- cypherpunks@lists.ogf.org

Fwd: [cryptography] JackPair Voice Encryption Dongle
by grarpamp 03 Sep '14

03 Sep '14

---------- Forwarded message ---------- From: Tom Ritter <tom(a)ritter.vg> Date: Mon, Aug 18, 2014 at 9:58 AM Subject: [cryptography] JackPair Voice Encryption Dongle To: Randombit List <cryptography(a)randombit.net> https://www.kickstarter.com/projects/620001568/jackpair-safeguard-your-phon… https://www.youtube.com/watch?v=rh6yF79FkAA DH with a 'Pairing Code' (ala ZRTP) to prevent MITM. Light on exact details, but they say it will be open source. "we think 10-12 digits [for a pairing code] is probably good enough, and more friendly for human reading" "We are using Diffie-Hellman at this point, and working on Elliptic curve Diffie-Hellman." "Synchronous stream cipher is used, with XOR'ed key-stream resulted from pseudo random number generator using OTSK as seed, and periodic marker flag for re-synchronization." "JackPair uses audio codec from Codec2, which has reasonable good sound quality at 1.2kbps. We have tested JackPair on top of GSM AMR 4.75 (Adaptive Multi-Rate, 4.75kbps) and HR (Half-Rate, 6.5kbps)." "Unlike traditional fax-modem technologies, our modem is designed from scratch to fight off the optimization done by GSM codec, including memory-less codec, voice activity detection (VAD)., automatic gain control (AGC) etc.. Basically we have to use synthesized voice to make mobile phones & media servers believe our signal is human voice, not just modulated waves." -tom _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

UWB Time Domain SDR Radio
by grarpamp 03 Sep '14

03 Sep '14

On Tue, Aug 19, 2014 at 10:50 AM, Troy Benjegerdes <hozer(a)hozed.org> wrote: > On Tue, Aug 19, 2014 at 02:37:35PM +0200, Eugen Leitl wrote: >> > > In unrelated vein, I've recently read that it was the spooks >> > > that killed the digital pulse radio star, by limiting licensend >> > > power to toy levels. Apparently they were very unhappy with a >> > > radio that's hard to look for. >> http://www.cringely.com/2014/05/15/nsa-help-kill-uwb/ " Rather than using specific frequencies UWB transmitted on all frequencies at the same time. The key was knowing when and where in the frequency band to expect a bit to appear. Two parties with synchronized clocks and codebooks could agree that at 10 nanoseconds after the hour at a certain frequency or range of frequencies a bit would appear if one was intended. The presence of that signal at that time and place was a 1 and the absence was a 0. But if you didn’t know when to listen where — if you weren’t a part of the conversation — it all looked just like noise." > UWB is a great idea in theory, until you build an antenna, or you > avoid the antenna and the UWB noise floor ends up as a DDOS attack > on all your existing communications channels. I'm interested in further links to papers regarding this ultra wide band UWB, pulse position modulation PPM, time domain TD scheme as it applies to radio spectrum. Especially any links to hack work being done under software defined radio SDR.

1 0

Re: ‘Fake’ cellphone towers found in U.S.
by coderman 02 Sep '14

02 Sep '14

On 9/2/14, Cathal Garvey <cathalgarvey(a)cathalgarvey.me> wrote: > ... > Also, that nameless towers are assumed to be government intercepts. I > can imagine (though I don't know much, if I'm honest) situations in > which backup towers brought in for events (concerts, public gatherings, > etc.) might be contracted from third parties and present apparently > aberrant nomenclature, if any. These backup cells might be brought into > otherwise quiet areas for normal maintenance, or to back up faulty > towers, etc.; a legitimate roaming association when out of normal coverage areas is different from what could be called an "intercept attack". that is to say, actively placing an intercept channel in front of a station when that station is able to associate with legitimate carrier towers is an active attack against carrier networks, while a roaming association when out of range of carrier is a desired function and not malicious. to complicate matters, a number of years back i reported on active MitM attacks on 4G networks by interfering with existing associations to force a roaming hand-off to attacker endpoint. thus a determination of what is "normal" perspective to carrier towers requires a span of time combined with local observation. (snapshots not sufficient) also, the new broadband back-haul'ed femtocells that some carriers are distributing may or may not appear as an impersonating interceptor, exhibiting the usual properties of a rogue tower while actually being carrier provisioned capacity. > ... on the other hand, why would the > US feds need to roll out a nationwide cell tower network to spy on > everyone when..they already have one? :) this is an interesting question. presumably there are two reasons: a) that the usual intercepts require judicial approval and logistic delays, and b) manipulating the local link and signaling channel affords deep "enabling" of the target via means not cleared to transit untrusted networks. fun questions, encourage more research! :P

2 1

Privacy Law [Hiibel, Terry, ID, etc] [was: Run Bitcoin, be concerned/prepared]
by grarpamp 02 Sep '14

02 Sep '14

On Tue, Sep 2, 2014 at 7:57 AM, coderman <coderman(a)gmail.com> wrote: > is anyone pursuing this in any other states? the ACLU seems to list > just Hiibel. .. I don't know, someone could write ACLU and ask. https://www.aclu.org/technology-and-liberty/hiibel-v-sixth-judicial-distric… > those are better. thanks :) Now with Nevada, number 38876... http://caseinfo.nvsupremecourt.us/public/caseView.do?csIID=4764 Oral args multimedia... http://www.oyez.org/cases/2000-2009/2003/2003_03_5554 Epic flavor... http://epic.org/privacy/hiibel/ Cornell 'legal resources' section is pretty good. http://www.law.cornell.edu/ https://www.aclu.org/organization-news-and-highlights/supreme-court-ends-te… [Subject updated, gmail dethreaded, refer back for earlier links.]

1 0

If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared
by Eugen Leitl 02 Sep '14

02 Sep '14

http://www.thedrinkingrecord.com/2014/08/25/a-law-enforcement-encounter-if-… A Law Enforcement Encounter: If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared Posted on August 25, 2014 So this afternoon I was roused from my day slumber by vigorous knocking at my front door. Under the impression the two gentlemen at my door step might be some sort of process servers or collections agents visiting about my substantial student loan debt I begrudgingly inquire as to what is going on. They inquire as to who I am, and I inquire as to who they are. 1 When they show badges I offer confirmation that I am indeed the person referred to frequently by the slave name2 they used. Their inquiry was laser focused on any information I might have about connections between BTCPak and The Silk Road3 of which I have none that can't be discovered by scraping public information off of the public web. BTCPak was this thing that accepted Bitcoin and provided prepaid codes you could load on to shitty Debit cards. I was new and didn't know any better so I had some of the most costly eatings and drinkings of my life. BTCPak was one of the more expensive ways to turn Bitcoin into US Dollars, but its advantage was it was fast and had a great reputation for working. If there weren't any codes to be had, the site wouldn't take Bitcoin. If you sent it Bitcoin it gave you the code in six confirmations. There was no market I knew of to feed the codes the other direction. The entire venture didn't even really seem to be a business. It just seemed to be a machine DBordello built to acquire Bitcoin in an automated fashion which as far as I can tell was turned off, because the future he was buying all of the cheap coins for finally arrived. A notable thing that kept coming up was an incredulity on the part of the investigators was that there was much of anything happening in early Bitcoin that wasn't shady and related to Black Market drugs. In reality a lot of stuff was happening on the plaintext Internet without the slightest shade of illegality. I mentioned the Devcoin4 thing that was my first source of any actual amount of Bitcoin. Devcoin was/is this arrangement where by dumping text into a wiki you earned coins on an altchain. You could then take the coins to this shitty exchange called Vircurex where you could dump them for BTC. As astounding as it seems at the time when I started doing this devcoin thing dumping a few thousand words in their wiki was probably worth a two digit number of BTC in the first month I got paid. Fuck me for having been so shortsighted and having not quite stumbled into what actual people were writing about Bitcoin. As astoundingly stupid as the premise sounds much of early Bitcoin involved people throwing coins around for appallingly, dumbfoundingly, stupid reasons in the name of "supporting Bitcoin" and "getting the ecosystem moving." Many stupid and lucrative things were scams of the Pirateat40 and GLBSE sort,5 I instead did the writing for Devcoins thing because I like sleeping soundly at night. What you, dear reader can take from this encounter is that if you were involved with Bitcoin before Coindesk6 became a thing and live in the United States, you too might be questioned by agents of two separate federal law enforcement agencies at the same time. If they are asking about BTCPak now, who knows how long the backlog of sites and ventures they are working through is. It's something to prepare for. When the agents suggested that I probably never expected they'd find me, they seemed a little shock when I replied that I kind of expected this attention eventually. I don't exactly keep the connections between my self and my slave name incredibly well guarded secrets, at least not on the scale of Silk Road users and administrators. This old Boy Scout would like to remind everyone of the motto: "Be Prepared". The reason for this is in my jurisdiction failure to identify yourself in a law enforcement encounter is a crime of questionable constitutional provenance, while having a conversation with a debt collector or process server that consists of nothing on your part other than intoning "Fuck You" a myriad of different was is great justice for all and legally sound. ↩ This odd thing happens when use a screen name long enough and act with established, credible pseudononymity in a space long enough, especially one with such an effective Web of Trust surrounding it. The layperson Toby gets asked about the learned amateur Bingo's hobby and suddenly you find yourself in an IRL encounter where you feel like you are wearing a person suit. Welcome to the future, its a weird fucking place. ↩ That thing I've avoided and wrote about on this blog before. ↩ Even though devcoin has dropped twenty times in value from ~200 satoshis per to ~10 satoshis per now, holding it would still have booked a dollar denominated gain over the time. But no, holding Devcoin would be stupid. ↩ Well so it would have seemed at least to the people running them. Running such a thing though doesn't fit my acceptable risk profile in the same way The Silk Road never fit my acceptable risk profile. ↩ Yes, the FBI agent name dropped Coindesk as a thing he reads as well as admitting to having a small amount of Bitcoin. ↩ This entry was posted in Bitcoin, Commentary, Disclosures, News. Bookmark the permalink.

3 5

Re: going double cryptome at DEF CON 22
by coderman 02 Sep '14

02 Sep '14

On 7/30/14, Eugen Leitl <eugen(a)leitl.org> wrote: > ... > Can you keep up the docs for a while? I forgot to mirror them. plans to provide a mirror of the DEF CON media archive indefinitely delayed. also redundant now that media.defcon.org is populated... in case you did not hear already, they canceled drive #3 from the media set, which was to include the cryptome mirror. alas, my copies also corrupted for the two volumes that were provided. perhaps prominently labeling them "GAY PR()N vol 0x0A:", and "... 0x0B" causing unintended consequence? . . . at any rate, the onion mirrors will be up for another month, but maybe not much longer... best regards,

1 0

Re: [Cryptography] cryptography Digest, Vol 16, Issue 26
by grarpamp 01 Sep '14

01 Sep '14

On Wed, Aug 27, 2014 at 3:21 PM, Peter Trei <petertrei(a)gmail.com> wrote: > On 26 Aug 2014 21:28:49 -0000 "John Levine" <johnl(a)iecc.com> wrote: > > Subject: Re: [Cryptography] toll bills, was Encryption opinion > >>> I've not been on any of those > ?>roads, but I've gotten three e-mailed bills in the last two weeks >>>that to the unskeptical eye look fully legitimate, which also >>>indicates that the phishers know that my geolocation makes driving >>>such roads plausible. > >> It's not geolocation, everyone is getting E-ZPass spam this month. I >> have an E-ZPass account, and can report that it looks nothing like the >> real mail they send, which just tells you to look at their web site >> for a statement or other message. This is aimed at the same kinds of >> suckers who fall for 419. > >> I also got an actual e-mail this month from an actual toll road >> telling me about an actual charge due to actually driving on it. It >> was the 407 in Toronto, not E-ZPass, and I knew they'd be billing me >> so I set up an account so they'd e-mail me instead of the default >> paper bill, but still ... > >> John > >> PS: So is there any crypto on toll transponders, or could I >> skim them from the side of the road and make clones? > > Apparently some do, most don't. EZ Passes are made by > Kapsch (Kapsch.net) which has data sheets available, and has > made their protocols open source. > > You can easily modify one to inform you of when its queried: > http://www.popsci.com/article/diy/ezpass-hack-covert-scanning " Bear <bear(a)sonic.net> Aug 28 (4 days ago) I've got one. It's an envelope lined with copper foil. I get the pass out when approaching a toll booth, and put it back (and put the 'chip clip' back on the envelope to ensure that the foil makes good electrical contact) as I pull away from the toll booth. A toggle switch would be nice, but we can be fairly confident that a Faraday cage is working as designed. Bear. " > ...and it turns out they're queried all over the place, not just at > tolls. There have been proposals for a 'kill switch' which would > allow you to disable it except when approaching a toll, but I > haven't seen that. > > But its moot, anyway. Transponders are being replaced by > license plate scanning. This is yet another case where we > accepted something (permanently visible LPs) on the basis > that no one could track every plate, everywhere, all the time. > Technology moved on, and invalidated that promise of > privacy-unless-they-really-really-need-to-violate-it. So you need active defense of plate masks/obfuscation mechanichs... flip down blanking devices, character cards, mask films on a loop roll motor, OLED plates. DIY 007. Drive masked, reveal as needed. Worst case, you don't notice the cop car near you and get a paper ticket for no plate or a hacked random nonspec plate. $100+... better than daily loss of privacy to intersection/roadside cams, google robot cars, etc. Next battle... killing all the manufacturer supplied transponders in your car... Then your cell phone.

1 0

[tt] NYT: Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58
by Eugen Leitl 01 Sep '14

01 Sep '14

----- Forwarded message from Frank Forman <checker(a)panix.com> ----- Date: Mon, 1 Sep 2014 00:35:43 +0000 (GMT) From: Frank Forman <checker(a)panix.com> To: Transhuman Tech <tt(a)postbiota.org> Subject: [tt] NYT: Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58 Message-ID: <Pine.NEB.4.64.1409010035310.8967(a)panix2.panix.com> Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58 http://www.nytimes.com/2014/08/31/business/hal-finney-cryptographer-and-bit… By NATHANIEL POPPER Hal Finney, a cryptographer and one of the earliest users and developers of the virtual currency Bitcoin, died on Thursday in Phoenix. He was 58. Mr. Finney had been paralyzed by amyotrophic lateral sclerosis, or A.L.S., and was taken off life support at Paradise Valley Hospital, his wife, Fran Finney, said. She said his body was immediately prepared for cryonic preservation by the Alcor Life Extension Foundation in Scottsdale, Ariz., according to his wishes. A graduate of the California Institute of Technology, Mr. Finney was a longtime futurist who put his programming skills to work in the service of his ideals, particularly his desire to see the privacy of individuals protected. In 1991, he began doing volunteer work for a new software project known as Pretty Good Privacy, or P.G.P., and immediately became one of the central players in developing the program. P.G.P. aimed to make it possible for people everywhere to encrypt electronic communication in a way that could not be read by anyone other than the intended recipient. The program used relatively new innovations in encryption that are still thought to be invulnerable to code breakers. Mr. Finney wrote in 1992 that cryptographic technology appealed to him because he worried about the ability of corporations and governments to snoop on citizens. "The work we are doing here, broadly speaking, is dedicated to this goal of making Big Brother obsolete," he wrote to an online group of fellow privacy activists. The original author of P.G.P., Philip R. Zimmermann, quickly became the target of federal prosecutors, who believed that the software broke United States laws against exporting military-grade encryption software. While the investigation went on and became a major cause for civil libertarians, Mr. Finney played a more quiet role in P.G.P. to avoid becoming a target himself. Mr. Zimmermann said in an interview that this decision meant Mr. Finney did not get proper credit for some of the important innovations he had made in the development of P.G.P. When the investigation concluded in 1996 without any charges being filed, P.G.P. became a company, and Mr. Zimmermann set out to hire Mr. Finney as his first employee. Mr. Zimmermann, in an interview before Mr. Finney died, said Mr. Finney was unusual in the field because he had none of the asocial tendencies and physical awkwardness that are commonly associated with people in the programming world. Rather, he said, Mr. Finney was a gregarious man who loved skiing and long-distance running. "Sometimes people pay some price for being extremely smart--they are deficient in some emotional quality," Mr. Zimmermann said. "Hal was not like that." While working on P.G.P., Mr. Finney was a regular participant in a number of futurist mailing lists, the most famous of which gave birth to the Cypherpunk movement, dedicated to privacy-enhancing cryptography. Following these lists, Mr. Finney became fascinated by the concept of digital currencies that could not be tracked by governments and banks. He was involved in many experiments aimed at creating an anonymous form of digital money, including his own invention, in 2004, of reusable proofs of work. Though that system never took off, he quickly saw the promise of the Bitcoin project when it was announced on an obscure email list in 2008 by a creator with the pseudonym Satoshi Nakamoto. Bitcoin used some of the same cryptographic tools harnessed by P.G.P. and held out the promise that participants could choose to be anonymous when spending money online. When the project drew criticism from other cryptographers, Mr. Finney was among the first people to defend it. He downloaded the Bitcoin software the day it was released. The day after that, he took part in the first transaction on the network when Satoshi Nakamoto sent him 10 Bitcoins. His early work on Bitcoin and his programming background led to frequent speculation in the Bitcoin community that Mr. Finney was Satoshi Nakamoto, a claim he always denied. Soon after getting started with Bitcoin, Mr. Finney learned in 2009 that he had A.L.S., and he withdrew, for a time, from active participation in the project. Harold Thomas Finney II was born on May 4, 1956, in Coalinga, Calif., to Virginia and Harold Thomas Finney. His father was a petroleum engineer. After graduating from Caltech in 1979 with a degree in engineering, he worked for a company that developed video games like Astroblast and Space Attack. As a young man, Mr. Finney developed an interest in preserving life through cryonic freezing until better, life-enhancing technologies were invented, said a college roommate, Yin Shih. In 1992, Mr. Finney visited the Alcor facility with his wife to determine whether he wanted to sign up his family to be preserved in Alcor's "containment vessels." "In my personal opinion, anyone born today has a better than 50-50 chance of living effectively forever," he wrote at the time. Mr. Finney remained an employee of the P.G.P. Corporation until his retirement in 2011, working from his home in Santa Barbara, Calif. In the last few years, Mr. Finney was able to move only his facial muscles, but he communicated and wrote Bitcoin-related software using a computer that tracked his eye movement. "I'm pretty lucky overall," Mr. Finney wrote on a Bitcoin website in 2013. "Even with the A.L.S., my life is very satisfying." As the price of Bitcoins rose, his family, to pay for his medical care, was able to sell some of the coins he secured in the early days. Besides his son, Jason, and his wife, he is survived by a daughter, Erin Finney; two sisters, Kathleen Finney and Patricia Wolf; and a brother, Michael. His wife, a physical therapist whom he met at Caltech, spent most of her days caring for him in his final years. After Mr. Finney's death, the freezing of his remains was announced by another futurist, Max More. "Hal," he wrote in a statement online. "I know I speak for many when I say that I look forward to speaking to you again sometime in the future and to throwing a party in honor of your revival." _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt ----- End forwarded message -----

2 1

[Bitcoin-development] Testing and reviewing requested for work on Bitcoin Core wallet
by Eugen Leitl 01 Sep '14

01 Sep '14

----- Forwarded message from Wladimir <laanwj(a)gmail.com> ----- Date: Mon, 1 Sep 2014 10:25:23 +0200 From: Wladimir <laanwj(a)gmail.com> To: Bitcoin Dev <bitcoin-development(a)lists.sourceforge.net> Subject: [Bitcoin-development] Testing and reviewing requested for work on Bitcoin Core wallet Message-ID: <CA+s+GJD_sKjJ52dA6W0aj1tPNV8bTCqX9H0iuQ56bpi6w3s7wg(a)mail.gmail.com> Hello, Cozz Lovan has been doing great work on Bitcoin Core's wallet code lately. If anyone cares about Bitcoin Core's wallet, for example its performance, do help testing and reviewing these improvements so that they can make it into 0.10: Subtract fee from amount https://github.com/bitcoin/bitcoin/pull/4331 [Wallet] Improve ReorderTransactions(..) https://github.com/bitcoin/bitcoin/pull/4697 [Wallet] Replace OrderedTxItems(..) with in-memory map https://github.com/bitcoin/bitcoin/pull/4702 [Qt] Call checkBalanceChanged() periodically instead for every updated tx https://github.com/bitcoin/bitcoin/pull/4712 Move g_signals.SetBestChain(..) below SyncWithWallets https://github.com/bitcoin/bitcoin/pull/4798 [Wallet] Call SetBestChain before and after rescan https://github.com/bitcoin/bitcoin/pull/4800 [Wallet] Do not flush the wallet in AddToWalletIfInvolvingMe(..) https://github.com/bitcoin/bitcoin/pull/4805 Wladimir ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development ----- End forwarded message -----

1 0

Update on interdiction, secret GSM
by bluelotus＠openmailbox.org 29 Aug '14

29 Aug '14

I purchased the latest smartphone with a slider qwerty keyboard. A Motorola Droid 4 with CM11 and a T5 torx screwdriver from Ebay. The two T5 screws to the battery ribbon cable had been glued. I discarded the smartphone. http://www.reddit.com/r/privacy/comments/2e7lwl/of_mylar_bags_to_block_phon… Nook Tablet with CM 10 arrived DOA. I could not go past the CM welcome screen. Tablet wouldn't shut down or reboot. I returned it to the seller. MIPS tablet #1 didn't charge via USB port, was missing file manager, Adobe Reader, Skype and app installer, would not mount my SD card and bricked my 16 GB SD card. I tried to use tablet #1's micro USB port to copy my personal files but tablet's USB port would not function. http://www.reddit.com/r/badBIOS/comments/2ejydo/mips_processors_are_rare_mo… MIPS tablet #2 did charge via USB port, was missing app installer but had file manager, Adobe Reader, Skype and two games whereas tablet #1 did not have any games, mounted my SD card but bricked my 8 GB SD card. I was able to copy my personal files using the tablet's micro USB port. http://www.reddit.com/r/badBIOS/comments/2el93r/cannot_air_gap_mips_tablet/ aLogcat logs disclose secret GSM in MIPS tablet #2: http://www.reddit.com/r/badBIOS/comments/2eub37/secret_gsm_in_mips_tablet_i… Hours after posting the above thread yesterday, my MIPS tablet #2 was stolen from my room. Were my laptops implanted with GSM and infected with firmware rootkits when they were interdicted? I had assumed FM radio transceiver/beacon implants or badBIOS. Many of the linux /var/logs I was denied permission to read even though I had logged into the graphical desktop on my laptops. A few of the /var/logs were of unknown file type. The type was unknown to the file manager. Had the firmware rootkits not tampered with the /var/logs, GSM may have been reported in the logs. Military contractors getting special access to surveillance programs. https://www.youtube.com/watch?v=JyT7yzap1Wc Greenpeace loses lawsuit over being hacked by former NSA hackers hired by private investigators hired by corporation http://readersupportednews.org/opinion2/277-75/25479-focus-corporations-spy… "Last year, California’s Pacific Gas and Electric Company (PG&E) was required after an investigation to pay $390,000 to the state’s General Fund after it was discovered that they were spying on anti-smart meter activist groups." http://www.foxnews.com/us/2014/04/17/is-your-home-energy-meter-spying-on/

1 0