Security Overview - Revision history

Yar: /* Fingerprinting */ link to tor bug tracker

2013-12-17T20:36:17Z

Fingerprinting: link to tor bug tracker

← Older revision		Revision as of 13:36, 17 December 2013
Line 184:		Line 184:
	* https://panopticlick.eff.org/		* https://panopticlick.eff.org/
	* http://browserspy.dk		* http://browserspy.dk
			* tor bug tracker is always thinking of new problems https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb-fingerprinting
	* https reduces attack surface but does not solve		* https reduces attack surface but does not solve
	** with http you are vulnerable to fingerprinting from EVERYONE EVERYWHERE		** with http you are vulnerable to fingerprinting from EVERYONE EVERYWHERE

Yar: /* Endpoints */ add android link

2013-12-15T23:51:30Z

Endpoints: add android link

← Older revision		Revision as of 16:51, 15 December 2013
Line 66:		Line 66:
	*** microsoft, apple, google: all evil		*** microsoft, apple, google: all evil
	*** hall of shame: skype, silverlight, flash are all evil		*** hall of shame: skype, silverlight, flash are all evil
			*** http://www.wired.co.uk/news/archive/2013-10/21/googles-iron-grip-on-android
	* defense in depth		* defense in depth
	** antivirus		** antivirus

Yar: /* Crypto */ add some ssl links

2013-12-15T20:52:32Z

Crypto: add some ssl links

← Older revision		Revision as of 13:52, 15 December 2013
Line 134:		Line 134:

	* SSL		* SSL
	** ~~show~~ example of site that sells SSL certs (namecheap.com)		** example of site that sells SSL certs: https://www.namecheap.com/ssl-certificates.aspx
	** ~~show directory with certs your~~ OS trusts		** example of who an OS trusts (Arch Linux uses Mozilla's cert list): https://www.archlinux.org/packages/core/any/ca-certificates/
	** any of these orgs can impersonate any website		** any of these orgs can impersonate any website
	** cert authorities don't solve mitm, just narrows down who can do it		** cert authorities don't solve mitm, just narrows down who can do it

Yar: /* Endpoints */ clean up & consolidate more

2013-12-15T20:45:14Z

Endpoints: clean up & consolidate more

← Older revision		Revision as of 13:45, 15 December 2013
Line 21:		Line 21:

	=Endpoints=		=Endpoints=
	* nonfree software (microsoft, apple, google: all evil)		early security: mainframes, protecting users from each other
	* security updates: package managers are the only way
	* app stores add complications: paywalls, "permission creep"
	* how exploits work: backdoors, CVEs, black market, foxacid
	* hall of shame: skype, silverlight, flash are all evil
	* early security: mainframes, protecting users from each other
	* how a computer works		* how a computer works
	** picture a vast table of index cards - that is memory, it is addressable		** picture a vast table of index cards - that is memory, it is addressable
Line 62:		Line 57:
	** botnets: send spam, mine bitcoin, steal your identity		** botnets: send spam, mine bitcoin, steal your identity
	** black market for pwnd computers, amazon accounts, etc		** black market for pwnd computers, amazon accounts, etc
			** backdoors, CVEs, foxacid
	** because exploits are valuable, they use sparingly to avoid discovery		** because exploits are valuable, they use sparingly to avoid discovery
			** updates
			*** always update!
			*** package managers are the only way
			*** app stores add complications: paywalls, "permission creep"
			** nonfree software
			*** microsoft, apple, google: all evil
			*** hall of shame: skype, silverlight, flash are all evil
	* defense in depth		* defense in depth
	** antivirus		** antivirus

Yar: /* Endpoints */ clean up, expand a little bit

2013-12-15T20:20:23Z

Endpoints: clean up, expand a little bit

← Older revision		Revision as of 13:20, 15 December 2013
Line 26:		Line 26:
	* how exploits work: backdoors, CVEs, black market, foxacid		* how exploits work: backdoors, CVEs, black market, foxacid
	* hall of shame: skype, silverlight, flash are all evil		* hall of shame: skype, silverlight, flash are all evil
			* early security: mainframes, protecting users from each other
	* how a computer works		* how a computer works
	** picture a vast table of index cards - that is memory, it is addressable		** picture a vast table of index cards - that is memory, it is addressable
Line 52:		Line 53:
	*** interact with images, html, javascript, emails		*** interact with images, html, javascript, emails
	*** buffer overflows, bad code, bad runtime, bad languages		*** buffer overflows, bad code, bad runtime, bad languages
			*** difference between code & data is arbitrary, enforced by software! this is what makes computers powerful, but is also very dangerous
	*** if remote attacker can run code directly on your CPU, that's an execution bug		*** if remote attacker can run code directly on your CPU, that's an execution bug
	*** this is how the NSA defeated TBB: bug in firefox xml library		*** this is how the NSA defeated TBB: bug in firefox xml library
Line 57:		Line 59:
	* arms race: who wants to break in?		* arms race: who wants to break in?
	** govts, spies		** govts, spies
	** vandals ~~- gnaa~~, syrian electronic army		** vandals, trolls, syrian electronic army
	** botnets: send spam, mine bitcoin, steal your identity		** botnets: send spam, mine bitcoin, steal your identity
	** black market for pwnd computers, amazon accounts, etc		** black market for pwnd computers, amazon accounts, etc
Line 71:		Line 73:
	*** prevents propagation, phoning home, so no payload for attacker		*** prevents propagation, phoning home, so no payload for attacker
	*** NAT is not security, ipv6 is coming, "internet of things" shiver		*** NAT is not security, ipv6 is coming, "internet of things" shiver
	* ~~developer security~~
	** ~~source control (~~git)		==Developer Security==
	** package signing		* source control
	** ~~opsec~~		** http://www.git-scm.com/about/info-assurance
			** https://www.kernel.org/
			** http://www.linuxfoundation.org/news-media/blogs/browse/2011/08/cracking-kernelorg
			* secret backdoors submitted openly? https://www.nsa.gov/research/selinux/
			* package signing, opsec
			* deterministic builds are the future
			** https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise
			** https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details
	** multiple compiler ecosystems (gcc, llvm/clang)		** multiple compiler ecosystems (gcc, llvm/clang)
	** deterministic builds are the future
	** secret backdoors submitted openly (selinux?)

	==Disk Encryption==		==Disk Encryption==

	* "rubber hose cryptanalysis" https://xkcd.com/538/		* "rubber hose cryptanalysis" https://xkcd.com/538/
	* adds security at rest, but not while running		* adds security at rest, but not while running
Line 87:		Line 93:
	* always keep backups - data loss is DoS		* always keep backups - data loss is DoS
	* deniability is very hard		* deniability is very hard
	* steganography: hiding in plain sight		** much easier to avoid being a suspect
			** having TBB on your disk is a red flag, especially with particular extensions
			** ideal solution is steganography: hiding in plain sight

	=Networks=		=Networks=

Yar: reformat with bullet points

2013-12-15T19:53:01Z

reformat with bullet points

Show changes

Yar: update, partially consolidate

2013-12-15T19:42:30Z

update, partially consolidate

Show changes

Yar: giant brain dump

2013-12-11T02:22:21Z

giant brain dump

New page

http://does-this-need-to-be-said.tumblr.com/

social engineering
* doxxing: http://thebot.net/general-tutorials/233339-how-doxing-works-protect-yourself/
* cultivate multiple identities, emails, usernames, etc

hardware
* cameras, microphones, radios
* facial recognition
* evil chip manufacturers
* keyloggers
* monitors leak radiation
* tracking devices on cars - ride a bicycle, store it indoors

endpoint operating systems: main problems
* nonfree software (microsoft, apple, google: all evil)
* security updates: package managers are the only way
* app stores add complications: paywalls, "permission creep"
* how exploits work: backdoors, CVEs, black market, foxacid
* execution, escalation, propagation, phoning home
* privilege separation (made windows XP unusable)
* on linux this is defeated by keyloggers - X Windows is broken, even ships with its own keylogger (xev)
* sandboxing is imperfect (that's how the NSA defeated TBB)
* hall of shame: skype, silverlight, flash are all evil
* firewalls++
* NAT is not security, ipv6 is coming
* virus scanners are an ugly hack. it's too late, wipe & restore
* rootkits, worms, botnets
* PRNGs: android fail
* developer security
* source control (git)
* package signing
* opsec
* multiple compiler ecosystems (gcc, llvm/clang)
* deterministic builds are the future
* secret backdoors submitted openly (selinux?)

disk encryption
* "rubber hose", "evil maid"
* risky without trusted boot, but trusted boot also broken
* deniability is very hard
* steganography
* best use case: phones (because of controlled environment)
* adds security at rest, but not while running
* your mugger probably won't dump the RAM, but cops can
* always keep backups - data loss is DoS

networks are evil
* ISPs spy on you
* assume all cables are tapped, intercepted
* routers & modems are vulnerable
* NSA suppresses openwrt to keep them that way
* closed hardware drivers are the other culprit - patents, binary blobs
* some things need old kernels: more work for kernel devs
* #1 reason some hardware needs dd-wrt, not openwrt
* cell phones especially, even with cyanogenmod

mesh networks
* harder to wiretap individuals
* but ideally should not be trusted either - end-to-end encryption
* can do location analysis, enable stalkers (seattle)
* mac address randomization: unsupported, not foolproof, easy to block

tor, vpns, proxies
* protect you from your own ISP/network hardware
* provider or exit node still can spy on you
* much VPN software/protocols are not audited
* local traffic analysis & timestamps could give you less deniability
* they can tell WHEN you are using tor/vpn
* tor only hides/obfuscates your IP address - NOTHING ELSE (unless you use tbb)
* flash is evil: poor sandboxing, disrespects proxies

mitm
* anyone controlling the pipes can do it
* Tor can make this WORSE, not better, so router-level Tor is also bad
* SSL
* https://www.eff.org/https-everywhere
* cert authorities don't solve mitm, just narrows down who can do it
* french ISP spoofed google, so did chinese govt
* show directory with certs your OS trusts
* show example of site that sells SSL certs (namecheap.com)
* one solution is ipsec + dnssec + dane, but these are not deployed. internet is broken.
* metadata
* even with SSL, they can see who you're talking to
* traffic analysis, packet size gives away a lot: google maps tiles, for example
* tor hidden services
* the address is the certificate
* solves the mitm problem
* solves the metadata problem
* solves the auth problem
* are not user-friendly by today's standards
* this is what securedrop uses
* in the future we will all memorize hashes like phone #s
* similarly: hashed.im
* OTR approximates this

cookies
* ad networks: google, etc
* analytics: google, etc
* CDNs: google, amazon, akamai
* social networks: facebook "like" button, twitter, etc
* session cookies partially solves
* but how long is your session?
* what did you do in your session?
* persistence - anything on disk: flash cookies, DOM objects, cache
* deleting flash cookies deletes security settings. flash is evil!
* disk encryption does not solve this - it is still a disk!
* private / incognito mode partially solves, makes false promises
* bugs, leaks, plugins: https://trac.torproject.org/projects/tor/wiki/doc/ImportantGoogleChromeBugs
* TAILS solves this - defense in depth

browser fingerprinting
* https reduces attack surface but does not solve
* with http you are vulnerable to fingerprinting from EVERYONE EVERYWHERE
* with https you are vulnerable to fingerprinting from sites you visit & 3rd party networks
* in active use at major sites
* worst offenders: javascript, plugins, user agents
* TBB does its best, not perfect
* TAILS mostly solves - but webrtc
* still leaves: your language, timezone (country), window size, timestamps, things you say & do, textual analysis

other datamining vectors
* referers
* geolocation
* URL shorteners: t.co, bit.ly
* if you're not paying, you're the product