Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 190 191 [192] 193 194 ... 249
2866
Security / Re: GPG for Ubuntu
« on: May 12, 2012, 12:01 pm »
I am making a GUI for GPG using Ruby and TK. It will be platform independent, as long as you have ruby interpreter.  I will post the source here when it's done, it would have been today but my VM fucked up and I lost a few hundred lines of code. I tried to make it as noob friendly as possible and it includes detailed on screen instructions. It will not be full featured but will provide all of the features of GPG that anyone here really uses (key generation, crypto operations, key management). If people like it I may add full functionality and possibly even more features like automatic clipboard encryption etc.

2867
Go with Mint it is like Ubuntu but even easier. If Ubuntu is almost ready for the masses, Mint is.

2868
Security / Re: GPG for Ubuntu
« on: May 10, 2012, 01:42 am »
I think Ubuntu comes with GPG you just need to get a GUI to control it

2869
With the development history of bitcoin having government ties and the documented history of drug trafficking by the CIA and other government agencies in the past, I wouldn't be surprised to find out it's all somehow tied into moving slush funds covertly somehow.

The development history of Bitcoin has governent ties? News to me.

2870
www.cl.cam.ac.uk/~rja14/Papers/cocaine.pdf

have heard of this many times but just now decided to read about it, I figure others might also find it interesting

2871
Security / Re: Can your ISP see that you use TOR?
« on: May 09, 2012, 02:02 am »
If you want to contribute to Tor I would highly suggest using a cheap VPS to do so , preferably anonymously registered at that, if you are anything other than a small time customer. This is especially true if you plan to run an exit because multiple people who ran exits have been raided after dumbass police traced some other person to them.

2872
Sniff Keystrokes With Lasers/Voltmeters
http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-barisani-bianco-sniff_keystrokes.pdf


http://users.wpi.edu/~martin/MQP/hnathpettengill.pdf
Differential Power Analysis Side-Channel Attacks in Cryptography

not sure if smart grid would be able to get precise enough measurements to carry out attacks like these though

here is something else about it

http://spectrum.ieee.org/energy/the-smarter-grid/privacy-on-the-smart-grid?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+IeeeSpectrumTheGrid+%28IEEE+Spectrum%3A+The+Grid%29

2873
Security / Re: VM dangers
« on: May 09, 2012, 12:56 am »
Truecrypt doesn't protect from hackers at all though, only from people who already have physical access to your computer. Plus it only protects from them if they are retarded and don't know how to covertly obtain passphrases, or just cold boot memory into a forensics laptop.

VMs can be useful for security, but it is a matter of having the right type of VM and also knowing the benefits and limitations. Isolating network facing applications into VM away from Tor and your real IP address can be a very big security boost in some ways, for one it can eliminate all possible IP leaks / DNS leaks etc. For two it can make it so even if you are rooted the attacker can not obtain your real IP address unless they break out of the VM and get to the host. It has disadvantages too though, primarily it increases complexity, which means that it is easier for the attacker to root your VM than it would be for them to root the same OS running on bare metal. The type of VM used has a lot to say about how hard it is for the attacker to break out of the VM and how much easier it is for them to root the VM versus the same os being run on bare metal. Paravirtualization seems to be the best of both worlds. Check out Qubes OS it is pretty cool security oriented distro that is based on Xen, it lets you create security domains and automatically puts every application you launch into a VM that is isolated into a security domain you set.

Windows is still widely considered to be the least secure choice of OS, and using Truecrypt for FDE doesn't protect from anything but a small range of potential attacks. You should still use FDE on your real disk  though, and of course not rely on FDE of a virtual drive.

If you are not using some sort of GUI isolation, be it from VMs or from mandatory access control profiles, any compromise of a windowed application is pretty much game over. You could have a Tetris application that has lowest possible user privileges pwnt, sucks because your desktop environment almost certainly is broadcasting keystrokes to all windowed applications, so they can spy on your keystrokes and EOP to root after you SU.

Pretty much what it boils down to is that you can use the best encryption algorithms every place you possibly can, and the best anonymity networks in the world, and it isn't going to do shit to protect you if you are hacked. Using encryption and anonymizers is important, but hardening your OS and using advanced configuration techniques and technologies to protect from hackers is just as important, and Windows is about as specialized for high security against hackers as *BSD is for gaming.

If you don't think you need to worry about being hacked just look up CIPAV. When FBI runs into a wall trying to identify a target who is using strong encryption and anonymizers, they turn to their arsenal of zero days and potentially-unpatched-exploits and try to find a combination that lets them by pass the security functionality that they can't directly break. DEA was working on developing a similar set of pre-packaged hacking tools for tracing and wiretapping targets using crypto/anonymizers as well, I heard about that for the first time about two years ago. 

2874
Security / Re: Can your ISP see that you use TOR?
« on: May 09, 2012, 12:34 am »
it's a closed research question now, the benefits don't outweigh the risks. And even the entry guards can tell if you are relaying or originating a given stream in most cases, after all they can count the number of extend cells you passed through them and Tor almost always uses three hops. Two extend cells means you are the originator. Nodes need to be able to see the number of extend cells to limit how long your path is, I believe Tor is network limited to 8 hop paths although 3 and very rarely 4 is the default behavior of the default client. Otherwise you could construct a circuit with 3,000 nodes on it and cost each Tor node a kb for every kb you send into the network, would be a big DOS weakness since having enough bandwidth to DOS the most sturdy node would then be enough to DOS the entire network.

If you are shipping product out and run as a relay it is especially bad since they could get lucky and decide to put everyone who runs a relay in your area under surveillance, if you are the only one you could really stick out as a potential suspect. Plus it makes you vulnerable to down time correlations between the relay and the online presence.

That section of the Wiki was written many years ago obviously since it claims Tor only has a few hundred nodes, today it has 3,000 nodes and has had thousands for several years.

2875
Off topic / Re: Giving up
« on: May 09, 2012, 12:28 am »
sniff a shit ton of ketamine you might feel better for weeks

2876
whosarat.com might find you a list of agents and LE addresses, I have heard about it a few times but never decided to spend any money for membership , it really pissed the government off though so it probably isn't entirely worthless

Pretty much people get busted and then give over all court documents and info on the informants / undercovers , and then they screen it to try and make sure it is legit info on informants/agents, and then they sell it for a membership fee. If you end up getting a membership you should try and copy the entire site and post an open source copy ;).

2877
Security / Re: Lets talk VPNs for anonymity's sake...
« on: May 08, 2012, 11:57 pm »
You have it backwards, Sweden requires more data retention than USA does.

http://www.dw.de/dw/article/0,,15826462,00.html

USA has no laws at all about data retention. NSA sucks everything up but it is illegal for them to be doing so. Swedish signals intelligence agency does the same thing though, https://en.wikipedia.org/wiki/Titan_traffic_database. Pretty much any country with a signals intelligence agency and any significant amount of internet traffic passing through them does the same exact shit though. USA is one of the only places that doesn't currently have mandatory data retention laws. Germany had them for a short while but their high court deemed them to be illegal last I heard, and demanded all the logs that had been kept up to that point be destroyed. Data retention is mandatory for all members of the EU but some have ignored the mandate.

Of course if feds want to log data they can legally force people to start logging if they can get court orders. But USA remains one of the few places where dragnet logging is not required by law.

2878
Security / FBI report on Bitcoin
« on: May 08, 2012, 01:04 pm »
http://www.scribd.com/doc/92797476/FBI-Bitcoin-Report-April-2012

2879
You shouldn't deposit them back into your same old wallet that defeats the point of mixing, you need to make a new wallet. I would personally try to hide the fact that you are using a mixing service too, one option would be to cash out into something like Pecunix and then to an exhanger for a bank wire. That will hide the fact that you used a mixing service unless someone gets records from both Pecunix, the exchanger you used and the Bitcoin exchanger you use to get Pecunix. Your best bet would be to get it cashed out to a Western Union money wire and pick it up with a fake ID, or cash it out of an ATM with an anonymous debit card. That way you avoid having unaccounted for money suddenly showing up in your bank account from an E-currency exchangers bank account.

2880
Security / Re: Steganography
« on: May 07, 2012, 08:41 am »
I only know a little about steganography in the grand scheme of things, but I have heard from people who generally turn out to be right, that there is no such thing as strong steganography. If an image or other data is analyzed, it is possible to determine that it has something hidden in it. This is generally done with some statistical techniques looking for the presence of certain levels of randomness, since steganographically hiding data in a file always increases its randomness. It seems to me that maybe very small data transfers would be extremely difficult to detect though, I am kind of skeptic about adding a single additional bit of randomness being enough to identify stegos presence. This technique could also be countered by increasing the randomness in many images, but since most people are not doing this, the people attacking stego seem to be able to get almost non existent false negatives and few false positives, and to be able to fairly quickly defeat everything that is attempted. I believe using unknown and/or more sophisticated algorithms is helpful in slowing them down, but not in defeating their efforts.

This doesn't mean that stego is not useful to avoid arousing suspicion in the first place, and in a way that is what it is intended for. But in another sense the goal of stego is to hide data in other data and hide the fact that this is happening, and in this area it seems to fail.

Sorry I really know very little about stego, but it doesn't seem to be a favored technique by people who really know their shit.

Pages: 1 ... 190 191 [192] 193 194 ... 249