Security News Digest February 07, 2017
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
A Security Analysis of Voatz, the First Internet Voting Application Used in U.S
The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections∗ Michael A. Specter James Koppel Daniel Weitzner MIT† MIT‡ MIT§ Abstract The company has recently closed a $7-million series A [22], and is on track to be used in the 2020 Primaries. In the 2018 midterm elections, West Virginia became the In this paper, we present the first public security review of first state in the U.S. to allow select voters to cast their bal- Voatz. We find that Voatz is vulnerable to a number of attacks lot on a mobile phone via a proprietary app called “Voatz.” that could violate election integrity (summary in Table1). For Although there is no public formal description of Voatz’s se- example, we find that an attacker with root access to a voter’s curity model, the company claims that election security and device can easily evade the system’s defenses (§5.1.1), learn integrity are maintained through the use of a permissioned the user’s choices (even after the event is over), and alter the blockchain, biometrics, a mixnet, and hardware-backed key user’s vote (§5.1). We further find that their network protocol storage modules on the user’s device. In this work, we present can leak details of the user’s vote (§5.3), and, surprisingly, that the first public security analysis of Voatz, based on a reverse that the system’s use of the blockchain is unlikely to protect engineering of their Android application and the minimal against server-side attacks (§5.2). -
An Evolving Threat the Deep Web
8 An Evolving Threat The Deep Web Learning Objectives distribute 1. Explain the differences between the deep web and darknets.or 2. Understand how the darknets are accessed. 3. Discuss the hidden wiki and how it is useful to criminals. 4. Understand the anonymity offered by the deep web. 5. Discuss the legal issues associated withpost, use of the deep web and the darknets. The action aimed to stop the sale, distribution and promotion of illegal and harmful items, including weapons and drugs, which were being sold on online ‘dark’ marketplaces. Operation Onymous, coordinated by Europol’s Europeancopy, Cybercrime Centre (EC3), the FBI, the U.S. Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) and Eurojust, resulted in 17 arrests of vendors andnot administrators running these online marketplaces and more than 410 hidden services being taken down. In addition, bitcoins worth approximately USD 1 million, EUR 180,000 Do in cash, drugs, gold and silver were seized. —Europol, 20141 143 Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. 144 Cyberspace, Cybersecurity, and Cybercrime THINK ABOUT IT 8.1 Surface Web and Deep Web Google, Facebook, and any website you can What Would You Do? find via traditional search engines (Internet Explorer, Chrome, Firefox, etc.) are all located 1. The deep web offers users an anonym- on the surface web. It is likely that when you ity that the surface web cannot provide. use the Internet for research and/or social What would you do if you knew that purposes you are using the surface web. -
In 2017, Broad Federal Search Warrants, As Well As
A PUBLICATION OF THE SILHA CENTER FOR THE STUDY OF MEDIA ETHICS AND LAW | FALL 2017 Federal Search Warrants and Nondisclosure Orders Lead to Legal Action; DOJ Changes Gag Order Practices n 2017, broad federal search warrants, as well as from disclosing the fact that it had received such a request. nondisclosure orders preventing technology and social On Oct. 12, 2017, the Floyd Abrams Institute for Freedom of media companies from informing their customers that their Expression at Yale Law School and 20 First Amendment Scholars, information had been handed over to the government, led to including Silha Center Director and Silha Professor of Media legal action and raised concerns from observers. However, Ethics and Law Jane Kirtley, fi led an amici brief in response Ithe U.S. Department of Justice (DOJ) also changed its rules on the to the ruling, explaining that National Security Letters (NSL) gag orders, leading a large technology company to drop its lawsuit issued by the FBI are accompanied by a nondisclosure order, against the agency regarding the orders. which “empowers the government to preemptively gag a wire or In 2017, the DOJ fi led two search warrants seeking extensive electronic communication service provider from speaking about information from web hosting company DreamHost and from the government’s request for information about a subscriber.” Facebook in connection to violent protests in Washington, The brief contended that these orders constitute prior restraints D.C. during President Donald Trump’s January 20 inauguration in violation of the U.S. Constitution and U.S. Supreme Court festivities. On Aug. -
Introduction Points
Introduction Points Ahmia.fi - Clearnet search engine for Tor Hidden Services (allows you to add new sites to its database) TORLINKS Directory for .onion sites, moderated. Core.onion - Simple onion bootstrapping Deepsearch - Another search engine. DuckDuckGo - A Hidden Service that searches the clearnet. TORCH - Tor Search Engine. Claims to index around 1.1 Million pages. Welcome, We've been expecting you! - Links to basic encryption guides. Onion Mail - SMTP/IMAP/POP3. ***@onionmail.in address. URSSMail - Anonymous and, most important, SECURE! Located in 3 different servers from across the globe. Hidden Wiki Mirror - Good mirror of the Hidden Wiki, in the case of downtime. Where's pedophilia? I WANT IT! Keep calm and see this. Enter at your own risk. Site with gore content is well below. Discover it! Financial Services Currencies, banks, money markets, clearing houses, exchangers. The Green Machine Forum type marketplace for CCs, Paypals, etc.... Some very good vendors here!!!! Paypal-Coins - Buy a paypal account and receive the balance in your bitcoin wallet. Acrimonious2 - Oldest escrowprovider in onionland. BitBond - 5% return per week on Bitcoin Bonds. OnionBC Anonymous Bitcoin eWallet, mixing service and Escrow system. Nice site with many features. The PaypalDome Live Paypal accounts with good balances - buy some, and fix your financial situation for awhile. EasyCoin - Bitcoin Wallet with free Bitcoin Mixer. WeBuyBitcoins - Sell your Bitcoins for Cash (USD), ACH, WU/MG, LR, PayPal and more. Cheap Euros - 20€ Counterfeit bills. Unbeatable prices!! OnionWallet - Anonymous Bitcoin Wallet and Bitcoin Laundry. BestPal BestPal is your Best Pal, if you need money fast. Sells stolen PP accounts. -
Computer Science 161 Fall 2020 Weaver Misc Topics 2
Computer Science 161 Fall 2020 Weaver Misc Topics 2 1 Pre Lecture Facepalm... From just a year ago! Computer Science 161 Fall 2020 Weaver Welcome to Hell Week.... Computer Science 161 Fall 2020 Weaver • Mental pressure of "Curl up in a ball with a rifle" vs "Pretend everything is normal" continues... • Highly likely Biden will be the winner: But we won't know for sure for another few days at least.... • Really a massive screwup: We should just have preliminary results announced on Friday at once for all states • Today is More Off Topic Stuff: • Nukes • Tor Hidden Services • Sidechannels 3 And Checking In With Everyone Again... How Are You on the Fauci Scale? Computer Science 161 Fall 2020 Weaver 4 The Interesting Problem: Limiting Use Computer Science 161 Fall 2020 Weaver • Who might use a nuke without authorization? • Our "allies" where we station our nukes • Original motivation: Nukes stored in Turkey and Greece • Someone who can capture a nuke • This is what sold the military on the need for the problem: We had nukes in Germany which would be overrun in case of a war with the USSR • Our own military • General Jack D Ripper scenario • The mandated solution: • Permissive Access Link (PAL) 5 Nuke Safety Features Computer Science 161 Fall 2020 Weaver • One-point safety – no nuclear yield from detonation of one explosive charge. • Strong link/weak link – • strong link provides electrical isolation; • weak link fails early under stress (heat, etc.) • Environmental sensors – detect flight trajectory. • Unique signal generator – digital signal used for coupling between stages. • Insulation of the detonators from electrical energy. -
Piracy Versus Privacy: an Analysis of Values Encoded in the Piratebrowser
International Journal of Communication 9(2015), 818–838 1932–8036/20150005 Piracy Versus Privacy: An Analysis of Values Encoded in the PirateBrowser BALÁZS BODÓ University of Amsterdam, Institute for Information Law The Netherlands The PirateBrowser is a Web browser that uses Tor privacy-enhancing technology to circumvent nationally implemented Internet filters blocking access to The Pirate Bay. This article analyzes the possible consequences of a mass influx of copyright pirates into the privacy domain. The article addresses the effects of the uptake of strong privacy technologies by pirates on copyright enforcement and on free speech and privacy technology domains. Also discussed are the norms and values reflected in the specific design choices taken by the developers of the PirateBrowser. Keywords: piracy, privacy, Tor, privacy-enhancing technologies, policy Introduction Tor (The Onion Router), “endorsed by Egyptian activists, WikiLeaks, NSA, GCHQ, Chelsea Manning, Snowden” (Dingledine & Appelbaum, 2013), is a volunteer network of computers that relays Web traffic through itself to provide anonymous, unobserved, and uncensored access to the Internet. It has about 4,000 relays and about 1,000 exit nodes. Tor users connect to the network, and their Web traffic is channeled through the internal relays to reach its final destination through one of the exit nodes. This arrangement makes the identification and surveillance of Tor users difficult. Anonymity is promised by the difficulty of tracing the Web traffic that appears on the exit node back to the individual who initiated the traffic, as long as there is a sufficient number of internal hops in between. Protection from surveillance is granted by the fact that each link in the communication chain is encrypted. -
Technical and Legal Overview of the Tor Anonymity Network
Emin Çalışkan, Tomáš Minárik, Anna-Maria Osula Technical and Legal Overview of the Tor Anonymity Network Tallinn 2015 This publication is a product of the NATO Cooperative Cyber Defence Centre of Excellence (the Centre). It does not necessarily reflect the policy or the opinion of the Centre or NATO. The Centre may not be held responsible for any loss or harm arising from the use of information contained in this publication and is not responsible for the content of the external sources, including external websites referenced in this publication. Digital or hard copies of this publication may be produced for internal use within NATO and for personal or educational use when for non- profit and non-commercial purpose, provided that copies bear a full citation. www.ccdcoe.org [email protected] 1 Technical and Legal Overview of the Tor Anonymity Network 1. Introduction .................................................................................................................................... 3 2. Tor and Internet Filtering Circumvention ....................................................................................... 4 2.1. Technical Methods .................................................................................................................. 4 2.1.1. Proxy ................................................................................................................................ 4 2.1.2. Tunnelling/Virtual Private Networks ............................................................................... 5 -
Deepweb and Cybercrime It’S Not All About TOR
A Trend Micro Research Paper Deepweb and Cybercrime It’s Not All About TOR Vincenzo Ciancaglini, Marco Balduzzi, Max Goncharov, and Robert McArdle Forward-Looking Threat Research Team Trend Micro | Deepweb and Cybercrime Contents Abstract ..................................................................................................................................................3 Introduction ...........................................................................................................................................3 Overview of Existing Deepweb Networks ......................................................................................5 TOR ............................................................................................................................................5 I2P ...............................................................................................................................................6 Freenet .......................................................................................................................................7 Alternative Domain Roots ......................................................................................................7 Cybercrime in the TOR Network .......................................................................................................9 TOR Marketplace Overview ..................................................................................................9 TOR Private Offerings ..........................................................................................................14 -
Going Dark: Impact to Intelligence and Law Enforcement and Threat Mitigation
GOING DARK: IMPACT TO INTELLIGENCE AND LAW ENFORCEMENT AND THREAT MITIGATION Bonnie Mitchell Krystle Kaul G. S. McNamara Michelle Tucker Jacqueline Hicks Colin Bliss Rhonda Ober Danell Castro Amber Wells Catalina Reguerin Cindy Green-Ortiz Ken Stavinoha ACKNOWLEDGEMENTS We would like to first thank the Office of the Director of National Intelligence (ODNI) for its generous funding and support for our study and learning journey to the DEFCON hacking conference. We are also very grateful to the Department of Homeland Security (DHS) for its support during the duration of the program. We could not have completed this study without the unwavering support and dedication of Ms. Bonnie Mitchell, ODNI Deputy National Intelligence Manager for the Western Hemisphere and the Homeland, our devoted Team Champion who steered us throughout this study and helped turn an idea into a product. We would like to acknowledge and thank each member of our public-private sector working group for their tireless efforts from around the U.S., which includes Krystle Kaul, G. S. McNamara, Michelle Tucker, Jacqueline Hicks, Colin Bliss, Rhonda Ober, Danell Castro, Amber Wells, Catalina Reguerin, Cindy Green- Ortiz and Ken Stavinoha. We are very thankful for all the unique insight we received from interviewees who contributed to this report by educating our group on the many aspects of ‘going dark,’ and we take full responsibility for any and all errors of fact or interpretation implied or explicit in this paper. Our interviewees include the Village sponsors at DEF CON, private sector industry experts and government officials. We are thankful for the interesting and diverse perspectives particularly from senior government officials and private sector experts. -
Unmasking 101: How [Not] to Use Anonymous Browsing
Isaiah Fischer-Brown Comp 116 Final Project December 13th, 2017 Unmasking 101: How [not] to use Anonymous Browsing Mentor: Ming Chow 2 Table of Contents 1. Abstract 2. To the Community 3. Introduction 3.1 How Tor Works 3.2 Hidden Services and Tor Browsing 3.3 Tor Funding and Regular Usage 4. How Users Should Not Use Tor 4.1 End-to-End Confirmation Attacks 4.2 High Profile Case Studies + Defenses Against Them 4.2.1 Carnegie Mellon Research using Correlation Attacks 4.2.2 Harvard Bomb Threat 4.2.3 LulzSec 4.2.4 Freedom Hosting 4.2.5 VPN Usage 5. Conclusion 6. References 3 1. Abstract The Onion Router, commonly known as Tor, has been the gold standard for free internet anonymity. Tor was originally developed for the U.S. Navy, with the purpose of keeping government communications secret and protecting the identity of government internet sources. In current society, Tor is used by all types of users, such as people aiming to avoid censorship on the internet, those trying to protect their children from targeted ads, or for perhaps more nefarious purposes. Given that virtual private networks (VPNs) are being banned in countries like Russia and China, and new surveillance laws are being pushed through internationally to combat terrorism, Tor will likely grow in popularity. The following research will examine Tor as a tool, explain proper usage, and present documented situations where users have been caught using Tor in illegal ways to demonstrate weaknesses in the system and how users can protect against them. -
The Tor Project, Inc
The Tor Project, Inc. Our mission is to be the global resource for technology, advocacy, research and education in the ongoing pursuit of freedom of speech, privacy rights online, and censorship circumvention. 1 What is Tor? Online anonymity 1) open source software, 2) network, 3) protocol Community of researchers, developers, users, and relay operators Funding from US DoD, Electronic Frontier Foundation, Voice of America, Google, NLnet, Human Rights Watch, NSF, US State Dept, SIDA, Knight Foundation, ... 2 The Tor Project, Inc. U.S. 501(c)(3) non-profit organization dedicated to the research and development of tools for online anonymity and privacy 3 Estimated ~800,000? daily Tor users 4 Threat model: what can the attacker do? Alice Anonymity network Bob watch Alice! watch (or be!) Bob! Control part of the network! 5 Anonymity isn't encryption: Encryption just protects contents. “Hi, Bob!” “Hi, Bob!” Alice <gibberish> attacker Bob 6 Anonymity isn't just wishful thinking... “You can't prove it was me!” “Promise you won't look!” “Promise you won't remember!” “Promise you won't tell!” “I didn't write my name on it!” “Isn't the Internet already anonymous?” 7 Anonymity serves different interests for different user groups. Anonymity “It's privacy!” Private citizens 8 Anonymity serves different interests for different user groups. Anonymity Businesses “It's network security!” “It's privacy!” Private citizens 9 Anonymity serves different interests for different user groups. “It's traffic-analysis resistance!” Governments Anonymity Businesses “It's network security!” “It's privacy!” Private citizens 10 Anonymity serves different interests for different user groups. -
Enhancing Cybersecurity for Industry 4.0 in Asia and the Pacific
Enhancing Cybersecurity for Industry 4.0 in Asia and the Pacific Asia-Pacific Information Superhighway (AP-IS) Working Paper Series P a g e | 2 The Economic and Social Commission for Asia and the Pacific (ESCAP) serves as the United Nations’ regional hub promoting cooperation among countries to achieve inclusive and sustainable development. The largest regional intergovernmental platform with 53 member States and 9 associate members, ESCAP has emerged as a strong regional think tank offering countries sound analytical products that shed insight into the evolving economic, social and environmental dynamics of the region. The Commission’s strategic focus is to deliver on the 2030 Agenda for Sustainable Development, which it does by reinforcing and deepening regional cooperation and integration to advance connectivity, financial cooperation and market integration. ESCAP’s research and analysis coupled with its policy advisory services, capacity building and technical assistance to governments aim to support countries’ sustainable and inclusive development ambitions. The shaded areas of the map indicate ESCAP members and associate members. Disclaimer : The Asia-Pacific Information Superhighway (AP-IS) Working Papers provide policy-relevant analysis on regional trends and challenges in support of the development of the AP-IS and inclusive development. The findings should not be reported as representing the views of the United Nations. The views expressed herein are those of the authors. This working paper has been issued without formal editing, and the designations employed and material presented do not imply the expression of any opinion whatsoever on the part of the Secretariat of the United Nations concerning the legal status of any country, territory, city or area, or of its authorities, or concerning the delimitation of its frontiers or boundaries.