Cryptome: Full Disclosure - Internet Dark Age (and Solutions)

Found this on Crytome yesterday and all I can say is it blew my mind. Trying to keep up with the Snowden revelations was hard enough finding out just how intrusive the spying has become downright sickening.

Thankfully the folks at... well they don't have a name but I'm grateful for the work they've put into this document. It's well worth the read and offers solid methods of protection against intrusion as well as highlighting just how badly the free internet has been compromised. First an intro to these folks.

About the Authors
The authors of this document wish to remain anonymous. However we are fully prepared to stand in a court of law and present our evidence.

We are a group of technical engineers, we are not associated with any activists groups whatsoever. We don't have a name, but if we did it would probably be “ The Adversaries ” according to NSA/GCHQ.

Here's the link to the PDF. It's well worth the read and I recommend as many folks download as possible before it disappears or the site goes down again. Full Disclosure PDF

This document is 50 pages long so I will only post one small piece pertaining to it. Solutions to these problems are in the PDF. TOR users take note you are also compromised. Here's some of the attacks it covers:

Internal Network Access
The attacker has direct access to your LAN and is inside your firewall.

Man in the Middle Attack
The attacker controls all outbound routes, he can easily perform an HTTPS Man-In-The-Middle attack by forwarding specific traffic for port 443 or destination network to a dedicated MITM network which he controls.

All SSL Certificates Compromised in Real-Time
The security of Public Key Infrastructure (PKI) is based primarily on the security of the owners private keys. These private keys are not necessarily required in order to perform a MITM attack.

Theft of Private Keys
Home networks are usually very insecure, mainly because only you or family use them, your guard is down and your SSH, VPN, PGP, SSL keys are all vulnerable to theft by the attacker and his available methods.

The Kill Switch
Actual capabilities uncovered here include the actual ability to apply physical censorship on the Internet by governments directed at individuals, groups, companies, entire countries or the majority of the users of the Internet at once

Tor User/Content Discovery
Users of the Tor network can easily be discovered by LAN packet fingerprinting, but also by those who download the Tor client. The attacker can stain packets leaving your network and before entering the Tor network, making traffic analysis much easier than was previously known.

All Tor traffic can be redirected to a dedicated private Tor network controlled by the attacker, in this way the attacker controls ALL Tor nodes and so can see everything you do from end-to-end.

A final word from these engineers as this was documented and tested using UK hardware.

I'm an American, does this apply to me
The NSA would only use this technique in the U.S. if they really thought they could go undetected. In the UK they have gone undetected until now ( since 2011, as evidenced by the date of the firmware ), you should assume that the U.S. is doing the same to all Americans and you should use the defenses as detailed herein as a precaution. We can turn off the lights ourselves.

Cryptome Website

reply to post by Bassago


Great thread, already DL'd.
S+F and a round of applause!!

reply to post by Bassago


your computer was probably compromised when you read the document.

PDF files can contain virus's.

reply to post by PhoenixOD


Maybe so, I've used the latest A/V scans. That's all I can do.

The data in the file was well worth the risk IMO. From what I see the biggest threats are form the actual ISP routers and modems. Once the NSA has their hooks into them you're pretty well finished. The doc shows you how to overcome those attacks, both inbound and outbound.

Bassago
reply to post by PhoenixOD

 

Maybe so, I've used the latest A/V scans. That's all I can do.

The data in the file was well worth the risk IMO. From what I see the biggest threats are form the actual ISP routers and modems. Once the NSA has their hooks into them you're pretty well finished. The doc shows you how to overcome those attacks, both inbound and outbound.

With my history of comments online, I would say the hooks are already very much inside my computer.

I thought my tin hat would keep me safe. It appears I was mislead.

*crumples up tin hat and throws it in the bin, cursing technology*

reply to post by OneManArmy


Which is why this information is important. It show's you directly how you can be attacked as well as how to resolve this problems.

I use a few of these methods already such as spoofed MAC addresses, non-ISP routers and additional locked down firewalls. Not saying this makes you completely safe but knowing the problems (exactly) is a good step to resolving them. And these guys did all the heavy lifting for us.

reply to post by Bassago


I think, the SPY!'n has gotten way out of control too. I also believe that it's gotten so widespread that it will be difficult to eliminate it.

I think Spy-Tools are possibly (most likely?) hidden in the later versions of the major operating systems, anti-virus software (key-loggers, screen-captures, audio/video) and possibly in major encryption programs ( because encryption can work) as back-doors to make decryption easier.

Where's the profit? I don't think there is a profit. I think the majority of these spying efforts and the money it takes to keep them going are being wasted. Wasted? ... a drain on societies where governments have to either TAX or continue Printing NEW MONEY (a devaluation of existing money) to keep it all runninng AND with little ( or NO ) monetary profit or return on investment.

I don't think it's any different from paying for a war without any spoils/profit !!!

< < < The "profit" part ( or lack there of ) is the part that has me irritated the most. > > >

There are now so many federal rules and regulations that you can't even breath without being charged some sort of TAX. I have it so bad that many mornings I wake up and my 1st thought is: "Well there goes another 100 bucks!".

A search engine that I only recently discovered is StartPage.com. They explain their service on their Privacy Page.

To really END this Dead-End Endeavor is to demonstrate the Futility of its current Magnitude.

I could go on and on and on ...