Delivery-Date: Sat, 21 Nov 2015 18:09:04 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY
	autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 4144C1E0AAE;
	Sat, 21 Nov 2015 18:09:02 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 925B1374EA;
	Sat, 21 Nov 2015 23:08:57 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id D024C372F9
 for <tor-talk@lists.torproject.org>; Sat, 21 Nov 2015 23:08:53 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id KNK_Bw3t2npH for <tor-talk@lists.torproject.org>;
 Sat, 21 Nov 2015 23:08:53 +0000 (UTC)
Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "*.riseup.net",
 Issuer "COMODO RSA Domain Validation Secure Server CA" (not verified))
 by eugeni.torproject.org (Postfix) with ESMTPS id 9C8E7372C5
 for <tor-talk@lists.torproject.org>; Sat, 21 Nov 2015 23:08:53 +0000 (UTC)
Received: from piha.riseup.net (unknown [10.0.1.163])
 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "*.riseup.net",
 Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK))
 by mx1.riseup.net (Postfix) with ESMTPS id CA3B51A1A6C;
 Sat, 21 Nov 2015 15:08:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak;
 t=1448147330; bh=bhqZRiRyS8VHJyvm8d+dQ24Y3FZcJZFehfbYqxUIEbg=;
 h=In-Reply-To:References:Subject:From:Date:To:From;
 b=JoM8oW+hnxwZtoqgr+KF1IE4jMkXk3UkgMR5CpwehjjzY8W/MwdzPFhbVYnBuzUTJ
 YHxS0C8nNbzQBzJOyR53clAgjsj8T01Xo/kta3nLg0TPv4UU0kgMHDu0xpWYfdVLa7
 Lz2SO6debCGeH3IlMC1LcSdZCvnNgh8ldk0Kq27Y=
Received: from [127.0.0.1] (localhost [127.0.0.1])
 (Authenticated sender: flipchan) with ESMTPSA id 1633C1C0209
User-Agent: K-9 Mail for Android
In-Reply-To: <CAJVRA1Q7ysd4c2wvicXy9ZH3tQvFzR_robA-LkUOFOs3TkwcJQ@mail.gmail.com>
References: <564EB197.7020207@columbia.edu>
 <20151120210105.Horde.YWWb5RcfXQQPOxUlAGDtLw1@127.0.0.1>
 <CAJVRA1Q7ysd4c2wvicXy9ZH3tQvFzR_robA-LkUOFOs3TkwcJQ@mail.gmail.com>
MIME-Version: 1.0
From: Flipchan <flipchan@riseup.net>
Date: Sun, 22 Nov 2015 00:08:42 +0100
To: tor-talk@lists.torproject.org, coderman <coderman@gmail.com>,
 "William H. Depperman" <whd2@columbia.edu>
Message-ID: <A37EA0C5-46F3-4FA1-B1EA-F29D3B415958@riseup.net>
X-Virus-Scanned: clamav-milter 0.98.7 at mx1.riseup.net
X-Virus-Status: Clean
X-Content-Filtered-By: Mailman/MimeDel 2.1.15
Subject: Re: [tor-talk] How does one remove the NSA Virus off the BIOS Chip
	as described by Snowden in the ANT Program
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

I would like to help in anyway i can , i'm currently developing an anti virus and auditing multi platform program , So if u can find out/copy all the viruses the nsa have given You and send it i would love to help on detecting and protecting ppl from it :)

coderman <coderman@gmail.com> skrev: (21 november 2015 13:10:05 CET)
>On 11/20/15, Virilha <tor@cheiraminhavirilha.com> wrote:
>>
>> I believe you need immediate help, to capture evidence and/or reverse
>> engineer malware.
>
>it will be persistent but latent.
>  e.g. after a time period of "unable to successfully implant in OS"
>    it will quit trying. or maybe not! unknown unknowns, etc.
>or maybe not! large variance between paid proprietary LE only exploit
>kit
>and truly exceptional nation state intelligence and exploitation
>techniques.
>you should use the BIOS adventures below to find out.
> [the TAO-related Snowden leak details are informative]
>
>mobile implants are observed "geofenced" by tower or stringray. by
>activity of other apps. by network traffic. by time of day, ... this
>is a long list :)
>
>your router(s) are trash, now. (maybe you can directly flash, like
>BIOS adventures below?)
>
>
>
>> If the first case (capture evidence), advise you to join an IRC
>> channel on server irc.oftc.net channel #debian -
>
>capture is good first step, and if not in this instance perhaps the
>next.
>capture is always useful! (via independent and not networked device)
>
>
>
>> If the second (reverse engineer the malware), I advise you to join an
>> IRC channel on server irc.freenode.net on channel ##asm and/or
>channel
>> ##re - me or others can help you with x86/64 stuff (assembly).
>
>you can open up and search for BIOS flash chip. if you're lucky it
>will be a 3.3V SPI flash chip in 4 or 8MByte (they often measure in
>bits, too, don't ask me why).
>
>you can use a rPi to do it, even!
>http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIOS-flash-using-Raspberry-PI.html
>http://satxhackers.org/wp/hack-content/uploads/2013/04/rPI_flashrom.pdf
>http://www.winbond-usa.com/resource-files/w25q64fv_revl1_100713.pdf
>
>that last is an SPI chip in my pair of ASUS B43J laptops - it is nice
>to have a pair, saving the good one, in case something like this
>happens. the stealthy stuff will betray power consumption and forensic
>flash image digest values (sha256 of specific flash regions)
>
>remember to adjust configuration parameters for SPI support if using
>the rPi.
>
>i highly recommend the Shikra as well, however, it requires postal
>CUSTOMS. :)
> http://int3.cc/products/the-shikra
>
>this is just the start, of course, but enough to give tells...
>
>
>
>best regards,
>-- 
>tor-talk mailing list - tor-talk@lists.torproject.org
>To unsubscribe or change other settings go to
>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

-- 
Sincerly Flipchan
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

