ATS Guide to Data Confidentiality - A MUST READ

Originally posted by intuitive
[...]

Im not sure but i think maybe somebody keeps connecting to my wifi in my street though ? it keeps dropping connection and dipping, If this happens how can i check to see if theres somebody connected? I've changed a password for connecting and that. If its easy and free and worth it i suppose there's no harm, good thread

WPS is a security issue for routers. Just end of last year was a severe security leak found and announced. If it is possible to disable WPS, disable it in your router settings.

Here is a list of some routers with info about WPS vulnerability. If you're lucky you can find your router here.

info about WPS:
en.wikipedia.org...
New WiFi Setup Flaw Allows Easy Router PIN Guessing
Attack Tool Released For WPS Setup Flaw

The security protocol WPA2 is more secure than WPA. I personally use only a cable connection at home, but if WPS can be disabled even WPA is considered to be safe enough usually. At least if you have a good password without dictionary words.

reply to post by badfish420


I have to thank you for your time and effort, very much!!!

I haven't read all the replies yet, so i dont know if someone else may of asked this, but is there something similar that can be used for tablets? I currently don't have anything on it security wise. Hope to sort it asap. S+F

Brilliant post OP !

Being a relative novice, I hope to be able to implement some of your reccomendations, with the way you have explained, I reckon I can pull it off !

Keep them coming

nice verry intresting

Good post. Thank you for the time to write this out.

I made an account just to come in and give a hint about making a super easy super hard password to hack. I was listening to an episode of Security Now awhile back and Steve Gibson came up with a genius way...

It is simply to start with a word, take for example mountain. Now between each letter add two characters and they can be the exact same characters it doesn't matter, and make one or two of the letters uppercase. Example

M##o##u##n##t##a##i##N

This password is 22 characters long and is super easy to remember, it is simply the word mountain with the first and last letters upper case and two pound signs between each letter. Here is another example if you wan to get a little more complicated, but not necessary:

m**o##U**n##T**a##i**n

Again just take the word, mountain in this case, and this time instead of one symbol, alternated between two, the astrik and the pound sign, and capitalized U and T, this is a little harder to remember but not by much.

Remember that most hackers that hack passwords use brute force attacks and thus they start with easiest to hardest, using a word in the English language is the easiest to hack, especially with no upper case. Adding in symbols so that the word cannot be hacked, even if the symbols are the same, will make the password almost unhackable, it would take a very very very long time to hack it using brute force.


Did it register? This is the simplest and safest way to make a password, no need to remember jarbled code that is 20 characters long. Just remember a simple word and the symbol you decide to use between each of the letters.


ETA:

Just googled for and found the podcast Steve Gibson explains what he calls password haystacks, here it is for anyone that is curious:

Thanks for sharing!

I'm going to learn all this and try to keep my questions to a minimum.

reply to post by badfish420


As someone who is interested in learning this I am sooooo thankful!

I never understood how to do this stuff but was really interesting in learning how but i didn't know where to start.

Thanks for sharing this. Now I shall go read in in depth and take notes!

I would like a series btw

The problem with a vpn is that yes, YOUR isp won't be able to tract your internet usage (IF you make sure dns requests are also going through the tunnel) but the isp on the other end will be able to track your usage just fine.

Only way around that is to have your vpn exit in another country. I live in China and have a vpn exit in California.

Great thread OP !

I'd like to add a few thing that might make your browing even more anonymous.
First, like someone already said in the thread, if you use a VPN or a proxy connection, this does not necessarily hide your trace since it only encrypt the connection between you and the proxy or VPN hub. (the IP that will be shown on the other end will be the proxy or the VPN. So if somebody wants to get back to you .. you better hope that the proxy or VPN owner does not give them the traffic logs). It is a great way to surf while at work or a school since nobody will be able to see what you're doing (unless they do a Man in the Middle Attack, then they might still be able to see everything you're doing locally).

One thing I like to use is TOR (not sure you've mentioned it in your thread). This will "bounce" your connection to a TOR node somewhere in the world. That way, you can change your IP anytime you want which increase the difficulty of tracking you.

Locally, I always go with a Linux distro installed on a USB key. On the top of it, a really good way of going it is by creating 2 truecrypt volume. One that you will use, and a decoy one (in case you're forced to open it, then you open the decoy one and leave the other one alone). in other word ... plausible deniability.

For your browser, I like to use mozilla with the following addons.
- Noscript (this will block everyscript until you allow them.. so they wont be able to fingerprint your system using _javascript)
-Adblocker Plus (just something additional to block popups)
-Priv3 - This protects you from being tracked by social network like facebook.
- BetterPrivacy ( This will delete every type of cookies that might contain pieces of information on what you browsed.)


You should also think about using a firewall at home and potentially a network intrusion prevention system (but that is only if you're a security freak like me).

Tor is flawed.

A lot of the nodes are almost certainly run by people who spy on the data that passes through them. And it is extremely slow.

AWESOME READ!! Thank You!

ONE question though that you may or may not know: When ordering gear and supplies online while using a VPN using a prepaid Visa, and after closing everything and disabling flash, cookies etc.....can't your order address still be in the merchants database? Isn't the Government tracking their info too? Or is that considered off topic? To me they relate because the issue is anonymity and if you can be tracked that way, then what is the point? People talk about purchasing supplies with cash, but that is not always practical when you live out in the country....Any ideas on that would be appreciated.

Vpn's are not intended to hide who you are. Even if the vpn provider kept no logs (or yourself if you rent out a linux server for vpn use) the isp that provides internet to the server will probably have logs.

And it doesn't take much coordination between isp's or a 3 letter agency or whoever to simply notice that your computer is always connected to a single ip, therefore all the activity that belongs to that ip = your activity.

If you want a free vpn that doesn't require signing up or anything, google 'ipv6 tunnel broker'. It's in essence a vpn and there's a couple of free providers. It's not advertised as a vpn but that's how it enables you to visit ip6 websites.

Thank you all so much for the flags and comments. I've been gone since last night and wasn't expecting such awesome feedback, you'll definitely get a series out of it. Now, time for some replies!

Originally posted by mileysubet
First off disable SSID broadcasting, that will make it so the "casual Joe" does not even see your wifi network. Rename your wifi to something obscure preferably a random string of alphanumeric characters...make sure to remember these or write OT down somewhere safe. You will need it to connect devices later

The above steps will go along way to securing your connection, but it won't stop determined hacker.

If you want to monitor your wifi activity, download Wireshark (free packet sniffer) an excellent network monitoring tool. The Wireshark web site has a massive amount information on how to use it's program. Play around with it, it is a great and very in depth product.

This is a quality answer. Something to remember with wireless APs: 1) NEVER use anything short of WPA2 for your encryption. WPA2 has dynamic keying which encrypts everything on a per-packet basis. 2) If you're connection is dropping and reliability is low, perhaps you're in a channel conflict with one of your neighbors? Either take a look at what channels are running in your neighborhood or just try a few different ones out. Depending on the version of 802.11 you're running you could only have three clear channels: 1, 6, and 11.

Originally posted by woodnut86
reply to post by badfish420

 

I have to thank you for your time and effort, very much!!!

I haven't read all the replies yet, so i dont know if someone else may of asked this, but is there something similar that can be used for tablets? I currently don't have anything on it security wise. Hope to sort it asap. S+F

What type of tablet are you running? Generally speaking, if it has a hardrive we can encrypt it!

Originally posted by zaintdead
The problem with a vpn is that yes, YOUR isp won't be able to tract your internet usage (IF you make sure dns requests are also going through the tunnel) but the isp on the other end will be able to track your usage just fine.

Only way around that is to have your vpn exit in another country. I live in China and have a vpn exit in California.

I'm not sure where you're coming from here. Yes, the VPN server can't have it's communications encrypted while visiting the internet, but that shouldn't matter. Generally with a VPN server you're connected along with 200 other people and there's no way to differentiate between who requested what page. The only thing an ISP can see is that you have an encrypted session along with many other people to this server, and what pages the server is requesting.

As someone mentioned previously: you are at the mercy of the VPN company of course. This is why it's important to select a reputable dealer or have a private VPN. Most companies won't keep logs, in many cases it's illegal to keep them if you specifically state you aren't in your privacy policy, and it's generally not the biggest concern. This is why I reccommended CyberGhost, they have over a million paying subscribers and do their jobs very well.

Someone asked how secure CyberGhost or another VPN is. Most of the time this is dependent to which server you are connected to. With most companies you have the selection between speed and security, I always pick security. We will take a look at the actual packet encryption later.

Originally posted by Starwise
AWESOME READ!! Thank You!

ONE question though that you may or may not know: When ordering gear and supplies online while using a VPN using a prepaid Visa, and after closing everything and disabling flash, cookies etc.....can't your order address still be in the merchants database? Isn't the Government tracking their info too? Or is that considered off topic? To me they relate because the issue is anonymity and if you can be tracked that way, then what is the point? People talk about purchasing supplies with cash, but that is not always practical when you live out in the country....Any ideas on that would be appreciated.

Yes any data you input to the website is going to be retained on their server, only your computer's whereabouts are being protected. I have spent some time on this issue myself and I do have a few suggestions. The first is a pre-paid credit card if they're available in your area, visa vanilla worked well for a while. I ran into a company who was just opening a few months ago, they offer 100% anonymous prepaid credit cards and atm cards, I will get you that link as soon as I see it. Also, depending on where you're purchasing, try gift cards. I ordered a ton of stuff from Amazon with gift cards anonymously, just need a shipping location.

It's easy for them to see who requested what on a server. Logs would show originating IP address for requests and time stamps... having 200 people connect doesn't gain you any anonymity.

Originally posted by zaintdead
Vpn's are not intended to hide who you are. Even if the vpn provider kept no logs (or yourself if you rent out a linux server for vpn use) the isp that provides internet to the server will probably have logs.

And it doesn't take much coordination between isp's or a 3 letter agency or whoever to simply notice that your computer is always connected to a single ip, therefore all the activity that belongs to that ip = your activity.

If you want a free vpn that doesn't require signing up or anything, google 'ipv6 tunnel broker'. It's in essence a vpn and there's a couple of free providers. It's not advertised as a vpn but that's how it enables you to visit ip6 websites.

edit on 23-1-2012 by zaintdead because: (no reason given)

If you were the owner of that VPN server you could say this is true. Like I mentioned previously, all they can see is an encrypted session. Now, pair that with 200 other people who have encrypted sessions on the same server and I think you've got a strong case of plausible deniability. IPV6 tunneling may achieve close to the same thing in essence but that's not what it was designed for. Ipv6 websites? You usually don't have any idea you're using IPV6, you're likely using it in your cell phone or navigator right now.

I'll say this one more time: You shouldn't care if the remote ISP has logs. All those logs say is that your IP has an encrypted session with that server. Since it's a public server not confined to the use of one person you can't be held responsible for every page that is requested. The remote ISP can't see the pages you're downloading, just an encrypted session. Now couple that with the security of generally keeping VPN servers in non-extradition countries and you've got a pretty strong case for anonymity.

Originally posted by zaintdead
It's easy for them to see who requested what on a server. Logs would show originating IP address for requests and time stamps... having 200 people connect doesn't gain you any anonymity.

On a regular webserver sure. On a VPN server specifically designed for this type of application? No. Short of that company keeping logs, being in the USA, and then being raided: there's no way.

Ok well i have a private server running OpenVpn, with just 2 clients that connect, so in my case ISP logs are a dead giveaway.

For 200 people connecting to it, then yes, the ISP logs are meaningless as they won't point to a specific user of the vpn (unless each was given their own personal ip address by vpn server, which is not likely).

Either way you are screwed, you have a personal vpn with not enough users to make ISP logs useless, but you have control over the server OR you use a commercial vpn in which case you have anonymity in numbers but no control over the server (they might keep logs).

And despite what any vpn provider says, they DO keep logs. How else would they cover their A$$ if someone used their service for pedo material or making bomb threats or terrorists activities etc.

Originally posted by intuitive
thank you will download wireshark then, and i will do the proxy aswell later.

hey i just downloaded wireshark and had a quick moment capturing and stopped it, I have no clue what i see but i have a red line? is this normal? i dont know what to look at, read nor do about it? stuff like thid makes me wanna uninstall at first because i have no idea, lol

edit on 23-1-2012 by intuitive because: (no reason given)

Wireshark is going to show you the packets traversing your network. Since there are a ton of protocols on most networks (local protocols like DNS and HTTP and routing protocols like RIP and EIGRP) you have to select what type of data you are interested in looking for. We do this by going to "Capture" at the top and then "Capture Filters" in the submenu. You'll see the screen below which is where you want to select what type of packets you want to see. Since you're looking for an intruder I would just leave the filters open (select "IP Only") and look for any IP address besides devices I know about. You can find your own IP by going to "start", "run", and then typein "ipconfig" and press enter. Also, you'll need to select an interface within the "capture", "interfaces" screen, just pick your network card (should be obvious).




Now, alternatively you should have a much easier way. I'm assuming you're using a general $50 wireless router? Somewhere physically on the router it will list the default router IP address and admin login. Go to that IP address in your web browser (for many devices it's usually 192.168.1.1... or 192.168.0.1...) and hit enter, log in with the admin details is said on the router. If you look at your menu there will be something along the lines of "connected devices", if not the terminology will likely be "router status". Just click that and view the list of devices that are currently connected to the router. Most idiots who wardrive don't have any clue how to suppress this list, and in many cases it isn't possible to do so without some serious work. Before you log out of the router be sure to change your admin username and password to something other than the default.

As I mentioned in a previous post, never run anything short of WPAv2 with AES encryption. Obviously pick a strong pass key, but most wardriving hacks don't happen by use of brute force. As long as you rotate those pass keys and keep AES running you will be fine.

You do have the option of not broadcasting your SSID like the man said, but this isn't really going to help you at all. Anybody with a wifi sniffer can see your network as soon as one packet traverses the wireless section. This absolutely SHOULD NOT be used in place of a standard security protocol.

Originally posted by zaintdead
Ok well i have a private server running OpenVpn, with just 2 clients that connect, so in my case ISP logs are a dead giveaway.

For 200 people connecting to it, then yes, the ISP logs are meaningless as they won't point to a specific user of the vpn (unless each was given their own personal ip address by vpn server, which is not likely).

Either way you are screwed, you have a personal vpn with not enough users to make ISP logs useless, but you have control over the server OR you use a commercial vpn in which case you have anonymity in numbers but no control over the server (they might keep logs).

Yeah it sucks. This is why I usually just go with a reputable company that offers the service. An option for you would be to daisy chain connections but this can become tough on your delay.

And despite what any vpn provider says, they DO keep logs. How else would they cover their A$$ if someone used their service for pedo material or making bomb threats or terrorists activities etc.

"I'm sorry, we don't retain logs of our user's activity". UltraVPN has a message when you sign up for an account that says "if you use this for hacking you are required to cover your traces". This doesn't say "we're super concerned about what you do" to me. Furthermore, you can simply not connect to a server in an area you aren't comfortable with. VPNs are everywhere. Russia, Costa Rica, Columbia, Bolivia. Do these seem like countries that are going to give half a # about the U.S.'s requests for logs from an internet server?

Ok, now I think I answered all the questions. If I missed someone please forgive me, and thank you all for the awesome comments!

This thread sounds like advertising for their vpn service.

Originally posted by woodnut86
reply to post by badfish420

 

I have to thank you for your time and effort, very much!!!

I haven't read all the replies yet, so i dont know if someone else may of asked this, but is there something similar that can be used for tablets? I currently don't have anything on it security wise. Hope to sort it asap. S+F

Turns out PGP works for tablets. I also found Becrypt which seems up to par. If you can't get either of those working let me know and we'll figure it out. Also, I assume TrueCrypt is compatible but I can't seem to find much documentation. Thanks for the kind words.

Originally posted by bozzchem
Have you used TruCrypt? It is free. Any opinion?

TrueCrypt is a fantastic program! Besides PGP, True Crypt is the best.

Originally posted by zaintdead
This thread sounds like advertising for their vpn service.

edit on 23-1-2012 by zaintdead because: (no reason given)

Yep, because that's the only software I suggested to people. In reality it's the one vpn service I covered (because I like it) so it's being used as a reference point for learners. Move on bro.

reply to post by badfish420
Excellent overview! I have one question: The "shredder" Does this mean if someone tries to access the computer and does not have the password that it will immediately shred all hard-drive data? You say you wrote a shell script. Perhaps you can enlighten us on how to do this ourselves? Meanwhile thanks for the wonderful explanation of anonymity and security! This will be priceless in the coming years (should we all survive 2012) when the govt. tries again and again to track us and hack us! Viva La Revolucion!