Tor is building an anonymous instant messenger…

tor_nsaTor, the team behind the world’s leading online anonymity service, is developing a new anonymous instant messenger client, according to documents produced at the Tor 2014 Winter Developers Meeting in Reykjavík, Iceland.  The Tor Instant Messaging Bundle (TIMB) is set to work with the open-source InstantBird messenger client in experimental builds released to the public by March 31, 2014. The developers aim to build in encrypted off-the-record chatting and then bundle the client with the general Tor Launcher in the following months.

Pidgin, an older and more popular open-source chat client, was originally considered to be the foundation of the TIMB but was thrown out in favor of InstantBird. However, Tor still plans to hire independent security contractors to audit the new software and test its mettle so that “people in countries where communication for the purpose of activism is met with intimidation, violence, and prosecution will be able to avoid the scrutiny of criminal cartels, corrupt officials, and authoritarian governments.”

Over the long term, TIMB will likely become the messenger of choice for Tor users. Software such as TorChat and BitMessage already have significant userbases and smart advocates, but with the full weight of the Tor Launcher and team behind it, there’s little reason to imagine TIMB won’t succeed.  The creation of the TIMB is yet another step in what has been a years-long improvement in Tor software. A decade ago, the anonymity program was available only to tech-savvy users who knew enough to dive into their operating system’s command line.  Now, the Tor user interface has progressed to the point that almost anyone can anonymously surf the Web with just a few clicks. If TIMB follows in those footsteps, it will be another powerful anonymity tool at the fingertips of of both the tech literate and humanity at large.

The Tor Project, a $2 million per year nonprofit consisting of 30 developers spread out over 12 countries, is pushing forward on TIMB as part of an overall initiative to make Tor even easier to use for the average person. Also in the pipeline are more localized support staff as well as “point-click-publish Hidden Services,” to make it extremely easy for anyone to create a Deep Web site.  When it comes to the sort of security that Tor provides, ease of use is of paramount importance. Many users can’t or won’t take the time to learn about encryption programs like Pretty Good Privacy (PGP), leaving themselves open to surveillance.

SOURCE – The Daily Dot

Squeaky Dolphin?

squeakydolphin-640x456Documents obtained by former NSA contractor Edward Snowden show that NSA analysts monitored content on The Pirate Bay and used the agency’s surveillance systems to track where it came from. The documents also show that the NSA’s British partners at the GCHQ used XKeyscore data as part of a surveillance program on sites that included WikiLeaks. That was part of a broader psychological profiling and targeting program to collect intelligence, influence individuals online, and disrupt groups like Anonymous that were considered threats.  The new documents show that the GCHQ conducted “broad real-time monitoring of social media activities, processing data on activities like watching YouTube videos and Facebook Likes to profile, categorize, and target individuals for psychological operations.” The NSA documents in the latest disclosure refer to monitoring for content that could be considered “malicious foreign activity.” But it’s clear that the NSA also used its XKeyscore surveillance to dig through traffic to the torrent-sharing site, and it could very well have profiled foreign users of sites like WikiLeaks and monitored their access to that and other websites.

However, the documents—one an internal NSA “frequently asked questions” Wiki page and the other a set of GCHQ slides on psychological operations—do not provide a picture of how much information about people accessing WikiLeaks was shared between the GCHQ and the NSA. And while the documents point to NSA monitoring of Pirate Bay, there’s no suggestion of how the information gathered was used or if it was used at all.  A third, unpublished document shows that the Obama administration apparently encouraged foreign governments in 2010 (including the UK) to pursue charges against WikiLeaks for the publication of diplomatic “wires” provided by Chelsea Manning, formerly known as Bradley Manning.

The GCHQ slide deck, published in 2012, highlights two tools used to conduct social networking, Web monitoring, and profiling. The first, called “Squeaky Dolphin,” pulls online activities within Web traffic caught by the agency’s monitoring systems. The monitoring systems are called “Airwolf” in the slides, which may be a UK codeword for the GCHQ’s equivalent of XKeyscore. That data includes webmail, blogs visited, YouTube views, Facebook “likes” clicked on websites themselves, and other data culled from individual users’ captured activity.

It runs those activities, captured in real-time, through IBM’s InfoSphere Streams processing software to create analytical feeds. Those feeds are then piped into a Splunk database and surfaced through a “dashboard” view that allows analysts to find trends in sentiment. As an example, the slides showed activity related to cricket matches in London and the surge in Facebook likes for Conservative member of Parliament Liam Fox. It can also be used to spot trends in traffic that might indicate upcoming events such as protests or other civil unrest.

While Squeaky Dolphin tends to look at things with a wider view, “AnticrisisGirl” is a bit more targeted. It can be used to passively monitor specific websites—including traffic to WikiLeaks, as the slides demonstrate. The tool can be tuned to a specific set of Internet user signatures or keywords, and it provides analytics of their behavior in real time, capturing search terms or direct Web addresses used to get to the sites in question.

SOURCE – arstechnica.com

NSA Proof Smartphone?

blackphoneFriends, I’m sure you all know that the NSA is reading your mail, listening in on your conversations and monitoring your activity on this very website.  I ran across an article about an upcoming smartphone called Blackphone aims to put privacy in your hands, protecting you from anyone wanting to snoop into your private data — even the NSA.  A Switzerland-based join venture between Silent Circle and Geeksphone, the project is backed by several important figures in the fields of computer security, including Phil Zimmermann, creator of data encryption protocol PGP (Pretty Good Privacy).  Blackphone is powered by a “security-oriented” Android build called PrivatOS. It’s carrier- and vendor-independent, and enables users to make and receive secure phone calls and video chats, exchange secure texts as well as transfer and store files.  Exact specifications of the phone haven’t been revealed, but Silent Circle CEO Mike Janke claims it’ll be a “high-end” smartphone.  The No. 1 priority of Blackphone isn’t its specs, however: It’s protecting users’ privacy, claims Zimmerman.  See the Video here.

“Blackphone provides users with everything they need to ensure privacy and control of their communications, along with all the other high-end smartphone features they have come to expect,” said Zimmermann.

The two companies behind the project make an interesting match. Silent Circle is a U.S.-based company focused on encryption; Geeksphone is a Spanish company behind Firefox OS developer devices.  Blackphone will be unveiled at the Mobile World Congress (MWC) in Barcelona on Feb. 24.

SOURCE – Mashable.com

UPDATE – 02/26/14 – Blackphone Unveils Super-Secure Smartphone at MWC

UPDATE – 02/27/14 – Take a closer look at the Batphone; I mean Blackphone

Malware prototype covertly jumps air gaps using inaudible sound…

mindthegapDamn!, now you have to disable your PC’s microphone!  Computer scientists have proposed a malware prototype that uses inaudible audio signals to communicate, a capability that allows the malware to covertly transmit keystrokes and other sensitive data even when infected machines have no network connection.  The proof-of-concept software—or malicious trojans that adopt the same high-frequency communication methods—could prove especially adept in penetrating highly sensitive environments that routinely place an “air gap” between computers and the outside world. Using nothing more than the built-in microphones and speakers of standard computers, the researchers were able to transmit passwords and other small amounts of data from distances of almost 65 feet. The software can transfer data at much greater distances by employing an acoustical mesh network made up of attacker-controlled devices that repeat the audio signals.

The researchers, from Germany’s Fraunhofer Institute for Communication, Information Processing, and Ergonomics, recently disclosed their findings in a paper published in the Journal of Communications. It came a few weeks after a security researcher said his computers were infected with a mysterious piece of malware that used high-frequency transmissions to jump air gaps. The new research neither confirms nor disproves Dragos Ruiu’s claims of the so-called badBIOS infections, but it does show that high-frequency networking is easily within the grasp of today’s malware.

The researchers developed several ways to use inaudible sounds to transmit data between two Lenovo T400 laptops using only their built-in microphones and speakers. The most effective technique relied on software originally developed to acoustically transmit data under water. Created by the Research Department for Underwater Acoustics and Geophysics in Germany, the so-called adaptive communication system (ACS) modem was able to transmit data between laptops as much as 19.7 meters (64.6 feet) apart. By chaining additional devices that pick up the signal and repeat it to other nearby devices, the mesh network can overcome much greater distances.

Holy catfish!  I guess now we will start seeing frequency filter utilities on all PC’s.  What about malware sniffing dogs or robots?  Just keeps getting weirder…

SOURCE – Ars Technica

LavaBit & Silent Circle launch Kickstarter initiative…

dark_mailLavabit founder Ladar Levison and Silent Circle recently began a Kickstarter initiative to help fund the development and roll out of the first Dark Mail clients.

“The Summer of Snowden may have taken the Lavabit email service offline,” the project’s Kickstarter page says, referring to National Security Agency leaker Edward Snowden, “But the lifeblood of the service is still alive and relevant to Dark Mail.”

Dark Mail is a newly proposed email protocol from Levison and Silent Circle that promises to encrypt not only the body of messages, as is the norm with today’s email encryption, but also protect the “header” metadata accompanying every message, such as the subject line, sender, recipient, and so on.  The plan is to turn Dark Mail into an open source protocol so that any email provider or client app maker can make their services Dark Mail compatible.

Metadata is one of the big weakpoints of secure email communciations , since you cannot hide it from a third-party observing Internet traffic—a fact highlighted this summer when leaks about the National Security Agency’s surveillance activities started coming to light.  The core Dark Mail ideal is that even if law enforcement forced a service provider to hand over its users’ communications, all the company could hand over would be unintelligible junk. Like other encryption schemes, only the recipient with the proper decryption keys would be able to read the message.  Levison and Silent Circle also hope that open-sourcing the Dark Mail protocol would encourage software providers to build Dark Mail capabilities into email clients, and that in turn will make using encrypted communication as seamless as using Gmail or Outlook.com is now. Current efforts to encrypt the body of email messages requires at least a modicum of technical knowledge and a willingness to troubleshoot potential set-up problems.

The Dark Mail Kickstarter campaign hopes to raise $196,608 to clean up the Lavabit secure webmail source code and build in the Dark Mail protocol. The campaign would also fund development of the first Dark Mail clients for numerous platforms, including Windows, OS X, Linux, iOS, and Android. Pledges for the campaign start at $25, which will give you access to the project’s official binary package for the apps and the Lavabit webmail code.  Pledges of $1,000 and up also give you access to the binaries in addition to technical assistance and a limited edition polo shirt.

  • Ads