Friday Squid Blogging: Simple Grilled Squid Recipe
Easy recipe from America’s Test Kitchen.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Comments
Geek Squad Leader • January 6, 2017 4:52 PM
Readers with long memories will remember that around 2011 there was a large spate of incidents where child pornography was found on computers that people had taken in for repair. There are now serious allegations that the FBI paid computer repair shops–including Best Buy–to place and then “discover” child pornography on customer’s computers. Best Buy is denying everything, of course, but this could blow up into one of the big computer security stories of 2017.
albert • January 6, 2017 4:56 PM
Old, but interesting:
https://fas.org/blogs/secrecy/2017/01/info-ops-dcid/
Also, check out governmentattic.org (FOIAs and other gov’t docs)
. .. . .. — ….
Noah • January 6, 2017 6:09 PM
Ex-soldier pleads guilty to terror crime after not revealing iPhone PIN
“Clarke’s offence was to obstruct a search carried out under the notorious Schedule 7 of the Terrorism Act 2000 – not in itself a terrorist crime as ordinary people would recognise. He refused to give police the PIN to his iPhone, claiming that he used the fingerprint access method and that he couldn’t remember the numerical PIN. A PIN he gave them allegedly did not work.”
http://www.theregister.co.uk/2017/01/05/ex_soldier_terrorist_offence_not_revealing_iphone_pin/
Thoth • January 6, 2017 8:26 PM
@Noah
That’s how things are these days. The US Constitution is simply a paper that the US Govt consistently violate while pretending to uphold it. The 5th Amendment rights simply don’t exist at all since asking for PIN or passwords and coercing and jailing the target is a clear breach of the 5th Amendment. It is not surprising that the US Govt is runned by a bunch of crooks and will always be.
How do we improve iPhone’s security when a PIN needs to be extracted from a target via coercion and torture ?
This is where self-destruct PIN codes come in handy assuming the following security requirements are met to ensure that the normal PIN and self-destruct PIN cannot be differentiated:
-
PIN comparison are to be held in security processor. I hate to say TrustZones and Secure Enclaves are secure backdoors but most people wouldn’t bother to use a smart card or external security device so it’s better to suck it up and say yea to TZ and Apple SE. So for this a smart card, TZ or Apple SE is required.
-
PIN entry mechanism must be uniform. That means the password textfield or PIN pad must be used to accept both the self-destruct PIN or the normal user PIN. There must be no special “self-destruct” entry field as this will give away the intention of the user.
-
PIN comparison mechanism to be robustly implemented and be made random to deciding which type of PIN to compare first that attackers cannot predict between the input PIN being compared against the stored user PIN or the stored self-destruct PIN. This prevents attackers from glitching the PIN comparing mechanism in an attempt to protect against predictive blocking the self-destruct PIN comparison from taking place via glitching attacks. One way to implement is to set a tamper flag in the register and round a random. The random is used to initialize whether to compare the input PIN to the user PIN or self-destruct PIN first. The tamper flag is simply a reserved byte in CPU’s SRAM cache where every step executed is incremented and written back to the SRAM cache and if the increment skips a step, it is obvious that a tamper is detected and the procedure is reset and SRAM and input PIN cleared from S/RAM memory. Because it is handled in the TZ or Apple SE secure processing zone, it is assumed that the transient data assigned inside is “secure”.
-
Simply storing the PIN directly is detrimental to reverse engineering attacks and bruteforce. Apple does it best by “mixing” a random nonce value with the PIN codes and password hash it and only the password hash is stored. Android uses a private key stored on chip and does something similar to Apple by only storing the finally derived password hash. These are pretty decent security practices.
-
After the self-destruct PIN is triggered, it should wipe all the keys and PINs stored on the chip and also best used together with some filesystem encryption. This effectively renders the data on the device unusable after self-destruct takes place. Self-destruct is only detected after the fact when it has occurred due to data not readable anymore (keys and PINs all wiped from TZ or Apple SE).
-
Filesystem secured data are to rely on keys and PINs stored in the TZ and Apple SE in some way so that the FS data is bound to the keys and PINs and when a wipe is initiated, it is gone. No amount of copying of the FS data and sideloading to another similar device should be allowed to work. Of course, users are to be cautioned that the wipe is absolutely permanent without even the slightest chance of recovery and sueing Apple, Samsung or whichever implementors wouldn’t magically make their wiped data suddenly appear and the implementors should not implement another way to recover the FS data via escrowing the keys and PINs stored in the security processing environment. Only due diligence of a backup of decrypted data is allowed.
-
OPSEC requirements when a device owner is captured is to never reveal the true user PIN but give away the self-destruct PIN in a “reluctant” manner. As the user PIN and self-destruct PIN cannot be differentiated from the surface and would only be known after being tried on the specific device itself. User may only give away the real user PIN after he/she is sure that the self-destruct PIN has been activated.
Anura • January 6, 2017 9:02 PM
@Thoth
I don’t think the US Constitution has ever been more than a piece of paper as far as the UK is concerned.
Patrick Burns • January 6, 2017 9:35 PM
We discuss two-factor authentication for IoT devices that explores kill switches and other applications of a “back channel” or a second, low power radio to solve for some IoT security challenges. Curious to hear any feedback from readers of this blog and hope this doesn’t qualify as spam: http://bit.ly/iotkillswitch
Jennifer Gold Stockholm • January 6, 2017 9:41 PM
@ Anura
I don’t think the US Constitution has ever
been more than a piece of paper as far as the > UK is concerned.
Indeed. particularly when one considers, that the US was never granted independence from England, to begin with, and thus remains a vassal state. legally speaking. one can find plenty of evidence to substantiate this online if one so chooses.
That puts a different slant on the U-S-A chant now doesn’t’t it
@All,
Booking in the 21st century, this is what we have to look forward to.
Anura • January 6, 2017 10:20 PM
@Jennifer Gold Stockholm
Well, I’d argue that Europeans stole all North American land, and it doesn’t even legitimately belong to us in the first place. Of course, you could also argue that all land was originally taken by whoever had the biggest stick, therefore it’s all stolen land and no country is legitimate. But really, what makes a country legitimate? Is there such a thing as an illegitimate country? Disputed maybe, but that’s about it.
Clive Robinson • January 6, 2017 10:54 PM
@ Anura, Thoth,
I don’t think the US Constitution has ever been more than a piece of paper as far as the UK is concerned.
Actualy it does crop up very occasionaly in UK legal cases for various reasons. And the process for dealing with it can be as farcical as it is labyrinthine.
But that is not the point I think @ Thoth was making. The problem is that in the US what is ment by your right not to incriminate yourself is becoming less and less under the repeated onslaught of psychopathic DoJ lawyers. Whilst in the UK we had both RIPA and anti-terror legislation that can be used to force you to hand over your pin/password etc or get serious jail time, which the current UK Priminster augmented in the “snoopers charter” whilst she was Home Office Minister.
It is this loss of what were once considered inalienable rights on both sides of the Atlantic that have become a concern to a number of people who are now looking for technical measures…
Most readers hear are aware of the three basic “factors” of authentication systems. However as discussed with @Nick P, @Wael and others, there are other factors / sub factors that might also be considered. So,
1, Something you are (biometric).
2, Something you have (token).
3, Something you know (passphrase).
4, Some place you are (geo_loc).
5, Some time window (temporal).
Whilst 4&5 (geo_loc & temporal) could be considered as sub factors of 3 (know) they are distinctly different. The use of “valid time windows” with passwords is not new, and has been possible under some *nix and other systems for around a third of a century.
It is only in more recent times that the ability for a device to verify it’s geo_location either as it’s absolute or relative position has become possible in a hand held device.
For instance you could use both the GPS system built into the phone due to US legislation or either the Radio Data System (RDS) of a built in VHF radio or the camera for “land mark” verification for absolute position or the Near Field Sensor (NFS) of contactless cards or advertising buttons etc or BlueTooth etc for a relative position.
There is also another factor that could be considered and that is,
6, Someone you know (verifier).
All of these factors could be used as a “Knock code” or “trip wire” for switching the state of a phone into a higher security state.
The use of a “verifier” is interesting legaly, because you can arange things such that you do not know the security token (key) therefor it is impossible for you to hand over. That is it can be given to you in parts via a shared secret system by three or more people in “out of jurisdiction” places where they can not be forced to hand over the key, as they do not know it either.
The problem however is that they would need to be built into the phone in some way which Apple are unlikely to alow, and Googles latest nonsense with stopping an add blocker, shows the issue of “Walled Garden” systems where you do not own the garden your device is in.
Jen Gold Stockholm • January 6, 2017 11:12 PM
OT sorry everyone, I’ll leave it at that
@ Clive Robinson, good morgunn
urine,
thanks, yes you are correct about medications being contraindicated, it generally requires clean living to be a safe practice. also, not for daily use but more for disease states. One stand out primary function is for triggering the immune system with antibodies administered in an uncoventional way (the operative word) via the back of the throat, and to acquire the unique pattern of antibodies to do so only requires the tiniest amount. Auto immune disease can be cured this way. The yogis like it for the melatonin for the pineal and pituitary glands
this is too long for a mobile but you may find excerpts of interest, it covers everything including all notable western literature on the subject
Peter S. Shenkin • January 6, 2017 11:27 PM
Dear Friends in the UK,
You argue that the U. S. constitution is “no more than a piece of paper.”
However, at least it is a piece of paper, which is more that we can say for yours.
So there!
-P.
Clive Robinson • January 6, 2017 11:35 PM
@ Anura,
But really, what makes a country legitimate? Is there such a thing as an illegitimate country? Disputed maybe, but that’s about it.
No country is legitimate, just “recognised”, usually by the UN, but can be by just a single Super Power (e.g. Taiwan by US).
The US and other countries have their “bad boy” lists of nations and it’s your guess as to how you get on/off any particular nations 5h1t list.
The problem of “recognition” is it does not reflect “actuality”. A geographic area can be claimed by many, and even if the area has recognised borders and what those in that area consider a Government it may not be recognised as such. Perversely there are “recognised countries” that in effect have no actuality. You see this with “diposed governments” and “governments in waiting” due to invasion etc.
Thus whilst there are a couple of hundred “actual” countries there are another fifty or so “recognised” countries that are in effect “virtual” countries.
You might ask why this is alowed, well the answer is it has certain advantages. A “sovereign state” has legal advantages not the least of which is diplomatic status, issuing passports and recognition of “people, legal or natural” which has tax benifits for both the sovereign nation and it’s people. Even though Luxembourg has land… It makes a nice little earner out of being a tax avoidance center in Europe.
I could go on but I think you get the idea.
Clive Robinson • January 7, 2017 12:05 AM
@ Peter S Shenkin,
Dear Friends in the UK, You argue that the U. S. constitution is “no more than a piece of paper.”
Actually, I think it’s non UK citizens arguing that (most in the UK care not a jot for the US Constitution, or the “Special Relationship”, or the fact the US was once a Colonial outpost, populated by “our cousins”).
Like the French with their “Liberté, égalité, fraternité” the USA and it’s “Constitution” and “Declaration of Independence” is mainly a patriotic conceit for their citizens to wave flags about. All countries have these little foibles to distract / brainwash their citizens. Of the few non citizens outside of a country who think about these patriotic conceits it is usually for devisive argument within their own country.
It’s why we outside the US tend to find “The Donald” and “The Russian’s Hacked our election” so ironically hypocritical and thus quaintly amusing.
Even funnier, is Germany’s Mummy Merkel, after having had the US tap her mobile for ten years, she phones Pres Obama to make her thoughts known. You would suspect that Obama already knew her thoughts on the matter from the transcripts / Intelligence briefings…
some1 • January 7, 2017 2:50 AM
This might bring some benefits: https://www.consumer.ftc.gov/blog/ftc-sues-d-link-over-router-and-camera-security-flaws
Wesley Parish • January 7, 2017 2:54 AM
Well, I’ve just had a very hilarious introduction to the malleability of the human face as seen by electronic equipment.
https://www.theguardian.com/technology/2016/mar/17/five-of-the-best-face-swap-apps
https://www.theguardian.com/technology/2016/mar/08/love-faceswapping-apps-memes-trend-kanye
When this is perfected ie made seamless, and assuming the continued unreliability of corporate and state security measures,
a: the state will not be able to either confirm nor deny the existence of its own citizens,
B: companies will not be able to either confirm or deny the existence of their customers,,
C: criminals will be able to use this to escape identification and thus justice, and
D: political, religious, etc dissidents will be able to use this to escape persecution.
Zakharias • January 7, 2017 3:30 AM
Is Yahoo helping NSA by false data-break claims?
Yahoo urges me and many other users to change password to secure the account from future theft of data including phone number, etc.
To change password, a phonenumber must be given and a second email-address. Sounds like a joke but isn’t.
Giving a phonenumber the user is definitely IDENTIFIED and linked to this email-account.
Yahoo seems want to quit service if a phonenumber is not given…
This guy should move,
“violated his civil rights by allowing him to commit identity theft.”
http://www.theregister.co.uk/2017/01/04/florida_man_sues_verizon_for_allowing_his_identity_theft/
Can we ship him to Guano so he knows what having his civil rights violated is like?
Who? • January 7, 2017 5:40 AM
@ Zakharias
Do you really need using Yahoo? I think it is time to move to a company that has a serious privacy policy.
Clive Robinson • January 7, 2017 5:59 AM
@ Zakharias,
Due to the things that have been happening at Yahoo, I would have given serious consideration to moving else where some time ago.
The chances are very real that they will not exist in the near future, so you would be advised to back everything up and keep it that way on a weekly basis and put a migration plan in place.
Thoth • January 7, 2017 6:22 AM
@all
Biomettic padlock for locking your house doors. More snakeoil incoming.
Link: http://www.secureidnews.com/news-item/biometric-padlock-replaces-key-with-fingerprint/
Curious • January 7, 2017 7:12 AM
I was walking beside a construction area today, and I noticed they had put up some posters saying that the equipment inside was DNA coded. Never heard of that before, outside the expected context, relating to the human genome. Though I guess, you could maybe create artificial DNA for smearing onto stuff.
Dirk Praet • January 7, 2017 7:14 AM
@ Noah
Ex-soldier pleads guilty to terror crime after not revealing iPhone PIN
A most extraordinary case of getting your priorities utterly wrong. Last May, the UK Home Office had to admit that of about 400 returned “foreign fighters” deemed potentially dangerous, only one in eight had been successfully prosecuted. Even us in the “failed state” of Belgium here do a better job. And whereas the UK’s active involvement in the fight against Daesh has been rather minimal, to put it mildly, they instead seize a golden opportunity to push the most comprehensive surveillance legislation in the history of the country, massively encroaching on the privacy and civil liberties of the entire population.
Then when a guy, fed up with government inertia and incompetence on the matter, decides to join the fight against this cancer to humanity on the battlefield himself, he ends up getting prosecuted under an anti-terrorism act. A spectacular win for the rule of law indeed. I mean, WTF?
JG4 • January 7, 2017 7:51 AM
it’s not just the King who thinks little of the US Constitution, purchased in the blood of our forebears.
“Just a Goddamned Piece of Paper”
http://www.counterpunch.org/2005/12/14/quot-just-a-goddamned-piece-of-paper-quot/
by Gary Leupp December 14, 2005
Doug Thompson, publisher of Capitol Hill Blue, says he’s talked to three people present last month when Republican Congressional leaders met with President Bush in the Oval Office to talk about renewing the Patriot Act. That act, passed by legislators who hadn’t read it, in the immediate aftermath of 9-11 (when most people were shell-shocked and lawmakers in particular disinclined to use their brains), has of course been criticized as containing unconstitutional elements. All three GOP politicians quote their president as saying: “Stop throwing the Constitution in my face! It’s just a goddamned piece of paper!”
4/5 • January 7, 2017 8:51 AM
@clive, @anura
Anent legitimacy,
http://www.mpil.de/files/pdf3/beitr204.pdf
The difference between sovereignty and recognition is straightforward. Recognition is a matter of state relations. Sovereignty is responsibility. Responsibility is compliance with law: at a minimum, the International Bill of Human Rights. The UN Charter. The Rome Statute.
So the USA is recognized but not sovereign. Legally that means the international community has an obligation to bring the USA into compliance with the law. So what CIA calls Russian interference is actually Pillar III of the Responsibility to Protect, R2P, as set out in the Summit Outcome Document and Implementing the Responsibility to Protect, customary international law adopted by acclamation by all UN member nations. Russia is fulfilling its legal obligations to build state and public capacity in the US, and to persuade the US state of the benefits of rule of law and the costs of its serious crimes of concern to the international community (including but not limited to the crime against humanity of systematic and widespread torture, a plan and program of extrajudicial killing by death squad and drone, aggression, illegal mass evictions and criminalization of the homeless constituting CIDT.)
This is an obligation of the entire world, not just Russia, and repudiation of Hillary Clinton was at most an immaterial side effect of the main effort: to return the US to responsible sovereignty by ending impunity (or so-called ‘absolute immunity’ in US law.) Ultimately that will take regime change or dissolution.
Anura • January 7, 2017 10:15 AM
@4/5
Hmm… In the future, I’d not try and pretend that Putin cares about international law, as they gave someone radiation poisoning in a foreign country, just because they were critical of the administration, while recently targeting hospitals in multiple bombings. It pretty much immediately gives you away as a paid troll.
ab praeceptis • January 7, 2017 10:51 AM
Thoth
We should reject biometric padlocks without at least bluetooth or, better, wifi built in. Plus, of course: Does that thing have a golden sticker? I have doubts.
Also: Why are we still getting inferior products? I want my padlock to have no less capability than my supa-secure ubuntu or windows. I’m tired of being at a disadvantage!
I demand biometric padlocks with a full apache-mysql-php stack built in plus I want MITM capability like the wonderful Symerski anti-virus products.
Such we could, for example, have a padlock app that could communicate with the smartphones of people getting close to the padlock and exchange social updates likes pictures of the inside of our dwellings. As a security bonus we could have the padlock grab new lets-encrypt certs from time to time.
Of course padlocks are security sensitive. That’s why I strongly suggest to only buy ones with a golden sticker and with a reasonable php.ini. And no less than eal 0.3+!!
Ted • January 7, 2017 10:54 AM
Microsoft’s head of threat intelligence analysis Sergio Caltagirone announced Tuesday that he’s joining a new team. After 9 years with the US Government and over 3 years with Microsoft, Sergio can now be found at the industrial control cybersecurity company Dragos. He is one of the authors of “the diamond model of intrusion analysis</a href> which was unclassified several years ago and has since been adopted across the cybersecurity industry.”
He was recently on the DtSR podcast</a href> “Episode 226 – Target Threats Facts From Fiction” where he contributes to a good discussion on the concept of advanced threats and behavior analytic development.
CyberScoop article</a href>.
Tyn Mann • January 7, 2017 11:18 AM
@Zakharias re:
“Is Yahoo helping NSA by false data-break claims?”
The phone number requirement is certainly bothersome. A company that proved beyond all reasonable doubt it is incapable of securing private data demands more private data to become get a secure password. It is certainly a bold move. Worth millions to an interested buyer maybe.
OK, I’ll admit it, I think some of the major data base losses are done by friendly governments and maybe the USA. Even for useless fake email accounts there is value in meta data and storing pass words for the ever growing password dictionary. Maybe Bob, the suspected target, used the same password twice, once at yahoo and the other for some import data, to the government. Governments would be hard pressed to explain how, for example, 500 million people are suspected terrorists. So, steal the data base for their real purposes, such as locating persons with over due library books, habitual pot smokers, jay walker warrants and untold partisan political purposes.
Who? • January 7, 2017 11:46 AM
@ Zakharias, Clive Robinson, Tyn Mann
I do not have –and never had– a cell phone. Hope it will not be a problem in the future. Each day more and more corporations, ranging from email providers to banks, require a cell phone number to allow customers using their services. Bad movement on their part. I will never get a cell phone. Ever.
4/5 • January 7, 2017 11:54 AM
@Anura, I don’t call you a brainwashed propaganda victim just because you parrot unsupported bullshit from US and UK intelligence weasels on faith, so don’t call me a paid troll. Look with some rigor at the Litvinenko and hospital claims and you will watch them fall apart like Assad’s chemical warfare.
Evidently well-sourced factual documentation bops your patriotic-dupe reflex with the rubber hammer, so I shall keep it to a minimum. To wit this statement, which you will never ever hear from NATO:
Lawfare ties themselves in knots trying to find US-style weasel-words and loopholes in it but it’s too straightforward. Russia (and China) acknowledge the bedrock international law of the civilized world. NATO tries to end-run it, or interprets it in bad faith. Russia accepts expert independent monitoring of institutionalized domestic human rights. The USA does not. There’s no comparison. Of the two countries, the USA’s the slow child, the ugga-bugga cave man. Here’s some data to go with your undigested fake news stories.
No, you don’t have to be Russian to know that your Heimat doesn’t come up to Russian (or world) standards. You just have to learn to think for yourself. How did you get your identity so wrapped up in patriotic pom-pom waving? Didn’t happen to me, and I’m doused in all the same jingoistic bullshit.
Who? • January 7, 2017 11:59 AM
A public (i.e. heavily redacted) document detailing the NSA… sorry, Trump… sorry russian activities in last U.S. elections:
https://publicintelligence.net/odni-russian-election-operations/
Isn’t it really odd that intelligence community releases this document so early? They usually keep these documents secret until leaked or required by law.
Clive Robinson • January 7, 2017 12:03 PM
@ Curious,
I noticed they had put up some posters saying that the equipment inside was DNA coded.
Look up “Smart Water” Bruce bloged about it a number of years ago.
Anura • January 7, 2017 12:09 PM
@4/5
It’s called not seeing the world in black and white, where if someone is bad, then anyone who opposes them is good. And seriously? China now is your White Knight? It’s telling that you see oppression as the same thing as justice.
Clive Robinson • January 7, 2017 12:59 PM
Never have you Digital Assistant in hearing range of MSM
This just makes me smile…
http://www.theregister.co.uk/2017/01/07/tv_anchor_says_alexa_buy_me_a_dollhouse_and_she_does/
How long befor some nutter works out the “down sampling trick” where by you put out a high frequency signal jusy thr other side of the sampling frequency, so that to Alexa and friends hear “order me a wizzbang whatsit”. whilst the humans might not hear it the dog and Alexa should and whatsit sales will go hup hup and away…
Anura • January 7, 2017 1:09 PM
@Clive Robinson
Sounds like a variation on the “One month free” model. You give someone a temporarily free service, knowing that most people signing up aren’t actually willing to pay for it, but they will forget to cancel. Even if 90% of the people who forget to cancel end up calling back to complain and get a full refund, they still end up with a net profit from those who did not. So, the question here is whether they make more money from the people who don’t return it than the people who do return it costs them.
4/5 • January 7, 2017 1:33 PM
@Anura, Why are you putting the words bad and good in my mouth? You read a simple comparison, and your head turned it into a categorical ‘black and white’ statement.
The US is simply a less developed country than Russia or China, in the legal sense of the word development, since development is the sum of all rights, including the right to peace. The US derogates non-derogable rights in breach of conventional international law. Russia and China do too, only not as systematically.
What’s telling is that you reflexively think everybody has to take a side. Believe it or not, you can just gauge every country by consistent standards. In fact, that’s what most people do.
Anura • January 7, 2017 1:53 PM
@4/5
I actually specifically did not say that everyone picks a side; I do not, but it’s pretty obvious that you do have a side. There is no way any objective, rational person can think Russia and China are not about the exact same thing the West is about: power and influence. None of them can stop seeking it because if they do then it would cause the other to gain power over them. So yeah, I’m still going with paid troll (just because of the sheer quantity), but who knows, you can find someone who believes anything.
4/5 • January 7, 2017 2:49 PM
“None of them can stop seeking it because if they do then it would cause the other to gain power over them.”
Thanks for the 24-carat nugget of US statist propaganda. What you’re regurgitating now is Morgenthau realism, which US statist institutions use to justify illegal or arbitrary acts. Morgenthau himself died in despair, and now he’s just forgotten – everywhere but in the backwards hinterlands of USA and a few of its most downtrodden satellites.
Interesting also that you’re so very certain about the identity relation between some unspecified attribute of three individual states, and so evidently incapable of consulting any information to verify or falsify that proposition.
So sure, go with that. I’ll go with post-secondary education 100% vocational/technical training with zero liberal arts; lots of competitive pressure and no attention to habits of mind or exposure to any canon. And not top-tier. AMIRIGHT?
Anura • January 7, 2017 3:24 PM
@4/5
Not at all. I’m a liberal socialist, who doesn’t want any lords or masters but prefers the ones who are going to take power from the least amount of people if I have to have them. Russia and China heavily censor their populations, far beyond anything in the US. I don’t want Russia, China, the US, Europe, or anyone controlling the world for own personal benefit. I do not support US foreign policy, and want to pull completely out of the Middle East – but that doesn’t mean leaving a power vacuum for the next wealthiest country to exploit. It means putting the power in the people of their own countries, and that doesn’t just mean the wealthy.
I also care about things like Human rights, freedom, and democracy, the latter of which requires people actually be informed. Propaganda and censorship are specifically about controlling people, and that’s what Russia, China, and the US all want.
Tõnis • January 7, 2017 4:35 PM
The U.S. Constitution still enumerates Americans’ God given rights. One might risk his life exercising those rights. That’s not a reality unfamiliar to the Constitution’s Framers.
@4/5’s
Litvenko, the polonium victim?
If you think those claims fell apart you obviously don’t realize the amount of radiation released by the noobs left a trail a few miles wide.
So, everything that comes out of our mouths is made up huh?
@Anura,
Don’t let these types disparage you, you know what’s up – agnostics don’t need proof when they have faith and gut feelings – they’re here to silence us just as much as ever.
A word of warning, I carry a large amount of suspicion that this was very much a hostile takeover and specific parts of the RNC may have been away prior. The FBI not walking their ass over to the DNC to alert them is one of the nails and that same behaviour may have been part of the reason why commie weighed in like hen did.
To grow complacent is to grow weak.
aware* not away.
@4/5’s,
Those idiots, and their handlers just like the redheaded doomkoff who couldn’t bear to randomize her mac likely have horribly informed and aware handlers.
Why risk good training methods being picked up by disposable zero’s?
They used enough polonium to kill 1000 people.
@4/5’s
Do you realize how easy it is to source peanut butter?
There’s no excuse for their blunder other than the GRU being populated by a bunch of skids.
100%
If the NSA is any reflection of capabilities when it comes to humint the reflection should shame you for defending such blunder.
@4/5’s
I suppose they’re all payrat’s payratting what their payrent’s tell them to.
@Anura,
Also, none of this is going away. A successful op has been accomplished, we will see much more in the next four years if not considerably longer. Nobody in their right mind @ the RNC would dare look the gift horse of collusion in the mouth.
I just hope things are insulated enough prior to the change-over considering any black budget operations. This is one time when you hope the roaches are ahead of the exterminator, some people that sign up aren’t crooks and nannies some of them are straight up dignified clear-thinking patriots through and through.
I trust O miles more than I trust T, “I know hacking” coming from T is a joke considering his pre-election internet commentary. They guy has a head full of Russian Uranium in his Cranium.
Thanks for the 24-carat nugget of US statist propaganda. What you’re regurgitating now is Morgenthau realism, which US statist institutions use to justify illegal or arbitrary acts. Morgenthau himself died in despair, and now he’s just forgotten – everywhere but in the backwards hinterlands of USA and a few of its most downtrodden satellites.
Yet, you seem to know about him huh?
So you’re some backwoods West Virginia shillbilly huh?
This time @Anura,
There is no way any objective, rational person can think Russia and China are not about the exact same thing the West is about: power and influence.
But! They don’t have it, yet. Which makes them more aggressive in the face of our cutting edge implementation of complacency.
We’re okay with insecure devices because of the almighty dollar, they’re okay with our insecure devices too because it’s an open door and an invitation without retaliation.
If anything, this election should be a windfall for north korea or any other country with nuclear weapons ambitions. It says to the little guy that the US won’t care unless the situation is at least extremely dire, the taste in our mouth from 20 years of the Persian Gulf is bitter indeed and they’re capitalizing on that.
We demonstrated outright hesitation in not toppling Assad, I’m not saying that’s a bad thing but it obviously left an open slot for the late entry of who’s in play now. There was a time not very long ago where they were visibly involved in the same arena they’re now entering back into. It’s just getting warmed up, I fear for Turkey – it’s very easy to identify and encourage terrorists – the FBI and DHS do it back home – so the shoe’s on someone elses feet now so what? It’s the same game, just being employed enmass especially if the Snowden revelations really did cause significant damage to the IC.
It would only take a couple ops going right and not making it fully into the light of our MSM for them to have enough feedback on their methods, it’s like throwing stones at fences – after so many rocks you know how to get them to pass through the filter.
Blah blah blah, ban me, kick me, ridicule me w/e. The more the denialist’s whine the more you know what the truth is.
Two things, about the election.
If you remember me speaking of the Russian’s I ran into: they were “history graduates” back home.
The guy I defended @ the polls for the lack of signage about “campaigning” was under the belief that Shillary was going to ban medical marijuana. While I defended him in the face of the administration believe you me that I did not express my belief to him or anyone else that he was suckered – it’s his right to believe what he wants and vote how he believes.
That last thing was an obvious facebook rooted disinformation campaign and highly inflamatory in my area which is why I consider it to be obvious disinformation.
They were nervous I knew Russian, the girl would move away while she was on the phone after they realized I knew bits and pieces. I think they were coming from the Catholic church prior to my identifying them, being at the church made me nervous because of the proximity to the election and fully knowing who runs and who volunteers for most of them.
Paranoid?
It’s a healthy dose don’t worry, it’s only a deadly dose if it’s not paranoia.
I kind’ve get the feeling that the bitcoin crackdowns are somehow related to paramilitary incursions, why not right?
If it’s borderless and you can train people at cryptoparties to encrypt how could you not envision training people on receiving money in a non-descript way.
WU is co-opted, LR was shutdown. It’s not just spammers and hackers that operate with those vendors and now with what may have been a large chunk of the mailer community being co-opted don’t expect borderless money to not be in play with these things.
LOL, chapman has a chapped ass trying to woo snowden.
Don’t get the facts twisted when you fall from the limelight next skid.
You should read your english dictionary and thesaurus more, your words betray you.
He who speaks, leaks.
arleta joe for president • January 7, 2017 6:47 PM
Living Near Heavy Traffic Increases Risk of Dementia, Study Finds
https://science.slashdot.org/story/17/01/06/2256228/living-near-heavy-traffic-increases-risk-of-dementia-study-finds
People living near a busy road have an increased risk of dementia, according to research that adds to concerns about the impact of air pollution on human health. Roughly one in 10 cases of Alzheimer’s in urban areas could be associated with living amid heavy traffic, the study estimated — although the research stopped short of showing that exposure to exhaust fumes causes neurodegeneration. Previously, scientists have linked air pollution and traffic noise to reduced density of white matter (the brain’s connective tissue) and lower cognition.
Chapman is no better than a mail order bride, in fact I would argue that she’s reasonable less marriage material considering … what?
Her ‘openness’.
Ivanka has more standing in my eyes than your soulswoman.
Trump wants to deport mexicans, that’s idiodic.
What every Republican should be considering is deporting Russians.
That’s keeping your eyes on the prize. 😉
How bad is it when someone of great power and standing can’t find a good American woman to wed? Are American women embarassed by him? Does he mistreat them? Does he find himself in requirement of a contractual obligation of a women who is well-geared to environments of “ask dad”?
There is something seriously wrong in Trumps bedroom if he can’t find a good American woman.
Personally I think he’s gay, but it could be that he just likes being in charge – and that’ll never happen with a well bred American woman.
I have this feeling he was bluffing Billy Bush and that’s why all these women coming forward is a “fabrication”.
His best move, would be to ‘own up’ to the two++ that WE KNOW from his own recorded statements exist.
We’ve got an ineffectual blowhard who suffers from lackadasia disinterest or … 😉
You want to see an American who has a “healthy” appetite?
Look no further than McAffe, that man literally just does no care.
So which is it?
Do you know how much me and my American wife fight?
She doesn’t lay down for anyone not even me, and I don’t in the least find that that threatening at all – I find it refreshing that she OWNS every inch of her being.
It would be a great threat to an insecure man.
blind as a bat • January 7, 2017 7:14 PM
That’s a No Go on The Geek-0
http://www.latimes.com/local/lanow/la-me-ln-geek-squad-child-porn-20160521-snap-story.html
|
|
/
Anyway you paint it he’s a defensive liar, a manipulator, and a general p**** b****.
So you can spin you webs all you want to anyone out here on the streets we can see right through the glass windows of the tower of blabber deflection and deference.
@4/5’s,
Did I strike a nerve?
Who’s nerve did I strike?
More than one (and one’s) nerve, I might add.
[GRU edit, insert: Do not be confused because Ms. Chapman is hotter than your tense American women, all Russian women are so. Chapman’s father is a big shot and would not stand for his little kiska to demean herself as a honey trap. even 4/5 is stupendously hot with violet eyes and turned-up nose]
What is THAT?
@4/5’s,
If you find yourself under the duress of a Soviet gun, you should think about defecting.
Maybe the GRU won’t edit that out of your incoming stream huh?
Do they trust you as much as I trust my wife?
^_^
Did you admit to having a GRU handler/companion?
Am I to believe that that was an honest post?
Even if it wasn’t are you trying to elevate yourself above (insert graphic image here).
I beg you, explain yourself.
Explain your puffery, or your position.
Before my supposition takes a very public superposition.
@All,
I can trust you guys to let me know when the CIA/NSA/FBI try to insert their feet and boots into MY mouth right?
@Amateur School Boy,
I really was leaning to Israeli influence for the election or maybe even Mexican so they can annex the southwestern united states like you guys did with the ukraine, but after your school boy interference in what appeared to be an honest back and forth has tainted the entire dialog pushed in your massively parallel operation.
Maybe next time you decide to insert something in real time you’ll push it further up the decision tree than your local handler before responding to your run-of-the-mill standard American dissenter.
I hope you’re not reprimanded for your mishandling of the situation, I would actually find great value in an open and continuing exchange between us.
@Anura,
What’s the deal with the ‘Anent’ comment from Ms. GRU?
Did you notice the el-rando refer to Dirk Praet as M. Praet?
https://www.merriam-webster.com/dictionary/anent
It might’ve been a spell checking substitution.
preserve for posterity please. • January 7, 2017 8:30 PM
[GRU edit, insert: Do not be confused because Ms. Chapman is hotter than your tense American women, all Russian women are so. Chapman’s father is a big shot and would not stand for his little kiska to demean herself as a honey trap. even 4/5 is stupendously hot with violet eyes and turned-up nose]
SEE: https://www.schneier.com/blog/archives/2017/01/friday_squid_bl_559.html#c6742503
Can you make this shit up?
https://www.schneier.com/blog/archives/2017/01/friday_squid_bl_559.html#c6742492
65535 • January 7, 2017 9:09 PM
@ Who?
“Isn’t it really odd that intelligence community releases this document so early? They usually keep these documents secret until leaked or required by law.”
It is consistent with the trends of USA leaks occurring on a holiday or the end of the work week – as in this case a Friday.
PDF version of the “De-Classified version:
https://www.dni.gov/files/documents/ICA_2017_01.pdf
The report is mixed and uneven. There really is not anything new in it except to brand the RT a GRU outlet. There is not evidence of hacking of voting machines.
Emptywheel’s gives a fair analysis of the report:
“What we see of it is uneven. I think the report is strongest on Russia’s motive for tampering with the election, even if the report doesn’t provide evidence. I think there are many weaknesses in the report’s discussion of media. That raises concerns that the material on the actual hack — which we don’t get in any detail at all — is as weak as the media section.” –emptywheel
https://www.emptywheel.net/2017/01/06/the-declassified-russian-hack-report/
I will say that the report tends to self-indict the Intelligence Community to the level of being partisan – or pro Hillary Clinton. That is somewhat destructive in and of its self. If the IC has become partisan then the USA has another big problem. It means that the IC is focusing its energy on political activism instead of actual technical achievements.
I would say the report is like throwing dust into the air or a Clive would say a lot of hand waving.
Assage:
“Wikileaks founder Julian Assange has said a 14-year-old could have hacked into the emails of Hillary Clinton’s campaign chairman. … Assange revealed the campaign chairman’s password was ‘password’ and that he had responded to phishing emails.
“The Wikileaks founder said he was 1,000 percent confident the Russians did not hack the Clinton campaign, adding Barack Obama was ‘trying to delegitimize the Trump administration’.”-dailymail
[More]
“Assange told Sean Hannity that Russia was not the source of the email hack, contradicting reports from the intelligence community that the Russian government purposely interfered with the presidential election.”-Time
http://time.com/4620806/julian-assange-russia-hack-fox-hannity/
I am guessing the source of most the emails was a disgruntled insider within the DNC who had access directly to the emails or had access to a backup drive. But, we will not know until this source comes forward. Take that guess for what is worth – a guess.
The name 4/5 might’ve been a reference to @Clive’s earlier statement:
https://www.schneier.com/blog/archives/2017/01/friday_squid_bl_559.html#c6742448
I’d assume this means that 4/5’s selection was an attempt to exonerate themselves from villification. BUT as we see in the ‘GRU edit:’ this hentity in all likelyhood is a ‘GRU insert’ proving Anura and myself (and others) right.
Further more, as a side note to the GRU and the current hentity who faux paus’d (see above) understand that your first-year slip gives much credence to the things that I am (very) effectively spraying.
https://www.schneier.com/blog/archives/2017/01/friday_squid_bl_559.html#c6742492
https://www.schneier.com/blog/archives/2017/01/friday_squid_bl_559.html#c6742523
Couldn’t make it up if I tried.
4/5 • January 7, 2017 9:27 PM
r, dahlink, You are indeed the most gullible human being I have ever encountered. But perhaps you are not so extraordinary. Is this the secret to how Americans are made to fall for the most ludicrous porkies? That Let’s roll crap, you all swallowed that. That Boston Marathon nonsense with the Cowboy hat and the American flag and the wheelchair and the glum fellow rolling along going Oh dear my leg, for Christ’s sake. It’s like a scientific experiment of your secret services, to see if there’s anything you people will not swallow:
https://willyloman.wordpress.com/2017/01/06/so-who-is-william-jacob-raak/
r (not rt) • January 7, 2017 9:33 PM
@4/5,
At this point, any link you post to me is potentially “nickel for my brain (not my back like a cymbal waving monkey).”
I’m just trying to express a feeling of taint coming out of you guys, but you’re right – I may be tainted too – but if you knew who I was and where I stood you might see me more clearly than I think your paint allows.
Maybe the same is true for you, but the “edit” kind’ve paint’s you into @Anura’s corner vs “free speech”.
Tragic.
It’s a shame the damage that is occurring to both of our images, (US/Russia) we both had and have the power to bring the whole world together but as long as either side operates in the dark absolutely nothing will be accomplished.
Please understand my concerns, my intent is not to antagonize but to express my suspicion in whatever form it takes.
@4/5’s
Anyways, now that you’re back from your temporary vacation I expect to see a refactoring of your angle. Please, bring it on.
And DO! Give the GRU a more independent voice than your own subchannel evocations.
@4/5’s
One last thing, this is very important…
Who hits the submit button?
Ms. Violet, or the GRU?
4/5 • January 7, 2017 10:10 PM
So many questions! And evidently sincere. International cooperation is important. If you wish we can discuss offline at irc2p room #RU anytime in the next 40 min. OTR enabled, no logging.
The password is Swordfish.
Clive Robinson • January 7, 2017 11:28 PM
@ Dirk Praet,
A most extraordinary case of getting your priorities utterly wrong.
It’s also strongly politically motivated as well as malicious (not uncommon in the UK these days).
The UK is still part of the EU, and part of that is the right to free movment, enshrined in the various articles of the EEC and later EU. As is the right to free movment of trade. Thus to take your skills and move them around the EU to where they are needed is one of the foundation bedstones of the who EU raison d’etre.
Syria and other aspects of the issues within the middle east are and have been a political hot potato in the UK. Asad was seen by the establishment in the UK as “one of us” that is he was “anglicised” in education and training (ophthalmologist) and by marriage (British of Syrian descent). And because he had little or no interest in politics it was assumed that when his brother died and he inherited the heir apparent status the UK could influence / guide him.
Long story short he is a minority Muslim (alawite) and thus built up a power base by using his position of preventing corruption rooted out all potential rivals, and started down a road of reform and modernisation. Importantly he realised that Syria like Israel needed a super power “sugar dady”, and that due to strong US republican support of Israel he would get no assistance from the US or their “special relation” UK poodle. So like Castro a generation or so before he went to the arms of the Kremlin.
Thus the UK finds Syria an extreamly touch subject and appears to have an almost schizophrenic policy…
In the early days of the conflict various UK ex-armed forces personnel who were fighting against IS came to the attention of the press, and this became an embarrassment to the UK.Foreign Secretary William Hague MP was said to be incandescent over various interviews they gave that showed up the duplicity of the UK position.
Thus this ex-soldier dropped himself into a political mine field. He also apparently had a significant chip on his shoulder with regards certain parts of the UK security services and their front men in the Met Police etc.
So they pushed his buttons, and when he reacted they decided to make an example of him. The unwarranted use of “terrorism” is quite deliberate so he can never get anything other than menial work if that, nor can he travel to gain worth while employment in other EU nations to get out from underneath what were most definatly politicaly inspired and motivated charges, because he dared to hold the UK Government up for it’s hypocritical behaviour.
But hey welcome to the new world order as prescribed by George Orwell…
Curious • January 8, 2017 1:22 AM
@ Clive Robinson
Re. “Smart water” Oh, lol. I just read “I think a better idea would be for me to paint it on your valuables, and then call the police.” 😀
Curious • January 8, 2017 1:24 AM
To add to what I wrote:
The poster I saw had the logo of the police on it, so I am thinking that maybe this whole dna thing might perhaps require some additional process including the police, for first registering items, in order to try avoid an awkward situation, as Bruce toyed with in that 2005 article.
Wesley Parish • January 8, 2017 3:26 AM
@JG4
in the immediate aftermath of 9-11 (when most people were shell-shocked and lawmakers in particular disinclined to use their brains),
Actually, it’s whenever there’s a “public emergency” or some such thing. The Spanish-American War is such an example. Using the declaration of war on Spain as an excuse, the US Congress illegally annexed Hawai’i, in spite of a majority of inhabitants of Hawai’i being opposed to such an annexation and having declared such:
https://en.wikipedia.org/wiki/Legal_status_of_Hawaii
The majority of the population in Hawaii was indeed vociferously opposed to U.S. annexation. In a single weeklong petition drive, 21,000 signatures—representing well over half of the adult population of Hawaii at the time—were procured by horseback, boat and foot travel. These petitions were hand-carried to Washington and delivered to the United States Senate.
and
https://history.state.gov/milestones/1866-1898/spanish-american-war
The McKinley Administration also used the war as a pretext to annex the independent state of Hawaii. […] At McKinley’s request, a joint resolution of Congress made Hawaii a U.S. territory on August 12, 1898.
Mind you, the US also used the Spanish-American War to annex the Philipines in spite of strong resistance from the Filipinos, likewise Puerto Rico, and near-annex Cuba in much the same way Poland was under the Soviet thumb. Nothing of that was legal by the Declaration of Independence and the US Constitution, which made informed consent such a vital part of statehood, rule and governance. I mean, bury my heart at Wounded Knee! After declaring that treaties were part and parcel of the Supreme Law of the Land, both the US Congress and the US Presidency proceeded to knowingly break that supreme law of the land whenever they felt they wanted the First Nations’ land.
Practice makes perfect, and they’ve perfected that art.
It also goes to illustrate the cautionary proverb about the policeman bringing his work home with him. They’ve perfected that on others, now it’s the average US citizen’s turn.
Clive Robinson • January 8, 2017 4:43 AM
@ Wesley Parish, JG4,
You forgot to mention the 1812-15 war and why the Presidential Palace in Washington had to become the White House…
Put simply the US decided to Annex what is now Canada whilst Britain was fighting the Napoleonic scourge and declared war on Britain. Sadly in the process of annexing the land, the US killed their own relatives who lived there, burnt their homes and property making those left determined to be rid of the southern US pest.
They say nations are forged in fire, but Canada only realy came into being because of the idiot politicians in Washington. At the end of it Washington was invaded and government buildings burnt and President James Madison, military officials, and the rest of his cowardly government fled the city and ran away in fear leaving their wives and families behind, to suffer the consequences of their actions.
The fun thing about more modern history is there are reasonably good original or primary records kept. You can by traveling to other countries learn much much more about your home countries rank behaviour, than your history teachers are ever going to tell you after the usual political revision and sensitization.
Oh and don’t entirely believe what you read Online when it comes to history… It appears that a number of people from the loosing side are trying to revise the history to sop up or spin up their image, by trying to pretend the land grab was just a diversionary tactic, when even US primary records show very much otherwise.
Dirk Praet • January 8, 2017 5:55 AM
@ r
Did you notice the el-rando refer to Dirk Praet as M. Praet?
Where is that? Can’t seem to find it.
For what it’s worth, my personal take on the discussion is that the US, Russia and China are on par. Whereas Russia and China are authoritarian states for PR reasons trying to come across as adhering to international law, the US is hiding less and less that international law in practice is but dead letter and subordinate to its own interests and legislation.
@ Who, @ 65535
It means that the IC is focusing its energy on political activism instead of actual technical achievements.
Absent any hard evidence, the entire “Putin is meddling in our elections”-thing to me reads as a carefully orchestrated psy-op on behalf of the IC and its MIC overlords. It diverts attention from its own sordid activities, shapes the hearts and minds of the general public and its “elected representatives” for a new cold war, all while undermining the legitimacy of the tweeter-in-chief they seem to have disturbingly little control over.
The last US president who turned against the CIA and its allies ended up dead. There is little doubt in my mind that unless Trump starts playing nice with them, the same thing will happen to him. In fact, I wouldn’t be surprised if somewhere in a basement a patsy is already being set up as part of a “great contingency solution”.
@Dirk,
I agree with your first paragraph as an accurate assessment.
The bottom parts is where I’m still working my fuzzy logic through. 😉
@4/5’s
Sorry I couldn’t make it last night, while I appreciate the offer I would like to thank you for ruining any chances I have of ever using i2p or Tor as a contingency anywhere in the near future. The last thing I want to become is a littleiepad for either side, I hope you understand that I would like to remain a ‘free’ agent.
Clive Robinson • January 8, 2017 8:28 AM
@ Dirk Praet, 65535, Who?,
In fact, I wouldn’t be surprised if somewhere in a basement a patsy is already being set up as part of a “great contingency solution”.
And to “kill two birds with one stone” what is the betting the patsy will look like or be from the ME and later be said by the IC to be of IS or Syria?…
Which will then get some back story about it was the “tweeter in chief” valiantly standing up to Muslims etc making him a convenient martyr-hero in the typical Republican make-over to act as a rallying cause… Thus giving the CIA and DoD War Hawks the excuse for the tanks to roll, for a proxie punchup with Russia. Thus more profit to flow from the hard pressed tax payer to the “corporate welfare mothers” of the MIC and neo-cons so the 0.1% of the 0.1% can get even fatter on their rent seeking behaviour. That is their “universal benift” that they and they alone are entitled to, as in their view only they will not be corrupted by it…
Oh and what is the betting that there is going to be a massive series of orders for orange boiler suits ordered along with all the other questionable gitmo gear (forced anal feeding etc) for all those other “proto-terrorists” who will get asset stripped via faux justice, in much the same way as went on –in much of Europe in the late 1930’s and– in the US in the 1940’s using the Alien Friends / Enemies and sedition acts from 1798.
@Clive,
I don’t like how it looks either, but the rest of you are eating MH17 style DDD all the way home.
Like I said back when the DNC leaks were occurring, if they want to play “international truth teller” they need to stop hiding behind the same trademarks the CIA uses – otherwise they’re just another “special dark” interest group.
Oh how sweet that hershey’s bar is.
All they’re adding to the conversation is chaff, which is where my problem lay with their ‘facts’. I don’t support terrorism in any form, even if MH17 was an accident somebody needs to pay.
The Russian’s say the succession would’ve never happened without the United States, but they’re Russians. The American’s say it’s the Russian’s fault, without owning up to potentially interfering with a direct Russian neighbor – we do this shit all the time in our own backyard so I understand their argument there.
But they shot down a Civilian Airliner and immediately proceeded to lie and cover up the incident and everything out of their mouth since has been the exact same “It wasn’t us” or “I get’s no respect” lines of bullshit.
Unprofessional,
Very.
Now going back to KST’s comment about manning and pussy riot – to put that into this context is to say that manning may have brought to light war crimes – in this case Russia is doing the exact same thing the American Military may have been doing there.
They like to think they’re coated in teflon, but they’re not. They act with impunity also and believe me we’re going to reap what we sew when ISIS becomes ether (this is dangerous). We need to work together it’s stupid, we’re all human we all make mistakes just quit with the lying – if you want to abide by international law and you want people to think you’re upright and forthright then you need to be upright and forthright not scandalous evasive maligned manipulative and armed to the teeth with a coldwar era playbook on Advanced Dungeons and Dragons 3rd Edition. (DDD)
So @ab, THAT’s why I rail against your constantly upturned nose. We american’s have a problem in our own state if you want to be constructive be constructive you’re love affair is with a lying bitch just the same.
Curious • January 8, 2017 8:55 AM
Off topic I guess:
Wow, I installed Skype around Christmas, haven’t even talked to someone yet, and now I being being told on their webpage (account.live.com) on login, that my account is temporarily suspended. Other than than, with skype login webpage fishing for my phone number, it says “we won’t give out your number”, as if you being Microsoft couldn’t seem more insincere, when the proper way to say would be to promise that they “won’t share your number”. And on top of that, they apparently haven’t sent me a code to me telephone to log in, despite soliciting me for the number. Bah.
@KST,
You’re an accessory after the fact if not an outright accomplice to begin with.
Deflect that, defer to your superiors I don’t care.
Know that the more you and yours cry about the color of paint your own government has chosen the more guilty you look.
We blow up American’s who fund and partake in terrorism, what’s your excuse? Not enough know-how to expend a couple BUK owner/operators?
“It was an accident.”, Yeah? So what if it was? What then? You can just kill 280+ people from governments not even involved in your quarrel and then finance and assist the cover up?
OMG STOP!
Maybe it’s make believe!!!
Maybe it’s Maybelline on a pig, are you the kind’ve pig that wears make-up in public?
Shame!
And yes, if your assertion is true then your training is far lax just like the redhead.
I’m a civvy, what are you? (insert: GRU)
We can’t trust a damn thing you say having that edited stream, it’s got the KGB seal of approval.
How did you feel when Turkey shot you down for violating their airspace?
How did you feel when you were blown up in Egypt?
This is what you did to innocent bystanders, just like the information manning may have released. Stop hiding behind “they do it too” if you want standing in the free-thinking public.
We have a responsibility to our fellow man to respect them and to protect the respectable members thereof, WE.
Karl Lembke • January 8, 2017 9:41 AM
It occurs to me that the use of gloves by food handlers may be an example of security theater.
بيضان • January 8, 2017 10:52 AM
It’s a shame people do or don’t read Wikileaks based on what political side they’re on, because its entertainment value is fabulous. The leaks themselves are a laff riot but Wikileaks itself is getting really funny.
https://niqnaq.wordpress.com/2017/01/07/wikileaks-tweet-medley-for-the-day/
Is this Sarah Harrison? Jen Robinson? Because JA’s access was cut off for a while. This level of ridicule is like light years beyond the Hungarian Oranges. If this were a boxing match they’d stop it as a TKO, the ‘intelligence community’ is so helpless. Interestingly, the ‘intelligence community’ does not include DIA or INR, who are watching this laughingstock with demure glee. They can step in when Trump decapitates the 3 stooges CIA/NSA/FBI.
ab praeceptis • January 8, 2017 11:39 AM
r
January 7, 2017 8:53 PM
r on Friday Squid Blogging: Simple Grilled Squid Recipe:
@Nick P,
I guess I am a troll. ;-P
So @ab, THAT’s why I rail against your constantly upturned nose.
I couldn’t care less what one of the worst spamming trolls here “thinks” of me.
Clive Robinson • January 8, 2017 12:21 PM
@ r,
… immediately proceeded to lie and cover up the incident and everything out of their mouth since has been the exact same “It wasn’t us” or “I get’s no respect” lines of bullshit.
You get the same from any Government when it’s boots on the ground foreign policy becomes a war crime. Or worse they over compensate and eviscerate those at the bottom. Whilst those above who led them into it, or turn a blind eye to it do not even get their collars felt unless they have become personaly a political embarrassment. And the fastest way to become a political embarrassment is to investigate the noises that come from the bottom of the pile (that was why Snowden would never have had a fair hearing and won’t now untill those in the middle have been laid to rest in Arlington etc).
My personal perspective is “All politicians lie habitually, and even if they do say something they mean today, tommorow they will have changed their minds for ‘political expediency’ as a favour is traded above their pay grade”.
@buy the rules,
‘Worse’, is a matter of perspective son.
Last night I illicited a response by what seems to be a GRU ‘submissions approval editor’ or simple puffery from a denialist cry baby like yourself by assailing the competence and integrity of a starchild, maybe your manager is better trained; maybe you’re the manager?
Ask the mod, while I would’ve preferred my inundation be removed and the petticoat be left exposed I shall not complain.
Metaphysics for fun and profit.
@Clive,
MH17 and the resulting indifferent behavior is what galvanized me, at this point in my life I am leaning heavily on Snowmen believing all this pro-GRU bullshit before he jetsetted just like duh Trump and Trumpettes.
Are these all legitimate word press sites or are these all recent compromises repurposed to push a seemingly diverse base?
Your habits are suspect suspect.
@Clive Robinson: The internship proposal (from the French DGSE) at page 397 of this (cryptanalysis of .docx files enciphered with reused one-time pad keys) might be of interest to you.
albert • January 8, 2017 2:38 PM
@Clive, Dirt, -1, etc.
[suitable background music for this comment: Louie Armstrongs version of “It’s A Wonderful World”.
“…The last US president who turned against the CIA and its allies ended up dead….”. JFK didn’t enter office with all the baggage Trump carries, so in Trumps case, the list of suspects would be huge, a ‘slam dunk’ so to speak.
Back in the day, when the gov’t accused the Mafia of something, the capo-du-jour didn’t hold a press conference to deny the charges. They preferred the ‘inside’ approach, and stayed under the radar. Bobby Kennedy knew this.
Your friendly psychopaths at the USDOS come up with all kinds of ideas, like who’s the latest bogeyman. There are only two possibilities, Russia (militarily, a true existential threat) and China (not there yet militarily, but close economically). This is why Trump chose China; it’s an economic issue. Businessmen don’t like military problems; they effup business. They don’t give a RSA about the governments, as long as they are -stable-. ‘Human rights’ and ‘democracy’ are BS to them. For the general public (sheeple), Russia is the perfect foil. No one in the US knows the culture or
the people very well. They have a bad history on the World Stage. They appeal to the ‘us-against-them’ mentality of cultures that encourage violent competition in every area of life.
Yes, wars* are good for the military/industrial-complex, but they serve other purposes as well. They encourage terrorism, especially in the ME. It’s good for Israel because it keeps their enemies busy, and draws attention away from their Gaza Project (they have a M/IC-too). On the home front (yes it is a front), terrorism helps get draconian spy laws through Congress, laws that bypass the Constitution, and eventually allow critics and protesters of all stripes to be squashed like bugs. This process started with Oklahoma City. I fear for another 911, not so much for the human toll, but for the resulting legislative actions.
.
@r,
How do you really feel?
*the continuous state of war we have been in apparently doesn’t make much difference to Pinker.
. .. . .. — ….
pareidolia • January 8, 2017 3:15 PM
“The last US president who turned against the CIA and its allies ended up dead”
Not true. Carter purged about 20% of CIA’s staff, mostly knuckle-draggers, and banned assassinations (in those days torture was mostly outsourced subject to CIA training). It didn’t take, but he lived to tell about it. All that happened was he lost his office to treasonous Iran-hostage dirty tricks.
https://fas.org/blogs/secrecy/2016/06/intel-carter-frus/
https://www.nsfwcorp.com/dispatch/assassinations/9895b18f1f024a50376a7f8b3b6a75a5b8925e35/
https://consortiumnews.com/archive/xfile.html
CIA is more out of control than ever; the difference this time is full codification of the Nuremberg Principles for an International Criminal Court with propria motu investigative powers, universal jurisdiction under the Convention Against Torture, and state responsibility doctrine. It’s open season on CIA criminals worldwide. If Trump and Bannon have the stones to exploit that, they can neuter CIA.
Sancho_P • January 8, 2017 4:23 PM
What @Geek Squad Leader brought up here (06, 4:52 PM) is a bummer regarding possible “evidence” on one of our devices:
http://www.ocweekly.com/news/best-buy-geek-squad-informant-use-has-fbi-on-defense-in-child-porn-case-7794252
Could the story be true? (haven’t heard about Best Buy Geek Squad before)
First group of questions would be around:
How came that “evidence” onto the HD?
Is a $500 bounty enough to place an image, suspicious but not child porn (‘we don’t want to seriously harm that guy …’), onto a victim’s computer?
If no one can say how and when it was put there – is it not evidence?
I’ll come back to that at the end of this posting.
The second is about the technical part in this particular case:
Where was that special set of data, on “unallocated ‘trash’ space?
To me “trash” as well as unallocated have a special meaning but don’t go easily together.
Would deleting an image send that bytes to the unallocated space?
I thought “unallocated” is disk space that isn’t part of a partition and can’t be directly accessed by the OS?
Only resizing partitions would be a possibility to make it unallocated space, but that seems to be easily done without forensic tools.
Probably I got it wrong or it’s an error in reporting that story.
But imagine the (FBI’s) geek squad(s) would check the entire HD of all incoming computers for bit patterns that may constitute (part of) an image file and cross check that pattern with their cp database.
So here is my real real problem with that story:
Looong ago I was playing with HD data structures because I thought of abusing HDs for a different purpose with my own data structure (not any standard file system).
From that time I still have drives (eeeh, some with with special electronics) and likely ‘uninterpretable’ data.
- Is it problematic to possess memory devices when you can’t show their content is not related to terrorism, cp, drugs or other serious crime, let alone national security?
What if I’d try to cross the border with an “unreadable” (by OS) memory, generally?
Imagine @Thoth’s secretly self destructing memory and the consequences.
A defective memory stick?
Oh, your phone boots but can’t access the external memory?
Your camera doesn’t recognize the SD card? Bad format?
Bad luck!
Fast forward to garbage on a ordinary (used by OS) disc space / memory:
What if they find the fingerprint of their specially signed (think of copyright protected, like smart water) honeypot – cp image (but not the full image)?
Is it me, the defendant, to prove that something is not there / true?
If the data is not accessible by OS, would I be off the hook?
@pareidolia,
Put your rubles where your mouth is, if you have proof of 9/11 boston etc cough it the f*** up or die choking on it. You’re not accomplishing anything seeding this seedy truth with your agenda.
@albert,
I think it’s partially ‘get off my lawn’, I don’t think they’re at all interested in a controlled demolition – the country isn’t completely disfunctional and anarchy is NOT the solution.
Obama had the dignity to second guess feeding bachelor pads to al nursa and the syrian rebels, the Russian’s should appreciate THAT. We had more than enough time ahead of their 1970’s carrier to do so and I think the responsible thing for the most part was done in not giving up the type of things that repelled the soviets in Afghanistan or what took down MH17.
It was a decision of tact. I’m worried about the little guys at this point thinking that nuclear aspirations are the ideal self-protection at this point rather than a ‘friendly neighbor’ attitude.
When NAFTA was implemented in 94, I found myself wondering why we didn’t think it was a good idea instead to try to prop up the post-soviet economy with the same style of trade agreement. Jobs promote security and as I’ve said many times before I think we dropped the ball with Russia in the 90’s in this aspect, but here we are – they didn’t collapse and thankfully as far as I know they still have complete control over their nuclear arsenal. If there’s anything I can praise Putin for it can be found in that fact, I don’t know the man but if my president looked the other way when we shot down a plane with 200 dutch/aussie/malay’s I’d be out in the streets with a torch to the ohio turnpike in a second.
What are they protesting? That it’s their turn to ruin the world with wanton mayhen?
No thank you, I’m not going to be a willing participant to sociopath’s choking each other’s people.
In the early 21st century their population was declining by 500,000 a year,
AIDS, Alcoholism and Suicide were to blame. No country should ever have to endure such hardship – their breadlines were a complete embarassment. I have family that lived through all the collapses of the Brasilian economy, I sincerely feel for the hardship of poverty and despair. But you want to shoot innocents out of the air? And not even own up to the mistake of your lawless puppets?
I hope your plane is the next one poached from a skeet skeet skeet shooting expedition.
If Bush or Cheney engineered 9/11, same to them – but it seems they’re far better at this game than you are aren’t they? The best you could do is encourage the smash and grab jobs of manning and snowden even when you have an unquantifiable number of insiders within the FBI. All this DDD and CIA finger waving coming from the east doesn’t do anything for anybody and it puts them on the map for being involved themselves by colluding with the republicans that started this ball rolling in the first place.
Which, by the way – makes the NSA very appealing from this fomenting perspective of mine.
I’m more than willing to bet that that’s the endgame, a united states of soviet republicans – if you think terrorism is bad now just wait until the stratification becomes thick enough you could skim the 1% fat right off the top with a team of helicopters.
I’m ready, are you?
Putin’s a capitalist, why not?
That’s what lowering the repatriation taxes is going to accomplish, freedom from the life sucking mess of poverty back home – all those people researching “move to canada” were 0.1%’ers. 😉
Run little doggy, run.
Clive Robinson • January 8, 2017 6:10 PM
@ Apo,
… cryptanalysis of .docx files enciphered with reused one-time pad keys might be of interest to you.
It is, what would be of even more interest would be the reasoning behind it…
In this day and age producing OTPs that are unique, should not be much of an issue, unlike the days of the Russia re-issue of OTP that formed the core of the VENONA work.
One area it might be likely to happen is an ill thought out Hard Drive or similar storage encryption protocol (FDE by IME etc) where there are multiple encrypted backups that can give the OTP reuse with documents evolving through multiple edits/revisions etc.
Clive Robinson • January 8, 2017 6:49 PM
@ r,
http://www.rand.org/pubs/issue_papers/IP198/index2.html
2000 paper on Ukraine and Caspian Energy resources as a US National Security issue might be of interest to you.
tyr • January 8, 2017 6:54 PM
@ Clive
One area it might be likely to happen is an ill thought out Hard Drive or similar storage encryption protocol (FDE by IME etc) where there are multiple encrypted backups that can give the OTP reuse with documents evolving through multiple edits/revisions etc.
Can you expand this a bit ? I’m failing to parse it
into clarity.
And sorry about the video link. I don’t use a cell
phone for the same reason you don’t want Youtube.
pareidolia • January 8, 2017 6:56 PM
Oh, stop it with the macho posturing, we can all tell you’re a pencil-neck who only does that on the Internet. Why I’m humoring you with information I don’t know, you never look at any of it, you just put up 40 more of those annoying posts. Open-source material is more than adequate to explode the official story. You can start with:
http://whowhatwhy.org/category/boston-marathon-bombing/
http://davesweb.cnchost.com/
(this you’ll have to find on the wayback machine because the author died, after being told he would, and how, by an anonymous internet friend)
If you have any ability to follow your inductive nose you’ll be outraged to see there’s an innocent man who’s going to be killed so CIA can bring the Phoenix Program home and try it out.
@KST,
Only does what on the internet?
You obviously haven’t seen: https://www.schneier.com/blog/archives/2017/01/the_effect_of_r.html
Please note: the_effect_of_r, God works in mysterious ways doesn’t he?
Also note, if you ever build a dossier for my stupid ars you’ll realize I’m pretty much WYSIWYG.
Pencil neck lol, as opposed to what? a leather neck?
I’m the first to stand up to a bully any day of the week, two days ago I was putting out a car fire while the wage slaves stood around like insurance wouldn’t cover their scarification and or immolation.
Who doesn’t know how to use a fire extinguisher?
Is that any kind of excuse?
Those are the pussy’s I have to deal with, slow thinkers.
People with severe apprehension in emergencies, thankfully I’m the opposite.
GRU labels me irritating, can I use you for a reference violet?
Do you know what the best thing about this site is?
With the NSA watching they can fact check everything I say.
Dirk Praet • January 8, 2017 7:30 PM
@ pareidolia
… It didn’t take, but he lived to tell about it. All that happened was he lost his office to treasonous Iran-hostage dirty tricks.
Jimmy Carter was a cerebral, principled man who actually believed in hippie stuff like peace, democracy and human rights, which in the eyes of quite some hard-liners in the agency made him (and the US) look weak. He did nothing to protect long-time allies like the Shah of Iran or Nicaragua’s dictator Somoza from being ousted. The Camp David Accords during which he forced Menachem Begin’s hand to withdraw from the Sinai made him another powerful enemy. Although there never was any iron-clad proof, it has often been speculated that the CIA in collusion with the Israeli government somehow played the Iranians not to release the American hostages in the Teheran embassy, thus paving the way for his electoral defeat to Ronald Reagan. A couple of years later, the world learned about the Iran-Contragate affair.
What probably saved Carter’s life was that he was also a predictable man who played by the book, and not an impulsive loose canon like JFK or the current tweeter-in-chief.
@ r
MH17 and the resulting indifferent behavior is what galvanized me
How come you are so sure the Russians were behind it? Although my gut feeling is telling me that it was probably a tragic mistake caused by some Russia-backed retard rebels playing with their new BUK toy, it is very hard to preclude that the entire thing wasn’t staged by the Ukrainian government to turn world and dog against Putin. We have seen similar things in the past during the Yugoslavian civil war.
And what about the responsibility of the airliner company that didn’t think it was necessary to divert civilian flight routes away from an area where there was an active civil war going on? They’re at least as much to blame as the bstrds who actually downed that plane.
@Dirk,
I’m not really, I wasn’t there.
But at the very least they triggered the event, irrespective of direct involvement. Malaysia deserves closure just as much as the Iraqi’s deserve peace.
I think occam’s razor in this case is it was a testosterone related mistake, we males have them OFTEN – but it doesn’t make it right to just slough off responsibility.
280 people died for no reason other than bragging rights that were quickly deleted from the internet.
@violet,
Look, I enjoy not being inundated by FBI lice – as nice as it would be to be able to speak freely in this world it is not possible. I will not be turning on a beacon for bugs.
@Dirk,
What we took from Iraq it’s people will never get back.
That was a fumble that in any sane man’s reality should’ve banned any future incursions from happening at our hand and our watch anywhere in the world. The only reason we can’t just up and leave is because it’s such a huge mess we made by puddle stomping in the middle east. I think the current administration may have been trying to repair it.
I think I am just like the majority of the other people visible on this site, I’m completely sick of “war”. Maybe Shillary would’ve attempted to depose Putin and Russia would splinter and explode in a nuclear haze – I don’t know. That’s not what I’m after, I’m after world peace and this is just my attempt at working through what I see as evil.
But, then again – there’s that are we becoming more moral than dangerous thing again.
And maybe for some of us, more moral is more dangerous.
Only God knows, and only time will tell.
MH17 was just an extra egg in the omelet, to get what one wants he cannot be shy.
If I was Russia and Ukraine shot MH17 out of the air and blamed it on me I would roll over them like the Chinese did in Tianamen Square, but they didn’t did they?
Where was the outrage at false accusations?
It was just a soft denial and some more fake news/fabricated images, the stuff of spammers – which Russia and the section of occupied Ukraine are rife with.
Could it have been an emergency concoction by Ukraine higher ups or those with access to US plotters? MAYBE.
But this is the challenge, separating the fact from the filth – we will never know as long as both sides hide behind the lens of opacity.
SO, we have to make a decision of who to trust and who to believe.
I live in America and have very little appreciable skills, chalk me up as a yesman and hang a yolk around me.
I choose to believe, sue me.
Opa!
CarpetCat • January 8, 2017 8:21 PM
Did the @Moderator clean up this topic? I find it a hard read, r seems to be responding to something not there.
I like this blog. I would like to keep reading this blog. I think if the @Moderator takes action, it should be noted. Or have I missed something?
@r How do you torch a road? 🙂 Wouldn’t the heat help this time of year in Ohio?
pareidolia • January 8, 2017 8:26 PM
@Mijnheer P., re iron-clad proof, Parry’s work is pretty darned dispositive (e.g. the third link at 3:15 and subsequent work he’s done debunking the statist debunkers.)
Another thing that may have saved Carter’s life is CIA’s adoption of the Safari Club structure, in which foreign agencies collude to use each other’s agents as cutouts. That made Carter’s reforms less of a threat than JFK, so perhaps that’s why they were content to purge him and vilify him.
CIA now has complete freedom from domestic control. Like Songun North Korea, their only worry is concerted international pressure.
@r well, if you’re scared to defend your right to privacy because you might get in trouble, then you’re pretty much useless to any tendency, much less the imaginary GRU recruiters in your fantasy world. what are you even doing here, if you don’t dare encrypt?
@CarpetCat,
I only count 1 pass thus far, I saved the original but that would generate trust and verification issues on pastebin.
Who’s going to believe me that someone Anura called a “paid russian troll” refuted being a “paid” “russian” “troll” and then later responded to me with content including at the end of it “GRU edit, insert:” defending my belittlement of Anna Chapman.
As for torching a road, I didn’t think it through.
defending against my*
I called her a ‘doomkoff’ ‘[sic]’ and proceeded to explain why I though Ivanka Trump was of a higher breed.
JG4 • January 8, 2017 8:36 PM
Thanks for the tip to look at the Litvinenko poisoning. If he lied about Putin twice in the media, that would be grounds for a brutal dismissal. If he told the truth twice about Putin publicly and Putin really is that brutal, we are staring into the abyss. For a KGB assassin with a reckless disregard for human life, Putin seems to be doing a good job of avoiding needless bloodshed in Ukraine. It appears that the Klinton Kabal are rather more reckless. I never imagined that I’d want to send a thank you note to a KGB assassin, but he sheltered Snowden, he kept the US out of Syria a few years ago and he seems to be reserved in dealing with the problems in Ukraine. There have been much worse psychopathic narcissists in recent history.
@CarpetCat, pareidolia
4/5 • January 7, 2017 6:37 PM
Anent 3:24, So then we agree on everything. Then what the fuck is this argument about? Because you think a Russian said it?
@r, wow, who put the nickel in you? The one thing you said that was vaguely comprehensible is wrong: redheaded doomkoff [sic] was not a spy, as you seem to presume, but a backchannel contact situated in case US government shitheads start PNGing accredited diplomats. Sane Americans need interlocutors when that happens so they don’t get vaporized with 50MT Satans for stupidly trying to pick on someone their own size. Nothing about Chapman was clandestine. [GRU edit, insert: Do not be confused because Ms. Chapman is hotter than your tense American women, all Russian women are so. Chapman’s father is a big shot and would not stand for his little kiska to demean herself as a honey trap. even 4/5 is stupendously hot with violet eyes and turned-up nose]
—end
@CarpetCat, depending on the structure I figure:
a) puffery
b) violet hits submit gru intercepts and edits
c) violet forwards to gru, gru submits after review
@violet,
Would you verify that please?
@violet,
Oh believe me, I encrypt.
In fact I spent 3 whole days after Trump was elected making sure all 82 of my hard drives were encrypted and or wiped.
I’m not afraid to defend my right to privacy, I just don’t want uninvited guests and extra extra scrutiny that jumping onto irc2p with someone who could be an FBI shill would invite.
If you want corruption, one needs to look no further than the J. Edgar Hoover building.
How’s that for disparagement?
@violet,
You saw the above link (multiples) about the Geek Squad right?
Have you no imagination?
Plus,
They’ve gotten in trouble for falsifying genetic data, blood data, fingerprint data…
The list goes on, they’re as bad as cops who receive cuts from their performance.
I’m not interested in being a phish.
Anyways,
Just like the NSA and Rofl Weber we can expect that members of the GRU suffer from … compartmentalization syndrome too.
Is there a word for that related to submariners I could repurpose for this case?
Let’s call it rickets and or decompression syndrome.
Silent and deep.
@violet,
I will ask you again, I believe I asked you under “KST”.
How many links do you have in your look-aside-buffer?
You seem to have a compendium of relevant links on topics of Russian national interest much like Nick P’s collection of validation related papers.
Why not just pastebin it up for us all rather than drawing out all these straws one by one?
@All,
Also it may be interesting to start drawing up a list of wordpress links she’s provided over her time here.
65535 • January 8, 2017 9:29 PM
@ Dirk Praet
”…the entire “Putin is meddling in our elections”-thing to me reads as a carefully orchestrated psy-op on behalf of the IC and its MIC overlords. It diverts attention from its own sordid activities, shapes the hearts and minds of the general public and its “elected representatives” for a new cold war, all while undermining the legitimacy of the tweeter-in-chief they seem to have disturbingly little control over… The last US president who turned against the CIA and its allies ended up dead [JFK – ed]…”
That could be true. The was a huge amount of money spent in the last cold war.
@ Clive Robinson
“And to “kill two birds with one stone” what is the betting the patsy will look like or be from the ME and later be said by the IC to be of IS or Syria?…”
“Which will then get some back story about it was the “tweeter in chief” valiantly standing up to Muslims etc making him a convenient martyr-hero in the typical Republican make-over to act as a rallying cause… Thus giving the CIA and DoD War Hawks the excuse for the tanks to roll…”-Clive
That is an unpleasant thought. I would hope brighter or bigger heads will reduce the power of the IC. It seems like the IC is pull all the strings at this moment with politicians lapping it up for various reasons – non of which have to do with true National Security – just turf wars and budget increases. This whole idea of the IC integrating with police and the IT industry seems to be quite profitable for that group of players. But, it leaves the average Joe/Jane footing the bill with no return on investment.
@65535,
Just think, you know how much the secret service has been messing up over the last couple years?
Let’s double down on that, it wasn’t my idea and I’m not encouraging it but I don’t see it as a bright spot in ‘speculative execution’ either.
Clive Robinson • January 9, 2017 12:24 AM
@ tyr,
Can you expand this a bit ? I’m failing to parse it
into clarity.
OK, I’ll un-nest it, and give a simplified / idealized / 20,000ft example as space is limited 🙂
If you backup an encrypted hard drive or more correctly copy an encrypted hard drive at it’s interface. Depending on how you do it you can end up with a bit level image of what is stored on the drive. Which is also called “The data at rest” in some articles and brochures etc. This is especially true for external hard drives.
An Inline Media Encryptor (IME) is a cryptographic device that sits between the computer interface and the hard drive inyerface and does Full Disk Encryption (FDE). The IME has the KeyMat and sometimes the actual encryption chip on a plug in device known as a Crypto Ignition Key. Pull the CIK and all you have is a bit of non-secret hardware, and hard drives with data at rest (or atleast that’s the design goal).
However with such a setup the copy/backup is usually by making a “bit level copy” at the hard drive interface (same as forensic examiners try to do). This is because the bit level data is already encrypted –ie at rest– and only of use to someone with either the CIK or the KeyMat in the CIK. Thus the job could be given to somebody who has no security clearence etc.
Now there is a problem with IMEs which is at what level they encrypt data. They generally can not do it at the file level, nor the OS Container / disk format level but at the logical drive sector/cylinder/head level as that is all that generaly comes out from the computer interface.
This means that encryption is done at the sector level and each sector has the same key no matter how often it’s read or written. In effect it’s a stream cipher, which is all an OTP is when you get down to the nuts and bolts level.
Importantly from a security aspect it’s a stream cipher with key re-use on every write of a sector… Which without a great deal of knowledge and care by the IME designers can be a major security issue.
To see why think of being an attacker having two –or more– time spaced copies of the drive bit level image. It’s easy to see a quick comparison can tell you what has changed, because it contains obvious differences on a simple sector by sector compare.
Now go back and think how a computer and it’s OS and Applications do things…
As a rule of thumb the result is that “Office” and other “productivity” files do not get over written they get fully written to new sectors off of the OS drive format free list and only the directory container gets over written.
Now comes the question of if data is already known on the hard drive sectors before they are over written… And the answer may be yes if the drive had a full formate through the IME (which is quite likely).
Thus you have from the early copy / backup the assumed known plaintext from the full format, encrypted by the sector level stream cipher. Thus you can get the assumed encryption key back for that sector by simply XORing in the assumed plaintext.
But you also have from the second copy/backup of the same sector with new “secret data” which you can now test with your assumed key stream. Due to the regular structure of certain “Office” files they are easy to automaticaly test.
Now you have one secret plain text back you can work your way back on a sector by sector basis to get earlier revisions that are also in the difference sectors between the two copy/backups.
The way to unpick the assumed plaintext from the ciphertext is fairly labour intensive but of a simplicity that is easily automated these days, with only minor prompting from an analyst.
Similar attacks work for the more complex modes of ciphers and even other cipher types. It depends on how skilled the IME designers are and the level of complexity in the IME.
You can look up some work in the 1990’s by Dorothy E. Denning on cryptography for storage to get a fuller understanding of the issues. Also you will find searches for her work turn up later MSc and PhD thesises that provide more modern information.
Thomas_H • January 9, 2017 1:59 AM
@Moderator:
Could you please tell “r” to stop spamming many short or single line posts in a row? It makes the discussion hard to read.
@r:
If you’re trying to get yourself ignored by the majority of readers, rest assured that you are succeeding in just that.
(yeah, yeah, I know, “don’t feed the troll”…)
Moderator • January 9, 2017 3:55 AM
@Thomas_H: Most of @r’s contributions to this thread consist of an extended response to @4/5’s assertion that the GRU has moral lessons to teach the U.S., and that interference with a presidential election is an acceptable way to accomplish this. One can say that r has taken the troll’s bait, or that he’s taken an emphatic position and called out the troll. @r: Please consider consolidating some of your comments in order to avoid inundating other readers. And please no more missives to 4/5.
It doesn’t matter at this point and I’m not willing to risk my own image in the face of known knowns to somebody who is very obviously at this point a very well known known.
Like ab, I really don’t care how people judge me it’s a fact of life.
@Mod, I understand and thank you.
Such an exercise in futility.
Czerno • January 9, 2017 5:02 AM
Snake oil detected, or else… ? :
Still using old open source PGP 6.5 on occasions. Some of you may know/remember it touts a “secure viewer” for the display of (decrypted) plaintext, using a “specially designed font” supposedly having “reduced levels of radio frequency emissions” from the CRT.
In your enlightened opinions, Sirs, is there anything serious behind this claim ?
I don’t know if current versions of (closed source) PGP still provide so called anti-tempest mitigations.
Google and UK Spies Work Together Redirecting Web Traffic • January 9, 2017 5:41 AM
Note: Drudge is used as an example as the funneling practice has become widespread
Rather than simply clicking to the WSJ article readers go to Google UK where American laws do not apply. Its a spying love-fest which all happens in milliseconds. The Americans are left clueless as usual not realizing the intrusive tracking occurring (and probably more).
Browser Test
I did a simple test to attempt to block the sneaky redirection using uBlock Origin with the Palemoon and Chromium browsers using the exlpicit rule: ‘* http://www.google.co.uk * block’
As guessed Chromium gave Google a free pass and showed the WSJ article
Palemoon behaved according to the rules and hung at google.co.uk
So why is Google inserting itself and referring Drudge readers to spy crazy England?
Is this related to the numerous DDoS attacks at Drudge recently?
Why the need Google and GHCQ? What are you recording, inserting and why (beyond American law). Does this also allow the NSA to circumvent spying restrictions on American citizens too?
Note: web pages load really fast at Drudge WITHOUT ‘assistance’ cover story
real link (behind a pay wall of course!)
http://www.wsj.com/articles/health-law-taxes-complicate-gops-repeal-strategy-1483790409
Clive Robinson • January 9, 2017 6:00 AM
@ Czerno,
using a “specially designed font” supposedly having “reduced levels of radio frequency emissions” from the CRT.
They were called “Software TEMPEST fonts” or just “Soft Fonts” and yes they are real. Have a look at the work of the UK’s Cambridge Computer Labs under Ross J Anderson from the late 1990’s onwards for a number of papers, and quite technical details by Dr Markus Kuhn.
The problem with most non ordinary fonts is the fast rising edge of the serial signal to the CRT Guns has a very large spectral content and energy, especially in the frequency bands most suitable for Van Eck freaking. Thus it was quite rasily radiated away from equipment and fairly trivial to intercept. With real time DSP techniques dropping rapidly in price along with easy mods to home scanners etc, it was something that even geeky tenagers could start to get into back then. Modern Software Defined Radio systems now make it possible to do with “pocket money” prices for the receiver and FOSS software and a “gaming laptop” (there are projects to put similar on smart phones…).
Soft fonts were designed with Fourier windowed edges (Gausian filtered). These have low spectral content and energy in the higher frequences, thus the do not radiate as well, and even at comparable energy levels are harder to lock onto to get a good image. Marcus Kuhn did a very nice demonstration over a decade ago showing that LCD displays still had the problem.
It has been discussed on this blog a number of times in the past, and there are some wrinkles you can use from radio astronomy and the like to get greater range or to pick out individual computers “in a sea of computers” which renders some security advice not just ineffective but actually harmfull.
A later Cambridge lab member has come up with a reasonable description of the problem area,
https://www.cl.cam.ac.uk/teaching/0910/R08/work/essay-ykrt2-videorf.pdf
Clive Robinson • January 9, 2017 6:09 AM
@ Bruce and others,
Whilst my son was bed bound due to winter malidies this weekend, he found this cartoon about Google that might amuse,
Dirk Praet • January 9, 2017 6:39 AM
@ r
If I was Russia and Ukraine shot MH17 out of the air and blamed it on me I would roll over them like the Chinese did in Tianamen Square, but they didn’t did they?
Russia vehemently denied all accusations and published its own findings, which – not surprisingly – were kinda ignored everywhere by Western MSM. It would seem that, contrary to a lot of other so-called leaders, Putin is very capable of restraint, which he showed again by not retaliating to Obama’s recent expulsion of Russian diplomats.
SO, we have to make a decision of who to trust and who to believe.
I believe it is even more important to not get carried away by the lies and propaganda of either side, and instead try to critically examine multiple information sources, carefully weighing what actually makes sense and what doesn’t. All of this is nothing but a game of thrones us mere mortals are just meaningless bystanders, and occasionally, collateral damage in.
ab praeceptis • January 9, 2017 11:59 AM
Dirk Praet
Good to see that some reason has survived.
If we applied common sense, ratio, and basic legal principles it quickly becomes clear:
The “investigation commission” is in a nato country (netherland) and not only has one of the two assumed perpetrators (ukraine) as a member but even made an agreement between the participators (incl. ukraine) that nothing would be published without the full consent of all participants.
Let us translate this to normal life:
Both, Mr. A and Mr. B. are said to be potential defendants in a mass killing. Mr. A, however, not only is part of the investigation team, but there are even agreements signed that the investigation will under no circumstances come to a conclusion Mr. B dilikes.
If this whole MH017 case didn’t have all the western media and polit puppets behind it, such an “investigation commission” could only be found in a ridiculous banana republic (which most nato countries have become).
There is plenty proof for blatant manipulation. One better known example is the film material of the “evil, inhumane russian rebel” who picks up a victim childs doll. It went through all the major TV stations in the nato countries as “proof” how evil the “russian rebels” are and how they mock the victims, even kids.
The truth? They carefully edited the original video to make it look maximally bad. In the original full video one can see that the “russian rebel” carefully and respectfully puts the doll back on the ground, takes of his cap, and makes a cross praying for the victims.
Moreover there is proof that the Buk System was a ukrainian one (not russian, not the “rebels” in the east) and that it had been brought in just a day or two before.
So, if one side frantically paints the other side as evil, not caring for facts and truth, not caring about even basic legal principles, using any and all means and massive propaganda – while – the other side (Russia) does everything in its ability to really investigate and to support a real investigation – then I have no more questions and know well who the mass killer is and who the victim is.
Now, with the hacking allegations the play that same script again. No evidence, no trutworthy and professional investigation but lots and lots of propaganda noise by the usual suspects and the media.
ab praeceptis • January 9, 2017 12:03 PM
Correction:
The Mr. A/Mr. B paragraph should obviouly end with “that Mr. A dislikes”.
Gerard van Vooren • January 9, 2017 2:35 PM
Do you guys want to know how the US government deals with IoT security? Here is how.
https://nakedsecurity.sophos.com/2017/01/09/ftc-will-pay-you-to-build-an-iot-security-checker/
It’s a joke. They are simply not getting it.
“The prize for the competition is up to $25,000, with $3,000 available for each honorable mention winner(s). Winners will be announced on or about July 27. The submission deadline is May 22 at noon eastern time.”
I can’t even explain how ridiculous that is. A decent hack will cost you six zero’s or more.
anony • January 9, 2017 2:52 PM
Visiting a site that uses Disqus comments when not logged in sends the URL to Facebook
“Adding Disqus comments doesn’t really scream out that the Facebook SDK will be loaded for all “anonymous” visitors even before they’ve scrolled anywhere near the Disqus comments.”
Ted • January 9, 2017 2:55 PM
GW Law School launches the Cybersecurity Law Initiative.
In 2015, GW held a public symposium</a href> on the Computer Fraud and Abuse Act releasing several available panel discussions and close to a dozen forthcoming articles.
From the December 2016 article “The Failure of the Computer Fraud and Abuse Act: Time to Take an Administrative Approach to Regulating Computer Crime</a href>”:
“Another way to address a new type of criminal activity (especially
one that is based on evolving technology) is to empower an administrative agency to create rules regulating the activity. Administrative agencies have a number of advantages over legislatures and courts because they can develop and apply expertise in setting rules, generate and enforce separate rules for civil and criminal liability, respond quickly in creating or changing rules in response to changing conditions,
and be insulated from political pressures.”
Other such administrative agencies are the SEC and DEA.
vas pup • January 9, 2017 4:11 PM
AI moves to really merit selection in IT field:
http://www.bbc.com/news/business-38393802
Tara analyses and ranks programmers’ code, removing biographical information such as age, race, gender or where you have worked in the past or where you went to university. The algorithm means that people are judged on the work they have produced rather than who they are or who they know.
While “bro culture” might be blamed for failing to retain the few women who do work in tech fields, the reality is there aren’t many trained female computer scientists to recruit in the first place. Although women earn 57% of all undergraduate university degrees in the US, they account for just 18% of computer science degrees.
Using artificial intelligence may level the playing field when it comes to hiring on merit but it won’t solve the recruiting “pipeline problem” of having too few women applicants.
Now you can have your yellow cake, and eat it too! • January 9, 2017 9:15 PM
I offer $5.
This gives a whole new meaning to ‘unattended installation’.
Davina Meher Baba • January 9, 2017 11:13 PM
thanks to @ Nick P for sharing this on Squid a few years ago!
may save your ass in more than one way
tyr • January 10, 2017 1:23 AM
@Clive
That makes more sense. It also points out why
you should never assume that you understand
how the technical parts of your hardware work
without being absolutely sure about it. The
encryption isn’t magic pixie dust that makes
such assumptions into gospel. Making two almost
identical copis with the same OTP is a recipe
for disaster. Given the abilities of high speed
computers to run brute force batch jobs it sure
seems trivial to extract plaintext and key in
that case.
What do you think of the coincidence of the Rus
losing two ambassadors in the same general area
in a few short weeks? Greece and Turkey.
Someone seems to think Carter (POTUS) was a hippy.
As far as I knew he did his time as Adm Rickovers
stooge overseeing the Boomer Fleet of MAD. Not too
much peacenik involved there. It was Reagan who
made him sound like one through the crooked back
door deals with the Iranians.
Another video you might like is at archive.org.
GoketsuJiraiya.
Not too long and a real eyeopener for those who
are NihongiPhiles.
@tyr,
That’s kind’ve a scary inference, I had it pinned the other way after the ‘revolt’ in Turkey.
Let’s hope it’s not already that bloody.
I had no clue about Greece.
http://www.usatoday.com/story/news/world/2016/12/30/greece-ambassador-brazil-murder/96015194/
Are you referring to that?
Nope, you mean this: http://www.independent.co.uk/news/world/europe/russia-diplomat-found-dead-athens-greece-apartment-police-andrey-malanin-a7518276.html
https://grsecurity.net/rap_faq.php
At the bottom,
As sole copyright holder on the RAP plugin itself, the PaX Team is only licensing the full version under a GPLv3 license to commercial customers to permit legal compilation of userland binaries.
So, only gpl compatible userland apps within licensed commercial releases can use these protections.
Is there a similar kernel level variant of RAP that we’re not seeing?
I greatly appreciate the piggybacking argument grsec makes, people are thieves in every shape and form but I think the -world- public needs a BSD licensed alternative.
How do these protections compare to BSD or MIT licensed solutions?
JG4 • January 10, 2017 6:47 AM
further proof that the FBI are dirty. in case it wasn’t clear enough from the fact that J. Edgar engaged in blackmail while he cavorted in female undergarments.
full spectrum dominance would be a good idea if your planet had more enlightened leaders
http://www.france24.com/en/20170110-pentagon-successfully-tests-micro-drone-swarm
JG4 • January 10, 2017 6:59 AM
this may revolutionize a lot of things
http://www.nature.com/news/quantum-computers-ready-to-leap-out-of-the-lab-in-2017-1.21239
this isn’t a particularly good or insightful article, but it’s the juxtaposition that is important. some of the AI implications will be driven by quantum computing
http://www.americanbanker.com/news/bank-technology/bring-on-the-bots-1093072-1.html
Thoth • January 10, 2017 8:41 AM
@r
BSD essentially is like “do whatever you want and just create us – the content creator(s) … oh and don’t blame us if things screw up…”. Really simple stuff.
GPL in whichever form or shape is like a bunch of mess. A minefield essentially.
I have not used MIT license before so I will only comment on the above two. I have switched or will do switching of all GPLs to 3-Clause BSDs and already have a few of my projects under the 3-Clause BSD.
vas pup • January 10, 2017 8:58 AM
Recent on biometrics:
http://www.bbc.com/future/story/20170109-the-seven-ways-you-are-totally-unique
Along with his colleague Patrick Flynn, also at the University of Notre Dame, Bowyer recently went to the annual Twins Day Festival in Twinsburg Ohio to see how well some of the latest technologies can do. “The fraction of identical twins in the population is slowly growing over time so it is potentially a real issue that you would want to distinguish between twins,” says Bowyer.
“Fingerprints are a pretty good way of telling identical twins apart, but not quite as good as it is in the general population.”
At the moment iris recognition is the best method we have for easily distinguishing twins.”
The complex patterns of ridges and furrows formed by the cartilage of your outer ears are remarkably unique to you.
By analyzing a combination of features, such as the distance from the lobe to two points on the upper edge, it is possible to recognize someone from even a fuzzy picture of their ear with 99.6% accuracy in just 0.02 milliseconds.
“As you grow older your ear doesn’t change – it just grows larger but the proportions remain the same,” explains Mark Nixon, a computer vision expert at the University of Southampton who has been one of the leading researchers in ear recognition.
Studies funded by the US Army Research office have found it is possible to identify individuals by looking at the fog of chemicals we leave in our wake as we move around. Scientists at the University of Bristol showed they could distinguish individuals by looking at a combination of 44 compounds secreted by the body, which evaporate off to form a ‘thermal plume’ that surrounds us.
…Kyushu University in Japan, claim they can distinguish between individuals with 100% accuracy, using equipment that produces atomic “fingerprints” of a scent and then running it through an artificial neural network on a computer.
Mark Nixon at Southampton University was one of the first researchers to do this and found that while the way we walk is often quite individual, the way we run is even more so. “Walking is a very passive motion while running is a forced motion and so it much more distinctive,” he explains. “Computers can break down the way you move into a set of numbers that are unique to you. We can identify you from the way your walk, the way you run and the way you go from walking to running.”
Researchers have found that by playing a short clip of white noise and then listening to the way it is changed by a person’s skull, it is possible to pinpoint their identity with 97% accuracy.
Essentially it means we are carrying around our own personal tuning forks inside our heads.
Güórales • January 10, 2017 9:18 AM
Autocomplete a novel phishing hole for Chrome, Safari crims. Hidden forms capture LastPass autofill
The attack vector is manifest when victims select autofill while filling out registration forms: attackers hide sensitive fields like street address, date of birth, and phone number, displaying only basic entry boxes like name and email.
Clive Robinson • January 10, 2017 1:38 PM
@ vas pup,
Researchers have found that by playing a short clip of white noise and then listening to the way it is changed by a person’s skull, it is possible to pinpoint their identity with 97% accuracy.
Essentially it means we are carrying around our own personal tuning forks inside our heads.
It’s actually an active EmSec attack that works with a lot more than just human biologicals. I’m supprised they did not mention the “red eye” effect and how it can be used in the same way.
I’ve mentioned this technique a number of times before and it works with all kinds of radient/conductive energy. Esentially what you have is a waveguide or transmission line that ends in a transducer of some kind. For maximal energy transfer the transducer is thought of as the load on the end of the transmission line. The better this load matches the transmission line the less energy gets reflected back from the load in the reverse direction down the transmission line, to be re-radiated back towards the source of the energy.
All transmission line and load pairs have characteristics that are frequency and time delay specific and can be used as a “finger print” in fine detail but as a general “class identifier” in less detail.
Thus in less detail you can tell a mouse from a cat, from a fox, from a dog, from a goat, from a sheep, from a cow, from a horse from it’s human rider. More interesting in biologicals you can also get a good indicator of their age. So rather than look the proverbial “gift horse in the mouth” and count it’s teeth you can send a pulse of white noise down it’s ear and listen to the echo…
The same class identifier / fingerprint has been used since atleast the early 1950’s to detect surveillance equipment. The most obvious one being the modified “red eye” technique to find cameras and other focused opticals. Less well known are microphones.
Red eye has infact been used by hunters for millenium for “night hunting” where animals look at the fire their eye reflections tell the hunter not just the size but type of prey. Later gun and lantern hunting was known as “lamping”. Oh and most drivers have seen “cats eyes” not just the man made ones in the road but real ones in urban and country areas.
There are two effects that can be used to charecterise a transmission line and it’s load. Firstly is the more commonly known Time Domain Reflectometery, where a high energy pulse is launched out. Some time later reflections come back. If you have a way of distinguishing direction you can make a form of radar or sonar system that shows not just the surface reflection echos but the additional echos from down the transmission line. The second method is to send a “Gausian White Noise Pulse” what you get back is a pulse with frequency dependent information the spectrum of this return pulse tells you about any bandwidth effects in the transmission line or load. You can improve this returned frequency response information by using a phase quadrature (IQ) receiver which will give not just amplitide but phase information as well.
AlanS • January 10, 2017 6:55 PM
From Lawfare: About that Explosive Trump Story: Take a Deep Breath
This afternoon, CNN reported that President Barack Obama and President-Elect Donald Trump had been briefed by the intelligence community on the existence of a cache of memos alleging communication between the Trump campaign and Russian officials and the possession by the Russian government of highly compromising material against Trump. The memos were compiled by a former British intelligence officer…
WhiskersInMenlo • January 10, 2017 6:59 PM
It occurs to me that a tax break is de facto registration.
The EFF is a bit concerned about tax breaks for security cameras.
“…..opposing new legislation introduced in California by Assemblymember Marc Steinorth that would create a tax credit worth up to $500 for residents who purchase home security systems, including fences, alarms and cameras. In a letter, EFF has asked the lawmaker to strike the tax break for surveillance cameras, citing privacy concerns as well as the potential threat created by consumer cameras that can be exploited by botnets. As we write in the letter: ”
https://www.eff.org/deeplinks/2017/01/why-tax-credits-security-cameras-terrible-idea
Comcast/Xfinity is the most visible to me but not the only player.
Where does Comcast and Xfinity fit into the reach of the all writs act?
Requests:
1) all Xfinity IP addresses on the following streets. Their routers have public Xfinity named access points.
the private name is visible via management tools. The routers are reasonably capable and programmable.
2) all customers on the following streets with XFINITY® Home Security Systems
3) all images and sound be routed to storage at…
4) all xfinity rental devices on the following route be programmed to notice and log any visibility
for access from MAC 00:00:00:00:00:00. where 00’s are real or even vendor filtered.
5) all shared Windows 10 Wi-Fi sense connectivity stuff…
https://www.wired.com/2015/07/share-not-share-wi-fi-windows-10/
I am for law and order but fully aware that unlawful use of this data is also possible and likely.
furloin • January 11, 2017 2:01 AM
@all
http://www.zerohedge.com/news/2017-01-10/4chan-claims-have-fabricated-anti-trump-report-hoax
If this is real it just means I lose all hope of any opsec to psyops at any three letter adjective. Also very very funny. I laughed hysterically for about three minutes while reading.
Lesson to learn here, do not let your hatred consume you.
Ai Roker • January 11, 2017 6:34 AM
https://yro.slashdot.org/story/17/01/10/2051201/pentagon-successfully-tests-micro-drone-swarm
Is $20 million going to stop this threat when everybody wants to invest in this technology?
@keiner,
In that civvy compiled document of speculation you indirectly linked on documentcloud there’s something superficially curious on page 6 article 5..
It reads:
5. In terms of other technical IT platforms, an FSB cyber operative flagged up the ‘Telegram’ enciphered commercial system as having been of especial concern and therefor heavily targetted by the FSB, not at least because it was used frequently by Russian internal political activists and oppositionists. His/her understanding was that the FSB now successfully had cracked this communications software and therefor it was no longer secure to use.
Could be a scare tactic on their part, it could be true, it could be disinformation or speculation but it’s good to put it in front of people no matter what.
By the way, I thank you for the 3 links you dropped on the other page.
Part 6. of that bloc may illustrate why our GRU friend became so upset after being censored here if she saw my link to time and comments about responsibility for fostering growth.
RE: Telegram,
If you were FSB defending your country from activism, would metadata leaks from telegram be sufficient for physical interdiction of users?
Locating would enable an end-run attack on devices and users, would they qualify that as ‘cracked’ ?
@Clive,
That document cloud pdf seems to be written on very cheap paper, perhaps 10pt stock?
I believe the redactions (they’re tilted) also were done post-hoc looking at page 2 of it, some of the information may be available as ‘bleeds’.
unhilighted: Botched intervention in recent Turkish crisis?
What intervention in Turkey? 😉
CarpetCat • January 11, 2017 12:06 PM
In regards to encrpytion:
I made the mistake a few years ago of logging off and restarting a government computer. I needed access but didn’t have it, so a buddy allowed me to use his account which was already up and running. (I know, not correct, but in the trenches- must faster)
When I finished, I did what I would normally do on a personal PC, I logged off. My friend came running over, NO! he shouted, as the governemt computer preceeded to do some secure erasing, some key scrubbing, et al.
Several hours later the machine could be ‘used’ again. I was not allowed to touch it anymore 🙁
(but it bloody well did run faster, imho 🙂 )
vas pup • January 11, 2017 12:47 PM
@Clive: Thank you!
Clive Robinson • January 11, 2017 8:32 PM
@ AlanS,
With regards the “Lawfare” article, it’s realy badly written. It looks like it’s using the same techniques as some scandle sheets do. In that it does the shock horror alegations stuff at the top, and only giving a realist view right at the bottom. So anyone not fully reading it would get the wrong impression.
Also the artical does not bring forth the point that the document is based on anonymous informants who almost certainly were “rewarded” in some way.
The fact that everything is so vague is why it has taken reputable new sources over two weeks to not be able to verify anything in them. And the only point that has been factualy checked is verifiably false…
Further the “MI6/SiS” man has now been publically identified, and it appears the trustworthyness of his reports comes only from when he was working at SiS where his reports would have been not just verified but vetted by his seniors prior to them being released to other agencies.
There has been no mention on the quality of his reports since moving into the private sector, which kind of gives the impression he has not had his private sector reports read by any government entities up until now…
What is more worrying is that two different “customers” payed for the same report, one set being disgruntaled Republicans, the other being Democrats…
Thus I am treating the report with the same level of confidence as the US Opinion Polls and MSM who said Hillary was a sure thing.
As I mentioned a few days ago people that act as agents/informers tend to do so for the MICE reasons, but also because it makes them feel important. As was seen with the Yellow Cake information sometimes they tell you what they think you want to hear so they don’t get dropped or burned.
Which is why people should remember what has been remarked in the past of, “When you pay for what you get, ‘sometimes you get what you pay for'” and not what you actually want.
Clive Robinson • January 11, 2017 8:57 PM
@ furloin,
With regards “4Chan” hoaxing the ex MI6/SiS guy, it did not make me laugh, but it did raise a wry smile.
Also if Trump did pay for the “Presidential suit” and got hookers to “golden shower” all over the bed that the Obama’s slept in, then there would be a record / bill / payment of an expensive “clean up” that would be in various “business records”…
I think it’s time to draw up the comfy chair, and put the feet up as this promises to be a “two bowl of popcorn” entertainment 😉
I thought I would never say this but “for once I’m actually enjoying US Politics”… I’d also like to say “You couldn’t make it up” but it might be that 4chan has B-)
Clive Robinson • January 11, 2017 9:21 PM
@ vas pup,
@Clive: Thank you!
That’s alright, hopefully it was of interest to other people as well.
@Clive,
Under who’s covers? A false name? Or maybe a temporarily re-assigned room number.
Even Hollywood celebrities get the privacy treatment, and at the time that’s exactly what Trump was. We’d have to unwind THAT in addition to travel itinerary.
‘Justin Case is in room 12’
You don’t want paparazzi bothering your guests now do you?
Especially when they’re up to kink. 😉
Something like that should be covered by the deposit, would they itemize every last thing against such an escapade or just make note of:
‘plastic sheets’ ?
If he/they really was/were a guest so close to the feet and cornerstone of the Kremlin I don’t expect an honored puppet to even have a record there. It would be improper if my goal was to invite you to a swinger party and not keep it on the up-and-up both in and with respect to my friend @Clive.
What your son doesn’t know. 😉
Notion-building • January 12, 2017 6:59 PM
Is it my imagination or has there been less exploits discovered publicly these last couple months?
@JG4,
10-30g a month is small change for someone who linked to the pharmer from south afrika brother.
It’s just the tip, a good email database can net you quit a bit in itself.
We are absolutely right to follow the belief that a large chunk of internet advertisers are nothing but botflies.
It’s likely that low just because it’s on the fringes of decency.
Like he said, he has non-google ad-gencies just clamoring for a slice of his viewer’s ships and impressions.
If the alt-right is truly that gullible then they really are a dangerous bunch in the face of impressions clicks and downloaders. It’s only one bad agency away from an instant botnet without direct phishing ever being required and that spells doom for the rest of us noscripters.
What’s more, how secure is the pseudo-right infrastructure? Can it be repurposed? Can it be redirected/infiltrated?
It’s a great target all things considered.
But yeah, $800 a day = 24,000 a mo so trust me when I say that aint shit.
If you’re a tree climber you can pull $3000 a day with two men working under you and the ability to sell yourself and your skills. (Maybe not consistently, but with enough exposure $1000 a day is still easy poaching.)
The same thing goes for any properly oriented construction company, I can have a drive way done in 2 days and you don’t want to see what the markup is on that. But, you have to play into the market one way or another and competition works it’s way in. Skilled trades are skilled trades, you’d better know what you’re doing. Something I have to constantly explain to small business owners is the “hand-brake” concept about pumping your prices ever so slightly enough to not drive yourself insane but still catch the phish.
There’s also the concept of autonomous money (incorrect name, is anyone a financials/accountant here to step in and coin the correct phrase?), like investments creativity can be leveraged in ways to generate income while you sleep.
One just has to be keen, or well- well connected.
I guess the bottom line is, before I run off for the day – if you work for someone other than yourself you’re likely in the wrong business.
JG4 • January 13, 2017 7:08 AM
http://www.nakedcapitalism.com/2017/01/links-11317.html
…
Big Brother is Watching You Watch
N.S.A. Gets More Latitude to Share Intercepted Communications New York Times (Bill B)
https://www.nytimes.com/2017/01/12/us/politics/nsa-gets-more-latitude-to-share-intercepted-communications.html
Chilling new pre&post-crime rule: if analysts find evidence that an American committed “any crime” they send to DoJ. @Thomas_Drake1
https://twitter.com/thomas_drake1/status/819700645355802625?refsrc=email&s=11
AI arms race risks spiralling out of control, report warns Financial Times (David L)
https://www.ft.com/content/b56d57e8-d822-11e6-944b-e7eb37a6aa8e
Highly Effective Gmail Phishing Technique Being Exploited WordFence (Dan K)
https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
the FT content is paywalled – this at least shows the front end
http://thefutureofai.blogspot.com/2017/01/ft-ai-arms-race-risks-spiralling-out-of.html
EXTRA, EXTRA • January 13, 2017 10:17 AM
Time to party like it’s 9/11
Rudy Giuliani to lead Trump’s cybersecurity team
http://www.recentnewz.com/rudy-giuliani-to-lead-trump-s-cybersecurity-team/
He was selected because of his private sector cybersecurity expertise, a Trump transition team statement said.
[…]
…Mr Giuliani, 72, who runs an international security consulting firm.
A vocal Trump supporter all through the campaign, he last month said he was taking himself out of the running for a cabinet job after his business contact came under media analysis.
Should check what that “international security consulting firm”…maybe it’s related to that one that consulted the UK government in that 7/11 London bombing thing back in 2005…
anony • January 13, 2017 2:25 PM
a machine tracking method that looks behind the browser, and reads graphic card abilities, drawing methods, and cpu cores to track you
(Cross-)Browser Fingerprinting via OS and Hardware Level Features
some other fine papers at the site
P6 “rely” => “relay” • January 13, 2017 2:35 PM
@furlion
The dossier was circulating well before “4chan” ‘hoax claims’ self-aggrandizing notwithtanding, go figure from zerohedge, a Russian infiltrated site
@EXTRA, EXTRA
“He was selected because of his private sector cybersecurity expertise, a Trump transition team statement said”
In reality:
https://mobile.twitter.com/SwiftOnSecurity/status/819777935129251841?p=p
–
s • February 23, 2017 11:01 PM
@r
Jobs promote security and as I’ve said many times before I think we dropped the ball with Russia in the 90’s in this aspect, but here we are – they didn’t collapse and thankfully as far as I know they still have complete control over their nuclear arsenal. If there’s anything I can praise Putin for it can be found in that fact, I don’t know the man but if my president looked the other way when we shot down a plane with 200 dutch/aussie/malay’s I’d be out in the streets with a torch to the ohio turnpike in a second.
So it’s the Reuters reporters’ fault for being in a dangerous place (ME) when US aircraft (with top-end optics) gun them down, but when an airplane flying miles over a war-zone and gets shot down by RUSSIANS, all of a sudden you go “oh my God killing civvies how awful” huh?
I’m guessing you don’t want to lock up the people who leaked that, on “espionage” charges, huh? Hypocrite.
s • February 23, 2017 11:09 PM
@r
The best you could do is encourage the smash and grab jobs of manning and snowden even when you have an unquantifiable number of insiders within the FBI. All this DDD and CIA finger waving coming from the east
That’s pretty rich considering that Snowden and Manning WERE insiders, and that you call their non-violent whistleblowing againsg war criminals in NSA/FBI/CIA a “smash and grab job” when the NSA/FBI/CIA are the ones who resort to violence, against their civilians, whenever their civilians outsmart them technologically. You constantly accuse anyone who critiques the USG of being a paid shill but you’re obviously a JTRIG operative or some low-level NSA troll.
s • February 23, 2017 11:57 PM
@65535
. It seems like the IC is pull all the strings at this moment with politicians lapping it up for various reasons – non of which have to do with true National Security – just turf wars and budget increases. This whole idea of the IC integrating with police and the IT industry seems to be quite profitable for that group of players.
The IC’s efforts have plenty to do with national security. Namely, reducing it.
But, it leaves the average Joe/Jane footing the bill with no return on investment
Joe/Jane ARE getting a return; sabotaged NIST standards e.g. dual elliptic curve cryptography with backdoors that will soon be sold to Russia/China, just like Equation Group’s collection of zero days was.
s • February 24, 2017 12:10 AM
@Clive Robertson
…Importantly from a security aspect it’s a stream cipher with key re-use on every write of a sector… Which without a great deal of knowledge and care by the IME designers can be a major security issue. …
You’re just describing the ancient “see the penguins” gaff right? How can you call it a hard problem? There are countless well known block-level solutions. Almost every mode of AES solves it easily except AES-ECB. Very simple, very well known, very SOLVED problem.
If American businesses still use ECB it’s not because of a technical difficulty. It’s because of the NSA sabotaging US national security to make it easier to persecute political dissidents and Vietnam war protesters. Or now Iraq war protesters.
s • February 24, 2017 12:32 AM
@Ted
Another way to address a new type of criminal activity (especially one that is based on evolving technology) is to empower an administrative agency to create rules regulating the activity. Administrative agencies have a number of advantages over legislatures and courts because they can develop and apply expertise in setting rules, generate and enforce separate rules for civil and criminal liability, respond quickly in creating or changing rules in response to changing conditions, and be insulated from political pressures.”
Other such administrative agencies are the SEC and DEA.
But hacking someone is already illegal (unless you’ve sold your soul to Satan I mean USG).
You know perfectly well that the only “regulations” such “administrative groups like the DEA” will pass are going to be “arrest and/or torture and/or kill anyone who makes their computer secure, or tells other people how to make their computers secure, or who sells hardware and/or software that would let Americans have secure computers”.
s • February 24, 2017 12:51 AM
@r
So, only gpl compatible userland apps within licensed commercial releases can use these protections.
Is there a similar kernel level variant of RAP that we’re not seeing?
@Thoth
GPL in whichever form or shape is like a bunch of mess. A minefield essentially.
Licensing some PaX stuff as BSD wouldn’t help NetBSD/FreeBSD/OpenBSD. That code probably needs completely rewritten to work outside of Linux.
All the GPL is doing is preventing someone from taking the volunteer/community work and selling it as part of a closed-source distro such as TiVo or Android.
GPL just means when you use other people’s open source code AND you change/combine it, that you must contribute it back to upstream, and even then ONLY IF it’s not for your own personal use.
BSD lets NGOs like Apple and Google perform Embrace Extend Exterminate attacks against the open source community. Please, no offense but PLEASE educate yourselves before telling people to start releasing code as BSD instead of GPL.
Clive Robinson • February 24, 2017 6:39 AM
@ s,
You’re just describing the ancient “see the penguins” gaff right?
Did you read my full comment?
It did start with,
- OK, I’ll un-nest it, and give a simplified / idealized / 20,000ft example as space is limited 🙂
And almost at the bottom,
- Similar attacks work for the more complex modes of ciphers and even other cipher types. It depends on how skilled the IME designers are and the level of complexity in the IME.
With regards,
How can you call it a hard problem? There are countless well known block-level solutions. Almost every mode of AES solves it easily except AES-ECB. Very simple, very well known, very SOLVED problem.
Hmm do you know about IME design? I suspect not, it’s very much more constrained than designing an OS or Userland encrypting storage device driver…
You have to consider, that to work effectively an IME must work with “no knowledge” of the upstream computer system or the downstream storage device. Also it must work effectively if either the computer or storage are changed. The only information it should work with is a small very standard subset of the low level protocol it’s interfaces use (IDE SCSI etc etc). It must not add or subtract from the protocol in any way, nor must it barf on any non standard additions, subtractions or modification of the protocol by the computer or storage device.
If it does not comply with those requirments, it will be at best problematic in use at the worst possible time to put it politely.
To see why, consider for instance any upgrade or modification of either the upstream computer or downstream storage device. If not fully transparent the IME will fail. Thus a backup in case of hardware failure or upgrade will likewise fail… Opps the major reason for backups has just been blown out of the water…
As for the use of “chaining modes” you need to have an IV for each storage block that is unique or you in effect get back to the duplicate keystream issue. Thus the IME not only has to generate the IVs independently of the computer or storage, it has to make them unique to prevent certain types of attack. The killer with that is it has to store them independently of either the upstream computer or downstream storage device, otherwise the requirment for transparancy gets blown out of the water. Further that IV generation has to be unique and independent in a way that does not alow any information from the computer or storage device. So no device IDs / serial numbers or magic numbers from the computer.
One test to check if you have an IME device design that has some chance it is going to work, is to put two of them in series between the computer and storage device. If anything stops working it’s back to the drawing board…
There is a heck of a lot more you have to know and consider when designing IMEs and there are quite a few subtle gotchers that someone who had written a crypto device driver would be very unaware of. And no I do not propose to go through them, as I don’t want to take the time it would to write a book to explain even some of them.
Oh and just to show what fun there is, an IME device is “transparent” which has “information leakage” considerations through the likes of “time based side channels”. How about you showing your technical credability by giving a 20,000ft overview as to how you would mitigate them?
If you can not answer it, don’t worry the old hands hear will understand why. After all it’s one of the reasons so many people read this blog.
@Clive Robinson
Seed IME’s from a manufacturer controlled TRNG before shipping them out, or include a cheap one like Bull Mountain(without the NSA-mandated backdoor) for initialization vector.
It’s not expensive to give the IME enough builtin storage so it won’t have to save the IV upstream or downstream. Or the IME could reserve the needed amount of space on disk times desired chaining depth, but there’s really no difficulty fitting it in the IME, which of course allows an infinite series of IMEs.
Of course it shouldn’t mangle the IDE/SATA/SCSI commands, but what’s hard about not doing that?
There are numerous modes that work at block/sector level. Not knowing the filesystem doesn’t mean that you’re stuck with AES-ECB. There are countless FDE software/drivers that work at block level and are filesystem agnostic.
Side channel attacks are mitigated the same as in a crypto driver; use primitives that take the same amount of time and energy for all inputs, and hope whatever anti-tamper features in the IME chip and connection between that chip and the upstream computer and of course in the computer itself are sufficient. The connection should of course be TEMPEST proof, with anti-tamper measures preventing reconnecting the data lines to another computer without sensitive keymat being wiped.
Of course with travesties like http://www.theverge.com/2017/2/24/14727418/fcc-privacy-rules-stay-ajit-pai-net-neutrality it’s obvious that big brother won’t allow Americans to use an IME in any mode but ECB. It would make it too hard to target political dissidents and peaceful protesters.
Clive Robinson • February 25, 2017 8:14 AM
@ s,
Seed IME’s from a manufacturer controlled TRNG before shipping them out
It’s actually the Crypto Ignition Key (CIK) and the IME you seed not the IME alone, that way you get around the problem of using a CIK in multiple IMEs.
Also it’s the user who should provide seed info at the setup of the respective parts. The manufacturer provides a very large offset / IV to give a base decimation of the key space. The trick is decoupling that number such that even if the manufacture gave it to a SigInt agency they would not gain by the information. Obviously the user has to provide a large seed preferably from a “true” random source that can not be backdoored by manufactures or SigInt agencies.
It’s not expensive to give the IME enough builtin storage so it won’t have to save the IV upstream or downstream
Err no you need to store it in the CIK, and the CIK needs sufficient space to store info for use in multiple IMEs. With modern storage sizes and standard storage block / sector sizes it would require a very large amount of storage. To much so the CIK needs to in effect calculate the block/sector IVs. One way this can be done is to keep the seeds on the CIK and get the IME to calculate them, but hold them in RAM in some unpredictable and evolving manner. Thus when the CIK is pulled even if the IME memory is burnt in / frozen and 100% recoverable the attacker gains no information of use. I’ve discussed how to do this with the likes of “data shadows” in the past.
What you don’t do is store anything on the computer or storage device as that would break the important transparency rule, which is a definate “no no”.
Of course it shouldn’t mangle the IDE/SATA/SCSI commands, but what’s hard about not doing that?
That depends on how you deal with “bad blocks” and if you are using block/sector/cylinder remapping as part of the IME function or not. Also if you are performing other functions such as leveling or scrubbing of storage devices. Basically when storage was tape or platter in an electromechanical device remapping was either impossible or had a time thus performance penalty as well as shortening the mechanical life of the storage device. This becomes less and less true as storage becomes more like RAM thus there is no real time penalty for remapping and it has security advantages. There are however issues to do with scrubbing if you do it on a sector basis but the computer uses blocks, one performance optimization OS/driver writers do is partial block writes causing “tail end” issues, which forensic investigators have long used as fruitful hunting grounds.
Side channel attacks are mitigated the same as in a crypto driver; use primitives that take the same amount of time and energy for all inputs…
Err no, that deals with some potential channels in the IME, not the issues to do with the timing transparancy of the IME between it’s upstream port and downstream port. It’s an area of investigation and mitigation that academia and industry has more or less ignored the existance of untill very reacently. One aspect of it is the storage device using various tricks to enumerate what is connected to it’s upstream port with the likes of “soft errors”. It’s the joy of interdiction / supply chain poisoning the firmware in your storage device can have spyware in it. As I’ve noted before active fault injection attacks are something that go back atleast as far as the 1980’s when I independently discovered various tricks to exploit it, apparently from speaking to others I was not the only person to independently discover such tricks. All of which suggests that the SigInt agencies are aware of it as well but have stopped people talking about it in the past.
The connection should of course be TEMPEST proof
Not sure how you are using “TEMPEST proof”, formally or informally. TEMPEST was –and I assume still is– about “passive EmSec attacks” where by the adversary observes “emmissions” from the equipment. That is only half the story, the “active EmSec attacks” are way way more interesting and usually not taught or even tallked about when technicians get TEMPEST training. The reason as with EMC most measures you take to reduce emmissions also reduces susceptibility. The fun is that not all emmission reduction techniques reduce susceptibility, some make it worse a lot worse… If you look at the academic side of things you will have to do a lot of hunting for information on active EmSec attacks, and the few there are have come from the likes of the UK Cambridge Uni Comp labs and more recently an Israeli Uni with ties to a German telecom company.
As for what Big Bro will or will not alow, as I point out from time to time they realy don’t have any choice in the matter. With a little thought all of their controls can be bypassed without difficulty (but a lot of tedium). Which means that they either have to let it pass or call out the “Guard Labour” the downside of that is it only goes in one direction and it’s not pretty for either side.
Nick P • February 25, 2017 7:37 PM
@ s
re PAX code on BSD’s
HardenedBSD is already doing similar things. One of main developers is long-time hacker “lattera.”
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Jonathan Wilson • January 6, 2017 4:41 PM
New way to track people using ultrasound (including using it to unmask Tor users)
https://www.bleepingcomputer.com/news/security/ultrasound-tracking-could-be-used-to-deanonymize-tor-users/
Even more reason to run an ad blocker on all your devices.