- cypherpunks@lists.ogf.org

How are the August 2015 Ferguson unrests going?
by Georgi Guninski 13 Aug '15

13 Aug '15

How are the August 2015 Ferguson unrests going? https://en.wikipedia.org/wiki/Ferguson_unrest#August_2015

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 13 Aug '15

13 Aug '15

On Thu, Aug 13, 2015 at 3:40 AM, Mike Perry <mikeperry(a)torproject.org> wrote: >> But consider looking at average flow lifetimes on the internet. There may >> be case for going longer, bundling or turfing across a range of ports to falsely >> trigger a record / bloat, packet switching and so forth. > > This interests me, but we need more details to determine what this looks > like in practice. NANOG list could link specific papers regarding nature of the internet. The various flow exporters have sensible default timeouts tend cover that ok for purposes intended. > I suspect that this is one case where the switch to one guard may have > helped us. In that various activities such as ssh, browsing, youtube, whatever are confined to being multiplexed in one stream, that makes sense. > However, Tor still closes the TCP connection after just one > hour of inactivity. What if we kept it open longer? The exporting host has open flow count limited by memory (RAM). A longer flow might be forced to span two or more records. The "flags" field of some tools and versions may not mark a SYN seen in records 2+, the rest of tuple would stay same. Active timeout gives periodic data on longer flows, typically retaining start time but implementations can vary on state. Here's an early IOS 12 default... Active flows timeout in 30 minutes (1~60) Inactive flows timeout in 15 seconds (10~600) Also consider what is wished to hide, big iso download, little http clicks, start time of some characteristic session rippling across or appearing at edges, active data pumping attack. And what custom flowish things and flow settings an adversary might be doing to observe those. Traditional netflow seems useful as idea base to form a better heuristic analysis system. > Or what if the first > hop was an encrypted UDP-based PT, where it was not clear if the session > was torn down or closed? In old netflow, UDP, where src/dst ip and port tuple is same, just times out into a record. Some new exotic DPI might form session context flow record based on application inside, crypto would stop the cleartext portion of DPI. Some flow tools don't reassemble so the frag game might slide by them in an arms race. > in this case I am worried it may end up silencing the people I'd really > like to hear from. I want real data from the field, here. There's no censor here. Other operators in the field can and should speak up on topic (and feel free to bash any my errors or lack of paper / code / data posting). > You can say that, but then why isn't this being done in the real world? > The Snowden leaks seem to indicate exploitation is the weapon of choice. The Snowden leaks and Bamford also indicate NSA-UTAH, gigawatts, massive international cable tapping, CARNIVORE, NARUS, X-WHATEVER, etc. Exploitation could use a few offices full of hackers and some good peering points and hosts, not that huge $billions level of infrastructure and outside your borders expenditure. Though blackbagging to stand up an IP in the target net via an active tap could be useful, the driver to localize due to cost. > I suspect other factors are at work that prevent dragnet correlation > from being reliable, in addition to the economics of exploits today > (which may be subject to change). These factors are worth investigating > in detail, and ideally before the exploit cost profiles change. Yes, bigdata still has to conform to at least some kind of cost benefit analysis and substantiation too. Where is the line on that these days... 2^40, 2^56, 2^80...? > As such, I still look forward to hearing from someone who has worked at > an ISP/University/etc where this is actually practiced. What is in > *those* logs? The questions were of a general "intro to netflow" nature, thus the links, they and other resource describe all the data fields, formation of records, timeouts, aggregation, IPFIX extensibility, etc. Others and I on these lists know what "360 gigs" of netflow looks like. *What* specific info are you looking for beyond that? Applicability to exploit? Should people print out flows from a degenerate client and exit use case and line them up? More tools and tech... http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.… nfdump, silk https://en.wikipedia.org/wiki/Network_Based_Application_Recognition More generally, netflow is not the only passive analysis tool or idea out there. So focusing on it may be narrow, though it is popular tool. > Specifically: Can we get someone (hell, anyone really) from Utah to > weigh in on this one? ;) Well, I'll speculate that by now they've lawyered up and silenced their OP such that it's unlikely that we'll hear from them (short of coderman firing a broadside FOIA at them ;) (We're speculating it's 360 gigs of netflow.) > Otherwise, the rest is just paranoid speculation, and bordering on > trolled-up misinformation. :/ https://www.youtube.com/watch?v=rh1Amz8s8MI http://www.multivax.com/last_question.html Everybody's now asking questions what is possible, my job is done ;)

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 13 Aug '15

13 Aug '15

On Wed, Aug 12, 2015 at 7:45 PM, Mike Perry <mikeperry(a)torproject.org> wrote: > At what resolution is this type of netflow data typically captured? Routers originally exported at 100% coverage, then many of them started supporting sampling at various rates (because routers were choking and buggy anyways, and netheads were happy with averages), some only do sampling. Plug flow probes into network taps and you can do whatever you want (netsec loves this and other tools). > Are we talking about all connection 5-tuples, bidirectional/total > transfer byte totals, and open and close timestamps, or more (or less) > detail than this? > > Are timestamps always included? Are bidirectional transfer bytecounts > always included? Are subsampled packet headers (or contents) > sometimes/often included? > > What about UDP sessions? IPv6? > > Information about how UDP is treated would also be useful if/when we > manage to switch to a UDP transport protocol, independent of any > padding. All of the above depends on which flow export version / aggregation you choose, until you get to v9 and IPFIX, for which you can define your fields. In short... yes. Flow endtime is last matching packet seen, but a flow can span records when the time (therefore space, ie RAM) limited mandatory expiry timers hit. UDP goes via that, TCP usually via flags. Records can span flows for which other semantic keys may not exist, as often with UDP. But DPI can also be used in the exporter to do all sorts of fun stuff and enable other downstream uses (obviously TLS / IPSEC / crypto break some things there). Tor already bundles multiple logical flows (only TCP for user today) into some number of physical TCP flows, UDP transport there might not need anything special. But consider looking at average flow lifetimes on the internet. There may be case for going longer, bundling or turfing across a range of ports to falsely trigger a record / bloat, packet switching and so forth. > and having more information about what is typically > recorded in these cases would be very useful to inform how we might want > to design padding and connection usage against this and other issues. "Typical" is really defined by the use case of whoever needs the flows, be it provisioning, engineering, security, operations, billing, bigdata, etc. And only limited by the available formats, storage, postprocessing, and customization. IPFIX and https://en.wikipedia.org/wiki/NetFlow https://en.wikipedia.org/wiki/IP_Flow_Information_Export https://www.google.com/search?q=(netflow|IPFIX)+(probe|exporter|parser) http://www.freebsd.org/cgi/man.cgi?query=ng_netflow&sektion=4 > I think for various reasons (including this one), we're soon going to > want some degree of padding traffic on the Tor network at some point > relatively soon Really? I can haz cake nao? Or only after I pump in this 3k email and watch 3k come out the other side to someone otherwise idling ;) https://cdn.plixer.com/images/slider-3-icon.png ... and/or some other bigdata systems ...

1 0

LegbaCore Thunderbolt OpROM checker released
by Blibbet 12 Aug '15

12 Aug '15

FYI: LegbaCore's Apple Thunderbolt-to-Ethernet Option ROM checker was released 5 days ago (I just found out today). If you have a modern Apple, you need this tool. http://firmwaresecurity.com/2015/08/12/interview-with-legbacore-and-their-o… https://github.com/legbacore/t2e_integrity_check Also boot a Linux liveCD (like LUV-live) with CHIPSEC to grab your Mac's ROMs, so you can examine them with (CHIPSEC, UEFITool, UEFI Firmware Parser, etc.). Save the snapshots of the images over time, so you can diff them for changes (with BIOS Diff, etc.). Thanks, Lee RSS: http://firmwaresecurity.com/feed

1 0

simple chat
by Juan 12 Aug '15

12 Aug '15

does anybody know a simple application with these features? 1) 'group chat' for a 'few' people - say, no more than 10 2) uses symmetric encryption (users already shared the key) 3) application uses a server for people to learn each other's addresses, but after the address exchange, the messages are sent p2p (maybe something based off IRC?)

4 6

Re: Privacy advocates resign over facial recognition plans (rysiek)
by Softy 12 Aug '15

12 Aug '15

Exhibit B: > 1. http://rys.io/en/94 > > Ryios, gov. officials debate these points; and consciously ignore them.

1 0

Re: Death lists.
by wirelesswarrior＠Safe-mail.net 11 Aug '15

11 Aug '15

Damn, I wanted to attend but they scheduled my Wireless Village talk at 4:00, almost the same time as Chris. If anyone here attended I'd love to hear some comments. WW > > http://news.yahoo.com/rush-put-death-records-online-lets-anyone-killed-0744… > Las Vegas (AFP) - Hackers at an infamous annual Def Con gathering in Las Vegas got schooled in how to be online killers. > > > > A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities. > "This is a global problem," Australian computer security specialist Chris Rock said as he launched a presentation titled "I Will Kill You." > The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research. > Once forms are submitted online, certificates declaring the listed person legally dead are generated. > A fatal flaw in the system is that people can easily pose as real doctors and funeral directors, Rock demonstrated to a rapt audience. > Doctors practising general medicine often don't bother setting up accounts at online portals for filling out information for death certificates. > An aspiring online assassin can step into that void, and borrow the identity of a doctor. > Setting up accounts requires a doctor's name, address, and medical license number. A basic Internet search will turn up that information, which is publicly available for the well-intended purpose of letting people check that physicians are legitimate before seeking care. > Drop down boxes containing illness categories and online guides are available for filling in "doctor speak" on forms and avoiding medical causes or circumstances that might trigger needs for autopsies or investigations, Rock's demonstration showed. > > - No one off limits - > > Borrowing a funeral director's identity to establish an online account for death certificate purposes was shown to be simple as well. Required information about legitimate funeral directors is posted on the Internet, and one could even claim to work at a funeral home. > In Rock's case, he made a website for a bogus funeral home and used that to back his application for an account as director. He got an automated call days later saying he was approved. > With both online accounts in place, deaths can be registered in the real world. > "You could kill anyone you want," Rock told AFP after the presentation. "No one is off limits." > A humor-infused list of scenarios included killing oneself off to get life insurance cash or going after others for vengeance. > Someone targeted might not even know they were declared dead until doing something official like trying to renew a passport or driving license. > Rock began digging into the death industry a year ago after an Australian hospital accidentally declared 200 patients dead. > > - Virtual babies - > > Getting birth certificates for virtual babies was demonstrated to be even easier than killing off people in the digital world, because registering births online only involves doctors and parents. > "Once you log on as a doctor, not only can you kill someone, you can actually birth someone," Rock said. > Given the time it takes for even a make-believe baby to grow into adulthood, he saw that as more tempting to crime gangs who could invest in the future by creating legions of virtual people for shady doings involving loans, stock trading, imports or other activities. > "You could even make fake identities for your children, so when they grow up they have burner identities," Rock said. > He dove into virtual birth and death in his book titled "The Baby Harvest: How virtual babies become the future of terrorist financing and money laundering." > >

4 3

Stealth aircraft
by wirelesswarrior＠Safe-mail.net 11 Aug '15

11 Aug '15

Fellow Droogs, Long ago I wondered but never spent time to find out how this military magic worked. While doings some RF research recently I fell upon a key tech: http://scholar.google.com.secure.sci-hub.org/scholar?q=stealth+plasma+aircr… Enjoy! WW

1 0

P25
by wirelesswarrior＠Safe-mail.net 09 Aug '15

09 Aug '15

Speaking of these devices... http://wiki.spench.net/wiki/Gr-baz#op25 WW

1 0

Death lists.
by jim bell 08 Aug '15

08 Aug '15

http://news.yahoo.com/rush-put-death-records-online-lets-anyone-killed-0744… Las Vegas (AFP) - Hackers at an infamous annual Def Con gathering in Las Vegas got schooled in how to be online killers.A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities."This is a global problem," Australian computer security specialist Chris Rock said as he launched a presentation titled "I Will Kill You."The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research.Once forms are submitted online, certificates declaring the listed person legally dead are generated.A fatal flaw in the system is that people can easily pose as real doctors and funeral directors, Rock demonstrated to a rapt audience.Doctors practising general medicine often don't bother setting up accounts at online portals for filling out information for death certificates.An aspiring online assassin can step into that void, and borrow the identity of a doctor.Setting up accounts requires a doctor's name, address, and medical license number. A basic Internet search will turn up that information, which is publicly available for the well-intended purpose of letting people check that physicians are legitimate before seeking care.Drop down boxes containing illness categories and online guides are available for filling in "doctor speak" on forms and avoiding medical causes or circumstances that might trigger needs for autopsies or investigations, Rock's demonstration showed.- No one off limits -Borrowing a funeral director's identity to establish an online account for death certificate purposes was shown to be simple as well. Required information about legitimate funeral directors is posted on the Internet, and one could even claim to work at a funeral home.In Rock's case, he made a website for a bogus funeral home and used that to back his application for an account as director. He got an automated call days later saying he was approved.With both online accounts in place, deaths can be registered in the real world."You could kill anyone you want," Rock told AFP after the presentation. "No one is off limits."A humor-infused list of scenarios included killing oneself off to get life insurance cash or going after others for vengeance.Someone targeted might not even know they were declared dead until doing something official like trying to renew a passport or driving license.Rock began digging into the death industry a year ago after an Australian hospital accidentally declared 200 patients dead.- Virtual babies -Getting birth certificates for virtual babies was demonstrated to be even easier than killing off people in the digital world, because registering births online only involves doctors and parents."Once you log on as a doctor, not only can you kill someone, you can actually birth someone," Rock said.Given the time it takes for even a make-believe baby to grow into adulthood, he saw that as more tempting to crime gangs who could invest in the future by creating legions of virtual people for shady doings involving loans, stock trading, imports or other activities."You could even make fake identities for your children, so when they grow up they have burner identities," Rock said.He dove into virtual birth and death in his book titled "The Baby Harvest: How virtual babies become the future of terrorist financing and money laundering."

1 0