Sex, Lies & Instant Messenger v3
Upcoming SlideShare
Loading in...5
×
 

Sex, Lies & Instant Messenger v3

on

  • 474 views

 

Statistics

Views

Total Views
474
Views on SlideShare
474
Embed Views
0

Actions

Likes
0
Downloads
9
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Sex, Lies & Instant Messenger v3 Sex, Lies & Instant Messenger v3 Presentation Transcript

  • sex, lies, & instant-messenger @alecmuffett www.alecmuffett.com green lane security www.greenlanesecurity.com v3.0@alecmuffett sex, lies and instant messenger
  • What should come of this?@alecmuffett sex, lies and instant messenger
  • When using the Web for private communication...@alecmuffett sex, lies and instant messenger
  • be aware 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  • be aware 2) what risks you protecting against?@alecmuffett sex, lies and instant messenger
  • be aware 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  • Goal “Keep control of your data.”@alecmuffett sex, lies and instant messenger
  • disclaimer (1) Almost all examples appearing in this work are fictitious. Any resemblance to real events or to real persons, living or dead, is probably coincidental.@alecmuffett sex, lies and instant messenger
  • disclaimer (2) Advice given here is necessarily incomplete; information security is a huge discipline and a full set of risks cannot be conveyed in 30 minutes.@alecmuffett sex, lies and instant messenger
  • 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  • passwords!@alecmuffett sex, lies and instant messenger
  • do not use secrets as passwords!@alecmuffett sex, lies and instant messenger
  • my history • Crack • First “smart” password cracker • 1991..96 • http://tinyurl.com/2jnzpy • CrackLib • password checking library • 1994..now@alecmuffett sex, lies and instant messenger
  • issue passwords are secret, but...@alecmuffett sex, lies and instant messenger
  • issue ...secrets make bad passwords@alecmuffett sex, lies and instant messenger
  • passwords guessable@alecmuffett sex, lies and instant messenger
  • 000000 1 1111 11111 111111 11111111 112233 123 123123 123321 1234 12345 123456 1234567 12345678 123456789 123abc 123qwe 1q2w3e 1q2w3e4r 222222 55555 654321 666666 7777 7777777 a aaaaaa abc123 adidas admin amanda andrew angel angel1 angels anthony apple asdf asdfasdf asdfgh ashley asshole austin baby bailey banana bandit baseball batman benjamin biteme blabla blahblah blessed blessing blink182 bubbles buster canada cassie charlie cheese chelsea chicken chris christ church cocacola compaq computer cookie cool corvette creative dakota dallas daniel danielle david destiny dexter diamond digital dragon eminem emmanuel enter faith flower foobar football football1 forever forum freedom friend friends fuckoff fuckyou fuckyou1 gateway genesis george ginger god google grace green guitar hahaha hallo hannah happy hardcore harley heaven hello hello1 helpme hockey hope hotdog hunter ilovegod iloveyou iloveyou! iloveyou1 iloveyou2 internet james jasmine jason jasper jennifer jessica jesus jesus1 john john316 jordan jordan23 joseph joshua junior justin killer kitten knight letmein london looking love lovely loving lucky maggie master matrix matthew maverick maxwell merlin michael michelle mickey microsoft mike monkey mother muffin mustang mylove myspace1 nathan nicole nintendo none nothing onelove online orange pass passw0rd password password1 peace peaches peanut pepper phpbb pokemon poop power praise prayer prince princess purple qazwsx qwert qwerty qwerty1 rachel rainbow red123 richard robert rotimi samantha sammy samuel saved scooby scooter secret shadow shalom silver single slayer smokey snoopy soccer soccer1 sparky spirit startrek starwars stella summer sunshine superman taylor test testing testtest thomas thunder tigger trinity trustno1 victory viper welcome whatever william winner wisdom zxcvbnm 250 top passwords - http://goo.gl/xPCq@alecmuffett sex, lies and instant messenger
  • “You’ll never guess my password, it’s in Klingon!”@alecmuffett sex, lies and instant messenger
  • @alecmuffett sex, lies and instant messenger
  • passwords brute-forceable@alecmuffett sex, lies and instant messenger
  • from: AAAA@alecmuffett sex, lies and instant messenger
  • to: zzzzzzzzzzzz@alecmuffett sex, lies and instant messenger
  • via: t5gn9LF$*RJ#@alecmuffett sex, lies and instant messenger
  • more than 1,000,000 guesses/second!@alecmuffett sex, lies and instant messenger
  • sometimes more than 9 billion guesses/second@alecmuffett sex, lies and instant messenger
  • google: imhoff password cracking hashcat performance@alecmuffett sex, lies and instant messenger
  • however...@alecmuffett sex, lies and instant messenger
  • password a window into your mind?@alecmuffett sex, lies and instant messenger
  • password reveals something about you?@alecmuffett sex, lies and instant messenger
  • password reflects your tastes?@alecmuffett sex, lies and instant messenger
  • password is known to your spouse?@alecmuffett sex, lies and instant messenger
  • also • reuse = self-incrimination • ...which is bad... • ...more later...@alecmuffett sex, lies and instant messenger
  • basic password discipline • use a password management tool • use 12/more random characters • use different passwords at each website • never reuse passwords • never share passwords • change annually/more often • change when someone discovers one!@alecmuffett sex, lies and instant messenger
  • next: instant messenger!@alecmuffett sex, lies and instant messenger
  • do not Skype IM with your lover!@alecmuffett sex, lies and instant messenger
  • Skype • peer to peer architecture • robust, replicated, flexible • excellent security • ...unless you’re up against the USA • ...or China • ...or maybe the UK@alecmuffett sex, lies and instant messenger
  • virtually impossible to expunge a recent conversation@alecmuffett sex, lies and instant messenger
  • deletion can make things worse messages resurrect from the dead!@alecmuffett sex, lies and instant messenger
  • (zombie data is not good)@alecmuffett sex, lies and instant messenger
  • Avoid XMPP with a lover... • Also called Jabber Protocol • Implementations: • GoogleChat • Some Facebook chat • Other systems@alecmuffett sex, lies and instant messenger
  • XMPP • Initial message is multicast • sent to all logged-in instances • eg: “hello sexy” • ...also arrives on the home PC • ...whilst you are at work@alecmuffett sex, lies and instant messenger
  • Other IM systems? • Not really wise... • AIM now multicast • YIM likewise • Go for something simple • Avoid specialist IM-client software • Use web-based systems@alecmuffett sex, lies and instant messenger
  • next: social media!@alecmuffett sex, lies and instant messenger
  • do not Twitter with your lover!@alecmuffett sex, lies and instant messenger
  • typos of doom!@alecmuffett sex, lies and instant messenger
  • D alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  • @alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  • ...and, worse...@alecmuffett sex, lies and instant messenger
  • D bob Nude! http://twitpic.com/b0gu5@alecmuffett sex, lies and instant messenger
  • Twitter App Risks • Third-party apps get access to DMs • Twitter clients... • Web Apps... • Proliferation of data is unwise • more backups • more caches • more access@alecmuffett sex, lies and instant messenger
  • do not Facebook your lover!@alecmuffett sex, lies and instant messenger
  • too easy to get wrong@alecmuffett sex, lies and instant messenger
  • Dropping Hints homepage displays with whom you communicate frequently@alecmuffett sex, lies and instant messenger
  • “Transitive trust” friends-of-friends may not be friends@alecmuffett sex, lies and instant messenger
  • Tommy Jordan! YouTube Video: Facebook Parenting: For the troubled teen@alecmuffett sex, lies and instant messenger
  • Facebook Software Ecology Facebook is not really Facebook@alecmuffett sex, lies and instant messenger
  • Analogy if you want to be private, don’t throw your diary into a pub full of gossips and journalists@alecmuffett sex, lies and instant messenger
  • next: phones!@alecmuffett sex, lies and instant messenger
  • do not smartphone with your lover!@alecmuffett sex, lies and instant messenger
  • massive comedy potential@alecmuffett sex, lies and instant messenger
  • iPhone screenlock@alecmuffett sex, lies and instant messenger
  • applications which pop-up alerts above the screenlock@alecmuffett sex, lies and instant messenger
  • Locked?@alecmuffett sex, lies and instant messenger
  • punchline:@alecmuffett sex, lies and instant messenger
  • Don’t combine this with Skype@alecmuffett sex, lies and instant messenger
  • do not go gaming with your lover!@alecmuffett sex, lies and instant messenger
  • MMORPGs • EQ • SecondLife • EVE Online • Warhammer • WoW • etc...@alecmuffett sex, lies and instant messenger
  • held to lower standard than IM@alecmuffett sex, lies and instant messenger
  • heavily-integrated software • game • webcam • voice • third party stuff • Ventrillo • Mumble • ...@alecmuffett sex, lies and instant messenger
  • game logs • logfiles are... • comprehensive • disparate • spattered all over the hard drive • ...and therefore hard to remove@alecmuffett sex, lies and instant messenger
  • next...@alecmuffett sex, lies and instant messenger
  • Geolocation can hurt you!@alecmuffett sex, lies and instant messenger
  • avoid sharing geolocation • Foursquare, Twitter, etc • “...but your Twitter messages said that you were in Essex?”@alecmuffett sex, lies and instant messenger
  • Do you have an in-car GPS? ...and do you know how to wipe it?@alecmuffett sex, lies and instant messenger
  • next, an obvious thing that’s often missed:@alecmuffett sex, lies and instant messenger
  • do not send porny naked pictures of yourselves, to each other@alecmuffett sex, lies and instant messenger
  • homebrew porn • webcam temporary copy • potentially restorable@alecmuffett sex, lies and instant messenger
  • homebrew porn • desktop copy • backup/time machine copy • image-management tool copy@alecmuffett sex, lies and instant messenger
  • homebrew porn • IM server copy • or: duplicate Skype transfers • plus: transfer logs@alecmuffett sex, lies and instant messenger
  • homebrew porn • remote copies • remote backup/time machine • remote image-management tool@alecmuffett sex, lies and instant messenger
  • homebrew porn • Took it with iPhone? • backed up to iTunes • backed up to iCloud?@alecmuffett sex, lies and instant messenger
  • homebrew porn • boyfriend’s archive copies • ...for sharing when you break up@alecmuffett sex, lies and instant messenger
  • do not use the family computer@alecmuffett sex, lies and instant messenger
  • there’s a reason it’s called a family computer@alecmuffett sex, lies and instant messenger
  • do not use work-related hardware@alecmuffett sex, lies and instant messenger
  • work hardware • not your machine • thus: “not your data” • may be taken from you • eg: bankruptcy, fired, updated • old hardware auctioned • automated backups? • network access logged?@alecmuffett sex, lies and instant messenger
  • summary@alecmuffett sex, lies and instant messenger
  • If you are going to live a double life then please do it right.@alecmuffett sex, lies and instant messenger
  • 2) what risks are you protecting against?@alecmuffett sex, lies and instant messenger
  • (apart from spouses and lawyers)@alecmuffett sex, lies and instant messenger
  • recreational computer forensics!@alecmuffett sex, lies and instant messenger
  • for teh lulz!@alecmuffett sex, lies and instant messenger
  • Things Geeks Do • Enumerate all possible URLs: • tinyurl • bit.ly • is.gd • t.co • ...and save the good ones@alecmuffett sex, lies and instant messenger
  • Things Geeks Do • Trawl... • Picasa • Twitpic • Yfrog • ...to much the same ends@alecmuffett sex, lies and instant messenger
  • Things Geeks Do • buy hardware from Ebay • undelete data files • desktops • laptops • printers (!) • storage • hard disks • thumb drives • SD cards@alecmuffett sex, lies and instant messenger
  • Things Geeks Do • buy phones from Ebay • restore deleted SMS • retrieve e-mail passwords@alecmuffett sex, lies and instant messenger
  • Find hardware in the street...@alecmuffett sex, lies and instant messenger
  • ...investigate it...@alecmuffett sex, lies and instant messenger
  • ...discover secrets.@alecmuffett sex, lies and instant messenger
  • Your challenge is to make that hard@alecmuffett sex, lies and instant messenger
  • 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  • do use separate identities, do not link identities!@alecmuffett sex, lies and instant messenger
  • create a disposable identity, start with an e-mail address@alecmuffett sex, lies and instant messenger
  • use a fake, boring, common pseudonym • good • edward wilson • carole smith • bad • sexxxy4UinBasingstoke • anything else that’s unique@alecmuffett sex, lies and instant messenger
  • is this legal? • probably breaking terms of service • is it criminal to lie? • maybe...@alecmuffett sex, lies and instant messenger
  • idea: Use a disposable Gmail account to set up a fake Yahoo account or vice-versa.@alecmuffett sex, lies and instant messenger
  • do not bookmark your secret identity@alecmuffett sex, lies and instant messenger
  • do use a random password • never used before • never use anywhere else • keep the password in your brain@alecmuffett sex, lies and instant messenger
  • do not store the secret identity password in your normal password manager!@alecmuffett sex, lies and instant messenger
  • do minimise data proliferation, do not leave footprints!@alecmuffett sex, lies and instant messenger
  • do not access your secret identity from your normal phone@alecmuffett sex, lies and instant messenger
  • iPhone • All backed up by iTunes: • SMS • call logs • geolocation (see recent press) • ...possibly password protected • You’re using a different password, yes?@alecmuffett sex, lies and instant messenger
  • Android • basically ditto • ...but backed up on Google instead@alecmuffett sex, lies and instant messenger
  • Do not access your secret identity using your normal laptop “login”@alecmuffett sex, lies and instant messenger
  • avoid intermingled filestore put no pseudonym files amongst personal files@alecmuffett sex, lies and instant messenger
  • set up different “users” • keep sensitive files in one place • ...hopefully • ...mostly • ...except for logs@alecmuffett sex, lies and instant messenger
  • set up encrypted hard disks resistant to post-Ebay forensics; do this prior to any usage@alecmuffett sex, lies and instant messenger
  • use browsers which support private browsing modes, and which delete cookies/history on exit@alecmuffett sex, lies and instant messenger
  • Example workflow:@alecmuffett sex, lies and instant messenger
  • Chrome “day-to-day”@alecmuffett sex, lies and instant messenger
  • Safari • Guests and visitors • Logging into a website without logging-out of Facebook first@alecmuffett sex, lies and instant messenger
  • Firefox • Ideal for... • porn • shagging • dubious e-mail links • security malware research@alecmuffett sex, lies and instant messenger
  • technical reference@alecmuffett sex, lies and instant messenger
  • browser settings (1) • clear cookies on exit • clear history on exit • dont accept 3rd-party cookies • block popups@alecmuffett sex, lies and instant messenger
  • browser settings (2) • dont save form input • dont save history • switch off autosuggest • set to private browser mode • ...permanently, if possible • else auto/delete cookies on exit@alecmuffett sex, lies and instant messenger
  • plugins / similar • Flash Player • Visit the security settings panel • purge Flash cookies and sites • set Flash db size to zero • HTML5 settings • set HTML5 db size to zero • watch for other/new issues@alecmuffett sex, lies and instant messenger
  • Firefox extensions • Tor • better: Tor Browser Bundle •SSL Everywhere •NoScript •RequestPolicy •AdBlock Plus •Ghostery@alecmuffett sex, lies and instant messenger
  • Adium / Pidgin for IM • use OTR encryption • not the same as OTR in GoogleChat! • solves the point-to-point chat issue • beware local logfiles@alecmuffett sex, lies and instant messenger
  • remember:@alecmuffett sex, lies and instant messenger
  • all this also applies to your phone@alecmuffett sex, lies and instant messenger
  • speaking of phones...@alecmuffett sex, lies and instant messenger
  • use a PAYG dumbphone • pay cash (where possible) • top-up with cash • enable PIN lock • avoid ... • paper billing • web integration@alecmuffett sex, lies and instant messenger
  • use voice calls@alecmuffett sex, lies and instant messenger
  • do not leave voicemails@alecmuffett sex, lies and instant messenger
  • wipe your SMS messages regularly@alecmuffett sex, lies and instant messenger
  • dumbphone SMS • lowest common denominator • messages still logged on backend • but overall exposure is less@alecmuffett sex, lies and instant messenger
  • if you must use smartphone • do not link this phone to your usual Google Account@alecmuffett sex, lies and instant messenger
  • if you must use smartphone • check out: • WhatsApp • TigerText • ...other SMS replacements • take time to understand how they work@alecmuffett sex, lies and instant messenger
  • finally...@alecmuffett sex, lies and instant messenger
  • decommission old hardware • computers • DBAN - Darik’s Boot & Nuke • Free suicide pill / CDROM for PCs • phones • Remove SIM • SMS may be on SIM as well as phone! • Check whether factory reset actually works • if not, smash it & drive a car over it repeatedly@alecmuffett sex, lies and instant messenger
  • bottom lines • the more copies of data exist • the harder it is to remove them • when data escapes your control • its available forever@alecmuffett sex, lies and instant messenger
  • when mistakes happen... • clean up calmly • do not amplify the mistake@alecmuffett sex, lies and instant messenger
  • remember • your lover has the same data • but may not be taking care of it • educate them gently • his/her systems will also one day be sold on eBay@alecmuffett sex, lies and instant messenger
  • So why must you actually know all this?@alecmuffett sex, lies and instant messenger
  • Well...@alecmuffett sex, lies and instant messenger
  • - shagging@alecmuffett sex, lies and instant messenger
  • - journalists and sources@alecmuffett sex, lies and instant messenger
  • - employees and whistleblowers@alecmuffett sex, lies and instant messenger
  • - activists in repressive regimes@alecmuffett sex, lies and instant messenger
  • - good data hygiene@alecmuffett sex, lies and instant messenger
  • - separating work and home data/life@alecmuffett sex, lies and instant messenger
  • @alecmuffett sex, lies and instant messenger
  • Future@alecmuffett sex, lies and instant messenger
  • ...?@alecmuffett sex, lies and instant messenger
  • bonne chance@alecmuffett sex, lies and instant messenger