DOCSLIB.ORG

Complete SIP Message Obfuscation: Privasip Over Tor

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Complete SIP Message Obfuscation: Privasip Over Tor Complete SIP message obfuscation: PrivaSIP over Tor Georgios Karopoulos Alexandros Fakis Institute for the Protection and Dept. of Information and Security of the Citizen Communication Systems Engineering Joint Research Centre University of the Aegean [email protected] [email protected] Georgios Kambourakis Dept. of Information and Communication Systems Engineering University of the Aegean [email protected] Abstract 1 Introduction The demand for private communications is high Anonymity on SIP signaling can be achieved either by among businesses, activists, journalists, military, and the construction of a lower level tunnel (via the use of law enforcement [1]. Nowadays, telecommunication SSL or IPSec protocols) or by employing a custom- providers increasingly shift their business model to- tailored solution. Unfortunately, the former category wards Voice over IP (VoIP) communications which are of solutions present significant impediments including more flexible and inexpensive, but with more security the requirement for a PKI and the hop-by-hop fash- and privacy issues compared to traditional communica- ioned protection, while the latter only concentrate on tions. One of the most prominent protocols support- the application layer, thus neglecting sensitive informa- ing multimedia services is the Session Initiation Proto- tion leaking from lower layers. col (SIP) [2], which is an application layer, text-based, To remediate this problem, in the context of this pa- signaling protocol responsible for session management. per, we employ the well-known Tor anonymity system Despite its popularity, SIP still suffers from privacy is- to achieve complete SIP traffic obfuscation from an at- sues, two of the most notable of which are (a) user iden- tacker’s standpoint. Specifically, we capitalize on Tor tity, and (b) IP address disclosure. Since SIP signaling for preserving anonymity on network links that are con- messages are in plaintext, an eavesdropper can acquire sidered mostly untrusted, i.e., those among SIP prox- sensitive data such as: communicating parties’ names ies and the one between the last proxy in the chain and and affiliations, IP addresses and hostnames, and SIP the callee. We also, combine this Tor-powered solution Uniform Resource Identifiers (URIs). The SIP header with PrivaSIP to achieve an even greater level of pro- fields that reveal these details are mainly From, To, tection. By employing PrivaSIP we assure that: (a) the Contact, and Call-ID. An example of a SIP mes- DRAFTsage header format is presented in Table 1; here some first hop in the path (i.e., between the caller and the out- bound proxy) affords anonymity, (b) the callee does not data like branch and tag values were omitted for know the real identity of the caller, and (c) no real iden- readability. tities of both the caller and the callee are stored in log Apart from SIP signaling messages, the architecture files. We also evaluate this scheme in terms of perfor- of the protocol per se is also another source of problems. mance and show that even in the worst case, the latency That is, SIP can be employed in either client/server or introduced is not so high as it might be expected due to Peer-to-Peer (P2P) architectures; in both cases the par- the use of Tor. ticipation of intermediary servers complicates the pri- 1 cation. Tunneling of the UDP traffic through Tor does Table 1: SIP message header format not really solve this issue because the traffic would be INVITE sip:[email protected] SIP/2.0 encapsulated in TCP. The latency induced by Tor is also Via: SIP/2.0/UDP pc8.agn.org;branch=... known to be quite heavy as the system relays and mixes Max-Forwards: 70 its traffic via multiple nodes. To: Al <sip:[email protected]> In this context, the paper at hand attempts to answer From: Geo <sip:[email protected]>;tag=... two basic questions: Is SIP over Tor affordable in terms Call-ID: [email protected] of service time? And if so, to which network hops CSeq: 314159 INVITE should be preferably Tor activated in order to achieve Contact: <sip:[email protected]> a fair balance between the level of anonymity and the Content-Type: application/sdp Content-Length: 142 time penalty introduced? Also, what is the additional delay if one considers to even anonymize network links that cannot be covered by Tor (think of the first hop between the caller and the outbound SIP proxy or the vacy problem. Previous work on these issues [3, 4] has registrar). shown that several header fields can provide private data To shed light on the aforementioned questions we im- to eavesdroppers. While for some data privacy protec- plement a proof-of-concept SIP over Tor system and tion is straightforward if the user selects not to provide conduct measurements to assess its performance in them, other header data cannot be omitted since they are terms of service times. Also, we combine this sys- needed for the correct routing of SIP messages to their tem with a purely application layer anonymization so- final destination. lution for SIP to make a decision whether an end-to-end Ideally, any complete anonymity solution for SIP preservation of anonymity is affordable. The results we should be designed and provided in a cross-layer man- obtained seem quite promising showing a latency in the ner. That is, while SIP operates at the application layer, vicinity of 2 secs across all scenarios. It should be noted several other sensitive information regarding its signal- here that our solution, as well as the aforementioned de- ing inevitably leak from lower layers. For example, lay, concerns SIP signaling only; thus, media protection while it is possible to conceal the IDs of the communi- should be considered separately. cating parties by applying, say, a pseudonymity scheme As discussed in a following section, previous work to Via and From headers, the IP addresses of both ends in the same topic is fragmentary and has only touched are available to an observer by just tracking the headers upon these issues not considering SIP at all. Therefore, of the IP packets conveying SIP messages. to our knowledge, this is the first work that elucidates on This fact motivated us to think of taking advantage the foregoing issues and provides real results that can be of the services of a generic anonymization system with used as a reference towards building truly anonymous the aim to apply an holistic anonymity solution for SIP. VoIP systems. On the one hand, such a solution seems promising as The rest of this paper is structured as follows. The anonymization systems like Tor [5] are self-reliant, i.e., next section briefly covers PrivaSIP [6, 7], an applica- normally their operation does not hinge on the pro- tion layer solution to preserve anonymity in SIP. Sec- tocols of upper layers, hence they can be straightfor- tion 3 offers a basic background on Tor operation. The wardly combined with them. Moreover, as discussed joint operation of Tor with PrivaSIP to achieve a high further in Section 4.3, such a system is able to protect level of user anonymity is addressed in Section 4. Sec- SIP signaling from a plethora of other type of attacks tion 5 reports on the experimental testbed, the scenar- including timing and collusionDRAFT ones. However, on the ios, and the results we obtained when running PrivaSIP negative side, taking Tor as an example, the problem over Tor. The last section concludes the paper and gives with SIP is that currently Tor only supports TCP for pointers to future work. its transport layer. As a result, although RFC 3261 [2] requires all SIP entities to mandatory implement both UDP and TCP, many real-world VoIP applications rely 2 PrivaSIP solely on UDP for latency reasons. So, at least for the time being, this is a serious impediment for VoIP users In the search of ways for establishing a system that to enjoy strong anonymity to real-time voice communi- would protect SIP end-users’ privacy, we chose Pri- 2 vaSIP [6, 7], an identity protection framework for SIP. Proxy share a password, which is used for Digest au- An alternative method could be [8], which was pub- thentication, this password can also be used as a key lished after we finished our work and we did not had (or as a key seed or master key) for the encryption of the time to evaluate it. the user ID with AES. PrivaSIP-RSA uses the Caller PrivaSIP is an application-layer protocol, whose Proxy’s and the Callee Proxy’s public keys to encrypt main idea is that each end-user’s real ID should be in- the caller user ID and Digest username, and the callee dividually encrypted in a way that it can be recovered user ID respectively. PrivaSIP-ECIES works in a simi- only by entities that need to do so in order for SIP pro- lar way with the difference of using Elliptic Curve cryp- tocol to operate correctly. In this way, untrusted proxies tography. or malicious users performing traffic analysis, will not The cost that comes along with PrivaSIP is negligi- be able to eavesdrop or even recover from the corre- ble concerning the privacy features offered, when sym- sponding ciphertext the real ID of the user. This way, metric cryptography is used. Nonetheless, as argued a basic level of unlinkability (of SIP transactions made in [6, 7], a user may perceive a latency ranging between by the same user in the course of time) can be retained 0.5 to 2 secs for the first SIP message when asymmetric as well.
Load more

Recommended publications
  • Uila Supported Apps
    Uila Supported Applications and Protocols updated Oct 2020 Application/Protocol Name Full Description 01net.com 01net website, a French high-tech news site. 050 plus is a Japanese embedded smartphone application dedicated to 050 plus audio-conferencing. 0zz0.com 0zz0 is an online solution to store, send and share files 10050.net China Railcom group web portal. This protocol plug-in classifies the http traffic to the host 10086.cn. It also 10086.cn classifies the ssl traffic to the Common Name 10086.cn. 104.com Web site dedicated to job research. 1111.com.tw Website dedicated to job research in Taiwan. 114la.com Chinese web portal operated by YLMF Computer Technology Co. Chinese cloud storing system of the 115 website. It is operated by YLMF 115.com Computer Technology Co. 118114.cn Chinese booking and reservation portal. 11st.co.kr Korean shopping website 11st. It is operated by SK Planet Co. 1337x.org Bittorrent tracker search engine 139mail 139mail is a chinese webmail powered by China Mobile. 15min.lt Lithuanian news portal Chinese web portal 163. It is operated by NetEase, a company which 163.com pioneered the development of Internet in China. 17173.com Website distributing Chinese games. 17u.com Chinese online travel booking website. 20 minutes is a free, daily newspaper available in France, Spain and 20minutes Switzerland. This plugin classifies websites. 24h.com.vn Vietnamese news portal 24ora.com Aruban news portal 24sata.hr Croatian news portal 24SevenOffice 24SevenOffice is a web-based Enterprise resource planning (ERP) systems. 24ur.com Slovenian news portal 2ch.net Japanese adult videos web site 2Shared 2shared is an online space for sharing and storage.
    [Show full text]
  • The Handshake - Establishing Secure Connections Over Insecure Channels
    Lecture 13: The handshake - establishing secure connections over insecure channels Boaz Barak We’ve now compiled all the tools that are needed for the basic goal of cryptography (which is still being subverted quite often) allowing Alice and Bob to exchange messages assuring their integrity and confidentiality over a channel that is observed or controlled by an adversary. Our tools for achieving this goal are: • Public key (aka assymetric) encryption schemes. • Public key (aka assymetric) digital signatures schemes. • Private key (aka symmetric) encryption schemes - block ciphers and stream ciphers. • Private key (aka symmetric) message authentication codes and psedoran- dom functions. • Hash functions that are used both as ways to compress messages for authentication as well as key derivation and other tasks. The notions of security we require from these building blocks can vary as well. For encryption schemes we talk about CPA (chosen plaintext attack) and CCA (chosen ciphertext attacks), for hash functions we talk about collision-resistance, being used (combined with keys) as pseudorandom functions, and then sometimes we simply model those as random oracles. Also, all of those tools require access to a source of randomness, and here we use hash functions as well for entropy extraction. Cryptography’s obsession with adjectives. As we learn more and more cryptography we see more and more adjectives, every notion seems to have modifiers such as “non malleable”, “leakage-resilient”, “identity based”, “concurrently secure”, “adaptive”, “non-interactive”, etc.. etc. Indeed, this motivated a parody web page of an automatic crypto paper title generator. Unlike algorithms, where typically there are straightforward quantitative tradeoffs (e.g., faster is better), in cryptography there are many qualitative ways protocols can vary based on the assumptions they operate under and the notions of security they provide.
    [Show full text]
  • Wiretapping End-To-End Encrypted Voip Calls Real-World Attacks on ZRTP
    Institute of Operating Systems and Computer Networks Wiretapping End-to-End Encrypted VoIP Calls Real-World Attacks on ZRTP Dominik Schürmann, Fabian Kabus, Gregor Hildermeier, Lars Wolf, 2017-07-18 wiretapping difficulty End-to-End Encryption SIP + DTLS-SRTP (SIP + Datagram Transport Layer Security-SRTP) End-to-End Encryption & Authentication SIP + SRTP + ZRTP Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time Transport Protocol) 2017-07-18 Dominik Schürmann Wiretapping End-to-End Encrypted VoIP Calls Page 2 of 13 wiretapping difficulty End-to-End Encryption & Authentication SIP + SRTP + ZRTP Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time Transport Protocol) End-to-End Encryption SIP + DTLS-SRTP (SIP + Datagram Transport Layer Security-SRTP) 2017-07-18 Dominik Schürmann Wiretapping End-to-End Encrypted VoIP Calls Page 2 of 13 wiretapping difficulty Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time
    [Show full text]
  • AUTHENTICATION TECHNIQUES for HETEROGENEOUS TELEPHONE NETWORKS by BRADLEY GALLOWAY REAVES a DISSERTATION PRESENTED to the GRADUA
    AUTHENTICATION TECHNIQUES FOR HETEROGENEOUS TELEPHONE NETWORKS By BRADLEY GALLOWAY REAVES A DISSERTATION PRESENTED TO THE GRADUATE SCHOOL OF THE UNIVERSITY OF FLORIDA IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY UNIVERSITY OF FLORIDA 2017 © 2017 Bradley Galloway Reaves For Sarah ACKNOWLEDGMENTS Iamonlywritingthistodaybecauseofthemultitudeoffamily,friends,teachers,and colleagues who helped get me here. This journey began in high school, when Mrs. Reid, my English teacher, suggested that I would make a good college professor. I wasn’t sure about the idea until my second programming class in college. I loved programming, so I would do the lab assignments at home, then show up in the lab to demonstrate the project to the TA. My work for the week was done, but I didn’t leave the lab. Instead, I stayed for the next few hours helping other students when they needed help with the programming assignments. It became the best part of my week, and I realized that there was no career I wanted more than to be a professor of computing. Having a goal and knowing what it takes to achieve it are two very di↵erent things. At the time I knew I needed a PhD, but nothing of what it took to get one. Luckily, I had wonderfully supportive professors and advisors who told me what it took, and one in particular helped me take the first steps toward a research career. Tommy Morris was a new professor at Mississippi State, and after teaching my digital design class o↵ered me a (paid!) position in his research lab.
    [Show full text]
  • Analysis of Effect of Zfone Security on Video Call Service in Wireless Local Area Network
    International Journal of Computer Techniques -– Volume 6 Issue 6,November 2019 ANALYSIS OF EFFECT OF ZFONE SECURITY ON VIDEO CALL SERVICE IN WIRELESS LOCAL AREA NETWORK Arip Solehudin 1 Bayu Priyatna 2 Nono Heryana 3 Teknik Informatika Fakultas Ilmu Komputer School of Engineering and Computer Science Sistem Informasi Fakultas Ilmu Komputer Universitas Singaperbangsa Karawang Universitas Buana Perjuangan Karawang Universitas Singaperbangsa Karawang Karawang, Indonesia Karawang, Indonesia Karawang, Indonesia [email protected] [email protected] [email protected] Abstract—Along with the development of WLAN (Wireless VoIP LAN that uses cable began to move using wireless Local Area Network) network technology, many services that network technology, namely wireless. The use of wireless used cable networks began to migrate to wireless networks. networks as a medium for the flow of data makes VoIP VoIP (Voice over Internet Protocol) is one service implemented services can be used in several communication technology in wireless local area networks. However, VoIP that uses tools such as personal computers, laptops, and smartphones. wireless technology as a data stream media Video Call service has a high risk of tapping pictures. To avoid tapping pictures, The use of VoIP technology that is implemented on you can add a security system to the service, one of which is to WLAN networks with video call services found in VoIP use Zfone security. With him adding a security system that will facilities is an excellent solution for conducting influence the work of Video Call services on the quality of conversations at affordable costs compared to the VoIP service.
    [Show full text]
  • Zfone: a New Approach for Securing Voip Communication
    Zfone: A New Approach for Securing VoIP Communication Samuel Sotillo [email protected] ICTN 4040 Spring 2006 Abstract This paper reviews some security challenges currently faced by VoIP systems as well as their potential solutions. Particularly, it focuses on Zfone, a vendor-neutral security solution developed by PGP’s creator, Phil Zimmermann. Zfone is based on the Z Real-time Transport Protocol (ZRTP), which is an extension of the Real-time Transport Protocol (RTP). ZRTP offers a very simple and robust approach to providing protection against the most common type of VoIP threats. Basically, the protocol offers a mechanism to guarantee high entropy in a Diffie- Hellman key exchange by using a session key that is computed through the hashing several secrets, including a short authentication string that is read aloud by callers. The common shared secret is calculated and used only for one session at a time. However, the protocol allows for a part of the shared secret to be cached for future sessions. The mechanism provides for protection for man-in-the-middle, call hijack, spoofing, and other common types of attacks. Also, this paper explores the fact that VoIP security is a very complicated issue and that the technology is far from being inherently insecure as many people usually claim. Introduction Voice over IP (VoIP) is transforming the telecommunication industry. It offers multiple opportunities such as lower call fees, convergence of voice and data networks, simplification of deployment, and greater integration with multiple applications that offer enhanced multimedia functionality [1]. However, notwithstanding all these technological and economic opportunities, VoIP also brings up new challenges.
    [Show full text]
  • Opus, a Free, High-Quality Speech and Audio Codec
    Opus, a free, high-quality speech and audio codec Jean-Marc Valin, Koen Vos, Timothy B. Terriberry, Gregory Maxwell 29 January 2014 Xiph.Org & Mozilla What is Opus? ● New highly-flexible speech and audio codec – Works for most audio applications ● Completely free – Royalty-free licensing – Open-source implementation ● IETF RFC 6716 (Sep. 2012) Xiph.Org & Mozilla Why a New Audio Codec? http://xkcd.com/927/ http://imgs.xkcd.com/comics/standards.png Xiph.Org & Mozilla Why Should You Care? ● Best-in-class performance within a wide range of bitrates and applications ● Adaptability to varying network conditions ● Will be deployed as part of WebRTC ● No licensing costs ● No incompatible flavours Xiph.Org & Mozilla History ● Jan. 2007: SILK project started at Skype ● Nov. 2007: CELT project started ● Mar. 2009: Skype asks IETF to create a WG ● Feb. 2010: WG created ● Jul. 2010: First prototype of SILK+CELT codec ● Dec 2011: Opus surpasses Vorbis and AAC ● Sep. 2012: Opus becomes RFC 6716 ● Dec. 2013: Version 1.1 of libopus released Xiph.Org & Mozilla Applications and Standards (2010) Application Codec VoIP with PSTN AMR-NB Wideband VoIP/videoconference AMR-WB High-quality videoconference G.719 Low-bitrate music streaming HE-AAC High-quality music streaming AAC-LC Low-delay broadcast AAC-ELD Network music performance Xiph.Org & Mozilla Applications and Standards (2013) Application Codec VoIP with PSTN Opus Wideband VoIP/videoconference Opus High-quality videoconference Opus Low-bitrate music streaming Opus High-quality music streaming Opus Low-delay
    [Show full text]
  • How to Use Encryption and Privacy Tools to Evade Corporate Espionage
    How to use Encryption and Privacy Tools to Evade Corporate Espionage An ICIT White Paper Institute for Critical Infrastructure Technology August 2015 NOTICE: The recommendations contained in this white paper are not intended as standards for federal agencies or the legislative community, nor as replacements for enterprise-wide security strategies, frameworks and technologies. This white paper is written primarily for individuals (i.e. lawyers, CEOs, investment bankers, etc.) who are high risk targets of corporate espionage attacks. The information contained within this briefing is to be used for legal purposes only. ICIT does not condone the application of these strategies for illegal activity. Before using any of these strategies the reader is advised to consult an encryption professional. ICIT shall not be liable for the outcomes of any of the applications used by the reader that are mentioned in this brief. This document is for information purposes only. It is imperative that the reader hires skilled professionals for their cybersecurity needs. The Institute is available to provide encryption and privacy training to protect your organization’s sensitive data. To learn more about this offering, contact information can be found on page 41 of this brief. Not long ago it was speculated that the leading world economic and political powers were engaged in a cyber arms race; that the world is witnessing a cyber resource buildup of Cold War proportions. The implied threat in that assessment is close, but it misses the mark by at least half. The threat is much greater than you can imagine. We have passed the escalation phase and have engaged directly into full confrontation in the cyberwar.
    [Show full text]
  • Pgpfone Pretty Good Privacy Phone Owner’S Manual Version 1.0 Beta 7 -- 8 July 1996
    Phil’s Pretty Good Software Presents... PGPfone Pretty Good Privacy Phone Owner’s Manual Version 1.0 beta 7 -- 8 July 1996 Philip R. Zimmermann PGPfone Owner’s Manual PGPfone Owner’s Manual is written by Philip R. Zimmermann, and is (c) Copyright 1995-1996 Pretty Good Privacy Inc. All rights reserved. Pretty Good Privacy™, PGP®, Pretty Good Privacy Phone™, and PGPfone™ are all trademarks of Pretty Good Privacy Inc. Export of this software may be restricted by the U.S. government. PGPfone software is (c) Copyright 1995-1996 Pretty Good Privacy Inc. All rights reserved. Phil’s Pretty Good engineering team: PGPfone for the Apple Macintosh and Windows written mainly by Will Price. Phil Zimmermann: Overall application design, cryptographic and key management protocols, call setup negotiation, and, of course, the manual. Will Price: Overall application design. He persuaded the rest of the team to abandon the original DOS command-line approach and designed a multithreaded event-driven GUI architecture. Also greatly improved call setup protocols. Chris Hall: Did early work on call setup protocols and cryptographic and key management protocols, and did the first port to Windows. Colin Plumb: Cryptographic and key management protocols, call setup negotiation, and the fast multiprecision integer math package. Jeff Sorensen: Speech compression. Will Kinney: Optimization of GSM speech compression code. Kelly MacInnis: Early debugging of the Win95 version. Patrick Juola: Computational linguistic research for biometric word list. -2- PGPfone Owner’s
    [Show full text]
  • Implementing an Ipv6 Moving Target Defense on a Live Network
    Implementing an IPv6 Moving Target Defense on a Live Network Matthew Dunlop∗†, Stephen Groat∗†, Randy Marchanyy, Joseph Tront∗ ∗Bradley Department of Electrical and Computer Engineering yVirginia Tech Information Technology Security Laboratory Virginia Tech, Blacksburg, VA 24061, USA Email: fdunlop,sgroat,marchany,[email protected] Abstract The goal of our research is to protect sensitive communications, which are commonly used by government agencies, from eavesdroppers or social engineers. In prior work, we investigated the privacy implications of stateless and stateful address autoconfiguration in the Internet Protocol version 6 (IPv6). Autoconfigured addresses, the default addressing system in IPv6, provide a third party a means to track and monitor targeted users globally using simple tools such as ping and traceroute. Dynamic Host Configuration Protocol for IPv6 (DHCPv6) addresses contain a static DHCP Unique Identifier (DUID) that can be used to track and tie a stateless address to a host identity. Our research focuses on preventing the issue of IPv6 address tracking as well as creating a \moving target defense." The Moving Target IPv6 Defense (MT6D) dynamically hides network and transport layer addresses of packets in IPv6 to achieve anonymity and protect against certain classes of network attacks. Packets are encrypted to prevent traffic correlation, which provides significantly improved anonymity. MT6D has numerous applications ranging from hosts desiring to keep their locations private to hosts conducting sensitive communications. This paper explores the results of implementing a proof of concept MT6D prototype on a live IPv6 network. 1 Introduction More networks are deploying the Internet Protocol version 6 (IPv6) due to the lack of available addresses in the Internet Protocol version 4 (IPv4).
    [Show full text]
  • PGP® Desktop for Windows User's Guide
    October 2003 PGP® Desktop for Windows User’s Guide Version Information PGP Desktop for Windows User’s Guide, version 8.0.3. Released October, 2003. Copyright Information Copyright © 1991–2003 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, with- out the express written permission of PGP Corporation. Trademark Information PGP and Pretty Good Privacy are registered trademarks, and the PGP logo is a trademark, of PGP Corpo- ration in the U.S. and other countries. IDEA is a trademark of Ascom Tech AG. All other registered and unregistered trademarks in this document are the sole property of their respective owners. Licensing and Patent Information The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST encryption algorithm is licensed from Northern Telecom, Ltd. PGP Corporation may have patents and/or pending patent applications covering subject matter in this software or its documenta- tion; the furnishing of this software or documentation does not give you any license to these patents. Acknowledgments The compression code in PGP Desktop is by Mark Adler and Jean-Loup Gailly, used with permission from the free Info-ZIP implementation. Export Information Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau of Export Administration, United States Department of Commerce, which restrict the export and re-export of certain products and technical data.
    [Show full text]
  • Online Security for Independent Media and Civil Society Activists
    Online Security for Independent Media and Civil Society Activists A white paper for SIDA’s October 2010 “Exile Media” conference Eric S Johnson (updated 13 Oct 2013) For activists who make it a priority to deliver news to citizens of countries which try to control the information to which their citizens have access, the internet has provided massive new opportunities. But those countries’ governments also realise ICTs’ potential and implement countermeasures to impede the delivery of independent news via the internet. This paper covers what exile media can or should do to protect itself, addressing three categories of issues: common computer security precautions, defense against targeted attacks, and circumventing cybercensorship, with a final note about overkill (aka FUD: fear, uncertainty, doubt). For each of the issues mentioned below, specific ex- amples from within the human rights or freedom of expression world can be provided where non-observance was cata- strophic, but most of those who suffered problems would rather not be named. [NB Snowden- gate changed little or nothing about these recommendations.] Common computer security: The best defense is a good … (aka “lock your doors”) The main threats to exile media’s successful use of ICTs—and solutions—are the same as for any other computer user: 1) Ensure all software automatically patches itself regularly against newly-discovered secu- rity flaws (e.g. to maintain up-to-date SSL certificate revocation lists). As with antivirus software, this may cost something; e.g. with Microsoft (Windows and Office), it may re- quire your software be legally purchased (or use the WSUS Offline Update tool, which helps in low-bandwidth environments).
    [Show full text]