Category: Security

Computer Security

Free personal firewall Privatefirewall review
Privatefirewall is an all purpose firewall with real time monitoring and intrusion detection, unlike Windows firewall that only monitors incoming connections, PrivateFirewall checks and blocks outgoing malicious trojans, in addition to monitoring computer processes and the registry which Windows firewall also leaves out. Privatefirewall is very easy to install working right out of the box after a computer reboot, it integrates tightly in the Windows Security Center disabling the built-in Windows firewall.

Running two firewalls at once could block some applications inadvertently, it is good practice to only use one, if firewalls rules were to conflict in between them there is no saying on what the network would do, to secure your computer a single firewall and a single antivirus is enough, you could run a hardware and a software firewall but once again, rules could conflict and it would not keep you much safer on the Internet.

Windows firewall alternative Privatefirewall

Privatefirewall allows you to create a list to blacklist or whitelist (trusted) websites, everything that happens is logged in case you want to look up suspicious activities or just learn what certain installed application is connecting to on the Internet, emails are monitored to detect anomalies, like sending 100 emails in under 5 minutes, a strong indication that some kind of bot is doing that, the firewall rules based filtering allows for customization of individual software blocking Internet access to selected programs while letting others through.

Privatefirewall main features
- Packet filtering supports IPv4 and the new IPv6 addresses
- Antihacker protection checks software behavior to identify malware activities
- Email anomaly protection protects against own computer being used for sending spam
- Advanced application management restricts programs rights, like executing code
Privatefirewall has a multilayered approach to computer security, it controls the way applications and processes operate in your computer, it detects Windows registry key value changes and stops untrusted executables being launched by camouflaged malware, popping up an alert when that happens, the firewall is lighter in resources than Comodo and ZoneAlarm, very easy to use for newbies, it comes with three preset profiles (home,work, on the road) with semi advanced control management for experienced users, definitely much better than the built-in Windows firewall and free for personal and commercial use, it seems like a bargain, specially indicated for those wanting a firewall for their tablet or notebook due to the few resources it uses and the “on the road” profile for mobile users.

Visit Privatefirewall homepage
5 October, 2011
Create an encrypted private chat room with PrivyTalks

While it is possible to create a private Chatoom online with something like Chatzy or Mibbit, the chat content will not be any more private than a postcard, it could be read by the website operator or someone with a packet sniffer, this can be solved using instant messenger software like Jitsi, supporting end to end encryption, but it requires both users to have the same program installed.

PrivyTalks lets you set up a private chat room accessible from any web browser or mobile device, not requiring software downloads, the connection with the site is through an SSL certificate and the chat content is encrypted using public key encryption (512bit RSA key). Setting up a chatroom takes seconds, after a single click your Internet browser will generate two RSA keys using javascript, one private encryption key to read received messages, and one public key that will be used by the other user to encrypt chat messages before sending them to you, the whole process takes place in real time with unnoticeable delay.

Privytalks will give you a personal URL to send to your contact, when they click on the link their own encryption keys will automatically be generated before connecting to the chatroom.

PrivyTalks encrypted private chatroom

One great advantage of PrivyTalks is that you don’t need to send any password, eliminating password leakage risk, and it is so easy to use that the average user will not even notice encryption is taking place, a problem I have found when trying to establish encrypted communications is that most non techie users bark at the thought of having to learn a new skill.

All messages at PrivyTalks are encrypted before leaving the computer, if anyone intercepted them, all they would get is gibberish, in a extreme case where PrivyTalks owners are forced to log chatroom conversations they would not be able to decrypt/read them because all encryption is carried out by the user in his own browser, PrivyTalks only serves as a means of channelling the chat, you can use a packet sniffer yourself and check how everything being sent out is encrypted.

PrivyTalks will warn you with a sound if someone connects to the chatroom so you don’t have to be looking at the screen waiting for your contact to connect, in case you forget to close down the browser, after 5 minutes of idle time the chat will disconnect itself and the contents cleared, a hashed fingerprint is showed below the chat window, this is to make sure that there is no man in the middle attack, which would change the fingerprint if it happened.

Every time you connect to a server on the Internet your IP is logged, there is no way around it other than using a proxy/VPN, PrivyTalks does not mention how long for connection logs are kept in the server, you should not treat PrivyTalks as an anonymous chat if you are using your real IP, treat it as a private chat that nobody else can read but may be traced back to you.

~~Visit PrivyTalks homepage~~

UPDATE 2015: PrivyTalks has been down for a few months, link erased.

14 September, 2011
Test for intrusion detection with Patriot NG

Patriot NG is a real time monitoring tool keeping an eye on changes in your Windows operating system and network, the program warns you of registry changes, new files in the Startup directory, new users being added, new services, changes in Windows host file, new scheduled jobs, Internet Explorer alteration(toolbars,configuration changes), changes in the ARP table (used for man in the middle attacks), opening of ports by new processes and anomalous network traffic.

This is a good tool to catch zero day threats, Patriot NG relies on software behaviour to predict if malware is changing files instead of using signature files like antivirus software without heuristics does.

Patriot NG IDS system

If you suspect your computer has been infected by a trojan the first thing to do should be detaching your router to stop all Internet access, if someone has managed to infect your computer they can disable intrusion detection tools and send you updated malware via the Internet. After you have disconnected your router an antivirus, anti-spyware and anti-rootkit software should be run in the computer until something is found.

An Intrusion Detection System (IDS) tool is best used by people with good computer knowledge, newbies might not realise that they are giving access to a trojan horse since malware is normally disguised and named as something else, the user will need to know some basic operating system files (locations&names) to understand what is going on.

Visit Patriot NG homepage

12 September, 2011
Retroshare P2P encrypted chat and filesharing

Retroshare is a decentralized open source friend-to-friend (F2F) Instant Messenger tool with group file haring capabilities and encryption, friends need to be invited before they are able to take part in the chat, you can create a group chat using a friends list, in group chats a forum can be used to distribute files in between acquaintances, the files are distributed in a multihop swarm system, even if one person goes offline, the files are still available as they can be downloaded from more than one source in parallel.

It is possible to post links on a public chatroom, the links are on the form of “retroshare://” and whoever clicks on them will need to have the software installed for them to work, this is an ideal program to securely transfer files in between friends with no central server keeping logs and your private encryption key kept in your hard disk with no possibility of leaking it out. Authentication is done using GnuPG encryption keys (GPG4Win is included in the Windows installer), connection is through SSH and OpenSSL is used for end to end encryption.

Retroshare encrypted chat and file sharing

Upload and download speeds will depend on the user’s available bandwidth, file sizes of more than 2GB are supported, a private friend to friend network like Retroshare solves the problem of strangers reporting on controversial files being shared but friends IPs are still visible and if someone steals a members identity the whole network will fall, due to its multiphop nature the original uploader might hide his computer’s IP from the person downloading from him but other people IPs sharing that file in the network will be visble, leading to the original source following them, disabling IP/certificate exchange services improves anonymity.

You can use Retroshare with a Virtual Private Network (VPN) to hide your real IP and improve your network anonymity, as VPNs are known to keep logs for a shorter time than ISPs do, there are no VPN incompatibilities of any kind, the software is available for Windows, Linux and MAC.

Visit Retroshare homepage

11 September, 2011
Cloud forensics tool OWADE pulls online services data

One of the problems that traditional computer forensics has is that lots of information is stored on the cloud, MSN, Yahoo, Skype, Dropbox, GoogleDocs, Facebook, etc, online data is accessible with a court order but that involves lots of paperwork making the investigation more complex with the physical data still unsecured and in some cases with the server located offshore out of local authorities jurisdiction. OWADE (Offline Windows Analysis and Data Extraction), is an open source cloud forensics tool developed by a Stanford University team and launched at the BlackHat 2011 security conference able to extract information from cloud services that a user has accessed in his computer.

Cloud computer forensics diagram

OWADE can reconstruct Internet activities and search for the online identities that have been used, Encase and FTK (The Forensics ToolKit) can already do this, OWADE advantage is its ability to decrypt files ciphered using the various Microsoft built-in encryption schemes, like Syskey and DPAPI (Data Protection API), OWADE combines its ability to decrypt Microsoft encryption algorithm with traditional data extracting techniques in order to access Skype chat history, decrypt Internet Explorer stored logins & passwords, by cracking the Windows user password, or access historical Wi-Fi location data stored by Windows, providing a list of access points with dates and times.

Traditional computer forensics software has a hard time reconstructing cloud services data stored in the hard disk due to Windows scattering everything across multiple files and encrypting some portions. OWADE does not pull data from the servers, the data was downloaded on the hard disk when the user accessed the service, what OWADE does is to search, decrypt and put together all of the cloud personal accounts, logs, logins and passwords that have been accessed.

This tool is still being developed, an Alpha version (not stable) has been released, and it can only analyse the Windows operating system.

Visit OWADE homepage

10 September, 2011
Jitsi the encrypted chat software with VoIP and video
Jitsi is an instant messenger with VoIP and videochat compatible with any other IM software supporting SIP (Session Initiation Protocol), an application layer protocol for voice over IP, XMMP/Jabber (Extensible Messaging and Presence Protocol), an open standard communications protocol used by Google Talk and most open source instant messengers, MSN/Windows Live Messenger, AIM, Bonjour, ICQ, Yahoo Messenger and Facebook chat, one of the few not supported IM is Skype.

Call encryption is implemented with SRTP (Secure Real-time Transport Protocol), a protocol with no effect on voice quality providing encryption using the AES cipher as default, authentication and message integrity, together with ZRTP, an open source protocol from Zfone for public key encryption in VoIP chats that can also be found in secure Linux instant messengers like SFLphone.

Jitsi encryption instant messenger

Jitsi IM main features
- Encrypted audio and video calls
- Support for most instant messenger software
- Call recording in SIP and XMPP (MSN in progress)
- File transfer preview, small photo thumbnail preview before accepting file
This secure instant messenger will encrypt video and voice calls across all services, including group chats, besides that, feature wise is pretty basic with little to show other than emoticons, text formatting, file transfer preview and avatars, this is a useful chat software with IPv6 support for those who care about privacy and security in VoIP and video conferences with no interest in playing songs while chatting or changing the IM skin/looks, a great IM for businesses due to its security and lack of bells and whistles that tend to reduce productivity while chatting, the messenger itself can be password protected and passwords are stored encrypted.

Visit Jitsi IM homepage
5 September, 2011
Lock a computer screen with ClearLock

If you have a user password set up in Windows clicking on “Windows key +L” on the keyboard will quickly lock your computer but you will not see what is going on behind the screen lock. Clearlock is a free Windows utility to lock Windows while you are away, using a transparent layer that allows you to see what is going on in the background with just a quick look without the need to unlock the computer, ClearLock has a nice 3D like GUI and there is no need to install it.

ClearLock a transparent computer screen lock

After entering the wrong password three times there will be a five minutes delay before granting another attempt, the number of invalid password entries are logged, you would be aware of them once you come back to your computer. If you forget your password while the screen is unlocked delete the .ini file inside the program folder to reset it, if the screen is locked you will have to reboot your computer.

This screen locker is a low level protector designed to stop low skilled adversaries, like children, from accessing your computer while you are away, determined serious opponents could plug in a USB thumbdrive in your computer and use Windows autorun feature to run a malicious script to pull your RAM memory and your screenlock password with it or even image the whole hard disk without you knowing.

Visit ClearLock homepage

1 September, 2011