Privacy, Security, Anonymity

[Woody]

Hi guys.

Lately I have become increasingly suspicious of the internet. Its no longer what it use to be. Every one tracks, monitors, and gathers your information and habits. Social media sites are notorious for this. From a forensics point of view, a quick look on someones computer can tell you their browsing habits, reveal user names to sites such as this, and possibly divulge passwords.

So I would like to share a couple of things that I do to help keep me an anonymous browser. Help keep my computer clean of cookies and history's and add a layer of privacy to my browsing.

First off, I use a laptop for everything. It runs OpenSUSE linux but a lot of things are applicable to windows users too.

My first thing I would like to share is "stop using internet explorer". It really is the most disgusting browser I have ever used. The last thing you want is to be undone by a cheap trick javascript exploit. I am not saying these don’t exist in firefox or chrome. There has historically been more public exploits for i.e. Myself, I use firefox because I like the range of add-ons and the security can be set to a paranoid level.

Because I use firefox I will tell you how I have it set up.
FireFox
-------------------------------------------------------------------------------------------
First thing I do is go to Edit -> Preferences -> Privacy tab
Tick the box that says "Tell web sites I do not want to be tracked"
Under the History header set firefox to "Never Remember History"
Also, When using the location bar, Suggest: Nothing

This will put firefox into an ultra paranoid state. Many users may find this irritating but you get use to it pretty quickly. Firefox will now no longer actively remember where you have visited and what your username was. You'll have to type in your user/pass to all sites manually but consider the alternative:

Your laptop falls into the hands of your adversary (LEO). He manages to fire up your browser and also finds your history. Oh look he visited icmag yesterday. He navigates to ICMAG and in the user/pass field he can see your online identity. A quick search for that username at ICMAG reveals your activity has run over the course of 5+ years. Complete with photos and grow logs. Even if you tell Firefox not to remember you at that site. Cookies on your hard drive can reveal your identity.

Add-On's:
There are a heap of privacy add-on's for firefox. Two that I have installed at the moment are "Ghostery" and "BetterPrivacy".

Ghostery: What a gem of an add-on. Ghostery has a whole heap of tracker sites registered. It is AMAZING to see how many sites try to track your online activity. Most are relatively harmless, but a computer forensic officer could use these to get a profile of your online activity. They serve YOU no purpose. They are just for advertising companies so I suggest you block them all. Click on Ghostery icon -> Options -> Select all -> save (Don't forget to save, its at the bottom of the page)

BetterPrivacy: There are also flash cookies. Not everyone knows about these. You might delete your cookies religiously or use FF settings to do it automatically but there is also another technique called flash cookies. These are hidden better and currently are not removed by any of the major browser's when you delete cookies. They're like a super cookie. BetterPrivacy can help you with these
-----------------------------------------------------------------------------------------------------------

So besides your browser what else can you do?

Well there is a free piece of brilliant software you can use for Hard Drive Encryption. Its called TrueCrypt and is available for Windows and for Linux. I love this program and I use it to encrypt anything that may be a little suspect. For example: I encrypt my entire portable hard drive. This I use to keep all my porn in case I ever lose it and a child finds it or something. I can also throw my personal information, and pictures onto it. It takes a while to encrypt the volume but once its done you can "mount" it in linux as a normal file system and read/write to it at normal speeds with the knowledge that once you unmount it its nice and secure. Same goes for a windows system. You fire up the truecrypt software, choose your encrypted device and once you put in your password truecrypt will give you a virtual drive you can read/write to at normal speed.

You don't need a portable hard drive however. Or a USB thumb drive. You can create an encrypted file on your existing hard drive and mount that the same way.

One other COOL AS SHIT thing you can do with truecrypt is encrypt your entire windows installation. This is not yet functional with linux but it is with windows and this is great because its easy to boot with a CD and crack or clear windows SAM passwords. This would allow anyone to log into your user account (or administrator) in windows and view your data/history etc. With TrueCrypt you can encrypt the entire device and install the truecrypt boot manager which will ask you for your password to unencrypt and boot to windows. This would also stop people from removing your hard drive and mounting it on another operating system to view your unencrypted data.

Oh! and another thing. You can set up the boot manager to boot to something completely stealth like "Missing operating system" or other error message. This would give the impression that the computer is faulty and only a correct password would continue the boot process. Of course this will only fool an untrained eye as the presence of the TrueCrypt boot manager would show something else is up.... If you know how what your looking for...

My final paranoid tip:
SSH Tunnels: I am lucky enough to have access to a few off shore nix/BSD servers. It is possible to create a secure encrypted SSH tunnel to these boxes and have them fetch your web traffic for you. What would the advantage of this be you might ask. Well, if your being watched at your ISP level or even at an upstream providers level then all they will see is traffic over SSH. All encrypted. I've noticed that some of my American friends are worried over something called the Patriot Act. I dont know what this is but I can only guess. Having a server in a country other than your own does add another layer of security in my eyes.

In firefox do this:
Edit -> Preferences -> Advanced -> Network Tab -> Settings
Select "Manual Proxy Configuration"
Set Socks Host = "localhost" and Port = "8080" (or another free port on YOUR computer)

Also, enter "about:config" into your address bar and hit enter.
toggle network.proxy.socks_remote_dns to true (this sends DNS requests through your SSH connection too)

At this stage, firefox is ready to use your tunnel. Windows users will have to download and use Putty to set up their SSH tunnel but linux users can issue the following command in a terminal window.

woody@linux-0hhk:~> ssh -C2qTnN -D 8080 woody@admin.woody.com
Password: ***********************************

Leave this window open and use your browser as normal.
Notice that I used 8080. If you set up firefox to use a different port then use that number instead.

If you don't have access to a server which is off shore you may be interested in looking up the TOR network. Its unencrypted so it offers no protection if you're being watched but it will provide a layer of protection if the site you are visiting is being watched as your IP address will be masked. There is a TOR add-on for firefox but I find it slow and a solid connection is very hard to find. Also, I would not log into anything through the TOR network as it is more vulnerable than most methods to a man in the middle attack. Also, you might want to look up the cost of a good virtual server. You can use the SSH tunnel method with a virtual server too and they are not very expensive.

So that is about all I can say at the moment. I am really hoping other people will chime in with their paranoid methods of security. I am open to criticisms so if you think one method is weak or can be improved I would love to hear from you.

I'm very interested in peoples thoughts about the direction social media is headed with google recently adjusting its privacy policy. Also interested in any thoughts on Android privacy issues seeing as its a google product.

And for a good google alternative I suggest everyone have a look at duckduckgo.com. They dont track you, or bubble your search results (read links at the bottom of their page).

Peace - out

 

[Anonymous0573]

Thanks a lot just followed your Ghostery and BetterPrivacy sections and was easy and simple. I'm computer unlearned so this is an area I've been trying to improve in the last few weeks especially.

 

[ScrubNinja]

Hey Woody, great post mate. This is the kind of thread I dig.

I have a few thoughts, but please don't think of any as disagreement, it's just that there is no agreed level of safety where one is actually "safe", and everyone has different levels and is in different overall situations, as I'm sure you'd agree. It's a complex, multi-layered subject.

Ghostery is a tracking company IMO. They say they don't log anything and they're "a new type of company that brings trust to online advertising by working as an intermediary between consumers, advertisers, industry self-regulatory programs, and government.". So lets analyze that: they can see nearly every page you go to, and their job is to talk to the government and advertising companies, but not about the sites you went to. Even though the only conceivable data that has ever been passed to them is a list of the sites you went to.

An intermediary is a third party that offers intermediation services between two trading parties.

So before I used it I would need to know what exactly is being traded between a Ghostery user and the government.

Truecrypt is cool and I use it sometimes with caveats. For example there can be issues if your computer hibernates while files are unencrypted - the unencrypted files can be stored in said hibernation file. There are some other examples in the (excellent) manual pages linked.

For those reasons, I would never decrypt a truly critical file on a regular installed OS that has ever connected to the world's most hostile network: the internets. I would use a live Linux distro such as Tails or Ubuntu Privacy Remix, preferably burnt onto CD/DVD and not a USB stick. In case I sound too paranoid, I'm talking 'bout your 100,000 bitcoin stash here, not some girlie pics you're keeping hidden from the girlfriend etc.

Also seeing as you're on Linux, have you checked out the LUKS system of encryption. It's better integrated into the system and apparently avoids some of Truecrypt's potential leak points.

you may be interested in looking up the TOR network. Its unencrypted so it offers no protection if you're being watched but it will provide a layer of protection if the site you are visiting is being watched as your IP address will be masked.

Tor encrypts everything between you and the Tor exit node, even if it's originally unencrypted. It offers a hell of a lot of protection in my opinion from my number one & two adversaries; the government and my isp (somewhat ironically, lol). I suspect the issue you're thinking of is that if you go to a HTTP site through Tor, the exit node can see your traffic and potentially log it (including your username/password for the site in question if you were to log in). That seems fair enough to me and I would never log into ANY site that didn't have HTTPS anyway. Tor Browser Bundle has the "HTTPS Everywhere" extension which helps. You should only use the Browser Bundle these days, not the old system of various extensions etc, as the bundle comes with it's own modded version of Firefox to work better as a whole system. It's also portable so could be put on an encrypted USB stick or whatever.

Also, I would not log into anything through the TOR network as it is more vulnerable than most methods to a man in the middle attack.

How is it more vulnerable than anything else? I'm not all that cluey on it, but I was under the impression that everyone is more or less at equal risk on any browser or OS?

Also, a friendly heads-up. Tor developers are smarter than ya may think, hehe.

Well, that's all I can think of for now apart from if you were worried about high level forensics stuff, you should use a non-journaling file system. FAT or Ext2 are non-journaling that I know of.The standard windows NTFS system is journaling.

Oh and consider using an open source password manager. I started using KeePass on various platforms. It's risky because one simple keylogger & some creative thinking could conceivably bring all your accounts unstuck, but if there was a keylogger on your system, your passwords have plenty of issues already, methinks. What really convinced me to switch was all the recent mass hackings & bulk password dumps of popular websites.

Wait, I got more! If using Linux, look into using AppArmor for things like Firefox. Or there's things like grsecurity patch if you want to get deeper.

If not using Linux, simply use Linux.

If you've read this far, you may enjoy these audio talks from the various HOPE conferences over the years. You gotta click around each one to find the downloads section but the latest conference downloads are here. A great one is Steven Rambam - "Privacy - A Postmortem (or Cell Phones, GPS, Drones, Persistent Dataveillance, Big Data, Smart Cameras and Facial Recognition, The Internet of Things, and Government Data Centers Vacuuming Google and Facebook, Oh My!)"

Heavy stuff. There are also a few talks concerning the "Arab Spring". I try to avoid mainstream news media, so I'm not sure if this is common knowledge or not, but there are real cases where governments have MITM'd (meaning hacked!) their whole population. WTF man.

I think of the people around me, my family and friends, and they're all pretty typical unskilled windows users. They don't stand a snowballs against the stuff discussed here. One guy thinks he is unilaterally safe from every single computer related threat because he has a paid subscription for AVG antivirus, lol. Like I said, there's no set level where one is suddenly "safe" from everything. The best you can really do is take an interest and start from the bottom up. Anonymous0573, even though I don't happen to trust Ghostery myself, it's still great that you installed it and that Woody mentions it, because it's given you a start and you're concerned about it, and getting your hands dirty.

Best of luck to all, and always remember to verify your hashes, pun intended.

 

[Skip]

As I've said before, if you use a LOT of security, like proxies and encryption, it's likely you'll draw more attention to yourself than those who don't. The US gov't is actively scanning for those who go to extremes to shield themselves from scrutiny. They just assume you're possibly a terrorist up to no good.

The best security is to not break any laws! And if you're legal and want to protect your location from theft, then never reveal your location to anyone.

It seems like 95% of busts are due to chance or some squealer, not due to postings on the Internet.

In fact, I challenge all to show us busts that came about solely due to Internet postings, without another flag being raised in the non-virtual world...

So a lot of the paranoia and extra security measures may be counter productive.

However if you're in the situation where LEO might get your electronics, then automatically removing your history and logging in everytime without cookies is a good habit.

 

[Woody]

Thanks for the replies and feedback guys!

ScrubNinja: Thank you for your detailed and comprehensive reply.
Pointing out those facts about Ghostery, I will be sure to look into it further!!

I tell you what though, they do block a lot of stuff which amazed me when I first installed it. I had no idea there were so many scripts running in the background. Some may be overkill, and not tracking you as bad as you think, or at all but wow.. Still, that kind of collaboration is a bit worrying. I wouldn't put it past some sneaky gov types to create something similar and use it for intelligences gathering under the guise of being a security app.

I was also unaware about the hibernation issues with truecrypt. It makes sense of course. I suppose its an issue too with the swap file, or how some operating systems take a quick ram snapshot when they crash etc. Like you say, if its something super top secrete then perhaps booting from non-writable media and viewing the file in pure ram space might be the way to go.

I was getting a little tired by the time I got to Tor.. lol your correct with most of your assumptions about what I was trying to say. I did indeed mean look out for evil exit nodes, well be aware of them anyway. There are rumors that wikileaks obtained a high traffic exit node which was being used by covert spy's to send stolen documents back to china and this is where the bulk of the material comes from. Weather this is true, who knows... it makes for a nice plot though.

I'm using the tor browser bundle now days too. It's a lot easier. You can still install ff plug-ins too if your that way inclined. And the always https is great.

Have you had much to do with tor hidden services? That interests me a bit so I might do a bit of looking into that. I have no idea how they work, although I have accessed a few for a looksie.

Online privacy is such a large topic, and when we start getting into smart phones it really gets nasty. There are all sorts of rumors and factoids out there. Personally I would love to see linux/BSD alternatives besides android. Something you could really control. Something the community could control. If linux/BSD behaved the way android is starting to behave it would have been shot down a long time ago!

At the end of the day, the smartest one out of all of us is probably Skip.

The best place to hide something is in plain sight!

I would love to hear more about how people stay safe online so if anyone else has anything to add feel free. I am busy looking through all the links ScrubNinja has posted, there is quite a bit of data there.

 

[Woody]

oh and I just read on the tor site that you should not install plug-ins....

 

[ScrubNinja]

Actually it got pointed out to me by Hisser that Ghostery is not as bad as I make out. I don't use it out of principle though.

I did check out the HS's along with half of reddit. Pretty cool technical idea for sure. Some good sites but ye gad, some very very very bad things too, and it can be difficult to avoid them. Be careful man, shit could get real, very quickly imo. I was quite disappointed in the execution, apart from a few legit places. So I guess bookmark them if you do plan to return, and don't get too adventurous.

Having said that, please PM me if you find the gladiator fights!

Yeah they say not to add plugins. I don't add any, but it is possible. The devs are often approaching Tor from a different angle to how you or I may approach it. Besides hiding your IP, they are also thinking in terms of the userbase as a whole. They would like everyone to be using the exact same setup, so the userbase is one mass of generic users. When you start adding this or that, people can stand out from the rest.

It's similar thinking to how by default, NoScript is not active in the Tor browser. See, if you and I both load icmag.com in Tor, anyone observing the network activities on a higher level will (hopefully!) just see two Tor users who connected to the site. Now picture if you were blocking javascript and I wasn't. You would stand out in the logs because your browser hasn't allowed it while the generic mass has. Now consider that between every site you or I block individually in noscript, it has formed a massive fingerprint of our browsers IF someone in a high place was watching us. In fact I think this was why they dropped Adblock Plus altogether too.

Personally I feel its all over the top, and it's not something I stress over but I could understand it being an issue I guess. I mean, if I was in China or somewhere with a truly hostile government, yeah definitely. But freaking out about micro-managing scripts on the internet is not how I want to spend time. I really only use Tor so that my ISP and therefore the government can't directly/easily monitor what I do, where I go, and who I associate with online. Basic human right to privacy imo.

If they wanted to set up a massive worldwide organized traffic analysis deep packet inspection man in the middle operation to bring me down, then so be it. I will pay the couple of hundred bucks fine, start a new grow, and continue making the most of life.

I hear you on the android thing too. There are some (almost completely) open source phones but it's almost irrelevant because the phone system appears to be completely whack.

More promising work is happening with other technologies like VOIP, satellite, and such, but I don't follow them at all. Hey there's also the Mozilla OS coming up. I will try that on an Android as soon as its available.

 

[dddaver]

oh and I just read on the tor site that you should not install plug-ins....

But...But...Adobe Flash installs and enables a plug-in in Firefox automatically when you update it now. So it's not only on your computer now, but in the "new improved" versions that it now adds that plug-in to your browser. So why does Firefox even allow that shit? Does anyone know if Linux Ubuntu allows Firefox to do that? I guess I could load my copy of Ubuntu and try it, I really would rather not do all that just to see if it might, then not really know if it really did or not anyway. I'm getting just a little tired of this crazy assuming that that's okay shit, and my using my IMPLIED consent. That's ASSUMING a lot by MS and you know what they say about assuming. But, NO IT'S NOT OKAY, then they just put shit on MY computer, when I simply update something so it will work. And THAT'S why I never let ANYTHING "automatically" update, that reason there and my bandwidth limits from my fucking ISP.

Sorry about the vent, that just really, really pisses me off. Probably depends how you update, but then again how would Joe Common Man know how not to get screwed over just by turning on his computer when the fucking industry leader does it as common practice? - smooch it MS.

 

[ScrubNinja]

Hey bro, I have ubuntu and firefox updated last night I think it was, & it didn't install flash.

Unlike Flash, Ubuntu is not gonna install itself, so I recommend you do it.

 

[LargePrime]

I wanted to add that a simple way to add security is to use a VPN

You might choose to review torrent freak .com , as they review all the major VPN's every year for there actual security policy.

Also note that WPA2 was compromised recently. So your wireless connections are never secure.

However if you have a SSH tunnel over wireless you can be pretty safe.

And remember kids, its not SSH if you are not exchanging private keys.

 

[Skip]

Lots of updates needed to any security FAQ these days thanks to Edward Snowden who should win the Nobel Peace Prize, imho.

1. ssl or https: isn't all that secure since the RSA encryption has backdoors specifically for the NSA, which means DEA can break it too. And now it only takes a couple of seconds to do.

2. Android and iPhones aren't secure AT ALL. In fact, they are poorly secured and can easily be accessed by the Feds and hackers too.

3. All the major US software companies have compromised the security of their products for the benefit of US gov't spy agencies. So you just have to assume that anything you do on an electronic device is being recording and archived somewhere.

4. Even hardware has been compromised! Computers, laptops, phones, tablets have been intercepted and modified or designed to allow gov't access without leaving any trace. It's quite likely that firmware has been modified either on a case by case basis or across the board.

So in summary, the more devices you use, the more attached you are to using them, the more at risk you put yourself if you are engaging in something illegal.

I pity the poor guy who just took a load of pics of his new grow room with his smartphone, then gets a traffic stop by the police who then look over his phone. Within an hour they've got a search warrant. The fact that he also posted his pics up on ICMag won't mean a damn thing to the cops. And if he just came from a special grow house, the cops can just look at his car's satnav system and see everywhere he's been lately.

One thing this thread shows is that REAL risk isn't posting insecurely on ICMag, but what history you have on your own computer or other device that can be used against you. Posting a pic of your grow on ICMag isn't illegal. But if that same pic is found on your computer when you get raided, it can then be used as physical evidence against you. That's how it works in the real world, they need real physical evidence of some sort.

 

[unregistered190]

Good points

 

[inthefire]

Rockwell-Somebody's watching me

 

[outhereinthesun]

Nice.. keeping it old school simple.

These are proper guidelines and anybody wanting a little edge on security need to take notes.


Also.... here is a browser: https://duckduckgo.com/

Peace Peace

 

[feeblebunny]

Consider Qubes OS. The xen hypervisor can run windows too. https://www.qubes-os.org/

 

[shithawk420]

People still use internet explorer?lol

 

[pashio]

For posting online I can recommend anyone using Tails operating system booted from flash. Its platform for security minded as it does use Tor network in default. (Hides your IP)

 

[Encrypt]

Lots of updates needed to any security FAQ these days thanks to Edward Snowden who should win the Nobel Peace Prize, imho.

1. ssl or https: isn't all that secure since the RSA encryption has backdoors specifically for the NSA, which means DEA can break it too. And now it only takes a couple of seconds to do.

2. Android and iPhones aren't secure AT ALL. In fact, they are poorly secured and can easily be accessed by the Feds and hackers too.

3. All the major US software companies have compromised the security of their products for the benefit of US gov't spy agencies. So you just have to assume that anything you do on an electronic device is being recording and archived somewhere.

4. Even hardware has been compromised! Computers, laptops, phones, tablets have been intercepted and modified or designed to allow gov't access without leaving any trace. It's quite likely that firmware has been modified either on a case by case basis or across the board.

So in summary, the more devices you use, the more attached you are to using them, the more at risk you put yourself if you are engaging in something illegal.

I pity the poor guy who just took a load of pics of his new grow room with his smartphone, then gets a traffic stop by the police who then look over his phone. Within an hour they've got a search warrant. The fact that he also posted his pics up on ICMag won't mean a damn thing to the cops. And if he just came from a special grow house, the cops can just look at his car's satnav system and see everywhere he's been lately.

One thing this thread shows is that REAL risk isn't posting insecurely on ICMag, but what history you have on your own computer or other device that can be used against you. Posting a pic of your grow on ICMag isn't illegal. But if that same pic is found on your computer when you get raided, it can then be used as physical evidence against you. That's how it works in the real world, they need real physical evidence of some sort.

Hello, I'm a very privacy conscious guy and that's the main reason to don't share my grow op here and I would love to do it..

On my point of view the REAL risk is posting photos here, there is no way to remove all metadata, do you guys overwrite or delete the EXIF data form photos? If you remove it with free software even open source or you check the code for yourself or your trusting in what other people say, its more likely that your making even worst to your privacy..

EXIF data contains date, time, settings, personal information and GEOTAGGED DATA..

Thanks to Snowden we know now know android and apple have backdoors, and very likely the increase of "hide" metadata on any level, camera is not a exception so we cannot trust NOTHING with electronics in it..

Do you have any real solution for this huge lack of privacy mainly on the metadata from images?

 

[_tessarecting]

Icmag strips EXIF

 

[Encrypt]

I appreciate your answer, but just because the site uses third party image hosting services doesn't means that there is no metadata association.
EXIF standarts are the one who I care less with 2 lines of code you can remove them easily,
There is too much variations to control the data contained in the data (metadata) to be 100% sure.

All the image data for example, pixels are what I don't have any trust and way to check it, all the hardware capable of taking pictures -pos mass surveillance, have fingerprints in each image.. Like the well know case of the printers..

The solution is maybe to start with TESTED open source hardware camera ( hard to find) + open source computing device and a few more steps, too much trouble for just posting pics.



This is from a paranoiac privacy perspective