Download as ODP, PPTX
Uploaded byRobert Rowley
Detecting and Defending Your Privacy Against State-Actor Surveillance
The document discusses various methods for detecting and defending against state-actor surveillance, highlighting issues such as hardware and software bugs, WiFi monitoring, and persistent compromise devices. It emphasizes the importance of evidence in identifying surveillance tools and suggests further reading for more information. The speaker invites engagement and discussion on the topic via Twitter.
Detecting and Defending Your Privacy Against State-Actor Surveillance
- 1. Detecting & DefendingAgainst State-Actor Surveillance Robert R @iamlei
- 2.
- 3. Breakdown ● I have only20 minutes ... ● ● ● ● ● Hardware bugs Software bugs Wifi monitoring Cell phone bugs/monitoring Conclusions
- 4.
- 5.
- 6. Hardware Bugs RF BugPrevention
- 7. Hardware Bugs RF BugPrevention
- 8. Hardware Bugs RF BugDetection HackRF or Any Radio Frequency Monitor
- 9. Hardware Bugs Data Exfiltration COTTONMOUTH I,II, III HOWLERMONKEY GINSU FIREWALK
- 10. Persistent Compromise GODSURGE HEAD/HALLUX WATER SCHOOL/SIERRA/STUCCOMONTANA JETPLOW FEED/GOURMET/SOUFFLE TROUGH
- 11.
- 12.
- 13.
- 14.
- 15.
- 16. Cell Phone Bugs BaseStations CYCLONE CROSSBEAM, EBSR, ENTOURAGE, NEBULA, TYPHO Intelligence GENESIS, WATERWICH, CANDYGRAM
- 17.
- 18. Conclusions ● Bugs are detectable Manyare based on attacks covered in Hacker cons ● Hard evidence is better than Hearsay I want to hear from the first person who finds one! ● Tin-Foil hats are not stylish
- 19. Further Reading &Sources ● Michael Ossmann (ossmann.blogspot.com) ● Bruce Shneier (www.schneier.com) ● http://leaksource.files.wordpress.com ● http://PrivacyTechJournal.com Harass me on twitter: @iamlei
Editor's Notes
- #3 I've been part of the hacker 'scene' for the majority of my life now, I present a lot about security, and care a lot about civil rights, here is where the two intersect I don't take well to hearsay arguments (e.g.. someone saying “this is how it is!” without evidence) I really care about government spying, after my experience at a young age with a FBI visit to my house (that was a scare n' care, abusing the patriot act) I care more now, after holding a job where I regularly addressed inquiries (subpoena/warrants) from intelligence agencies.
- #4 Appelbaum made a big stink at 30c3. Lots of talk about what they were using, but nothing about what to do... so this is the missing part of that talk. Released a 'catalog' of tools/bugs intelligence agencies could buy for surveillance needs. I will cover the 'how to detect', and where possible 'how to defend' against these surveillance bugs. I will hope I get bugged myself, more than deal with some crazy plot (don-pope-tinefoil-hat)
- #6 RF transmitters, unknown frequencies Surlyspawn: Keyboard Ragemaster: VGA cable (red line) Loudauto: Embedded microphone Tawdryyard: Radio Beacon (think RFID) Defenses: RF bug sniffer, physical inspection
- #7 HackRF Complaicaiotns: knowing frequencies
- #8 HackRF Complaicaiotns: knowing frequencies
- #9 HackRF Complaicaiotns: knowing frequencies
- #10 COTTONMOUTH: Every USB bug possible GINSU: PCI bus bug HOWLERMONKEY: RF transceiver (works with other things) FIREWALK: Ethernet bug (inject traffic)
- #11 Devices injected either directly to JTAG (godsurge), BIOS, or comapct flash cards (*montana) to provide persistent compromise on a device
- #12 Look inside
- #13 Look inside
- #14 SWAP/IRATEMONK (Hard drive firmware/MR) WISTFULTOLL/DIETBOUNCE (motherboard BIOS)
- #15 SWAP/IRATEMONK (Hard drive firmware/MR) WISTFULTOLL/DIETBOUNCE (motherboard BIOS)
- #16 SPARROW – UAV NIGHTSTAND – More worried about pineapple's from Hack5
- #17 CellTower Canary or Pair of pants with RF signal blocking pockets (e.g.. don't bring your devices where you dont want to be tracked)
- #19 Remember: This is the same government that could not roll out a health insurance website.