- cypherpunks@lists.ogf.org

Re: Hackers Remotely Kill a Jeep on the Highway
by Shelley 28 Jul '15

28 Jul '15

On July 24, 2015 5:13:46 AM Georgi Guninski <guninski(a)guninski.com> wrote: > Not sure if this is true: > > http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ > <quote> > I was driving 70 mph on the edge of downtown St. Louis when the exploit > began to take hold. > ... > Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee > started blasting cold air at the maximum setting, chilling the sweat on > my back through the in-seat climate control system. Next the radio > switched to the local hip hop station and began blaring Skee-lo at full > volume. I spun the control knob left and hit the power button, to no > avail. Then the windshield wipers turned on, and wiper fluid blurred the > glass. > ... > The result of their work was a hacking technique—what the security > industry calls a zero-day exploit—that can target Jeep Cherokees and > give the attacker wireless control, via the Internet, to any of > thousands of vehicles. > ... > I mentally congratulated myself on my courage under pressure. That’s > when they cut the transmission. > > Immediately my accelerator stopped working. > </quote> > It's true. This isn't the first time these guys have demonstrated this kind of exploit. I heard an interview with Greenberg on NPR earlier in the week. Fascinating and terrifying! -S

17 28

Fwd: [liberationtech] Introducing SeeOnce
by Razer 28 Jul '15

28 Jul '15

-------- Forwarded Message -------- Subject: Introducing SeeOnce Date: Mon, 27 Jul 2015 17:40:55 -0500 From: Francisco Ruiz <ruiz(AT)iit.edu> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> To: liberationtech <liberationtech(a)lists.stanford.edu> Newsgroups: gmane.technology.liberationtech Hello LiberationTech subscribers, SeeOnce is a new web app that encrypts text and files with forward secrecy. This is achieved by changing keys with every message rather than using a server to store keys or encrypted material. SeeOnce consists of a single, relatively small html document, which doesn't connect to any servers. It is based on a javascript implementation of TweetNaCl, plus WiseHash, a dictionary-based key entropy meter that adds a variable number of scrypt key stretching rounds for weaker keys. Forward secrecy is obtained through a protocol similar to OTR messaging, except that communications are expected to be asynchronous. SeeOnce connects to the browser's default email through conventional mailto and web links, so users don't need to install anything. Removal of ephemeral data can be done via a single button. Another important goal is to make key exchange transparent to the user, so that even complete novices can use it right away. Please take a look at SeeOnce and give us any suggestions you might think appropriate. The preferred way is by starting Issues at the project's GitHub page at: https://github.com/fruiz500/SeeOnce The app is directly downloadable from https://seeonce.net. A Chrome app, able to synchronize its data through Google servers, is available at:Â https://chrome.google.com/webstore/detail/seeonce-privacy/jbcllagadcpaafoek… Thank you very much. -- Francisco Ruiz Associate Professor MMAE department Illinois Institute of Technology PL22ezLok=gqqjw-pq3eu-sgzpp-j87cn-fh7ik-6kvmn-comx2-b4xfn-gihga-s46e4=PL22ezLok h**ps://www 'dot' youtube 'dot' com/watch?v=UOJXI8E0lKY get the PassLok privacy app at: https://passlok.com <http://passlok.com>

1 0

the LibGen situation
by Eugen Leitl 28 Jul '15

28 Jul '15

https://www.reddit.com/r/Scholar/comments/3bs1rm/meta_the_libgenscihub_thre…

1 0

Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway)
by wirelesswarrior＠Safe-mail.net 28 Jul '15

28 Jul '15

Jim, Only what I have read. The reviews by professionals have been very favorable given its price though not in the same league as pro equipment. Some use it often to take into the field while leaving their expensive gear safe on the bench. The software is also well reviewed though closed source, AFAIK. WW -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>, "wirelesswarrior(a)Safe-mail.net" <wirelesswarrior(a)Safe-mail.net> Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> Subject: Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway) Date: Tue, 28 Jul 2015 06:11:20 +0000 (UTC) > > > From: jim bell <jdb10987(a)yahoo.com> > From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> > > > > wirelesswarrior(a)Safe-mail.net <wirelesswarrior(a)Safe-mail.net> writes: > > > > >>For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, > .>>that not long ago were in the $10,000s. The HackRF (which some have > >>complained is little more than an IF strip) effectively covering down to > >>below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is > >>not in the same league as the 16-bit USRPs). If some hardware hacker were to > >>deliver a 14-16 bit ADC daughter board (there are afforadble chips offering > >>up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it > >>could substantially improve its use. > > >The problem with the HackRF (and other USB-based devices) is the bandwidth of > >the USB connection, it's not that the HackRF hardware can't handle it, it's > >that you can't get that much data to the PC. > > >(I have a HackRF - I needed a cheap way to track down some odd RFI issues - > >and it's a pretty cool piece of hardware for the money, but, as I mentioned > >earlier, you do get what you're paying for. If I could make a wishlist, it'd > >be nice to have a rev.2 with some work done on the front- end...). > > Do you know anything about this model: http://www.triarchytech.com/index.html 4, 6, 8, and 12 GHz units. > > Jim Bell > > > > > > > > > > > > > > > > > > > >

1 0

Intercept receivers (was Re: Hackers Remotely Kill a Jeep on the Highway)
by wirelesswarrior＠Safe-mail.net 28 Jul '15

28 Jul '15

-------- Original Message -------- From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Apparently from: cypherpunks-bounces(a)cpunks.org To: jdb10987(a)yahoo.com Cc: cypherpunks(a)cpunks.org Subject: Re: Hackers Remotely Kill a Jeep on the Highway Date: Sun, 26 Jul 2015 21:42:14 +1200 > jim bell <jdb10987(a)yahoo.com> writes: > > >There are some rather economical spectrum analyzers being sold today. > > You have to be careful with those, the straight USB-dongle ones are going to > be SDR-based, typically the RTL820T meant for DVB-T use (and re-purposed by > half the hacking world for all manner of other things), then you have the USB- > interface ones with more powerful SDRs, and finally you've got purpose-build > spectrum analysers. Compared to the real thing, you're going to run into > severely limited bandwidth (anything that spreads the signal across a wide > spectrum is going to be difficult to impossible to deal with), and not-so- > spectacular signal handling (there's a reason why the real thing costs > thousands of dollars). > > That's not to say that they're no good, just that you need to be aware that > you're getting what you pay for. If you've got a specific purpose in mind, > check first that whatever you're getting will be able to do the job. There's > quite a bit of material out there on this, google something like "sdr spectrum > analyzer" to find articles on it. > > Peter. Achieving receivers and spectrum analyzers with wide frequency coverage, high dynamic range and wide bandwidths (with very low noise circuitry, stable local oscillators, etc.) simultaneiously has, up till recently, demanded very high prices. That's why few outside of governments, corporations and well-funded professionals could afford them. However, with the rapid growth and falling prices of SDR this has and is changing. For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, that not long ago were in the $10,000s. The HackRF (which some have complained is little more than an IF strip) effectively covering down to below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is not in the same league as the 16-bit USRPs). If some hardware hacker were to deliver a 14-16 bit ADC daughter board (there are afforadble chips offering up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it could substantially improve its use. WW

3 3

Varoufakis claims had approval to plan parallel banking system for Greece
by John Young 28 Jul '15

28 Jul '15

Varoufakis claims had approval to plan parallel banking system for Greece http://www.ekathimerini.com/199945/article/ekathimerini/news/varoufakis-cla… Allegedly aided by Columbia University IT professor to design a hack of existing taxation systems. Columbia Computer Science Faculty http://www.cs.columbia.edu/people/faculty

3 6

How do cookies on Twitter give me "safer experience"?
by Georgi Guninski 27 Jul '15

27 Jul '15

With javascript and cookies disabled, go to https://twitter.com/ Orange CSS shit which can't be closed with the "X" suggests: > Cookies help personalize Twitter content ... and provide you with a > better, faster, safer Twitter experience. By using our services, you > agree to our Cookie Use. Me fails to see how browsing Twitter with cookies enabled makes me any any safer. How so?

3 2

Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway)
by wirelesswarrior＠Safe-mail.net 27 Jul '15

27 Jul '15

Peter and Jim, -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>, "wirelesswarrior(a)Safe-mail.net" <wirelesswarrior(a)Safe-mail.net> Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> Subject: Re: Intercept receivers (was Re: Hackers Remotely Kill a Jeep onthe Highway) Date: Mon, 27 Jul 2015 15:31:17 +0000 (UTC) From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wirelesswarrior(a)Safe-mail.net <wirelesswarrior(a)Safe-mail.net> writes: >>For example, Ettus' USRPs, covering VHF to 6 GHz or so, starting under $1000, .>>that not long ago were in the $10,000s. The HackRF (which some have >>complained is little more than an IF strip) effectively covering down to >>below 10 Mhz is only $300 (though its performance, due to only 8-bit ADC, is >>not in the same league as the 16-bit USRPs). If some hardware hacker were to >>deliver a 14-16 bit ADC daughter board (there are afforadble chips offering >>up to 60M samples/sec) for the HackRF (it is provisioned to accept one) it >>could substantially improve its use. >The problem with the HackRF (and other USB-based devices) is the bandwidth of >the USB connection, it's not that the HackRF hardware can't handle it, it's >that you can't get that much data to the PC. The HackRF contains a LPC4320 which has unused capacity for light DSP and other tasking. For any heavy DSP it could use a FPGA. It has an internal header for expansions like this (and/or a higher resolution ADC and its CPLD can be reflashed to accomodate such changes. >(I have a HackRF - I needed a cheap way to track down some odd RFI issues - >and it's a pretty cool piece of hardware for the money, but, as I mentioned >earlier, you do get what you're paying for. If I could make a wishlist, it'd >be nice to have a rev.2 with some work done on the front- end...). The HackRF, like all wideband, direct conversion, receivers, can suffer LNA saturation from nearby/very strong out-of-band signals (pagers and FM broadcasts). A cheap, simple, solution is a coax notch filter, in line with the antenna. I've been experimenting with these and they seem to work very well. From: jim bell <jdb10987(a)yahoo.com> Here's my idea for a probe for an RF device. The wavelength of a 2.45 GHz signal (WiFi) is about 12 cm. A quarter-wave antenna would be 3 cm. Or, that 3 cm could be in the form of a loop, at the end of a piece of.'hardline', or other coaxial cable. (hardline would be best, I think, because it is a small diameter. ) https://en.wikipedia.org/wiki/Coaxial_cable So, the diameter of the loop would be a bit more than 1 cm diameter, which is appropriate for finding tiny RF sources. One side of the loop would be connected to the center conductor of the coax, and the other side of the loop connected to the shield of the coax. Note: The coax should probably have many dissipative RF beads strung along its length, in order to prevent the cable itself from picking up RF, and delivering to the loop on the end, thereby to be detected. http://www.amidoncorp.com/small-ferrite-beads/ There are many different kinds of materials that such beads are made from; perhaps we can have an RF engineer chime in on the subject. He can also tell us if the loop is too-badly mismatched (RF impedence) to the coax to function well. Jim Bell Try it!

1 0

Re: Varoufakis claims had approval to plan parallel banking system for Greece
by Georgi Guninski 27 Jul '15

27 Jul '15

On Mon, Jul 27, 2015 at 01:11:51PM +0200, Jorge SoydelBierzo wrote: > > Varoufakis denies this info http://twitter.com/yanisvaroufakis/status/625336067831558144 > > Don't know what the truth is. >From TFA: === Recorded call You can find extracts from the conversation below. Varoufakis was advised that the call was being recorded when it began. === === Normal Lamont interrupts: "There are certainly others listening but they will not tell it to their friends." Varoufakis (laughing): "I know. I know they are. And even if they do I will deny I said it === > > El 27/7/2015, a las 12:34, Georgi Guninski <guninski(a)guninski.com> escribió: > > > >> On Sun, Jul 26, 2015 at 06:38:07PM -0400, John Young wrote: > >> Varoufakis claims had approval to plan parallel banking system for Greece > >> > >> http://www.ekathimerini.com/199945/article/ekathimerini/news/varoufakis-cla… > >> > >> Allegedly aided by Columbia University IT professor to design a > >> hack of existing taxation systems. > >> > >> Columbia Computer Science Faculty > >> > >> http://www.cs.columbia.edu/people/faculty > > > > From TFA (looking for the best, but expecting the worst): > > > > === > > “But let me give you an example. We were planning along a number fronts. > > I will just mention one. Take the case of the first few moments when the > > banks are shut, the ATMs don’t function and there has to be some > > parallel payment system by which to keep the economy going for a little > > while, to give the population the feel that the state is in control and > > that there is a plan.” > > === > > > > > >

1 0

SIGINT and improving wireless privacy at the PHY
by wirelesswarrior＠Safe-mail.net 27 Jul '15

27 Jul '15

I will be co-presenting a paper, with Ettus' Balint Seeber, at Defcon 23 (Balint will also be presenting a separate, coordinated, paper). http://www.wirelessvillage.ninja/speakersched.html WW

4 3