CPSC 257: Information Security in the Real World Ewa Syta April 28, 2016 CPSC 257 April 28, 2016 1 / 48 1 Attacks on Anonymity 2 Tools for Secure Communication CPSC 257 Outline April 28, 2016 2 / 48 Announcement Final Exam Friday, May 6 at 9am, WLH 207 Final Exam Review Session Tuesday, May 3 at 2:30pm, WLH 208 CPSC 257 Outline April 28, 2016 3 / 48 Announcement Final Exam Lectures 13-24 and all major concepts covered in class CPSC 257 Outline April 28, 2016 4 / 48 Announcement Peer Tutors Office Hours (reading period) Monday and Wednesday, 2-5pm CPSC 257 Outline April 28, 2016 5 / 48 Attacks on Anonymity CPSC 257 Attacks on Anonymity April 28, 2016 6 / 48 Staining Attack An active attack that leaves behind evidence: higher risk but better payoff. • Web Cookies • Web Trackers • Flash Cookies • Web Beacons • Header enrichments • Zombie Cookies CPSC 257 Attacks on Anonymity April 28, 2016 7 / 48 Web cookie Source: Wikipedia:HTTP Cookie Web cookie - (HTTP cookie), a piece of data sent from a website and stored within a browser. • Meant to make browsers stateful (e.g., remember preferences, authentication, items in a shopping cart). CPSC 257 Attacks on Anonymity April 28, 2016 8 / 48 Web tracker Source: The Murky World of Third Party Web Tracking, MIT Review Web tracker - (third-party cookie), a piece of data sent from a website other than the one user is connecting to. • First-party cookies vs. Third-party cookies • Allow to track users across multiple websites • Advertising purposes You can control the use of cookies by adjusting your browser's privacy settings. CPSC 257 Attacks on Anonymity April 28, 2016 9 / 48 Flash cookie Source: Wikipedia: LSO Flash cookie - (Local Shared Object), a piece of data that websites which use Adobe Flash may store on a user's computer. • Stored outside the browser. • Used to store settings for games, videos, etc. • Only in 2011 functionality added to allow browsers to manage LSOs. CPSC 257 Attacks on Anonymity April 28, 2016 10 / 48 Web beacon Source:Wikipedia: Web beacon Web beacon - an object embedded in a web page or email, which unobtrusively (usually invisibly) allows checking that a user has accessed the content. • Transparent image (usually 1 pixel x 1 pixel) that is placed on a site or in an email. • Typically used by third parties to monitor the activity of customers at a site. CPSC 257 Attacks on Anonymity April 28, 2016 11 / 48 Header enrichment Source: Does your phone company track you? Arstechnica HTTP Header enrichment - adds information such as the Mobile Subscriber ISDN (MS-ISDN) number to HTTP headers on mobile devices. • Tracking on mobile devices if difficult. • Applications • Attribution of network resources, performance enhancement, analytics, advertising. • Added info visible to everyone. • You have no control over it. Unless you use HTTPS. Zombie cookie - an HTTP cookie that is recreated after deletion.1 1 Verizon's zombie cookie gets new life. Arstechnica. 10/2015 CPSC 257 Attacks on Anonymity April 28, 2016 12 / 48 Examples https://panopticlick.eff.org/ Ghostery Lightbeam CPSC 257 Attacks on Anonymity April 28, 2016 13 / 48 Staining and Fingerprinting Attacks Both attacks have serious implications not only for anonymity, but also privacy. Routinely used in tracking web users, targeted advertising but also for more adversarial purposes. CPSC 257 Attacks on Anonymity April 28, 2016 14 / 48 Privacy Policy Wikipedia: Privacy Policy Privacy policy is a statement or a legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Most websites publish them. No one reads them. TL;DR: \We collect everything. We use it as we see fit”. Google Privacy Policy: http://www.google.com/intl/en/policies/privacy/ CPSC 257 Attacks on Anonymity April 28, 2016 15 / 48 Real-world attack against anonymity: NSA vs Tor CPSC 257 Attacks on Anonymity April 28, 2016 16 / 48 NSA about Tor23 \Tor stinks." \Very Secure." \Still the King of high secure, low latency Internet Anonymity. There are no contenders for the throne in waiting." \We will never be able to de-anonymize all Tor users all the time. With manual analysis we can de-anonymize a very small fraction of Tor users, however, no success de-anonymizing a user (...) on demand." 2 Tor: 'The king of high-secure, low-latency anonymity'. The Guardian. 10/2013 3 'Peeling back the layers of Tor with EgotisticalGiraffe’. The Guardian. 10/2013 CPSC 257 Attacks on Anonymity April 28, 2016 17 / 48 Peeling back the layers of Tor with EGOTISTICALGIRAFFE3 Based on what we know, NSA cannot de-anonymize users by breaking the core Tor protocol. Instead, they target software vulnerabilities in Firefox that the Tor Browser is built upon. NSA actively searches for and exploits vulnerabilities \around" Tor. CPSC 257 Attacks on Anonymity April 28, 2016 18 / 48 QUANTUM4 QUANTUM - NSA's program to insert packets from the Internet backbone. • Quantum servers are at key places on the Internet backbone. • They can react faster than other servers. • Leaked NSA slides showed a Quantum server impersonating Google. 4 How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID, Bruce Schneier, 10/2013 CPSC 257 Attacks on Anonymity April 28, 2016 19 / 48 Man-on-the-side Attack Man-on-the-side attack - an adversary reads the traffic and inserts new messages, but does not modify or delete messages sent by other participants. • Relies on a timing advantage so that the attacker's response reaches the victim before the legitimate response. • The client uses the first response he receives. CPSC 257 Attacks on Anonymity April 28, 2016 20 / 48 FOXACID4 FOXACID - NSA codename for an Internet-enabled system capable of attacking target computers in a variety of ways. • FoxAcid servers are accessible using regular domain names. • If visited using a personalized url, a FoxAcid tag, the server attempts to infect that browser and the computer. • FRUGALSHOT are severs that handle call backs from infected machines and provide further instructions (e.g., upload data, location). CPSC 257 Attacks on Anonymity April 28, 2016 21 / 48 NSA's 6 Step Attack on Tor Users56 1 Scan Internet traffic. Use \upstream" data collection programs. 2 Mark Tor requests using fingerprinting techniques. Use XKeyscore to do so. 3 Sift out marked traffic. All Tor users look alike so it is easy to tell them apart from non-Tor users. 5 How the NSA identifies Tor users in 6 easy steps , DailyDot. 10/2013 6 Our Government Has Weaponized the Internet. Here's How They Did It, Wired. 11/2013 CPSC 257 Attacks on Anonymity April 28, 2016 22 / 48 NSA's 6 Step Attack on Tor Users 4 Send users to NSA servers. Use Quantum to re-direct targets to FoxAcid servers pretending to be the legitimate server that the Tor user is trying to access. 5 Attack users' computers. Use FoxAcid servers to deliver exploits. 6 Identify Tor users. After obtaining access to the target computer, it is easy to identify the user based on email accounts accessed from the same computer, stored information, etc. CPSC 257 Attacks on Anonymity April 28, 2016 23 / 48 Freedom Hosting7 & Silk Road Freedom Hosting, a provider of anonymous hosting and Silk Road, a black market website, were both operated as Tor hidden services. Both were shut down by FBI. • In 2013, all sites hosted by Freedom Hosting began serving an error message with hidden code embedded into the page. • It was an exploit leveraging a security hole in Firefox to identify Tor users by reporting back the user's IP to a server in Northern Virginia. • Later, FBI admitted it was behind this mass malware attack. 7 FBI Admits It Controlled Tor Servers Behind Mass Malware Attack. K. Poulsen. Wired. 9/2013 CPSC 257 Attacks on Anonymity April 28, 2016 24 / 48 Additional Resources • The Tor Project, https://www.torproject.org/ • Tor Browser • How Tor works? by Artist Molly Crabapple and Writer John Leavitt https://www.eff.org/whatistor • EFF on NSA Spying on Americans https://www.eff.org/nsa-spying • The definitive guide to NSA spy programs http://www.dailydot.com/politics/nsa-spy-prgrams-prism-fairview-blarney/ CPSC 257 Attacks on Anonymity April 28, 2016 25 / 48 Tools for Secure Communication CPSC 257 Tools for Secure Communication April 28, 2016 26 / 48 What is secure communication? Source: Wikipedia:Secure Communication Secure communication is often thought of as preventing unauthorized access to information authorized parties are exchanging while being in distinct physical locations. Secure communication on the Internet tries to mimic a private face-to-face conversation. • You know who you are talking to. • No one else knows what you are talking about. • Often there is no proof the conversation took place. CPSC 257 Tools for Secure Communication April 28, 2016 27 / 48 Goals of secure communication Authentication • Verifying the parties to a communication. Confidentiality and integrity • Hiding and protecting the content of a communication. Anonymity • Hiding the parties to a communication. Deniability • Hiding the fact that a communication takes place. Availability • Allowing a communication to take place. CPSC 257 Tools for Secure Communication April 28, 2016 28 / 48 Tools for secure communication • Secure email: OpenPGP, Hush Mail (and similar) • Secure/anonymous communication: Tor Browser • Secure search: DuckDuckGo, Disconnect.me, StartPage • Secure messaging: OTR; Signal and similar apps. • Secure file transfer: SecureDrop • Secure environment: Tails • Secure device: Blackphone CPSC 257 Tools for Secure Communication April 28, 2016 29 / 48 Secure email As we discussed, email is inherently insecure. Two ways to secure it: • Encrypting network connections (SSL). • Encrypting and signing messages (OpenPGP, S/MIME) CPSC 257 Tools for Secure Communication April 28, 2016 30 / 48 Secure email in practice While encryption and signing offer some additional protections, they are not always easy to set up and use.