Hacker10

KProxy Agent, a portable Internet browser with proxy

KProxy Agent is a Chrome based portable browser that comes preconfigured to handle HTTP requests through one of the free KProxy network of IPs to bypass Internet filtering. People using public computers at work and college will find it useful to access Facebook, YouTube and other typically blocked entertainment sites. The browser runs in Incognito mode by default (known as Private Browsing in Firefox). Chrome Incognito mode executes in RAM memory and does not store browsing history, cookies or cache in the hard drive, browsing traces will be gone and non recoverable after you close KProxy Agent, the developers claim that proxies encrypt data in between the browser and the sites you visit, any passwords or email you send can not be intercepted by anyone listening in, which makes this tool suitable for security in public Wi-fi access points.

The speed tests I carried out on the free proxies gave me around 2MB-4MB, this is enough to watch online TV, taking advantage of this I managed to bypass geoblocking filtering and I was able to watch Hulu from outside the US without problems, unfortunately the ping rate wasn’t so impressive and browsing Internet sites at times it felt slow, I solved it by choosing a different proxy server closer to home.

KProxy Agent portable proxy browser

KProxy Agent has been developed in Java, it will not work if this is not installed. Java has had numerous security problems in the past but it benefits from being multi platform, this portable browser will run in Windows, Mac and Linux or any other OS that has Java installed. Switching in between proxies can be done in a matter of seconds within a couple of mouse clicks but only US and German proxies could be found in the proxy list. KProxy Agent could benefit of a more detailed proxy information, instead of having ten different public proxies with the American flag next to them they could point out where exactly in the US each proxy is located, East or West coast and enumerate server load for each one of the proxies so that the user can choose the best one.

It seems that KProxy Agent developers intend to make money with this program by getting people to upgrade to their faster premium proxy service, you will find KProxy Pro mentioned around but in a non obstructive way, if you only use an Internet censorship bypass tool occasionally the free version is just fine, you only need to trust KProxy owners with your data just as it happens with all other proxy or VPN services.

Visit KProxy Agent homepage

21 January, 2013
German police testing FinFisher/FinSpy trojan horse tools

A German ministry of the interior budget document leaked to Netzpolitik reveals that the Federal Criminal Police (BKA) is considering acquiring surveillance tools sold by British Gamma Group to monitor computer and Internet usage, German police is developing its own electronic surveillance tool called Spähtrojaner, at a cost of three million Euros but it will take more than a year to be finished and they need to deploy spying tools now, German magazine Spiegel quotes police sources confirming that they are already testing FinSpy trojan horses to eavesdrop in people’s computers.

FinFisher/FinSpy espionage software is marketed as a crime fighting tool only available to law enforcement and it requires a UK Home Office export license to be sold outside the European Union, the software is of dual use and it has been launched in the past against political dissidents in Bahrain where security researchers managed to map suspected FinFisher Command and Control servers around the world.

FinFisher/FinSpy trojan horse infrastructure

This government endorsed malware is normally installed in target computers using social engineering getting a user to open the trojan horse sending it through email, posting a file to a website for download, or getting physical access to the computer. A security researcher looking into a FinFisher trojan horse sent to political activists in Bahrain found out that the file was disguised as a .jpg written in Unicode Right-to-Left Override character with the .exe being found at the beginning of the file and not the end as it is usual, the exact trojan horse name was “exe.Rajab1.jpg” and it opened an actual cover-up photograph besides infecting the computer.

According to that report FinFisher captured data was stored in a random Windows system folder called: C:\Documents and Settings\User\Application Data\Microsoft\Installer\{A69832D8-3F71-4241-7493-7551DB00C34C} prior to sending it to the command server.

FinFisher toolkit Gamma Group

FinFly trojan horse can record VoIP conversations before they are encrypted by Skype or after they have been decrypted on the recipient’s side, it logs keystrokes and it can grab screenshots or activate webcams and microphones. A smartphone version called FinSpy mobile can wiretap Android, iPhone and Blackberry phones, antivirus software does not detect FinFisher tools, if you are afraid you can be targeted by it then consider virtualization of all of your Internet activities in VirtualBox or use a live DVD that has no permanent storage.

Visit Gamma Group homepage

19 January, 2013
Dooble privacy Internet browser encrypts browsing data

Dooble is an open source platform independent (Windows,Mac and Linux) Internet browser designed for privacy that comes with a secure P2P email client and serverless messenger called Interface, the browser rendering engine is based on WebKit, the same that Apple Safari uses, pages should look the same in both browsers. Dooble doesn’t need installation, it can run from a USB thumbdrive.

After launching this privacy browser for the first time you will be asked to enter a passphrase to secure your Internet session, the passphrase must be composed of a minimum of 16 characters or it won’t be accepted. Once it has been set up your Internet browsing history, cookies, cache, bookmarks, favicons and downloads will be encrypted using AES256 and SHA512 by default, itirations, encryption algorithm and salt length can all be changed in the Settings tab.

The security tab allows you to choose always HTTPS for websites when available, see the website IP address, hide your referrer, set the browser to Do Not Track, suppress redirections and automatically sweep cookies every hour. Creating a new profile is done with a GnuPG encryption key, you can have various browsing profiles each one of them containing own preferences.

Dooble privacy Internet browser

With the same browser you will be able to access I2P websites, an anonymous network routing traffic like tor does. I2P anonymously hosted websites are known by the extension .i2p and called eepsites, not accessible through regular Internet without installing special anonymizing software first, Dooble browser search box in the toolbar includes alternative search engines like Blekko, YaCy and WolframAlpha.

There are proxy configuration settings for HTTP and the integrated FTP client supporting Socks proxy. Dooble has a clean but simple interface, it needs 80MB free space to run and it loads quickly with low CPU usage, there are not many functional extras but it does all you need an Internet browser to do and its main selling point is obviously security, if you need to move in between computers with a portable browser Dooble will protect you in case of losing your thumbdrive but it will do nothing against trojan horses installed in a public computer and some countries make it a criminal offense to refuse to disclosure your password to law enforcement when requested, in those cases Dooble encrypted Internet browsing cache will not be of much help.

Visit Dooble browser homepage

10 January, 2013
Mobile phone password manager WISeID

WISeID is a password manager available for Android, iPhone/iPad, Windows Mobile and BlackBerry, it has been designed to locally encrypt data in your phone using AES256, a very secure uncrackable algorithm that is a US government standard. You will be asked to enter a master password after installing the app, to unlock the database you can use a combination of face recognition or dot pattern together with the passphrase.

Inside the app everything can be categorized into passwords, bank accounts, social network logins, credit cards, email accounts and others, data can be searched and optionally synced across devices using a Dropbox account.

WiseID smartphone password manager

After storing the username and password for a website inside WISeID you can launch the URL to automatically log in, saving you time. The encrypted data is kept in the mobile device at all times, unlike Lastpass, there is no central server where accreditations are communicated. WISeID is open to the choice of registering with them and get a free X.509 digital certificate called WISeKey’s Personal ID or eID that can be used to encrypt and digitally sign email messages.

There is no way to recover your data if you lose your master password, no backdoor built in. At the moment of writing WISeID is free, if this changes you might want to look into KeePass mobile password manager instead.

Visit WiseID homepage

6 January, 2013
Brute force Linux encryption with LUKS volume cracker

The Linux Unified Key Setup (LUKS) volume cracker utility is a Windows program built around FreeOTFE to launch a brute force attack against compatible Linux encrypted volumes like Cryptoloop, dm-crypt and LUKS, widely used Linux disk encryption schemes, with the later also ported to the Android phone.

Operating LUKS volume cracker is very easy, select an encrypted volume first, select a dictionary you have, or build a custom one based on words likely to be used by the suspect and finally click on the huge “Crack” button, you will be given updates about the cracking process on the window below the program.

LUKS volume cracker

The good news are that LUKS intentionally slows down password access to stop dictionary attacks and brute-force is not a real option unless a very easy password has been chosen or the attacker has a list of potential passwords. When you design a password do not get awed by its length, entropy (randomness) is a much more important factor in password security than the number of characters it is forged of, make sure special characters and blank spaces are present in it.

If would like to destroy an encrypted LUKS volume there is no need to wipe the whole partition, erasing the header and keyslots is enough, by default, LUKS decryption keys are contained within the firs 2MiB of an encrypted LUKS partition. A salt value is also stored inside the header, it will be impossible for anyone to decrypt a volume without knowing it, not even if the password is found out later on. Encrypted Solid State Disks and thumbdrives will still need full device wiping as wear levelling technology moving around data makes it impossible to securely overwrite an specific sector.

To wipe the first 10MB of an encrypted LUKS volume (sda1) in Linux type:

dd if=/dev/zero of=/dev/sda1 bs=512 count=20480

Visit LUKS volume cracker homepage

28 December, 2012
Deceiving authorship detection with JStylo-AnonymouAuth
Stylometry, the study of linguistic style, is a method used for authorship recognition, it has helped in numerous historical breakthroughs attributing documents of unknown authorship. The same technique can be used to identify an anonymous blogger or forum poster but a set of necessary conditions must be met for stylometry to succeed, like having a reduced number of suspects and a few hundred of available paragraphs that can be compared and analyzed by an algorithm.

It is possible for a state sponsored agency to use their computers to scan similar forums to try and link a high target with his real identity by looking at the writing style alone, it is well known that spy agencies already have the capability of scanning Facebook for keywords, where people is using their real name, but due to the millions of users that Facebook has, an stylometry attack would not be feasible unless it is reduced to forums with just a few dozen users. Gathered evidence is still not a definite beyond reasonable doubt, but it can used as an extra intelligence tool pending confirmation.

Adversarial stylometry JStylo-AnonymouAuth

Manual adversarial stylometry techniques to circumvent authorship recognition:
- Obfuscation: An author can deliberately camouflage his writing style, including punctuation and use the thesaurus to avoid being repetitive or briefly quoting someone’s else words.
- Imitation: An author imitates someone’s writing style so that analysis will point towards that person or throw the algorithm off the trail with no conclusive result.
- Translation: Automatic software can translate the text a couple of times to a different language and then back to the original.
The Drexel University research team has also released an open source tool called Jstylo-Anonymouth, bundling together an authorship recognition analysis tool and authorship recognition evasion tool, the software is written in Java and will work in any operating system. When you use Anonymouth to circumvent authorship recognition you will be shown an analysis of text complexity, unique and sentence word count, average sentence length, letter space and reading ease score then you will be told if each feature is optimal for anonymity or it needs changing, this automated software is ideal to release long documents.

Note: Software is an alpha release still in development.

Visit JStylo-Anonymouth homepage
15 December, 2012
U.N. report reveals secret law enforcement techniques
Buried inside a recent United Nations Office on Drugs and Crime report titled “Use of Internet for Terrorist Purposes” one can carve out details and examples of law enforcement electronic surveillance techniques that are normally kept secret.

The report includes real accounts of investigative techniques countering terrorist groups secure communication systems.

Terrorist groups using computer security
- Point 187: Members of the outlawed Turkish Revolutionary People’s Liberation Party-Front (DHKP-C) used steganography software called Camouflage to hide messages inside JPEG files and encrypted attachments with WinZip before emailing them. A joint Turkish and Italian police operation managed to decrypt the messages and arrest over a hundred people involved with the organization.
- Point 194: An Alqeda affiliated webmaster managing a jihadist website from Brazil was specifically targeted by the police to grab him by surprise while he was still online to make sure that they would get his encryption keys thanks to which the investigators were able to open all relevant encrypted files.
- Point 280: International members of the guerilla group Revolutionary Armed Forces of Colombia (FARC) communicated with their counterparts hiding messages inside images with steganography and sending the emails disguised as spam, deleting Internet browsing cache afterwards to make sure that the authorities would not get hold of the data. Spanish and Colombian authorities cooperated to break the encryption keys and successfully deciphered the messages.
- Point 374: German citizens members of a group called Islamic Jihad Union used the dead email inbox trick to communicate in between them, the suspects did not send the email to prevent wire tipping in transit, saving the messages to the draft folder instead for the other part to read and reply, coupled with accessing the Internet using insecure wireless access points of unsuspecting citizens with one of the suspects using encryption which forensics expert tried to access and failed.
- Point 198: It explains how an investigator can circumvent Truecrypt plausible deniability feature (hidden container), advising computer forensics investigators to take into consideration during the computer analysis to check if there is any missing volume of data.
- Point 201: Mentions a new covert communications technique using software defined high frequency radio receivers routed through the computer creating no logs, using no central server and extremely difficult for law enforcement to intercept.
- Point 210: Explains how Remote Administration Trojans (RATs) can be introduced into a suspects computer to collect data or control his computer and it makes reference to hardware and software keyloggers as well as packet sniffers.
- Point 228: Talks about a honeypot jihadist website created by the CIA and the Saudi Government to attract and monitor terrorists, leading to the arrest of jihadists before they could carry out their operations but finally having to dismantle their own website when law enforcement realised that it was also being used to plan attacks against US troops in Iraq.
- Point 378: Explains how during an Alqeda case in Belgium and after an informal request without any kind of warrant within two weeks the FBI managed to provide Belgian authorities with a CD containing relevant emails data held in US servers voluntarily provided by Yahoo and Microsoft.
Full report:
http://www.unodc.org/documents/frontpage/Use_of_Internet_for_Terrorist_Purposes.pdf
6 December, 2012