Online Security for Internet Media Serving Severely Censored Countries
Total Page:16
File Type:pdf, Size:1020Kb
Online Security for Internet Media Serving Severely Censored Countries A white paper for SIDA’s October 2010 “Exile Media” conference Eric S Johnson (updated January 2012) For activists who make it a priority to deliver news to citizens of countries which try to control the information to which their citizens have access, the internet has provided massive new opportunities. But those countries’ govern- ments also realise ICTs’ potential and, to various extents, implement countermeasures against the delivery of inde- pendent news via the internet. This paper covers what exile media can or should do to protect itself, addressing three categories of issues: common computer security precautions, defense against targeted attacks, and circumventing cybercensorship, with a final note about overkill. For each of the issues mentioned below, specific examples from within the human rights or freedom of expression world can be provided where non-observance was catastrophic, but most of those who suffered problems would rather not be named. Common computer security: The best defense is a good … The main threats to exile media’s successful use of ICTs—and ways to deal with those threats—are the same as for any other computer user: 1) Ensure all software regularly and automatically patches itself against newly-discovered security flaws (and e.g. to maintain up-to-date SSL certificate revocation lists). As with antivirus software, this may cost something; e.g. with Microsoft (Windows and Office), it may require your software be legally purchased (or you can use the WSUS Of- fline Update tool, which can help in low-bandwidth environments). Firefox, Chrome, Adobe Acrobat Reader and Flash player, iTunes, Skype (and other IM clients), and Java VM should update themselves (or at least prompt you to install newly-available updates), but it’s worth verifying from time to time. MBSA’s scan is more complete than Windows Update. The free (Windows-only) Secunia PSI vulnerability scanner / patch manager can help inform you about needed updates; other solutions, like IBM’s BigFix, are for-fee. Don’t forget to update your smartphone’s Android OS or iOS (on an iPhone). (~USD100/computer/yr to license Microsoft products) 2) Use a good antivirus on all workstations—one which constantly (at least daily) automatically updates its virus- fighting capabilities (e.g. TMIS, McAfee, NIS, AVG, Avira, Kaspersky, Avast, CA, Immunet, F-Secure, Microsoft Security Essentials; but use only one). When acquired as part of a “security suite,” an antivirus pro- gram will come with more-detailed firewall (although the one built in to Windows 7 or Mac OS 10.7 is just fine), anti-spam, and some level of malware protection. If you feel that more is better, consider adding Anti- malware, ThreatFire, and/or Ad-Aware (all free). Ensuring data execution prevention is on provides an additional security boost. (MSE, AVG, Avast free; others ~USD40/computer/year) 3) Avoid falling for phishing lures and malware (can’t say it too often!): a. Don’t open attachments to, or click on links in, e-mail messages from unknown senders—they might result in stolen documents, giving botnets (such as those tracked by ShadowServer) control over your computer, or al- lowing government law enforcement agencies remote access to your files (using e.g. offensive security prod- ucts such as FinFisher, HackingTeam, and Vupen). If you must open an unknown attachment, consider scan- ning it with Jotti first. b. Never enter your password into a site accessed from a link in an e-mail, e.g. when your bank sends you a note saying “your statement’s ready to view” or Facebook says someone “wants to be friends,” type the URL into your browser (or use a shortcut from your “favourites” menu). (The URL in the hyperlink might be fake, in which case you’ll be clickjacked; you can’t tell the difference!) c. Never provide your online account login credentials to third parties such as that site which says “please enter your [for example, Gmail] account login and password so we can provide you with service X.” Some are legitimate, but many aren’t. If you log in, then at best someone will use your account to spam everyone in your address book; at worst, someone will stealthily monitor your account and/or use it to trick your friends into revealing important information. Check your e-mail accounts’ settings/options monthly to ensure there’s no unexplained forwarding. Deploy the free Simple Phishing Toolkit to test your employees; train the 15% who “fell for it” how to avoid being phished. 4) Never lose physical control/possession of your computer. A rootkit or keylogger can be installed in seconds; then you’re compromised. Make sure your computer is set to always require a password upon boot; then, ensure your screensaver automatically locks your computer after a minute of inactivity, and if you walk away from your com- puter while it’s on, lock it (flag-L in Windows, ctrl-shift-eject under Mac OS). 5) Back up your data at least once every other week. This protects against potential loss due not only to attack, but also to (much more likely, and in fact inevitable) technical failure (e.g. of a hard drive). The simplest way is to set your computer to (overnight) copy your data (e.g. in Windows 7, c:\users\[your-name]\) to your backup medium; or, most OSes have simple backup programs built in (e.g. Windows Backup or Mac OS’s Time Machine). Or, there are third-party specialised backup programs used to automate the process (e.g. the open-source Cobian, AllwaySync or Acro- nis for Windows, Retrospect for the Mac). Be sure your backup media are fully encrypted (see below). Be sure to at least occasionally put a copy of your data “offsite” so that if your house burns, you don’t lose both your computer and your backup. Alternatively, use a secure online (“cloud”) service such as Dropbox, Wuala, or egnyte. Don’t forget to back up your site as well (it will eventually be hacked and erased, and you’ll want/need to restore it)—and when you do, in- clude your CMS database (not just static pages). Finally, don’t forget to back up your mobile’s contact list too! (USD50/user for a high-capacity USB thumbdrive; Dropbox and Wuala are free; egnyte has a small fee) 6) Use strong passwords; set password recovery mechanisms. Passwords must be reasonably long (at least 20 characters) and relatively random (e.g. 3HorsesCapitalize.AnchorageBetter). Never use passwords consisting only of a name or anything in a dictionary—otherwise Cain & Abel (or its more sophisticated brute-force-cracking cousins) can guess it. When signing up for an online service, provide backup e-mail addresses, phone numbers, and/or security questions which can be used to authenticate you in case control of your account is lost. If you do lose control (or it’s shut), use personal contacts through RSF, HRW, or Internews (all affiliated with the Global Network Intiative, and therefore plugged in to large online service providers) to try to recover it. Don’t reuse identical passwords across services. If you consider your computer secure (e.g. you’re using whole-hard-disk encryption), use LastPass or Keepass to to make unique, strong passwords and remember them. Don’t share a password with co-workers or paste it on a PostIt on your monitor! 7) Secure your office and home wi-fi access points (APs). Set a new password for your AP’s control panel (the manufacturer-set default one is public knowledge). Then, make sure it’s using WPA (WPA2-AES is the best) for encryption, since the older WEP is highly insecure: sniffing open wi-fi is one of the simplest ways for snoops to get access to your entire digital life. Turn off WPS, since it provides attackers a “hole” through which to enter. 8) Don’t use public networks (e.g. wi-fi hotspots) except encryptedly. Use Firefox’s HTTPS Everywhere or (better) a virtual private network (VPN). Otherwise, the person sitting next to you in Starbucks could use DriftNet to see what you’re downloading, or FireSheep to sidejack access to your Facebook account to social- engineer her way into the confidence of your friends (unless you use the non- default encrypted access to Facebook, Twitter, and Google; the former two can be set, in your login preferences, to be “HTTPS only”), or Wireshark to see everything. 9) Encrypt your instant-messaging (IM) and VoIP communications by ensuring both ends of the conversation use either the real Skype (not the Chinese version, TOM Skype, which has cybercensorship and cybersurveillance built in), Gchat (IM via your Gmail webmail interface) or an encrypted IM client such as Pidgin+OTR, Miranda+OTR, or Jitsi+OTR for otherwise-unencrypted IM networks such as ICQ, Gtalk, AIM, MSN, and Y!, but both ends must use it. (VoIP via Zfone (using ZRTP) and Blink (using SIP/SRTP), like Skype, are completely encrypted—but also source-code-published so peer-reviewed and therefore more trustworthy.) Targeted attacks: Higher—or hire—technology Attacks can come in many forms; defending against all of them is impossible, but there are steps to take—some easier, some more sophisticated. 10) Globally, internet traffic is massive and dispersed; surveilling you online isn’t always easy for your attacker. A hostile party is more likely to try to get your hard drive. Ensure all workstations—especially portable ones which are more likely to be lost or stolen—are using whole-hard-disk encryption (WDE). (The “Windows login pass- word” without WDE can be circumvented by a USD20 USB-to-SATA bridge.) Windows’ top version, Ultimate (and its more-often-pirated corporate version, Enterprise) includes WDE (Bitlocker; most 2010-or-later notebooks (except in Russia and China, where TPM’s theoretically not allowed) are TPM 1.2-compliant, but otherwise you’d have to carry a USB “key”); so does the newest version of Mac OS X, Lion (10.7; FileVault 2); for Linix users, LUKS is built in to the Ubuntu distro.