What's new
  • ICMag with help from Landrace Warden and The Vault is running a NEW contest in November! You can check it here. Prizes are seeds & forum premium access. Come join in!

Advanced Computer Security: How to Remove and Sever the Trail of Evidence

Crake

Member
Hi all. Thanks for adding to the discussion. You've brought up some very good points that I neglected to mention, such as MAC address and using virtualized instances of operating systems.

I just wanted to take a moment to reassure you that Tor (and most other proxies) will indeed mask your MAC address. As your packet is forwarded through each node in the proxy, its header information is replaced with that of the node's.

golden, I don't think it's necessary to delete your posts. You've added some valuable discussion. I'm gad you brought up Linux and other operating systems since I didn't mention them out of the original post. I'm glad you are expanding your horizons in regards to operating systems.

There are certainly merits to using a lightweight *nix distro such as Knoppix or a virtualized instance of windows--namely the fact that they leave very little behind (though it's worth mentioning that they still have their vulnerabilities, such as cold boot attacks). However, one's choice of operating system is of little relevance. The user's umbilical to the outside world has very few variables. A TCP/IP packet header (especially IPv6) only contains enough information to get the packet from point A to point B validly.

What is important is one's adeptness with their choice operating system. This means knowing:
-which processes are running on your machine so that nothing is occurring without your awareness,
-there are no processes broadcasting logged keystrokes to an outside source,
-there are no processes listening for an incoming packet on an arbitrary port to instantiate some malicious code,
-exactly what your operating system is doing with its knowledge of your usage.

To be honest, I feel safest on a Windows machine. The reason for this is that it is not open source. Microsoft's reputation depends on providing a safe environment for its clients. I'm not talking about the average joe. I'm talking about which operating system big business operations like the NSA will choose. Microsoft doesn't want to lose its big spenders. What this means is that I know the kernel I'm running has no malicious code embedded in it. The likelihood of malicious code running on closed-source code in a competitive market is lower because businesses have their reputations at stake. Vulnerabilities do arise, of course, but should you follow any system administration websites, you'll find that far fewer arise on Windows machines than they do on Linux machines. Also, I know that no one is able to insert a windows CD and change my root password, like one can on a Linux machine.

I'm glad you brought up the topic of Wireless networks, which is also a certainly a potential area of vulnerability. A WPA method of encryption with a 26 byte passkey of varying numbers, symbols, and cased alphas should suffice for any home network. But of course, to eliminate the threat of man-in-the-middle or other wireless attacks, simply stay hardwired.
 

h&r

Member
you guys didnt follow what golden was saying at all, and I dont feel like rehashing it...and all these things are case by case basis, boil it all down to - do you research if your gonna put yourself outthere...

a few points that matter little... and i wont even comment on m$ and NSA...soo funny

You have been misinformed. It is very easy to change your Mac address, you just have to run Mac MakeUp on Windows, or follow a HOWTO for Backtrack 3 regarding WiFi network penetration and you'll see how to change the silly Mac.

u Can change MAC from commandline on linux, no extra prog needed, chalk up another point to leave m$ alone

So, yes, make sure you use a long and complicated WEP key if you have to use a wireless network. A 26 byte passkey of varying numbers, symbols, and cased alphas should suffice for any home network.

A complicated pass of same bit length takes just as long to crack as all 1s, as its cracked by polling algorithms derived from ack data from the default gateway, test it out on your own router.
 

h&r

Member
btw cannabi, may want to use a lil discretion with names like BT3, dont need all the kiddies outthere trying to XSS this site now do we, cuz theyll likely find an in, and may just look thru YOUR account
 

cannabi

Member
The thing about M$ is that they're just trying to keep LEO off their backs with regards to not providing an easy method for changing MAC, etc.

Thing is, if they don't know about BT3 til now, I'm kinda doubting they'll easily figure any exploits for this site, furthermore I was pretty sure Gypsy Nirvana said that this site doesn't maintain logs at all, so even if they figure an in, it'll be rather useless to them. (I could be mistaken on that issue, though.)
 
G

growcodile

Wireless networks. As golden and cannibi mentioned, wireless networks are a potential node of vulnerability. To feel truly secure, one should eliminate this potential by staying wired. If it's impossible to be wired, a home network should use a strong security method such as WPA or WEP with a very difficult-to-crack passkey that is changed regularly.

WEP is very unsafe, you can break keys in minutes ...
 
G

growcodile

If I've gotta use a software program to change the MAC, I think I'll keep things the way they are. Thanks for the info.

just a bit ago you stated it cant be changed now using a program/tool to do it is too much ?
 
G

growcodile


i wont .. read the concept and you will see that in the case of plausible deniability you are ABLE to give keys to the not hidden volume .. with only legal stuff on it ..
 
G

growcodile

thats all irrelevant and only concept until a legal precedent takes place meanwhile people are in jail on previous precedents

bro nobody in those news stories used plausible deniability!! its a 100% working concept ...
 
G

growcodile

everywhere where ppl use TRUECRYPT + hidden containers .. you dont hear in the news about these ppl ofcourse ...
 
E

Evades Capture

People should remember that one way LEO is limited in their snooping is the fact that they have to take into account the costs of their enterprise as a matter of accountability to the public purse. You can't just throw countless man-hours at an investigation if there is limited evidence that a conviction will result.

The question is then, what is a threat to you, personally, on the internet and when using a computer?

In my opinion, these are the main GENERAL threats:

1.) Identity theft/fraud

Shopping online is a motherfucker, do it at your own risk.

2.) Legal problems from sharing copyrighted media

One of two situations where you may be targeted strictly for the CONTENT of the data you are sending or receiving. A picture of a pot-plant is nothing, but if someone has a copyright on it, then it might be a problem.

3.) Sharing illegal content.

Usually childporn, and if you have that on your comp then go fuck yourself. But there is other legally restricted data - privileged information (Valerie Plame, anyone?), weapons designs, some kinds of software, identification and banknote templates in some jurisdictions, terrorist propaganda in some jurisdictions, etc.

But what is a threat on ICMAG?

I think the number one threat would be you pissing someone off and showing off a juicy target (Grow diary, etc) and them hacking into icmag to get your info. This is why it is important to not get in flamewars on the internet when sharing sensitive information, I'm serious! While I'm sure icmag is as secure as possible, the fact is that a determined hacker can get at the data, and get your information - every system has holes and backdoors. If you can hack a bit and you know the right vulnerability sites, you can squat on them until something comes up for vBulletin, for instance, and launch an attack before icmag patches up. Or, if you have money, you go through the right channels (helps if you speak Portuguese or any number of Eastern European languages, though usually English services can be found), it is easy as shit to buy full identity profiles.

So play nice, keep your posting non-specific, and keep your sensitive data and grow-ops separate from your netbox! Then and only then, move on to the advanced defenses explored by posters above.
 

Crake

Member
WEP is very unsafe, you can break keys in minutes ...
Growcodile, thanks for correcting me. I actually came here to hoping I'd be able to correct myself before anyone caught this. But you're right, WEP is very unsafe and only requires some packet observation to crack.
 
G

growcodile

ooops dude! you seriously have no (technical) understanding of the concept truecrypt / hidden volumes have ... too bad for you, could have saved YOUR ass too! :dunno:
 

Latest posts

Latest posts

Top