Detecting and Defending Your Privacy Against State-Actor Surveillance
•Download as ODP, PDF•
1 like•1,698 views
This is a review of recently leaked documents that detail state-actors surveillance technologies. In the presentation I provide easy to implement actionable methods to detect state actor surveillance, and steps you can take to defend against them. (short version)
More Related Content
Recently uploaded
Recently uploaded (20)
Featured
Featured (20)
Detecting and Defending Your Privacy Against State-Actor Surveillance
- 1. Detecting & Defending Against State-Actor Surveillance Robert R @iamlei
- 3. Breakdown ● I have only 20 minutes ... ● ● ● ● ● Hardware bugs Software bugs Wifi monitoring Cell phone bugs/monitoring Conclusions
- 6. Hardware Bugs RF Bug Prevention
- 7. Hardware Bugs RF Bug Prevention
- 8. Hardware Bugs RF Bug Detection HackRF or Any Radio Frequency Monitor
- 9. Hardware Bugs Data Exfiltration COTTONMOUTH I, II, III HOWLERMONKEY GINSU FIREWALK
- 10. Persistent Compromise GODSURGE HEAD/HALLUX WATER SCHOOL/SIERRA/STUCCO MONTANA JETPLOW FEED/GOURMET/SOUFFLE TROUGH
- 14. BIOS/Firmware/CF Card Hacked? Re-Flash Devices
- 16. Cell Phone Bugs Base Stations CYCLONE CROSSBEAM, EBSR, ENTOURAGE, NEBULA, TYPHO Intelligence GENESIS, WATERWICH, CANDYGRAM
- 17. Cell Phone Bugs
- 18. Conclusions ● Bugs are detectable Many are based on attacks covered in Hacker cons ● Hard evidence is better than Hearsay I want to hear from the first person who finds one! ● Tin-Foil hats are not stylish
- 19. Further Reading & Sources ● Michael Ossmann (ossmann.blogspot.com) ● Bruce Shneier (www.schneier.com) ● http://leaksource.files.wordpress.com ● http://PrivacyTechJournal.com Harass me on twitter: @iamlei
Editor's Notes
- I've been part of the hacker 'scene' for the majority of my life now, I present a lot about security, and care a lot about civil rights, here is where the two intersect I don't take well to hearsay arguments (e.g.. someone saying “this is how it is!” without evidence) I really care about government spying, after my experience at a young age with a FBI visit to my house (that was a scare n' care, abusing the patriot act) I care more now, after holding a job where I regularly addressed inquiries (subpoena/warrants) from intelligence agencies.
- Appelbaum made a big stink at 30c3. Lots of talk about what they were using, but nothing about what to do... so this is the missing part of that talk. Released a 'catalog' of tools/bugs intelligence agencies could buy for surveillance needs. I will cover the 'how to detect', and where possible 'how to defend' against these surveillance bugs. I will hope I get bugged myself, more than deal with some crazy plot (don-pope-tinefoil-hat)
- RF transmitters, unknown frequencies Surlyspawn: Keyboard Ragemaster: VGA cable (red line) Loudauto: Embedded microphone Tawdryyard: Radio Beacon (think RFID) Defenses: RF bug sniffer, physical inspection
- HackRF Complaicaiotns: knowing frequencies
- HackRF Complaicaiotns: knowing frequencies
- HackRF Complaicaiotns: knowing frequencies
- COTTONMOUTH: Every USB bug possible GINSU: PCI bus bug HOWLERMONKEY: RF transceiver (works with other things) FIREWALK: Ethernet bug (inject traffic)
- Devices injected either directly to JTAG (godsurge), BIOS, or comapct flash cards (*montana) to provide persistent compromise on a device
- Look inside
- Look inside
- SWAP/IRATEMONK (Hard drive firmware/MR) WISTFULTOLL/DIETBOUNCE (motherboard BIOS)
- SWAP/IRATEMONK (Hard drive firmware/MR) WISTFULTOLL/DIETBOUNCE (motherboard BIOS)
- SPARROW – UAV NIGHTSTAND – More worried about pineapple's from Hack5
- CellTower Canary or Pair of pants with RF signal blocking pockets (e.g.. don't bring your devices where you dont want to be tracked)
- Remember: This is the same government that could not roll out a health insurance website.