Hacker 10 - Security Tips | Computer security tutorials. Encryption and privacy software.

FBI software specifications to monitor social networks

Caitlin / 27 January, 2012 / Other Computing / Permalink

Social network monitoring

The Federal Bureau of Investigation is calling on IT companies to submit a “white paper” on how to build a software tool to monitor social networks like Facebook and Twitter, they want to use the information collected to predict and respond to crisis. The system should be able to work in real time, with search capabilities of social networks and news sites like the CNN and MSNBC, using keywords and parameters defined by FBI agents, with automated filtering of collected data. Other specifications include instant notifications of breaking events triggered by keywords and the alerts being shown colour coded on a geospatial map with the ability to save and archive warnings, they even mention their preferred maps, which are Google Maps, Google 3D Maps and Yahoo Maps.

The application should help view domestic terrorist threats and worldwide, classifying terror groups, being able to quickly locate US embassies and Government installations around the globe including details like the weather forecast and displaying video feeds of traffic cameras in real time to spot traffic patterns like bottlenecks, obstructions and flash mobs. Twitter is specifically mentioned and the FBI asks for the ability to instantly search and monitor all publicly available tweets across the whole Twitter site, the application must be able to translate foreign language tweets into English, using a minimum of 12 different languages, attaching a reference document of “tweet” lingo for officers to be able to understand the data. Vendors able to build that kind of mass surveillance software must include their estimated pricing to the FBI.

A quick reminder that if you don’t want your Facebook postings to be read and stored by the FBI, the only privacy workarounds are not to use a social network, use something more anonymous like Pidder, or to only post in private not allowing public view. Besides the Government, employers and enemies alike can find the information you post in Facebook useful too.

Reference: Federal Business Opportunities (fbo.gov)

0 Comments

Private hosting in Iceland with 1984 hosting

Caitlin / 26 January, 2012 / Other Computing / Permalink

1984 hosting review

Powered by free software and green energy with their headquarters and equipment in Iceland, 1984 hosting offers private hosting, VPS, domain registration, email and free DNS services, the company claims that they will go the extra mile to protect their customers right of freedom of speech, privacy and anonymity, they will not reply to threatening emails and will only obey a valid Icelandic court order, if they become aware of any investigation by the authorities 1984 hosting will warn the customer unless there is a gagging order, one of the two founders is a member of the Icelandic IMM (International Modern Media Institute), a foundation working for free speech.

Control panel 1984 hosting

I was given a test account to see what their services are like, 1984 shared hosting has a custom hosting panel based on ispCP, simple and easy to use, you will not get lost or wonder where things are, functions can be accessed within a couple of clicks, the panel default language is Icelandic, it can be changed to English, Hungarian, Spanish, Danish and others. On the main tab there are statistics about space and bandwidth, number of SQL databases, FTP accounts and subdomains, backups are perfomed daily and they can be restored using the control panel, custom 404, 401, etc pages can be created too, websites status, like number of visitors, can be measured with awstats. Files can be uploaded using FTP or FTPS (FTP Over Explicit TLS/SSL) with SFTP support being planned for the future, alternatively you can use net2ftp, web based FTP, to upload files via browser, with the hosting account you also get an IMAP/POP3 email account, email can be retrieved with an email client or webmail (SquirrelMail).

If you go for a VPS there is a list of the most common Linux and BSD distros to choose from or you can ask 1984 hosting to install a particular distribution that isn’t there, payments are made with Paypal or credit card.

1984 hosting net2FTP

The Icelandic Parliament will soon introduce a new legislative freedom of expression framework enshrining protection for whistle blowers, information sources, communications, publication restraint orders and others, this makes the hosting company location ideal, but I was baffled by their free speech policy, while claiming to go the extra mile to protect customers civil rights, and hosting many politically sensitive websites they apparently have speech limits, set by what they called in the email exchange “sense of decency“, and made it clear to me that disagreeing with a website will not have an account terminated but they will not allow racist propaganda or pro-pedophile websites on their network as they say they would not sleep at night if they were serving them, and as for warez and copyrighted material, Iceland has the same laws than any other western country and they have to comply with them.

My impression is that 1984 hosting could be a good place to publish whistle-blowing or corporate data leaks and count with strong investigative journalism protection out of the reach of US trigger happy libel laws, or you could use it as an offshore webmail account since their hosting prices are reasonable, but don’t push it too hard towards extreme websites not covered by this host so called “free speech” sense of decency.

Visit 1984 hosting homepage

Comments are closed

US judge orders woman to decrypt laptop or face contempt of court

Caitlin / 24 January, 2012 / Other Computing / Permalink

Forced to decrypt drive

In a case that could set a legal precedent, a Federal US judge has ruled today on a long standing case that the defendant Ramona Fricosu, involved in a multimillion bank fraud, must decrypt her Toshiba laptop hard drive of face contempt of court, the woman had argued that exposing the laptop contents to law enforcement by entering her password would violate the Fifth Amendment, right not to self-incriminate, the judge ruling in a 10 page verdict says that the defendant isn’t protected because the 1789 All Writs Act has been used to require telephone companies to aid in surveillance and can be invoked in forcing decryption of hard drives as well.

Her solicitor, Phil Dubois, has asked for a stay of execution so that they can appeal and has announced that his client may not be able to decrypt the laptop for any number of reasons although the defendant was recorded in a jailhouse conversation with her ex-husband admitting to having access to the laptop and it will be hard to claim that she doesn’t know the password.

It looks like the US could become a country like the United Kingdom where refusing to reveal your password to the authorities is already a criminal offence, but while UK laws sets a maximum prison sentence of 2 years (5 years if the case is related to terrorism), in the US people could be held in contempt of court which means an indefinite prison sentence.

This is not the end of it yet as hopefully the appeal will be granted and could overturn this verdict, once the legal fight has exhausted all possible recourse, US law should soon be clear about if citizens have the right to refuse to reveal the password to their encrypted files or not, at the moment is best to be cautious and assume that sticking a finger up the cops and saying that you won’t reveal the password might not work as expected.

Note: According to an article in Popular Science, the defendant was using Symantec PGP Desktop full disk encryption.

4 Comments

Android phone encrypted IM chat with Gibberbot

Caitlin / 21 January, 2012 / Mobile Phone / Permalink

IM encryption Android

Gibberbot is a secure Instant Messenger app for Android phones, it works with any Jabber or XMPP compatible chat software (Facebook chat, GTalk, Ovi, Openfire, etc) this open source messenger developed by the Guardian Project uses end to end encryption with Off-the-Record messaging (OTR) standard, it will keep your service provider out of the equation making it impossible for an eavesdropper to read the messages.

Optionally Gibberbot can be used with Orbot (tor on Android app) to chat over the tor network, adding anonymity to an already private chat and circumventing censorship firewalls. Before signing into the chat you will be asked if you would like to save your password, you shouldn’t do this as anyone with access to your phone would be able to impersonate you.

Android secure IM Gibberbot

Off-the-Record encryption needs both parties to be using it, the people you are chatting with must have Gibberbot installed or be using a desktop computer with an instant messenger that has the plugin installed, Pidgin (Windows&Linux) and Adium (Mac) can all use Off-the-Record (OTR).

You should swap digital fingerprints first to make sure he/she is the right person behind the keyboard, Gibberbot allows you create a scannable QR (Quick Response) code out of a digital fingerprint making it easy to exchange in person, after verifying fingerprints with your partner the chatbox will be shown green indicating that encryption and identity have all been authenticated, if you can not verify your partner’s identity the chatbox will be coloured orange indicating that encryption is working but identification failed, if encryption doesn’t work because the other end hasn’t got Gibberbot installed the chatbox will be shown in red colour and can still be used.

Note: This app is still in development and could contain some bugs.

Visit Gibberbot Android Market page

6 Comments

Review offshore VPN provider VPN4All

Caitlin / 19 January, 2012 / Internet Anonymity / Permalink

VPN4All review

VPN4All is one of the few big VPN providers that I had not tried yet, it attracted me that they are located offshore, a loosely used term, offshore literally means in a foreign country,VPN4All offshore location is to be found in the privacy friendly Seychelles, a sovereign archipelago of islands with 85.000 habitants in the Indian Ocean. Seychelles privacy laws make it very difficult for its government and banks to share information with other countries about companies there, it is a place often used to establish companies in secrecy as there are no requirements for shareholders to be listed in the registry, local laws do not require VPN providers to keep logs either, and VPN4All claims to have turned off logging in all of their servers, they textually mention in their privacy policy that “any requests by law enforcement can be met without providing any information about clients or their data. Even a court order would not provide any personal data about users.”

Their VPN software runs on Windows and Mac, Linux computers could use PPTP, but it is not as secure, the mobile version of VPNAll can be used on the iPhone, iPad, Android, and Windows Mobile. Running a VPN on a mobile device will encrypt Instant Messenger chat communications and Voice over IP calls besides hiding your IP when connecting to the Internet.

Offshore VPN provider VPN4All on my NASA wallpaper

I was very pleased with the VPN client highly configurable options, encryption is set up at the highest possible level, AES256 and RSA2096bits key, the interface and installation is multilingual, you can choose in between English, Spanish, Arabic, Chinese, German and others. At the moment of writing, VPN4All has VPN servers in Finland, Seychelles, USA, UK, Canada, Lithuania, Russia, Germany, Hong Kong and a long etc, over 50 VPN servers with thousands of IPs.

Being myself on a home 6MB Internet connection in Europe I was able to get a little over 4MB in their USA servers with a 150ms ping, the closer European servers at their lowest load gave me my full ISP speed. I contacted VPN4All support a couple of times, once opening a ticket which was replied to me in under 24 hours and the other time using their online live chat which was answered by a friendly support team member in just a few minutes.

In countries in which there is more than one server they can be found spread out, along the US West and East coast and UK South and North for example, this is obviously advantageous. You can also select a special test TCP server from the list to make sure that no firewall is blocking your traffic and troubleshoot problems, VPN4All states that they will go as far as using Teamviewer to help you out if necessary, the VPN client comes with a clear to understand offline manual with screenshots, but I did not have to use it.

VPN4All connection

To send email via SMTP you can whitelist a mail server adding it to the VPN client email options. During the time I have been using this VPN service I did not experience any disconnection issues, a green/red icon located in the Windows toolbar allows you to quickly see the VPN connection state.

The good stuff

The VPN can be set up to always use a static IP (fixed) if you wish so, right clicking on the server and choosing “Anchor IP“, from then on the selected server will show a blue Anchor, this is useful to stop certain websites from blocking people out of their accounts when they detect the IP has changed, like for example Paypal. In the settings one can choose to do exactly the opposite and instruct the VPN client to automatically rotate the computer IP every hour, 30min, 5min. If you have a favourite server it is possible to bookmark it in the drop down list, it will then appear with a yellow star next to it.

A small green bar appears next to each server allowing you to see the load in real time, a common problem with VPN providers owning multiple servers is that you have to waste time swapping servers once you realise the one you have chosen is too slow, with VPN4All you will always be able to get onto the best performing server, a green arrow automatically indicates the fastest VPN for your location, and if any of the servers goes temporarily offline, it will be greyed out from the list, server load can also be seen using the control panel through your VPN4All web account.

VPN4All running on mobile device

The bad stuff

The file sharing unlimited bandwidth package pricing is on the high side, however the VPN4All 50GB/month package is acceptable and buying a yearly account gives you a seizable discount, mobile licenses for smartphones need to be bought separately. There is a problem with some servers identifying themselves as being located somewhere else due to server registration details being used by websites to identify location, this problem is common in all VPN providers I have used before but VPN4All has a slight above the average rate.

Conclusion VPN4All

If you are after a VPN with a solid no logging privacy policy located outside US and European Union jurisdiction look no further than VPN4All. If you need a VPN provider that will give you a choice of static or dynamic IPs for web surfing and watching online TV with servers worldwide for a reasonable price and good 24/7 support, VPN4All will do that nicely, but test the VPN first if you badly want a location, just to make sure that it is really showing to websites as being located there. I have used this VPN widely to watch US and UK online TV with no problems, though. There is a 30 money back guarantee (subjected to 100MB usage) that should give you piece of mind.

The big selling point of this VPN over others is the headquarters location in a country with strong privacy laws (Seychelles), dozens of worldwide servers, and a free static IP throw into the package. I give this VPN a personal score of 8 out of 10, once they solve the VPN server geolocation ID problem they should be entitled to a 10 out of 10.

Visit VPN4All homepage

Special discount: VPN4All is now kindly offering a 15% discount to anyone who enters the word hacker10 at the checkout! This code can be used to buy an already discounted yearly package too.

4 Comments

How to secure your personal data at border crossings

Caitlin / 19 January, 2012 / Other Computing / Permalink

Protect laptop from airport security

Border control officers at land crossings and airports in many countries have the right to search traveller’s laptop and smartphones without a court order, that is where your family photos, banking details and list of visited websites reside. Lawyers, doctors and businessmen should also be concerned about this practise, if you care about your privacy here are some tips to protect your digital data from noisy border agents:

Backup your data: There is the possibility that a border agent damages or seizes your device, always have a backup somewhere else and never take the backups with you, leave them at home. If you need to backup your data at the guess country, i.e. holidays photos, use an encrypted cloud service like SpiderOak or Wuala, encrypt the and SFTP to your server, or back it up to an encrypted USB thumbdrive and mail it to your home.

Use whole disk encryption: Whenever it is possible use full disk encryption as opposed to file encryption, there are too many places where the operating system creates temporary copies of personal data to be able to securely wipe everything. If you can get away with using a Linux live CD for your day to day Internet usage this is the best course of action, remove the laptop hard drive or wipe it, with a live CD nothing will be saved to your hard drive.

Officer searches laptop at border crossing

The country you visit could have different encryption laws to that of your home country, in the UK for example, it is a criminal offence not to reveal the password to your encrypted files when law enforcement asks for it, the penalty for refusing is up to 5 years in prison. If unsure about local cryptography laws, store your data encrypted on the cloud and take only a live CD with you, download your files only after going through customs and make sure to never save anything as you could be asked for access at any time during your stay or on your way out.

Smartphone protection

If you are using an SD card for storage, extract it and wipe the memory card on a PC using specialist software (Eraser, ProtectStar, BCWipe, etc). On Android phones, download the Whispercore app for full phone encryption. Another choice is to use a second phone only for travelling, unless you really need a smartphone abroad, buy a cheap phone and transfer your SIM card there, this should also help you protect against theft by making it less attractive.

Digital cameras

Border agents might want to look at your holiday photographs for whatever reason, sometimes searching for illegal pornography or to corroborate that you really have been on a leisure break. There is no easy protection against this other than extracting the memory card, encrypting it and mailing it to yourself, it will help not to look suspicious by coming back from holidays with an empty camera by introducing a second memory card in the digital camera with photos you don’t care about anyone seeing

The decision on whether to search your electronic devices or not will take into account the countries you have visited, your background (criminal record), how you behave at the border, and the state of alert at the time, electronic devices can also be searched at random or just because the border officer feels like it.

Border control agents could swap test your laptop for bomb residue, this test is called Explosive Trace Detection and it can be carried out on any piece of checked baggage.

For further information read the Electronic Frontiers Foundation Guide for Travelers Carrying Digital Devices

2 Comments

Shutdown a computer remotely with RemoteRebootX

Caitlin / 17 January, 2012 / Other Computing / Permalink

Remote computer management

RemoteRebootX is a portable application to remotely monitor a computer in real time, it can also be used to simultaneously shutdown, reboot, ping or Wake-on-LAN multiple computers, the best part is that it does not need to be installed in the remote computer, simply launch RemoteRebootX and add hosts. A task scheduler allows you to automatically execute actions without supervision, other useful options are retrieving the last boot time of a host, acquiring its MAC address and looking at the drive space information, all of the actions can be done using the interface or right clicking on the computer IP.

On restricted computers you will be asked to login first before executing any command, using the padlock icon, it will also ask you for the computer Workgroup. This tool can be used by system administrators in conjunction with BatchPatch, a paid for application, to install updates on multiple servers and reboot them simultaneously.

Computer management RemoteRebootX

RemoteRebootX interface is not as pretty as that of EMCO Wake-on-LAN, another tool to remotely control a computer over the Internet or inside a network, but it has higher capabilities, allowing you to reboot and shutdown computers, which EMCO Wake-on-LAN can’t do, and it can be carried on a USB thumbdrive.

Visit RemoteRebootX homepage

0 Comments

Free portable antivirus McAfee Stinger

Caitlin / 16 January, 2012 / Computer Security / Permalink

Portable antivirus

McAfee Stinger does not need installation and can be run from a USB thumbdrive but it asks for administrator rights, this tool has not been designed as a replacement for a fully fledge antivirus, you could use it when you are travelling to check an Internet cafe computer before using it, McAfee Stinger is light on resources, small and fast. After executing it you can select a directory for scanning or scan the whole computer which took me 2 minutes for a 300GB hard drive, McAfee Stinger will scan subdirectories and compressed (.zip,.rar,.7zip) files too, if anything is detected you can choose to repair, rename, delete or report only.

Besides providing protection for travellers using unknown computers this tool can be used as a second opinion if you detect an anomaly, the first thing quality malware will do is to disable your local antivirus, that is why it is important to scan your files with two different antiviruses when something does not add up, as well as checking for outgoing Internet connections.

Portable antivirus McAfee Stinger

This tool scans the boot sector which is where rootkits tend to lodge, processes and registry are also scanned, with an heuristic check which sensitivity can be adjusted from Very low to Very high, the default is Medium. Heuristics is a system to detect antivirus like behaviour, meant to discover zero day never seen before threats. McAfee Stinger comes with a very limited list of virus signatures, around 4000, they can be seen by clicking where it says “List of viruses“, it is mostly made up of trojan horses, McAfee claims that it can remove prevalent Fake Alert malware.

If you suspect your computer is infected you might want to check other software that McAfee’s has on its free tools page AntiMalware section, RootkitRemover and GetSusp, both directed at beginners and easy to use, good computer security is made up of layers, the more passive and active security layers you have the less chances of infection, another choice is to use an online antivirus if you are comfortable allowing access to your files.

Visit McAfee Stinger homepage

0 Comments

Uninstall a Windows program safely with iObit uninstaller

Caitlin / 13 January, 2012 / Computer Security / Permalink

Get rid of hard to uninstall software

iObit uninstaller is a tool to help you get rid of junk left behind by uninstalled programs, some of its advantages over the standard Windows uninstaller is that it will scan the registry and hard drive to find invalid keys and leftover files, allows you to uninstall various program in batch mode using a single click, and it has a “Force Uninstall” mode to eliminate software not listed in the Windows Add/Remove control panel or if the original uninstaller no longer works, however this is not guaranteed to succeed all the time.

It’s tabbed interface classifies installed programs in “Windows Updates” ; “Rarely Used” ; “Large Programs” ; “Recently Installed” ; “Toolbars” and “All Programs“. This makes it very easy to find what you want to get rid of, an instant search box is also included, after using the Powerful Scan you will be presented with all the leftover files found and asked if you would like to erase them, anything you do is logged inside a text file accessible from the menu together with a shortcut to Windows Restore Point to reverse changes, iObit uninstaller will create a restore point every time you use the advanced uninstall mode.

iObit free Windows uninstaller

This program does not need installation and it can used in portable mode, it is a good tool to have for IT administrators, however, it requires administrator rights, unlike some of their competitors iObit uninstaller does not track what changes are made to your computer when you install software, the program is not as complete as Revo Uninstaller Pro, but it is free, if you are having problems eradicating a hard to go program it is well worth a try.

Visit iObit uninstaller homepage

0 Comments

1 2 … 20 Next »

Hacker 10 - Security Tips

Private hosting in Iceland with 1984 hosting

US judge orders woman to decrypt laptop or face contempt of court

Android phone encrypted IM chat with Gibberbot

Review offshore VPN provider VPN4All

How to secure your personal data at border crossings

Shutdown a computer remotely with RemoteRebootX

Free portable antivirus McAfee Stinger

Uninstall a Windows program safely with iObit uninstaller

Search

Categories

Blogroll

Archives