News WikiLeaks reveals sites critical to US security

[nismaratwork]

If it has a passkey, why can't they just run each one in sequence until they get it? We have the power. Is there a reason you couldn't set up a piece of software to run such an attack?

I know it's less complicated, but if I need a password to something I just run a brute force attack to run all possible combinations until it breaks it.

When it comes to sound encryption you run into problems of factoring large prime numbers... so brute force would take more time than the universe has been in existence. Barring a breakthrough in the factoring of prime numbers or computer hardware, that's a locked file.

 

[rhody]

whatever is in "insurance" is only 1.5GB, which is only a 1/1000-th of the total volume they claimed to have collected a few years ago before they even went public.

there is apparently a lot more over at Cryptome that John Young is releasing (is he trying to cover his own *** so he isn't next?) from the internal private wikileaks mailing list, but I'm not sure how much time i'd want to invest in that.

Proton,

Got a link for this ?

Rhody...

 

[NeoDevin]

If it has a passkey, why can't they just run each one in sequence until they get it? We have the power. Is there a reason you couldn't set up a piece of software to run such an attack?

I know it's less complicated, but if I need a password to something I just run a brute force attack to run all possible combinations until it breaks it.

The keyspace is too large, and each attempt takes some finite amount of time. If you have a 256bit key, then that's 2^{256} = 1.158\times 10^{77} possible keys. If each attempt takes 1 microsecond, then that's 1.158\times 10^{71}\mathrm{s} = 3.672\times 10^{63}\mathrm{years} to try every key. This means on average, to guess a 256bit key by brute force will take 1.836\times 10^{63}\mathrm{years}/\mbox{No. of CPUs}. There simply aren't enough CPUs in the world to make this a manageable number.

 

[CAC1001]

What have we learned from Wikileaks that changes the major issues with these wars? NOTHING! The "common man" already figured out the big stuff such as W's administration's lies to the UN, the people of the USA, and each other.

They weren't "lies."

 

[NeoDevin]

They weren't "lies."

Which ones weren't "lies"?

 

[Mathnomalous]

They weren't "lies."

Misstatements, I suppose.

 

[nismaratwork]

Misstatements, I suppose.

Carefully chosen ones!


CAC1001:Yes, statements made with the intent to be truthful, but somehow ended up being about nonexistent weapons programs. I hate when I slip up and concoct a cause for war... I mean the last time I was just yachting in The Gulf of Tonkin, and then all hell breaks loose...

 

[CAC1001]

They weren't lies or mis-statements, they were what the administration thought were statements of fact. A guy like General Colin Powell, one of the most respected men on the planet at the time, wasn't going to just go and "lie" to the United Nations and the world, over such an issue.

 

[Hurkyl]

When it comes to sound encryption you run into problems of factoring large prime numbers... so brute force would take more time than the universe has been in existence. Barring a breakthrough in the factoring of prime numbers or computer hardware, that's a locked file.

I can factor large prime numbers in my head.

 

[nismaratwork]

I can factor large prime numbers in my head.

Oh thank god, I have this supposedly one-way hash function I need cracked, and you're just the brain- er... man... I need to put in a jar in my new machi- ahhh... to operate my new computer. Here... drink this while I get a striker saw and a jar...

CAC1001: You're entitled to your religious beliefs. Wait, wrong response, but it applies pretty well.

 

[CAC1001]

CAC1001: You're entitled to your religious beliefs. Wait, wrong response, but it applies pretty well.

I would say it is a "religious belief" among the people who claim President Bush lied the nation into war.

 

[jobyts]

When it comes to sound encryption you run into problems of factoring large prime numbers

Factoring large prime numbers? I'm sure you will run into problems. I tried even smaller ones, but didn't succeed.

 

[Proton Soup]

Proton,

Got a link for this ?

Rhody...

sure, not exactly a 1/1000-th mind you, but same order of magnitude.

http://cryptome.org/0003/wikileaks-lash.htm

To: John Young <jya[a t]pipeline.com>
From: Wikileaks <wikileaks[a t]wikileaks.org>
Subject: martha stuart pgp
Date: Sun, 7 Jan 2007 12:20:25 -0500

-----BEGIN PGP MESSAGE-----
Version: None

J. We are going to **** them all. Chinese mostly, but not entirely a feint. Invention
abounds. Lies, twists and distorts everywhere needed for protection. Hackers monitor
chinese and other intel as they burrow into their targets, when they pull, so do we.
Inxhaustible supply of material. Near 100,000 documents/emails a day. We're going to
crack the world open and let it flower into something new. If fleecing the CIA will
assist us, then fleece we will. We have pullbacks from NED, CFR, Freedomhouse and
other CIA teats. We have all of pre 2005 afghanistan. Almost all of India fed. Half
a dozen foreign ministries. Dozens of political parties and consulates, worldbank,
apec, UN sections, trade groups, tibet and fulan dafa associations and... russian
phishing mafia who pull data everywhere. We're drowing. We don't even know a tenth
of what we have or who it belongs to. We stopped storing it at 1Tb.

 

[WhoWee]

sure, not exactly a 1/1000-th mind you, but same order of magnitude.

http://cryptome.org/0003/wikileaks-lash.htm

These WikiLeaks people sound like little kids sitting in an upstairs closet, planning to sneak down the stairs to listen to an adult conversation taking place around a card table (a 1950's or 1960's retro example). Then once they hear something they run back to the closet and giggle, then maybe tell their friends about it the next day.

The difference is that while a story including Bob's dad said a bad word, and Matt's dad had gas, and Bill's mom wanted another drink might have been entertaining, it didn't really injure anyone.

If your link is real, maybe the hackers should start to worry about ALL of the players. Everyone will not be restricted by the rules applicable to the US. Personally, I'll find it ironic and even humorous if the unintended consequences of this leak is the retaliation onto the hackers themselves - by their "info hosts".

Bragging often gets people into more trouble than the act itself - IMO.

 

[Proton Soup]

These WikiLeaks people sound like little kids sitting in an upstairs closet, planning to sneak down the stairs to listen to an adult conversation taking place around a card table (a 1950's or 1960's retro example). Then once they hear something they run back to the closet and giggle, then maybe tell their friends about it the next day.

The difference is that while a story including Bob's dad said a bad word, and Matt's dad had gas, and Bill's mom wanted another drink might have been entertaining, it didn't really injure anyone.

If your link is real, maybe the hackers should start to worry about ALL of the players. Everyone will not be restricted by the rules applicable to the US. Personally, I'll find it ironic and even humorous if the unintended consequences of this leak is the retaliation onto the hackers themselves - by their "info hosts".

Bragging often gets people into more trouble than the act itself - IMO.

wikileaks isn't even the story. the real story is that you've got a hacker mafia in russia breaking in everywhere getting dirt on everyone off public networks. and i guess chinese too. and nobody cares about that, or dealing with it. the only thing anyone cares about is the appearance, the public relations aspect. Assange is a convenient scapegoat that you can publicly flay while conveniently ignoring that the barn door is wide open.

 

[nismaratwork]

This isn't hacking... it's script-kiddy bull****. They're just saying they watch the activity of people who DO have the talent to enter databases, and then packet sniff them! Our security is SO BAD, that it just takes a bunch of script kiddies being supported by a handful of talented and generally anonymous black-hats.

 

[nismaratwork]

wikileaks isn't even the story. the real story is that you've got a hacker mafia in russia breaking in everywhere getting dirt on everyone off public networks. and i guess chinese too. and nobody cares about that, or dealing with it. the only thing anyone cares about is the appearance, the public relations aspect. Assange is a convenient scapegoat that you can publicly flay while conveniently ignoring that the barn door is wide open.

Proton, we have the NSA and Echelon, and more... we do the same thing. This isn't hacking, as I mentioned previously, just another form of semi-active sigint. The issue isn't that this is being done, but that we're sucking at it.

 

[Proton Soup]

This isn't hacking... it's script-kiddy bull****. They're just saying they watch the activity of people who DO have the talent to enter databases, and then packet sniff them! Our security is SO BAD, that it just takes a bunch of script kiddies being supported by a handful of talented and generally anonymous black-hats.

i'm not sure whether you're saying our security is good or bad.

 

[rhody]

This isn't hacking... it's script-kiddy bull****. They're just saying they watch the activity of people who DO have the talent to enter databases, and then packet sniff them! Our security is SO BAD, that it just takes a bunch of script kiddies being supported by a handful of talented and generally anonymous black-hats.

misnara,

Since Proton did not address my original question in Post https://www.physicsforums.com/showpost.php?p=3032729&postcount=242" I will pose the question to you, to separate fact from fiction, isn't that what PF is supposedly all about ?

whatever is in "insurance" is only 1.5GB, which is only a 1/1000-th of the total volume they claimed to have collected a few years ago before they even went public.

there is apparently a lot more over at Cryptome that John Young is releasing (is he trying to cover his own *** so he isn't next?) from the internal private wikileaks mailing list, but I'm not sure how much time i'd want to invest in that.

Proton, errr. Misnara,

Got a link for this ?

I respect your opinion and insight hopefully backed by multiple, verifiable sources...

Thanks in advance...

Rhody...

P.S. BTW from the information I have been able to obtain even if they were to crack thehttp://www.popsci.com/technology/article/2010-12/how-secure-julian-assanges-thermonuclear-insurance-file" , and text is scrambled and would be of no use anyway.

see text from the link:

There are three variants of AES, which differ in the size of their keys (128, 192, or 256 bits), though they all use the same 128-bit block size. The size of the key has other implications within the algorithm itself (and slightly increases the encoding time), but mostly, it increases the amount of time needed to break it with what's called a "brute force attack" (more on that in a bit). The three variants also carry different numbers of "rounds" protecting their keys. Each round is sort of like a layer of further obscurity, making the original data all the more disguised. AES-128 has ten rounds, AES-192 has twelve, and AES-256 has fourteen.

Those rounds make it effectively impossible to compare the ciphered data with its key and divine any sort of pattern, since the data has been so thoroughly mangled by, in this case, 14 rounds of highly sophisticated manipulation that it's unrecognizable. The rounds make an already secure algorithm that much more secure.

 

[Proton Soup]

Proton, we have the NSA and Echelon, and more... we do the same thing. This isn't hacking, as I mentioned previously, just another form of semi-active sigint. The issue isn't that this is being done, but that we're sucking at it.

that's the same thing

 

[nismaratwork]

i'm not sure whether you're saying our security is good or bad.

Our security is wretchedly bad.

I think you need to check what 'hacking' originally meant, came to mean, and really means in practice; there's no way that someone using someone else's programs to scan ports or sniff packets is a hacker... they are a script-kiddy. Hacking is actively creating your own code, and entering where you're not welcome... not managing botnets, not packet-sniffing, and not even massive signal intercepts. It may be that this is a semantic issue, I'm not sure.

 

[nismaratwork]

misnara,

Since Proton did not address my original question in Post https://www.physicsforums.com/showpost.php?p=3032729&postcount=242" I will pose the question to you, to separate fact from fiction, isn't that what PF is supposedly all about ?



I respect your opinion and insight hopefully backed by multiple, verifiable sources...

Thanks in advance...

Rhody...

P.S. BTW from the information I have been able to obtain even if they were to crack thehttp://www.popsci.com/technology/article/2010-12/how-secure-julian-assanges-thermonuclear-insurance-file" , and text is scrambled and would be of no use anyway.

see text from the link:

Well that's a tough question, although it strikes me as a bad idea to torture such a (newly) public figure for a passcode. Anyway, on the technical side AES256 is extremely secure, and if you're saying that beyond that he may have used PGP encryption or more hash functions on the cleartext...

...The bottom line is that as I said, that file is only going to be opened if:
1.) There's a flaw found in the encryption scheme used (collision errors, doubtful)
2.) Computers or methods advance beyond current expectations allowing for a means to bypass the protection.
3.) Luck on an astronomical scale.

Personally I think the major flaw here is that I'm not clear that Assange or anyone else knows what's in that file. If it's meaningless crap, then what a waste, right? On the other hand, if it's terribly sensitive and clearly gets people killed... whoops. No, this isn't something the US is looking to open, it's a fail-deadly device for Assange to use in a manner he's yet to make clear.

 

[Proton Soup]

I think you need to check what 'hacking' originally meant, came to mean, and really means in practice; there's no way that someone using someone else's programs to scan ports or sniff packets is a hacker... they are a script-kiddy. Hacking is actively creating your own code, and entering where you're not welcome... not managing botnets, not packet-sniffing, and not even massive signal intercepts. It may be that this is a semantic issue, I'm not sure.

yeah, not really interested in that debate. and as i understand it, hacking originally had to do with hardware reverse engineering. and wasn't even a negative term i think until people started building phone "blueboxes" or whatever kind of boxen they were called. blah blah blah 2600 blah...

 

[nismaratwork]

yeah, not really interested in that debate. and as i understand it, hacking originally had to do with hardware reverse engineering. and wasn't even a negative term i think until people started building phone "blueboxes" or whatever kind of boxen they were called. blah blah blah 2600 blah...

Yes... exactly...

*goes off to cry nerd-tears alone*

 

[CAC1001]

From my understanding of it, hacking is refers to people who like to solve problems and build and create things, and applies to people who have an obsession with learning everything about something. So a person may learn to program in all the major languages, they will read technical manuals, they will learn electronics to an advanced level, they'll learn the telephone and Internet infrastructure, they'll load individual operating systems up onto their computer and read the manuals to each operating system and study them to find the holes, etc...a hacker is not interested in doing anything malicious or destructive (unless maybe defending their country by doing bad things to foreign countries trying to do the same to their country).

"Hacking" got a negative connotation when people started using these skills for destructive and criminal purposes however. From what I have read, the term for such malicious hackers is/was actually "crackers."

However, outside of the hacker culture, the general term used by the media and so forth is "hacker" and also cracker is known as being a racist term to others, so one can see how people would be reluctant to use it. Today it seems more the terms are White Hat hacker and Black Hat hacker (white hat is good, black hat is bad).

Although referring to technology, the hacker philosophy can really apply to any art or science. If you study music and learn everything you can about music, all the instruments, all the major works, etc...then you are applying the hacker philosophy to music. Or if you learn everything there is to know about automobiles, you're applying it to autos. If you are obsessed with economics and learn everything there is to know about how economies work, you're basically applying it to economics as well. Hacking is about figuring out how things work.

Script kiddies are just people who download software that has already been written by others and use these tools to perform malicious activities. But a script kiddie has no real knowledge of how to actually program or how things actually work. The really dangerous "hacker" is the kind who knows in-depth all about the technology, and has no qualms about doing bad things.

 

[nismaratwork]

From my understanding of it, hacking is refers to people who like to solve problems and build and create things, and applies to people who have an obsession with learning everything about something. So a person may learn to program in all the major languages, they will read technical manuals, they will learn electronics to an advanced level, they'll learn the telephone and Internet infrastructure, they'll load individual operating systems up onto their computer and read the manuals to each operating system and study them to find the holes, etc...a hacker is not interested in doing anything malicious or destructive (unless maybe defending their country by doing bad things to foreign countries trying to do the same to their country).

"Hacking" got a negative connotation when people started using these skills for destructive and criminal purposes however. From what I have read, the term for such malicious hackers is/was actually "crackers."

However, outside of the hacker culture, the general term used by the media and so forth is "hacker" and also cracker is known as being a racist term to others, so one can see how people would be reluctant to use it. Today it seems more the terms are White Hat hacker and Black Hat hacker (white hat is good, black hat is bad).

Although referring to technology, the hacker philosophy can really apply to any art or science. If you study music and learn everything you can about music, all the instruments, all the major works, etc...then you are applying the hacker philosophy to music. Or if you learn everything there is to know about automobiles, you're applying it to autos. If you are obsessed with economics and learn everything there is to know about how economies work, you're basically applying it to economics as well. hacking is about figuring out how things work.

Script kiddies are just people who download software that had already been written by others and use these tools to perform malicious activities. But a script kiddie has no real knowledge of how to actually program or how things actually work. The really dangerous "hacker" is the kind who knows in-depth all about the technology, and has no qualms about doing bad things.

I could hug you if your conservative ideology didn't irk me so much. Oh what the hell, let's hug it out you big galoot!

edit: "And my orders are to weed out all non-hackers who do not pack the gear to serve in my beloved Corps!" (R. Lee Ermy as Drill Sgt. Hartman, 'Full Metal Jacket')

 

[rhody]

I offer you: http://www.schneier.com/blog/archives/2009/09/real-world_acce.html"
"[URL
Schneier on Security[/URL]

I used to get his Crypto-Gram Newsletter forwarded by a friend at work and this month has started again.
Interesting, and I might add very credible expert on security issues:

From the link above:

http://mba.tuck.dartmouth.edu/digital/Research/ResearchProjects/DataFinancial.pdf"

A sample of credible research, with background, assessment, and risks, clearly laid out, which for me is critical in separating fact from speculation or fiction.

I will keep my eye open for insight, information missed or overlooked by mainstream media and toss it over the fence for review and discussion.
Fox News talking heads Oreilly et al frequently quote information cited in the News Letter, but that is about all the attention it gets in mainstream media. IMHO Schneier is worth following, and frequently is weeks and in some cases months ahead of developing security issues and trends.

Rhody...

 

[Proton Soup]

Schneiner is great. I've got his 1st ed. Applied Cyptography laying around someplace.

that RBAC stuff sounds like they're trying to make things as complicated as possible. and yes, it's a lot of work and costs a lot of money. and no, nobody wants to pay for it.

 

[Galteeth]

Personally I think the major flaw here is that I'm not clear that Assange or anyone else knows what's in that file. If it's meaningless crap, then what a waste, right? On the other hand, if it's terribly sensitive and clearly gets people killed... whoops. No, this isn't something the US is looking to open, it's a fail-deadly device for Assange to use in a manner he's yet to make clear.

What would lead to you to believe Assange doesn't know what's in the file? The purpose to me seems pretty clear. He said he would only release the password if he were killed or imprisoned for life. It's leverage against that happening. The file could be pictures of cats for all we know. The point is, that if people believe it could be something that might damage them (which is why you don't say what's in it, because you're not sure who might want to jail or kill you) it might dissaude them from jailing or killing Assange.

 

[nismaratwork]

What would lead to you to believe Assange doesn't know what's in the file? The purpose to me seems pretty clear. He said he would only release the password if he were killed or imprisoned for life. It's leverage against that happening. The file could be pictures of cats for all we know. The point is, that if people believe it could be something that might damage them (which is why you don't say what's in it, because you're not sure who might want to jail or kill you) it might dissaude them from jailing or killing Assange.

You expect me to believe that beyond this overview, Assange has read the vast number of documents described as being in this file? You can't go around assuming that every gun isn't loaded, so the 'cats' concept is probably wishful thinking. Here is what is claimed to be in the file, at least:

The military papers on Guantanamo Bay, yet to be published, believed to have been supplied by Bradley Manning, who was arrested in May. Other documents that Assange is confirmed to possesses include an aerial video of a US airstrike in Afghanistan that killed civilians, BP files and Bank of America documents.

I'm sure he watched the video and read some of it, but unless he's smuggling HD movies in the original 720-1080 he could have a LOT of pictures of cats in a compressed file of that size.