Collaborate Disseminate
Kelly Jackson Higgins has a story about how I hacked her 10 years ago, by sniffing her email password via WiFi and displaying it on screen. It wasn’t her fault — it was technology’s fault. Sooner or later, it will betray you.The same thing happen… Continue reading Technology betrays everyone
Many in the community are upset over the recent “Verizon DBIR” because it claims widespread exploitation of the “FREAK” vulnerability. They know this is impossible, because of the vulnerability details. But really, the problem lies in misconceptions ab… Continue reading Freaking out over the DBIR
The question posed by Bruce Schneier is whether vulnerabilities are “sparse” or “dense”. If they are sparse, then finding and fixing them will improve things. If they are “dense”, then all this work put into finding/disclosing/fixing them is really doi… Continue reading Vulns are sparse, code is dense
My previous post shows how anybody can verify Satoshi using a GUI. In this post, I’ll do the same, with command-line tools (openssl). It’s just a simple application of crypto (hashes, public-keys) to the problem.I go through this step-by-step discussio… Continue reading Satoshi: how Craig Wright’s deception worked
In this WIRED article, Gaven Andresen says why he believes Craig Wright’s claim to be Satoshi Nakamoto:
“It’s certainly possible I was bamboozled,” Andresen says. “I could spin stories of how they hacked the hotel Wi-fi so that the insecure connection gave us a bad version of the software. But that just seems incredibly unlikely. It seems the simpler explanation is that this person is Satoshi.”
That’s not how this works. That’s not how any of this works.
The entire point of Bitcoin is that it’s decentralized. We don’t need to take Andresen’s word for it. We don’t need to take anybody’s word for it. Nobody needs to fly to London and check it out on a private computer. Instead, you can just send somebody the signature, and they can verify it themselves. That the story was embargoed means nothing — either way, Andresen was constrained by an NDA. Since they didn’t do it the correct way, and were doing it the roundabout way, the simpler explanation is that he was being bamboozled.
Below is an example of this, using the Electrum Bitcoin wallet software:
This proves that the owner of the Bitcoin Address has signed the Message, producing the Signature. I typed the first two fields, hit the “Sign” button. The wallet looked up the address in my wallet (which can have many addresses), found the matching private key that only I posess, then signed the message by filling in the bottom window.
If you had reason to believe that this address belonged to Satoshi Nakamoto, such as if it had been the first blocks, then I would have just proven to you that I am indeed Satoshi. You wouldn’t need to take anybody’s word for it. You’d simply type in the fields (or copy/paste), hit “verify”, and verify for yourself.
So you can verify me, here are the strings you can copy/paste:
Robert Graham is Satoshi Nakamoto
15fszyyM95UANiEeVa4H5L6va7Z7UFZCYP
GyMgaHVszLSej/VuCdeXnMmiB/d6rBrghQ3qR6XvabZtBrzF8vOA1IW4MnhNfcLny1N15pSZw16JlmQWss7y3zM=
You should get either a “Signature verified” or “Wrong signature” message when you click the “Verify” button.
There may be a little strangeness since my original message is ASCII, but if you copy out of this webpage, it’ll go in as Unicode, but it appears that this formatting information is ignored in the verification process, so it’ll still work.
Summary
Occam’s Razor is that Andresen was tricked. There was no reason to fly him to London otherwise. They could’ve just sent him an email with a message, a signature, and an address, and Andresen could’ve verified it himself.
Whether the police can force you to unlock your iPhone depends upon technicalities. They can’t ask you for your passcode, because that would violate the 5th Amendment right against “self incrimination”. On the other hand, they can force you to press yo… Continue reading Touch Wipe: a question for you lawyers
So starting next week, running for a week, I plan on scanning for ports 0-65535 (TCP). Each probe will be completely random selection of IP+port. The purpose is to answer the question about the most common open ports.This would take a couple years to s… Continue reading My next scan
WIRED has written an article defining “White Hat”, “Black Hat”, and “Grey Hat”. It’s incomplete and partisan.
Black Hats are the bad guys: cybercriminals (like Russian cybercrime gangs), cyberspies (like the Chinese state-sponsored hackers that broke into OPM), or cyberterrorists (ISIS hackers who want to crash the power grid). They may or may not include cybervandals (like some Anonymous activity) that simply defaces websites. Black Hats are those who want to cause damage or profit at the expense of others.
White Hats do the same thing as Black Hats, but are the good guys. The break into networks (as pentesters), but only with permission, when a company/organization hires them to break into their own network. They research the security art, such vulnerabilities, exploits, and viruses. When they find vulnerabilities, they typically work to fix/patch them. (That you frequently have to apply security updates to your computers/devices is primarily due to White Hats). They develop products and tools for use by good guys (even though they sometimes can be used by the bad guys). The movie “Sneakers” refers to a team of White Hat hackers.
Grey Hat is anything that doesn’t fit nicely within these two categories. There are many objective meanings. It can sometimes refer to those who break the law, but who don’t have criminal intent. It can sometimes include the cybervandals, whose activities are more of a prank rather than a serious enterprise. It can refer to “Search Engine Optimizers” who use unsavory methods to trick search engines like Google to rank certain pages higher in search results, to generate advertising profits.
But, it’s also used subjectively, to simply refer to activities the speaker disagrees with. Our community has many debates over proper behavior. Those on one side of a debate frequently use Gray Hat to refer to those on the other side of the debate.
The biggest recent debate is “0day sales to the NSA”, which blew up after Stuxnet, and in particular, after Snowden. This is when experts look for bugs/vulnerabilities, but instead of reporting them to the vendor to be fixed (as White Hats typically do), they sell the bugs to the NSA, so the vulnerabilities (call “0days” in this context) can be used to hack computers in intelligence and military operations. Partisans who don’t like the NSA use “Grey Hat” to refer to those who sell 0days to the NSA.
WIRED’s definition is this partisan definition. Kim Zetter has done more to report on Stuxnet than any other journalist, which is why her definition is so narrow.
But Google is your friend. If you search for “Gray Hat” on Google and set the time range to pre-Stuxnet, then you’ll find no use of the term that corresponds to Kim’s definition, despite the term being in widespread use for more than a decade by that point. Instead, you’ll find things like this EFF “Gray Hat Guide”. You’ll also find how L0pht used the term to describe themselves when selling their password cracking tool called “L0phtcrack”, from back in 1998.
Fast forward to today, activists from the EFF and ACLU call 0day sellers “merchants of death”. But those on the other side of the debate point out how the 0days in Stuxnet saved thousands of lives. The US government had decided to stop Iran’s nuclear program, and 0days gave them a way to do that without bombs, assassinations, or a shooting war. Those who engage in 0day sales do so with the highest professional ethics. If that WaPo article about Gray Hats unlocking the iPhone is true, then it’s almost certain it’s the FBI side of things who leaked the information, because 0day sellers don’t. It’s the government who is full of people who foreswear their oaths for petty reasons, not those who do 0day research.
The point is, the ethics of 0day sales are a hot debate. Using either White Hat or Gray Hat to refer to 0day sellers prejudices that debate. It reflects your own opinion, not that of the listener, who might choose a different word. The definition by WIRED, or the use of “Gray Hat” in the WaPo article, are obviously biased and partisan.
The AP Stylebook and others are now declaring that “Internet” should no longer be capitalized, that you should just say “internet” instead. This is wrong, because the Internet is just an internet.Internet is short for internetwork. This was a term deve… Continue reading No, Internet should be capitalized
So the latest news is that you can run Ubuntu and bash on Windows 10. In other words, from the bash command-line, you execute apt-get to get/run any Ubuntu binary — the same binary that runs on Linux. How do it work?I don’t know yet, but bro… Continue reading Some notes on Ubuntu Bash on Windows 10