Hacker10

  • Quick text encryption with ImmediateCrypt

    Quick text encryption with ImmediateCrypt

    ImmediateCrypt is a free open source utility written in Java to encrypt text messages, it uses cryptographic standards like the AES256bit cipher, CBC block chaining and PKCS#5 padding, ImmediateCrypt can be installed on a USB thumbdrive, there is no need to have administrator rights to execute it in your computer, something that should be appreciated by those using public computers. In order to decrypt messages both parties will need to have ImmediateCrypt installed, it doesn’t matter what operating system they are using as long as Java is present, the software will work in Windows, Mac OS X and Linux/BSD.

    To encrypt text simply copy and paste it inside the box, enter a password and click on “Crypt“, the receiver will reproduce the same steps using the “Decrypt” button, the password should have previously been given using secure channels like an encrypted VoIP call or in person.

    ImmediateCrypt portable text encryption
    ImmediateCrypt portable text encryption

    ImmediateCrypt does not have any configuration settings or extra features like a password meter, this is not a high security encryption program in the sense that it would be possible for a virus to read your clipboard text and there is no virtual keyboard making it possible for a trojan to capture keystrokes, but if you are convinced that your computer is 100% secure and your main concern is only stopping man in the middle attacks when you email someone a text message it should be impossible for a third party intercepting the garbled text to decipher what it says.

    Immediatecrypt is much easier to use than PGP encrypted email, it is a good way to convince your beginner computer friends to start using encryption as they will not have to spend time learning how it works since everything can be explained in under a minute and it is intuitive.

    Visit ImmediateCrypt homepage

  • Brute force a Truecrypt volume with TrueCrack

    Brute force a Truecrypt volume with TrueCrack

    Truecrack is an open source Linux only tool optimized with Nvidia Cuda (Compute Unified Device Architecture ) technology, a computing platform able to process queries in parallel that can be used to crack Truecrypt volumes greatly speeding up brute force attacks, Truecrack will only work if the volume has been encrypted with the default Truecrypt settings RIPEMD160 and XTS block cipher mode based on AES. The software can read a list of passwords from a text file or generate a list of possible passwords from a charset of symbols defined by the user, a dictionary attack of 10,000 possible passwords with a length of 10 characters each will take 11 minutes to execute on an Intel Core i7 computer CPU, the same list of possible passwords in GPU mode (Nvidia Cuda technology) only takes 30 seconds to execute.

    Truecrack will open a Truecrypt volume and retrieve the masterkey from its header section checking the success of the deciphering operation, if the password is right or wrong, querying the true and crc32 fields.

    Truecrack brute force Truecrypt
    Truecrack brute force Truecrypt

    This is not the first tool designed to crack Truecrypt, while Truecrypt default settings are safe, for what I have seen in other similar tools they are all optimized to crack Truecrypt encryption having into account that the user did not change the default cipher (AES) or key derivation (RIPEMD160) and they do not work when keyfiles have been used. Choosing a strong passphrase should stop any brute force attack on your Truecrypt volume but if you would like to play the paranoid card it would be a good idea to change the default settings to something else, like a cascade algorithm, and add a keyfile.

    Visit TrueCrack homepage

  • Anti-forensics mobile phone app Wickr

    Anti-forensics mobile phone app Wickr

    Wickr is an all-round free smartphone app for the iPhone with an Android version coming soon, it provides text, image, audio and video encryption with AES256bit, self-destructing messages with a timer regulating who can read text, photo or video messages and how long for they are available for retrieval but its best feature is possibly Wickr destroying files metadata erasing all attached personal information identifying the author and file creation details with a data shredder making sure that when you erase something it is really gone beyond recovery. The service also hides usernames and phone serial number by adding several random digits to each value and salting and hashing it to make it undecipherable.

    Even thought you need an account with Wickr you can still use this app anonymously, you are not asked for any identifiable information, minimal connection logs are kept and they do not contain anything that could be linked to a user, the messages stored in Wickr servers are all encrypted, it would not be possible to force the company to reveal its content, the password to decipher the data is only kept in your own phone. Your mobile phone provider will see that your are connecting Wickr servers but they will not be able to read your messages or learn who you are communicating with, any logging from their part to spy on you would be unproductive.

    Wickr antiforensics mobile app
    Wickr antiforensics mobile app

    The only weak spot Wickr has is that the phone screen capture utility can be used to copy a time restricted message, Apple does not allow developers to disable screen capture on their iPhones and there is nothing that can be done about this. The app complies with HIPAA requirements for encryption and privacy and encryption is FIPS 140-3 compliant, a U.S. government computer security standard issued by NIST, standing for Federal Information Processing Standards. The app is the brainchild of a former defense contractor and a former forensics investigator, these are people with the know how, not some some CEO expert in marketing learning about a product on the go as it often is, the antiforensics expertise of the people behind the app shows in the end product quality.

    To secure your communications the app will have to be installed in both phones, sender and receiver, home users can use all features for free but if you would like to send a message to multiple people at once, a typical corporate use, you will be asked to upgrade. This app can punch a big hole in data retention laws.

    Visit Wickr homepage

  • Free speech hosting in Iceland with OrangeWebsite

    Free speech hosting in Iceland with OrangeWebsite

    OrangeWebsite is a hosting company specialised in free speech hosting with its headquarters and servers based in Iceland, their terms and conditions allow you to host any controversial material with the only exception of neonazi websites because ethnic agitation is a crime in Iceland and sites that promote potential harm to minors or link to child pornography. You are also allowed to run a tor proxy or VPN using one of their servers, their range of services embrace private whois domain registration (outside the USA), shared hosting for small businesses or personal websites, virtual servers and dedicated servers. Customers can sign up for hosting, affiliate program and domain registration anonymously, you will only be asked for your email address and Bitcoins will be used for payments.

    I was given a package to test their services and I was quite pleased with everything, I have been using cPanel for years but I had not problem getting used to their ispCP (Internet Service Provider Control Panel) administration panel used to manage domains and files, it is more simple than cPanel and has less features but enough to get the job done, if you would like to install WordPress or a similar platform and do not know how to do it, you can request to have it installed for you at no extra cost when you order the hosting plan. The welcome email will include all the details you need to set your website, host IP to FTP files, DNS server for your domain and a URL to access webmail (RoundCube), one of the addresses is indicated as special access without leaving any logs.

    OrangeWebsite hosting control panel
    OrangeWebsite hosting control panel

    Backups are performed daily but the SQL database will have to be downloaded manually using using phpMyAdmin where the username is your database user and password is the database user password, one main difference to have into account in comparison with cPanel.

    OrangeWebsite should fulfill the needs of those longing for reasonably priced offshore free speech hosting and/or privacy email service (hosted or forwarded) located outside the EU and USA, the best part is that they accept Bitcoin payments making anonymity easier to achieve cutting payment processing companies and their silly terms and conditions out of the equation, this hosting company should also be suitable for people in need of personalised in-house support as opposed to big hosting companies where customers are just a ticket number to the staff. It should not be difficult for a customer to contact OrangeWebsite CEO if you have to.

    UPDATE 2013: OrangeWebsite is now using cPanel for webhosting.

    Visit OrangeWebsite hosting

  • Anonymous messenger chat with jTorchat

    Anonymous messenger chat with jTorchat

    jTorchat, standing for Java Torchat, is a rewrite of Torchat, a decentralized anonymous P2P messenger that works over the tor network. Being written in Java means that the code is easily carried across platforms, jTorchat should work in any operating system that has Java installed (Linux, Windows, BSD, etc), it can be used in portable mode but my Windows7 OS asked me for administrator rights to grant access to Java and allow the application through the Windows firewall, it will possibly won’t work in computers where you do not have admin rights (i.e. library, internet cafe).

    Anonymous Internet chat jtorchat
    Anonymous Internet chat jtorchat

    The settings allow you to change language interface, make links clickable, sync your buddy list and automatically start file transfers saving them to the Downloads folder, the rest of the messenger has expected basic features consisting of announcing status as away or online, adding contacts, request buddies, blacklist people and what they call “Holy contact” which means whitelisting someone, a flashing message on the Windows taskbar will warn you everytime someone joins the chat.

    At the moment there are no chatrooms but you can easily interact with other people who have marked themselves as online or broadcast a message to a whole group marked with an specific hashtag, like #linux, #torchat-help, #public, #privacy. It is also possible to use other chat commands like /nick or /help and retrieve a webpages from your buddy using the /page command but there is no support for images or html, only .txt.

    JTorChat settings
    JTorChat settings

    All users get a unique alphanumeric string randomly created by tor, based on the .onion address of a hidden service, this string is used to communicate with your buddies so that tor knows where to send the messages. jTorchat  local port can be changed to any unused one and it can work with obfsproxy, a tool  hiding the nature of the traffic to circumvent tor proxy blocking at  ISP level  by some countries.

    There wasn’t too many users when I visited jTorchat but they are relatively new and as the tool is better known it could change, something to be aware of is that you will still be browsing the Internet with your home IP, jTorchat will only route through the tor network your online chat session, be very careful if you click on a link posted by someone else in the chat.

    Visit jTorchat homepage

  • Cain & Abel Windows password cracker

    Cain & Abel Windows password cracker

    Cain&Abel is a long standing password recovery tool that can sniff passwords from the network you are in, crack encrypted passwords using dictionary, brute force and cryptanalysis attacks, record VoIP conversations creating an MP3 audio file, reveal password boxes, analyse encrypted SSH and HTTPS connections and much more. The target public are security researchers, network administrators and IT teachers but it can also be exploited by the bad guys of course, the developer will not help in illegal activities.

    I downloaded this program from the official site and AVG antivirus gave me a warning that the software contained a trojan horse, due to how password crackers work it is possible your antivirus will trigger a security warning too, it is up to you to decide what to do, I also got a popup warning from Cain&Abel saying that I had Windows firewall enabled and this would stop some features, implying that I should disable it for everything to work. You will be asked to optionally install WinPCap a packet capture library, without it Cain&Abel wireless packet sniffing won’t work.

    Cain&Abel password cracker
    Cain&Abel password cracker

     How to record a VoIP call with Cain&Abel

    To record a VoIP call with Cain&Abel go to “Configure“, click the “Sniffer” tab, select the network interface card from the list and save the settings, now go to the “Sniffer” tab in the main window choose “VoIP” and “Start Sniffing“, from now on any voice over IP call that goes through the network will be encrypted and saved as MP3, you will have to wait until enough traffic has been generated before being able to listen to the audio file.

    The configuration window can also be used to create self-signed fake digital certificates, retrieve a digital certificate using a proxy with the “Certificates Collector” or launch an ARP (Arp Poison Routing) attack with a real or spoofed IP and MAC address. This free password cracker is one of the most complete available in the market and an excellent tool to learn about computer security, everything is easily classified in tabs “Decoders“, “Network“, “Sniffer“, “Cracker“, “Traceroute“, “CCDU“, “Wireless” and “Query“, each one of those tabs contains related extra options.

    To use Cain&Abel you should have some computer security background, this is not a tool for the complete beginner, the most basic tool Cain&Abel includes is a Base64 password decoder going up to a WPA PSK (Pre-Shared Key) calculator and an RSA SecurID Token calculator, this is an excellent tool to find out about passwords, it contains a password decoder, cracker and dumper as well as hash calculators with support for Wifi for network monitoring.

    Visit Cain&Abel homepage