Sex, Lies and Instant Messenger mk II

3,084 views

Published on

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
3,084
On SlideShare
0
From Embeds
0
Number of Embeds
914
Actions
Shares
0
Downloads
5
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Sex, Lies and Instant Messenger mk II

  1. 1. this slide intentionally left blank@alecmuffett sex, lies and instant messenger
  2. 2. sex, lies, & instant-messenger @alecmuffett www.alecmuffett.com green lane security www.greenlanesecurity.com v2.0@alecmuffett sex, lies and instant messenger
  3. 3. What should come of this?@alecmuffett sex, lies and instant messenger
  4. 4. When using the Web for private communication...@alecmuffett sex, lies and instant messenger
  5. 5. be aware 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  6. 6. be aware 2) what risks you protecting against?@alecmuffett sex, lies and instant messenger
  7. 7. be aware 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  8. 8. Goal “Keep control of your data.”@alecmuffett sex, lies and instant messenger
  9. 9. disclaimer (1) All examples appearing in this work are fictitious. Any resemblance to real events or to real persons, living or dead, is mostly coincidental.@alecmuffett sex, lies and instant messenger
  10. 10. disclaimer (2) Advice given here is necessarily incomplete; information security is a huge discipline and a full set of risks cannot be conveyed in 30 minutes.@alecmuffett sex, lies and instant messenger
  11. 11. 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  12. 12. passwords!@alecmuffett sex, lies and instant messenger
  13. 13. do not use secrets as passwords!@alecmuffett sex, lies and instant messenger
  14. 14. my history • Crack • First “smart” password cracker • 1991..96 • http://tinyurl.com/2jnzpy • CrackLib • password checking library • 1994..now@alecmuffett sex, lies and instant messenger
  15. 15. issue passwords are secret, but...@alecmuffett sex, lies and instant messenger
  16. 16. issue ...secrets make bad passwords@alecmuffett sex, lies and instant messenger
  17. 17. passwords guessable@alecmuffett sex, lies and instant messenger
  18. 18. 000000 1 1111 11111 111111 11111111 112233 123 123123 123321 1234 12345 123456 1234567 12345678 123456789 123abc 123qwe 1q2w3e 1q2w3e4r 222222 55555 654321 666666 7777 7777777 a aaaaaa abc123 adidas admin amanda andrew angel angel1 angels anthony apple asdf asdfasdf asdfgh ashley asshole austin baby bailey banana bandit baseball batman benjamin biteme blabla blahblah blessed blessing blink182 bubbles buster canada cassie charlie cheese chelsea chicken chris christ church cocacola compaq computer cookie cool corvette creative dakota dallas daniel danielle david destiny dexter diamond digital dragon eminem emmanuel enter faith flower foobar football football1 forever forum freedom friend friends fuckoff fuckyou fuckyou1 gateway genesis george ginger god google grace green guitar hahaha hallo hannah happy hardcore harley heaven hello hello1 helpme hockey hope hotdog hunter ilovegod iloveyou iloveyou! iloveyou1 iloveyou2 internet james jasmine jason jasper jennifer jessica jesus jesus1 john john316 jordan jordan23 joseph joshua junior justin killer kitten knight letmein london looking love lovely loving lucky maggie master matrix matthew maverick maxwell merlin michael michelle mickey microsoft mike monkey mother muffin mustang mylove myspace1 nathan nicole nintendo none nothing onelove online orange pass passw0rd password password1 peace peaches peanut pepper phpbb pokemon poop power praise prayer prince princess purple qazwsx qwert qwerty qwerty1 rachel rainbow red123 richard robert rotimi samantha sammy samuel saved scooby scooter secret shadow shalom silver single slayer smokey snoopy soccer soccer1 sparky spirit startrek starwars stella summer sunshine superman taylor test testing testtest thomas thunder tigger trinity trustno1 victory viper welcome whatever william winner wisdom zxcvbnm 250 top passwords - http://goo.gl/xPCq@alecmuffett sex, lies and instant messenger
  19. 19. “You’ll never guess my password, it’s in Klingon!”@alecmuffett sex, lies and instant messenger
  20. 20. @alecmuffett sex, lies and instant messenger
  21. 21. passwords brute-forceable@alecmuffett sex, lies and instant messenger
  22. 22. from: AAAA@alecmuffett sex, lies and instant messenger
  23. 23. to: zzzzzzzzzzzz@alecmuffett sex, lies and instant messenger
  24. 24. via: t5gn9LF$*RJ#@alecmuffett sex, lies and instant messenger
  25. 25. more than 1,000,000 guesses/second!@alecmuffett sex, lies and instant messenger
  26. 26. sometimes more than 2 billion guesses/second ( google: imhoff password cracking )@alecmuffett sex, lies and instant messenger
  27. 27. however...@alecmuffett sex, lies and instant messenger
  28. 28. password a window into your mind?@alecmuffett sex, lies and instant messenger
  29. 29. password reveals something about you?@alecmuffett sex, lies and instant messenger
  30. 30. password reflects your tastes?@alecmuffett sex, lies and instant messenger
  31. 31. password is known to your spouse?@alecmuffett sex, lies and instant messenger
  32. 32. also • reuse = self-incrimination • ...which is bad... • ...more later...@alecmuffett sex, lies and instant messenger
  33. 33. basic password discipline • use a password management tool • use 12/more random characters • use different passwords at each website • never reuse passwords • never share passwords • change annually/more often • change when someone discovers one!@alecmuffett sex, lies and instant messenger
  34. 34. next: instant messenger!@alecmuffett sex, lies and instant messenger
  35. 35. do not Skype IM with your lover!@alecmuffett sex, lies and instant messenger
  36. 36. Skype • peer to peer architecture • robust, replicated, flexible • excellent security • ...unless you’re up against the USA • ...or China • ...or maybe the UK@alecmuffett sex, lies and instant messenger
  37. 37. virtually impossible to expunge a recent conversation@alecmuffett sex, lies and instant messenger
  38. 38. deletion can make things worse messages resurrect from the dead!@alecmuffett sex, lies and instant messenger
  39. 39. (zombie data is not good)@alecmuffett sex, lies and instant messenger
  40. 40. Avoid XMPP with a lover... • Also called Jabber Protocol • Implementations: • GoogleChat • Some Facebook chat • Other systems@alecmuffett sex, lies and instant messenger
  41. 41. XMPP • Initial message is multicast • sent to all logged-in instances • eg: “hello sexy” • ...also arrives on the home PC • ...whilst you are at work@alecmuffett sex, lies and instant messenger
  42. 42. Other IM systems? • Not really wise... • AIM now multicast • YIM likewise • Go for something simple • Avoid specialist IM-client software • Use web-based systems@alecmuffett sex, lies and instant messenger
  43. 43. next: social media!@alecmuffett sex, lies and instant messenger
  44. 44. do not Twitter with your lover!@alecmuffett sex, lies and instant messenger
  45. 45. typos of doom!@alecmuffett sex, lies and instant messenger
  46. 46. D alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  47. 47. @alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  48. 48. ...and, worse...@alecmuffett sex, lies and instant messenger
  49. 49. D bob Nude! http://twitpic.com/b0gu5@alecmuffett sex, lies and instant messenger
  50. 50. Twitter App Risks • Third-party apps get access to DMs • Twitter clients... • Web Apps... • Proliferation of data is unwise • more backups • more caches • more access@alecmuffett sex, lies and instant messenger
  51. 51. do not Facebook your lover!@alecmuffett sex, lies and instant messenger
  52. 52. too easy to get wrong@alecmuffett sex, lies and instant messenger
  53. 53. Dropping Hints homepage displays with whom you communicate frequently@alecmuffett sex, lies and instant messenger
  54. 54. “Transitive trust” friends-of-friends may not be friends@alecmuffett sex, lies and instant messenger
  55. 55. Facebook Software Ecology Facebook is not really Facebook@alecmuffett sex, lies and instant messenger
  56. 56. Analogy if you want to be private, don’t throw your diary into a pub full of gossips and journalists@alecmuffett sex, lies and instant messenger
  57. 57. next: phones!@alecmuffett sex, lies and instant messenger
  58. 58. do not smartphone with your lover!@alecmuffett sex, lies and instant messenger
  59. 59. massive comedy potential@alecmuffett sex, lies and instant messenger
  60. 60. iPhone screenlock@alecmuffett sex, lies and instant messenger
  61. 61. applications which pop-up alerts above the screenlock@alecmuffett sex, lies and instant messenger
  62. 62. Locked?@alecmuffett sex, lies and instant messenger
  63. 63. punchline:@alecmuffett sex, lies and instant messenger
  64. 64. Don’t combine this with Skype@alecmuffett sex, lies and instant messenger
  65. 65. do not go gaming with your lover!@alecmuffett sex, lies and instant messenger
  66. 66. MMORPGs • EQ • SecondLife • EVE Online • Warhammer • WoW • etc...@alecmuffett sex, lies and instant messenger
  67. 67. held to lower standard than IM@alecmuffett sex, lies and instant messenger
  68. 68. heavily-integrated software • game • voice • webcam • other third party stuff@alecmuffett sex, lies and instant messenger
  69. 69. game logs • logfiles are... • comprehensive • disparate • spattered all over the hard drive • ...and therefore hard to remove@alecmuffett sex, lies and instant messenger
  70. 70. next...@alecmuffett sex, lies and instant messenger
  71. 71. Geolocation can hurt you!@alecmuffett sex, lies and instant messenger
  72. 72. avoid sharing geolocation • Foursquare, Twitter, etc • “...but your Twitter messages said that you were in Essex?”@alecmuffett sex, lies and instant messenger
  73. 73. Do you have an in-car GPS? ...and do you know how to wipe it?@alecmuffett sex, lies and instant messenger
  74. 74. next, an obvious thing that’s often missed:@alecmuffett sex, lies and instant messenger
  75. 75. do not send porny naked pictures of yourselves, to each other@alecmuffett sex, lies and instant messenger
  76. 76. homebrew porn • webcam temporary copy • potentially restorable@alecmuffett sex, lies and instant messenger
  77. 77. homebrew porn • desktop copy • backup/time machine copy • image-management tool copy@alecmuffett sex, lies and instant messenger
  78. 78. homebrew porn • IM server copy • or: duplicate Skype transfers • plus: transfer logs@alecmuffett sex, lies and instant messenger
  79. 79. homebrew porn • remote copies • remote backup/time machine • remote image-management tool@alecmuffett sex, lies and instant messenger
  80. 80. homebrew porn • Took it with iPhone? • backed up to iTunes • backed up to iCloud?@alecmuffett sex, lies and instant messenger
  81. 81. homebrew porn • boyfriend’s archive copies • ...for sharing when you break up@alecmuffett sex, lies and instant messenger
  82. 82. do not use the family computer@alecmuffett sex, lies and instant messenger
  83. 83. there’s a reason it’s called a family computer@alecmuffett sex, lies and instant messenger
  84. 84. do not use work-related hardware@alecmuffett sex, lies and instant messenger
  85. 85. work hardware • not your machine • thus: “not your data” • may be taken from you • eg: bankruptcy, fired, updated • old hardware auctioned • automated backups? • network access logged?@alecmuffett sex, lies and instant messenger
  86. 86. summary@alecmuffett sex, lies and instant messenger
  87. 87. IF YOU ARE GOING TO LIVE A DOUBLE LIFE, THEN PLEASE DO IT RIGHT.@alecmuffett sex, lies and instant messenger
  88. 88. 2) what risks are you protecting against?@alecmuffett sex, lies and instant messenger
  89. 89. (apart from spouses and lawyers)@alecmuffett sex, lies and instant messenger
  90. 90. recreational computer forensics!@alecmuffett sex, lies and instant messenger
  91. 91. for teh lulz!@alecmuffett sex, lies and instant messenger
  92. 92. Things Geeks Do • Enumerate all possible URLs: • tinyurl • bit.ly • is.gd • t.co • ...and save the good ones@alecmuffett sex, lies and instant messenger
  93. 93. Things Geeks Do • Trawl... • Picasa • Twitpic • Yfrog • ...to much the same ends@alecmuffett sex, lies and instant messenger
  94. 94. Things Geeks Do • buy hardware from Ebay • undelete data files • desktops • laptops • printers (!) • storage • hard disks • thumb drives • SD cards@alecmuffett sex, lies and instant messenger
  95. 95. Things Geeks Do • buy phones from Ebay • restore deleted SMS • retrieve e-mail passwords@alecmuffett sex, lies and instant messenger
  96. 96. Find hardware in the street...@alecmuffett sex, lies and instant messenger
  97. 97. ...investigate it...@alecmuffett sex, lies and instant messenger
  98. 98. ...discover secrets.@alecmuffett sex, lies and instant messenger
  99. 99. Your challenge is to make that hard@alecmuffett sex, lies and instant messenger
  100. 100. 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  101. 101. do use separate identities, do not link identities!@alecmuffett sex, lies and instant messenger
  102. 102. create a disposable identity, start with an e-mail address@alecmuffett sex, lies and instant messenger
  103. 103. use a fake, boring, common pseudonym • good • edward wilson • carole smith • bad • sexxxy4UinBasingstoke • anything else that’s unique@alecmuffett sex, lies and instant messenger
  104. 104. is this legal? • probably breaking terms of service • is it criminal to lie? • maybe...@alecmuffett sex, lies and instant messenger
  105. 105. idea: Use a disposable Gmail account to set up a fake Yahoo account or vice-versa.@alecmuffett sex, lies and instant messenger
  106. 106. do not bookmark your secret identity@alecmuffett sex, lies and instant messenger
  107. 107. do use a random password • never used before • never use anywhere else • keep the password in your brain@alecmuffett sex, lies and instant messenger
  108. 108. do not store the secret identity password in your normal password manager!@alecmuffett sex, lies and instant messenger
  109. 109. do minimise data proliferation, do not leave footprints!@alecmuffett sex, lies and instant messenger
  110. 110. do not access your secret identity from your normal phone@alecmuffett sex, lies and instant messenger
  111. 111. iPhone • All backed up by iTunes: • SMS • call logs • geolocation (see recent press) • ...possibly password protected • You’re using a different password, yes?@alecmuffett sex, lies and instant messenger
  112. 112. Android • basically ditto • ...but backed up on Google instead@alecmuffett sex, lies and instant messenger
  113. 113. Do not access your secret identity using your normal laptop “login”@alecmuffett sex, lies and instant messenger
  114. 114. avoid intermingled filestore@alecmuffett sex, lies and instant messenger
  115. 115. set up different “users” • keep sensitive files in one place • ...hopefully • ...mostly • ...except for logs@alecmuffett sex, lies and instant messenger
  116. 116. set up encrypted hard disks resistant to post-Ebay forensics@alecmuffett sex, lies and instant messenger
  117. 117. use browsers which support private browsing modes, which delete cookies & history on exit@alecmuffett sex, lies and instant messenger
  118. 118. example workflow@alecmuffett sex, lies and instant messenger
  119. 119. Chrome “day-to-day”@alecmuffett sex, lies and instant messenger
  120. 120. Safari • Guests and visitors • Logging into a website without logging-out of Facebook first@alecmuffett sex, lies and instant messenger
  121. 121. Firefox • Ideal for... • porn • shagging • dubious e-mail links • security malware research@alecmuffett sex, lies and instant messenger
  122. 122. technical reference@alecmuffett sex, lies and instant messenger
  123. 123. browser settings (1) • clear cookies on exit • clear history on exit • dont accept 3rd-party cookies • block popups@alecmuffett sex, lies and instant messenger
  124. 124. browser settings (2) • dont save form input • dont save history • switch off autosuggest • set to private browser mode • ...permanently, if possible • else auto/delete cookies on exit@alecmuffett sex, lies and instant messenger
  125. 125. plugins / similar • Flash Player • Visit the security settings panel • purge Flash cookies and sites • set Flash db size to zero • HTML5 settings • set HTML5 db size to zero • watch for other/new issues@alecmuffett sex, lies and instant messenger
  126. 126. Firefox extensions • Tor • better: Tor Browser Bundle •SSL Everywhere •NoScript •RequestPolicy •AdBlock Plus •Ghostery@alecmuffett sex, lies and instant messenger
  127. 127. Adium / Pidgin for IM • use OTR encryption • not the same as “OTR” in GoogleChat! • can solve the point-to-point chat issue@alecmuffett sex, lies and instant messenger
  128. 128. remember:@alecmuffett sex, lies and instant messenger
  129. 129. all this also applies to your phone@alecmuffett sex, lies and instant messenger
  130. 130. speaking of phones...@alecmuffett sex, lies and instant messenger
  131. 131. use a PAYG dumbphone • pay cash (where possible) • top-up with cash • enable PIN lock • avoid ... • paper billing • web integration@alecmuffett sex, lies and instant messenger
  132. 132. use voice calls@alecmuffett sex, lies and instant messenger
  133. 133. do not leave voicemails@alecmuffett sex, lies and instant messenger
  134. 134. wipe your SMS messages regularly@alecmuffett sex, lies and instant messenger
  135. 135. dumbphone SMS • lowest common denominator • messages still logged on backend • but overall exposure is less@alecmuffett sex, lies and instant messenger
  136. 136. if you must use smartphone • don’t link to your normal Google Account@alecmuffett sex, lies and instant messenger
  137. 137. if you must use smartphone • check out: • WhatsApp • TigerText • other SMS replacements@alecmuffett sex, lies and instant messenger
  138. 138. finally...@alecmuffett sex, lies and instant messenger
  139. 139. decommission old hardware! • computers • DBAN - Darik’s Boot & Nuke • Free suicide pill / CDROM for PCs • phones • Remove SIM • SMS may be on SIM as well as phone! • Check whether factory reset actually works • if not, smash it and drive a car over it repeatedly@alecmuffett sex, lies and instant messenger
  140. 140. bottom line • the more copies of data exist • the harder it is to remove them • when data escapes your control • its available forever@alecmuffett sex, lies and instant messenger
  141. 141. when mistakes happen... • clean up calmly • do not amplify the mistake@alecmuffett sex, lies and instant messenger
  142. 142. remember • your lover has the same data • but may not be taking care of it • educate them gently • his/her systems will also one day be sold on eBay@alecmuffett sex, lies and instant messenger
  143. 143. so why must you actually know all this?@alecmuffett sex, lies and instant messenger
  144. 144. answer...@alecmuffett sex, lies and instant messenger
  145. 145. 1) shagging@alecmuffett sex, lies and instant messenger
  146. 146. 2) journalists and sources@alecmuffett sex, lies and instant messenger
  147. 147. 3) employees and whistleblowers@alecmuffett sex, lies and instant messenger
  148. 148. 4) activists in repressive regimes@alecmuffett sex, lies and instant messenger
  149. 149. 5) separating work and home data/life@alecmuffett sex, lies and instant messenger
  150. 150. 6) good data hygiene@alecmuffett sex, lies and instant messenger
  151. 151. bonne chance@alecmuffett sex, lies and instant messenger

×