Cryptocurrency candidates: Bitcoin enters politics

Read MoreThis city could become the world's bitcoin capital

David says CoinVox has been approached by about 20 candidates who are seeking bitcoin funding in the coming election cycle.

Jared Polis represents the second congressional district of Colorado and is running for re-election to the House of Representatives this year. The description on his donation page reads, "I am proud to be one of the first members of Congress to promote personal financial freedom by accepting a digital currency for contributions."

Polis said his campaign was "eagerly awaiting" the FEC's decision on bitcoin donations in May. He has raised approximately $2,000 in bitcoins from more than 60 donors.

Christina Gagnier, Democratic candidate for the 35th congressional district in California, said her use of bitcoins has caught the attention of individuals who may not have been interested in her campaign otherwise.

"So far, it's not a huge percentage (of donations)," she said. "But I have engaged donors I haven't engaged before."

Read MoreTime for digital currencies to grow up

Bitcoin is converted into cash immediately upon donation to avoid volatility in the coin's value. It is created by online users who solve complicated mathematical puzzles and stored in digital "wallets."

Because this is the first election cycle in which virtual currency has been used, experts say there is no official data on how much bitcoin has been brought in during this election cycle so far.

"The $100 cap is an issue, and I wonder if the FEC will revisit that," Jerry Brito, a senior research fellow at the Mercatus Center at George Mason University, said. "I expect to see people maxing out that $100 donation."

Go here to see the original:
Cryptocurrency candidates: Bitcoin enters politics

Hacker swipes $83,000 from Bitcoin mining pools

Bitcoin.org

It's no longer surprising when we hear that a cryptocurrency exchange has suffered a security breach, but now a hacker has targeted mining pools -- and managed to steal $83,000 in cryptocurrency as a result.

The Dell SecureWorks Counter Threat Unit (CTU) research team said Thursday it has identified an exploit that can be used to lift cryptocurrency from mining pools, and at least one hacker has already taken advantage of the security flaw.

A hijacker was able to use a fake Border Gateway Protocol (BGP) broadcast in order to compromise networks belonging to some of the biggest names in the field -- including Amazon, Digital Ocean, and OVH -- between February and May 2014. According to the researchers, at least 51 networks were compromised from 19 different ISPs, and at least one hijacker was able to use this flaw to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, therefore collecting the miner's profit for themselves.

Miners were able to continue searching for blocks, which results in the minting of new bitcoins, but spoofed servers ensured that miners never received their cut -- instead, the hijacker took off with all of the earnings.

In total, it is believed this single hijacker has been able to earn $83,000 in roughly four months.

Although Bitcoin was the main target of the heist, with 1 BTC currently worth $589, it was not the only cryptocurrency affected.

"The threat actor hijacked the mining pool, so many cryptocurrencies were impacted," the researchers said. "The protocols make it impossible to identify exactly which ones, but CTU researchers have mapped activity to certain addresses."

One miner spoken to by Dell SecureWorks said he estimates 8,000 dogecoin were hijacked and stolen in March, worth $1.39. The miner later added a firewall rule to reject connections from the hacker's mining server, which rejected the hijack and led to normal mining regularity. While $1.39 is a tiny amount, if widespread, such hacking can be lucrative.

The researchers were eventually able to trace the fake broadcasts to a single router at an ISP in Canada. While the hijacker has not been identified, CTU believes the scheme can be blamed on a rogue employee of the ISP, an ex-employee with an unchanged router password, or simply a black-hat hacker.

Link:
Hacker swipes $83,000 from Bitcoin mining pools

Assange urges Snowden to be ‘extremely cautious’ if he leaves Russia

UK: WikiLeaks founder Julian Assange has warned former National Security Agency contractor Edward Snowden that leaving Russia could be dangerous, even with his new residence permit.

Speaking via videoconference to an audience at a freedom of speech convention in Mexico City, Assange said that Snowden could face threats to his physical well-being if he decides to leave Russia.

Of course our advice is that he be extremely cautious in doing so for his physical security, the WikiLeaks founder said, according to AFP.

As RT reported, Snowden was officially granted a residence permit from Russia earlier on Thursday. Effective August 1, the permit will last for three years and allows Snowden to travel anywhere within Russia, as well as beyond the countrys borders for up to three months.

Snowdens lawyer, Anatoly Kucherena, noted that the former NSA employee would be able to apply for Russian citizenship in five years, though he has not made a decision on that front.

On the subject of Snowdens security, Kucherena said that a private firm is in charge of his detail, adding that he will not benefit from state protection due to the many bureaucratic procedures required to obtain it. Assange himself is familiar with taking precautions to ensure his physical safety, as he has been holed up within the Ecuadorian embassy in London for more than two years now. The 42-year-old is wanted for questioning in Sweden regarding allegations that he sexually assaulted two women in 2010.

Sweden issued a warrant for his extradition over the allegations in 2012, but Assange who has denied all the charges was awarded political asylum and has now spent 778 days inside the embassy.

London police have staged a 24-hour stakeout of the premises, and are ready to arrest Assange immediately should he ever leave the building. Assange is also worried that by going to Sweden, he would open himself up to extradition to the United States which is upset over WikiLeaks decision to leak diplomatic cables back in 2010.

As for the possibility that Snowden may be extradited to the US, Kucherena dismissed the possibility outright, saying it would not happen because Snowden doesnt face any charges inside Russia.

- RUSSIA TODAY

See the original post:
Assange urges Snowden to be ‘extremely cautious’ if he leaves Russia

Yahoo Mail to support end-to-end PGP encryption by 2015

Yahoo is following in the footsteps of Google and plans to implement end-to-end encryption into Yahoo Mail by 2015. Like Google, Yahoo plans to use the OpenPGP encryption standard to encrypt messages. OpenPGP, which is the gold standard for email encryption, uses a public-private keypair scheme to protect user messages.

To get the encryption done, Yahoo will use a modified version of Google's alpha stage End-to-End Chrome extension. But Yahoo's version will be designed to work with the Yahoo Mail interface instead of Gmail.

Yahoo also plans on making encryption a native part of the Yahoo Mail mobile apps, according to a tweet byAlex Stamos,Yahoo's chief information security officer.Stamos announced Yahoo's email encryption plans during Black Hat USA, a security conference that ended on Thursday.

Further reading:The 10 most terrifying security nightmares revealed at the Black Hat and Def Con hacker conferences

As part of the encryption effort, Yahoo will create a new privacy engineering team to work on the project. The team's first hire was Yan Zhu, a staff technologist for the Electronic Frontier Foundation who worked on projects such as the HTTPS Everywhere and Privacy Badger add-ons. Zhu was also the person who recently discovered a security flaw in WordPress login cookies.

The news that yet another major webmail service wants to build encryption tools into its product is encouraging. But it's not clear how many people will actually want to use the new option.

While encryption and privacy are top of mind for many as the revelations from Edward Snowden and other whistleblowers continue to roll out. The problem is both Google and Yahoo must make encryption dead simple to use.

On top of that is the issue of key management. How will Yahoo help users with managing their keys while at the same time preventing the company from having access to them?

If Yahoo sticks everyone's keys on a company server, for example, Yahoo could be compelled to hand them over to law enforcement. One way around this is to require users to manage their keys themselves, which isn't very realistic for a mass market serviceif you lose your private key, it is impossible to read your encrypted emails.

Alternatively, the company could employ a scheme similar to services like Lastpass, where user keys are on company servers, but the keys are encrypted on the user's PC before they arrive on company servers. That way Yahoo would only be handing over encrypted blobs that law enforcement would have to attempt to crack.

Excerpt from:
Yahoo Mail to support end-to-end PGP encryption by 2015

These 3 Chrome extensions make encryption easier for everyone

Thanks to the fallout from the revelations about the U.S. government's surveillance tactics, people are starting to take interest in using encryption tools for keeping email, files, and instant messaging private. Just recently, Yahoo said it would build encryption into Yahoo Mail and Google is doing something similar with Gmail.

The problem is that encryption is usually a task that only power users can handle.Email encryption, for example, has typically required a desktop email client. But who doesn't use webmail these days? That's a problem that Google and Yahoo aim to change.

But they aren't the only ones. Lately, some easy-to-use encryption tools have popped up that are very well designed and don't require you to dramatically change your usage habits.

Here's a look at three of them.

All the tools below are Chrome extensions and apps, but are also available for other platforms and browsers as noted.

Also, keep in mind we're not suggesting that these tools can be used under dangerous situations such as political oppression or revolution. Scenarios like that are way beyond the scope of this article.For the average North American hoping to keep their data private from passive government snoops, private companies, co-workers, and others, these tools should work just fine.

The Cryptocat start screen.

Cryptocat is probably the encryption tool that is easiest to use right now. This is an instant messaging program created by Montreal-based programmer Nadim Kobeissi.

You can use Cryptocat to chat with just one person or a group of people. To get started, install Cryptocat from the Chrome Web Store and then open it either from the all apps tab in Chrome or the taskbar launcher in Windows--if it's installed.

A new tab will open in Chrome. Fill out the form with a conversation name and nickname of your choosing and press connect. You now have your own encrypted chat room. To get others to join your chat just give them the conversation name and have them follow the same steps to join. Cryptocat also works with Facebook chat.

Read more:
These 3 Chrome extensions make encryption easier for everyone

Encryption Keeps Your Data Safe. Or Does It?

In the post-Snowden era, many people have come to believe that the only way to maintain privacy is through encrypting everything. (Well, as long as your encryption doesn't use the flawed RSA algorithm that gave the NSA a backdoor.) A fast-moving session at the Black Hat 2014 conference challenged the assumption that encryption equals safety. Thomas Ptacek, co-founder of Matasano Security, noted that "nobody who implements cryptography gets it completely right," and went on to demonstrate that fact in detail.

The Crypto Challenge This session was based on Matasano's crypto challenge, described as "a staged learning exercise where participants implemented 48 different attacks against realistic cryptographic constructions." According to Ptacek, more than 10,000 people have participated in the challenge.

How did it start? "There are people that I end up arguing with on Twitter," said Ptasek. "I want to share crypto knowledge, but I don't want to arm those people with my jargon." That was the origin of the challenge. Matasano researchers created six sets of eight challenges. To complete a set, you must successfully implement all eight challenges using the programming language of your choice. After you successfully complete one set, they'll send you the next. "To get the jargon, you have to code," explained Ptasek.

Eighth Grade Math Required You might expect that implementing and cracking various types of cryptography would require detailed knowledge of arcane mathematical disciplines. Ptasek listed five high-end topics, among them "fields, sets, and rings" and "Feistel and S-P network structure." He went on to explain that none of them are required. Most of the challenges require little more than high-school algebra, and some knowledge of coding.

Those taking the challenge submitted their work in a dizzying variety of programming languages. Some even stepped outside the realm of programming altogether. One participant submitted a solution coded as a simple Excel spreadsheet. Another solved one of the challenges using PostScript.

"There's going to be a lot of detail in this talk, and we'll talk fast," said Ptasek. "You won't walk out of this knowing how to exploit RSA, but I can show you how straightforward it is. Just let the math wash over you like the poetry of insecurity." I like that!

To Err Is Human The presentation went on to examine some specific and well-documented cryptographic blunders. One company solved the problem of encryption efficiency by setting an essential parameter to one, just one. Cryptocat, famously used by Edward Snowden, didn't go quite that that far, but by tweaking code for efficiency the developers vastly reduced the resources required to crack encrypted messages. And yes, the Cryptocat algorithm was at its worst between May 2012 and June 2013.

After a point, the session did indeed get quite technical. I did almost manage to understand a clever technique the Matasano folks devised to break RSA-encrypted credit cards. It involved submitting carefully selected numbers to the encryption server as if they were encrypted data and noting the reaction. Each number that was accepted as valid brought them closer to decrypting the text, and also narrowed the range of numbers for the next attempt. The resulting demo was a classic movie-style version of cracking encryption, with plaintext letters appearing one by one as binary bytes scrolled past.

Will You Take the Challenge? If you want to take the crypto challenge, send a note to cryptopals@matasano.com. Do note that the strict one-at-a-time rule for challenge sets has been suspended. You can now get all of the setsat once. In an announcement before the talk, Ptasek explained that "We're giving a talk about the challenges at Black Hat, and want our loyal cryptopals to see all the challenges before Black Hat ticketholders do." Going forward, the Matasano team plans a website devoted to the challenges, and even a book.

More here:
Encryption Keeps Your Data Safe. Or Does It?

Microsemi develops FPGA security/secure-boot programme

August 07, 2014 // Graham Prophet

Extension of cryptography research differential power analysis patent license renews focus on security for critical communication, industrial and defence applications; the patent and related work provides resistance to DPA attacks

Page 1 of 2

Microsemi says it is the only major FPGA company that currently has a license to use the patented DPA countermeasures, and has implemented DPA-resistant secure programming and boot-up protocols in its SmartFusion2 SoC FPGAs and IGLOO2 FPGAs. Microsemi will now be able to extend the secure boot protection of these Microsemi devices to other third-party MCUs, DSPs, GPUs and FPGAs used within the same system. Microsemi is currently working with customers with the secure boot solution, and is offering the solution as a reference design that runs on Microsemi's standard cryptographically-enabled SmartFusion2 and IGLOO2 FPGAs.

It is more critical than ever to prevent persistent malware implants in boot and application code. Supervisory control and data acquisition (SCADA) systems, routers and data communications systems together control the worlds industrial and communications infrastructure where these threats can be catastrophic, said Bruce Weyer, vice president of marketing and business operations, at Microsemi. In addition, the U.S. government and defence contractors are looking to share the cost of defence systems through the expansion of foreign military sales. These DoD contractors are looking for ways to secure their advanced technology systems against reverse engineering and exploitation so they can be exported safely, and our secure boot solution is an important security layer in providing that protection.

In the Internet of Things era, connected machines need to be secure, and to be secure in the sense of DPA resistance. Just because a machine or system says it meets the Advance Encryption Standard (AES), it does not necessarily mean it is secure, Microsemi notes the DPA countermeasure solution increases system overall security by protecting the keys that are stored in the system against side-channel attacks.

MPUs/MCUs,Authentication & Encryption,PLDs/FPGAs/ASICs

See the original post here:
Microsemi develops FPGA security/secure-boot programme

Microsemi Continues Its FPGA Security Leadership for Secure Boot with Extension of …

Significantly Increasing Security for Critical Communication, Industrial and Defense Applications, Patent Solution Provides Resistance to DPA Attacks

ALISO VIEJO, Calif. Microsemi Corporation (Nasdaq: MSCC), a leading provider of semiconductor solutions differentiated by power, security, reliability and performance, today announced the company has obtained an extension of its existing Differential Power Analysis (DPA) patent license from the Cryptography Research division of Rambus. The patent license extension allows Microsemi to continue providing industry-leading solutions for the secure booting of third-party processors and FPGAs using the Cryptography Research portfolio of patented breakthrough DPA countermeasures.

Microsemi is the only major FPGA company that currently has a license to use the patented DPA countermeasures, and has implemented DPA-resistant secure programming and boot-up protocols in its SmartFusion2 SoC FPGAs and IGLOO2 FPGAs. Microsemi will now be able to extend the secure boot protection of these Microsemi devices to other third-party MCUs, DSPs, GPUs and FPGAs used within the same system. Microsemi is currently engaging key customers with the secure boot solution, and is offering the solution as a reference design that runs on Microsemi's standard cryptographically-enabled SmartFusion2 and IGLOO2 FPGAs.

"It is more critical than ever to prevent persistent malware implants in boot and application code. Supervisory control and data acquisition (SCADA) systems, routers and data communications systems together control the world's industrial and communications infrastructure where these threats can be catastrophic," said Bruce Weyer, vice president of marketing and business operations, at Microsemi. "In addition, the U.S. government and defense contractors are looking to share the cost of defense systems through the expansion of foreign military sales. These DoD contractors are looking for ways to secure their advanced technology systems against reverse engineering and exploitation so they can be exported safely, and our secure boot solution is an important security layer in providing that protection."

According to the Aberdeen group, by the year 2020 approximately 50 billion machines will be connected. Not only do these machines need to be secure, but they need to be secure in the sense of DPA resistance. Just because a machine or system says it meets the Advance Encryption Standard (AES), it does not necessarily mean it is secure. Microsemi's DPA countermeasure solution increases system overall security by protecting the keys that are stored in the system against side channel attacks.

"By extending this license, Microsemi and its customers are helping to secure the massive number of processors and FPGAs used in critical industrial, communications, networking and defense applications, many of which are still vulnerable to the DPA attacks," said Paul Kocher, chief scientist of the Rambus Cryptography Research division. "While the security issues surrounding side channel attacks have continued to gain notoriety, expanding this needed power analysis protection for the boot stage of FPGA devices and processors is an important step towards securing overall systems."

Microsemi is in a unique position to be able to offer this enhanced secure boot solution because, in addition to having the most secure FPGAs on the market, Microsemi also offers a software product called WhiteboxCRYPTO that allows the secure execution of standard cryptographic algorithms.

About Differential Power Analysis Attacks DPA is an insidious and powerful technique hackers use to extract secrets such as cryptographic keys from an electronic device by externally monitoring the instantaneous power consumed by the device while it is operating on the secrets. CRI's secure boot is a highly effective security measure that ensures a programmable device such as a microcontroller (MCU), digital signal processor (DSP), graphics processor (GPU) or field programmable gate array (FPGA) is executing authentic code that has not been tampered with or altered.

About SmartFusion2 SoC FPGAs SmartFusion2 SoC FPGAs integrate inherently reliable flash-based FPGA fabric, a 166 megahertz (MHz) ARM Cortex-M3 processor, advanced security processing accelerators, DSP blocks, SRAM, eNVM and industry-required high performance communication interfaces, all on a single chip. Microsemi's SmartFusion2 SoC FPGAs are designed to address fundamental requirements for advanced security, high reliability and low power in critical communications, industrial, defense, aviation and medical applications. For more information visit: http://www.microsemi.com/products/fpga-soc/soc-fpga/smartfusion2.

About IGLOO2 FPGAs Microsemi's IGLOO2 FPGAs continue the company's focus on addressing the needs of today's cost-optimized FPGA markets by providing a LUT based fabric, 5Gbps transceivers, high speed GPIO, block RAM, a high-performance memory subsystem, and DSP blocks in a differentiated, cost and power optimized architecture. This next generation IGLOO2 architecture offers up to five times more logic density and three times more fabric performance than its predecessors and combines a non-volatile flash based fabric with the highest number of general purpose I/Os, 5Gbps SERDES interfaces and PCI Express end points when compared to other products in its class. IGLOO2 FPGAs offer best-in-class feature integration coupled with the lowest power, highest reliability and most advanced security in the industry. For more information visit: http://www.microsemi.com/products/fpga-soc/fpga/igloo2-fpga.

Read the rest here:
Microsemi Continues Its FPGA Security Leadership for Secure Boot with Extension of ...