynamic calls (eval, new function(), setTimeout, setInterval, so on.) Eliminate 3rd party assets. Allowed web assets to be signed. Allowed sets of web assets to be versioned (and attested to by 3rd parties.) Dynamic HTML and JS (read, non-static HTML & JS) would not be supported. The combination of signing, versioning and lack of dynamic features paves the way for uninjectable, client-side in browser encryption/decryption. Something AFAIK we cannot do today. Is anyone working on it? -Travis On Wed, Sep 30, 2015 at 11:23 AM, Georgi Guninski <guninski(a)guninski.com> wrote: > On Wed, Sep 30, 2015 at 01:26:18AM -0400, grarpamp wrote: > > https://twitter.com/Snowden > > How this scores on twatter: > > 1.03 meeelion followers for about 23 hours on twatter? > (not sure about the error terms). > > -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

3 6

US Pres Candidate Carly Fiorina Supplies NSA, Spying, Torture, Warmongering and Bankruptcy
by grarpamp 30 Sep '15

30 Sep '15

http://motherboard.vice.com/read/carly-fiorina-i-supplied-hp-servers-for-ns… https://www.yahoo.com/politics/carly-fiorina-defends-bush-era-torture-and-s… http://politics.slashdot.org/story/15/09/29/220239/carly-fiorina-i-supplied… According to an article at Motherboard, shortly after 9/11, NSA director Michael Hayden requested extra computing power and Carly Fiorina, then CEO of HP, responded by re-routing truckloads of servers to the agency. Fiorina acknowledged providing the servers to the NSA during an interview with Michael Isikoff in which she defended warrantless surveillance (as well as waterboarding) and framed her collaboration with the NSA in patriotic terms. Fiorina's compliance with Hayden's request for HP servers is but one episode in a long-running and close relationship between the GOP presidential hopeful and U.S. intelligence agencies. $500 billion over ten years by one estimate—and an upgrade of “every leg of the nuclear triad,”

2 1