Simple Security Questions

This is the Simple Security Questions thread for simple questions. If you have a simple question and a suitable thread doesn't already exist, just post it here and someone will probably try to answer it for you. Remember to do some research before asking your question. No one wants to answer a question that a simple search can already resolve.

what are lainon's favorite resources for learning various forms of safeSecs? I know that one Lainon was getting a team together to create a guide to good opsec practices. I know there are plenty of good resources to practice various forms of hacking, and in so doing, apply that towards your own practices and netsec. but i'm curious what resources people have used to increase their knowledge of various *secs, and if they'd be willing to share them. (i'd start a /sec/ pdf thread, if i had any to offer.)

Does anybody knows about a good call spoofing service? (if its free, go ahead with it) I'd want to improve my social engineering skills

Does anyone know how much Android base phones home, without gapps? I have a DuraXE which is an Android phone masquerading as a dumbphone. I think it's just using the Android kernel and base. As far as I can tell, none of the stock apps are there. I'll be using just to make calls and to occasionally tether to a Linux laptop with a vpn. But do you think I should try to get into the hosts file and block Google domains, to try to keep it from data collecting?

>>19 check the CVE for android: http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224

>>13 1) arduino board x 1 2) arduino gsm shield x 2 3) simcard x 10 - infinity 4) build or find a multiple sim adaptor x 1 or 2. 5) setup sim-cards on shield 1 with adaptor for making calls from. 6) setup shield 2 with sim-cards to dial into (option adaptor shield) 7) connect everything up software & forward all calls from shield 2 to the multi sim shield for making calls. 8) solar power & battery life long 9) place in remote location anywhere far away from you 10) call into your box using any burner phone 11) happy social exploiting sim-card adaptors allow for multiple sim-cards to be used for sending (forwarding you calls) & receiving (accepting your calls). so you are not dialling in & out on the same numbers. i know my response does not contain links to call spoofing services.

Is PIA a good option for a vpn?

>>22 http://www.alterian.com/about/ FVEY?

>>22 Absolutely not. They're at the forefront of sponsored recommendations, and their privacy practices are fairly antithetical to the purpose behind a VPN. You get what you pay for. A decent VPN will cost. I recommend NordVPN, and have considered Mullvad though I haven't used it personally. After some small social engineering in the form of an incomplete sign up, I have a code for two years of NordVPN for $79, can share for the interested. Using a VPN running through a decent server (i.e., Switzerland) will take a toll on your speed, though. https://thatoneprivacysite.net/vpn-comparison-chart/ is a good reference.

>>24 damn, I had no idea about this whole 14 eyes thing.

>>24 friendly reminder that nordvpns key got leaked https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa >22 use tor without a vpn if at all possible if you simply must have a vpn mullvad has a good track record (it's slow but that's the price you pay) else algovpn + streisand and bulletproof hosting.

Hey Lainons, what are some good and up to date hacker/infosec zines?

>>37 I strongly recommend the Phrack Magazine. I think many of the lainons has already knew this one, right? http://phrack.org/ https://en.wikipedia.org/wiki/Phrack First published in 1985, it has became an online underground zine, the frontier of the hacker culture. This is where legendary articles like Hacker Manifesto, Smashing The Stack For Fun And Profit were published. There are both technical-oriented and spiritual/philosophical-oriented articles, the latter plays an important role and formed what we know as hacker culture. The only problem is we have less and less old-school hackers, and the update of the articles is really slow, but it is a must-read for anyone who's interested in hacker culture.

>>37 PoC or GTFO is pretty great. A lot of the articles are seriously technical though, and take a fair bit of getting your head round. https://www.pocogtfo.com/

>>43 Thanks for mentioning. Personally I think this is one of the few zines that inherited underground hacking culture... Also don't forget to read their piece of sarcasm on regression analysis. http://openwall.info/wiki/people/solar/pocorgtfo

>>29 What's wrong with using VPN + Tor? Also I'm not sure if selfhosting a VPN is a good idea. Especially for people who seed torrents alot.

>>64 There's nothing wrong with using VPN + Tor, if anything it's better to do that then what >>29 says. Multiple Letter Agencies can see _when_ you're using Tor if you're not using a VPN or something like meek: https://blog.torproject.org/blog/how-use-%E2%80%9Cmeek%E2%80%9D-pluggable-transport

>>22 There's somebody who made a spreadsheet with most of the VPN providers, their pros and cons. Check it out https://thatoneprivacysite.net/vpn-comparison-chart/

I would like some recommendations for a good anonymous email service

>>69 If you use Tor, cock.li allow you to do a anonymous account. Just remember to not put any information linkable to you. Ideally: >generate a random string # head -n 1 < /dev/urandom | base64 >get some of the characters and fill the account registration Of course, it does not mean cock.li is secure. You should use pgp, reop[1] or codecrypt[2] before send the massages. You, host your own server (pay with bitcoin and access only via tor). [1] http://www.tedunangst.com/flak/post/reop [2] https://github.com/exaexa/codecrypt

>>64 >What's wrong with using VPN + Tor? If you use VPN > Tor (in that order) there's no problem. It's a good practice if you're using IPsec (but not if using PPTP or TLS). Now, if you're using Tor > VPN (in that order), then that's bad. The main thing about Tor is that it changes in a non deterministic way it's exit nodes. If you use a VPN as you end point (the point that will actually connect with the server you're trying to GET), then people can build a profile about your traffic activity, since you have a unique IP adress (the VPN). Should only use VPN > Tor. That's my opinion, at least. Some people will disagree.

>>64 https://www.torproject.org/docs/faq.html.en#IsTorLikeAVPN >>71 >If you use VPN > Tor (in that order) there's no problem. IMO there could be, if you want to hide the fact that you are using Tor, your ISP could just use DPI and found what you are using Tor. >Now, if you're using Tor > VPN (in that order), then that's bad. Indeed it is, I use it for some websites that block Tor however. I just download a free VPN in the whonix ws, do my things and then create a new workstation although it is not that necessary.

>>76 Yep. Well said. But, I'm curious: why are you using whonix? It's much simpler to just point all your traffic to localhost and allow TorDNS. You'll not leak nothing. All these things about Whonix, and Qubes and Tails seems kinda idiot to me (except some good bits, like randomized mac address by default). Virtualization doesn't mean more security. It mean "security done the bloat way".

>>77 >But, I'm curious: why are you using whonix? I use it just to experiment, but it is really more secure. Unless an attacker manage to get out of the VM or attacks the gateway your IP is safe, someone with root privileges can bypass a firewall. >All these things about Whonix, and Qubes and Tails seems kinda idiot to me Why do you think so? There are great advantages in some of those. >Virtualization doesn't mean more security. It mean "security done the bloat way". Virtualization really means that it is more difficult for someone to get full control over your computer.

>>78 Virtualization is the bad way to do security. Let's get the Matryoshka doll analogy: you want something to be safe. Will you add more dolls to cover the layer 0 (that's where your secret stuff is) or do you want only one doll, but with much stronger security? You can still say that you want more dolls, but you're not considering one factor: the materials cost. When you put too many dolls there's too much effort to do these dolls and to maintain their security and it turns to be simple to get an exploit when you have so many "materials" (code). The right way to do it is to fortify the layer 0 with better materials, not more materials (in this analogy it would be the equivalent to use sandboxes), not to put more, entire, dolls. You can also check this thread: http://marc.info/?l=openbsd-misc&m=119318909016582&w=2 Together with the above said, the x86 virtualization is not a real virtualization. Different from other architectures like SPARC64 that had a special chip for virtualization, x86 runs virtualization on microcode. Since microcode is absolutely close source, you don't know what the fuarrrk is going on. >There are great advantages in some of those. I can see only one advantage these, and it's on Tails: the non persistence of changes. But, you can do that with other systems too, especially the runs that use ramdisk.

>>77 >All these things about Whonix, and Qubes and Tails seems kinda idiot to me Yes, it's kinda idiotic to put the system/applications in a virtual machine, rather than actually harden them. In fact, we do have underlying groundwork, such as the famed PaX/Grsecurity kernel, and recent plagiarism adoption by KSPP is a great improvement of security; userspace/compiler hardening is essential also, we already have NX, stack-protector-strong, RELRO, D_FORTIFY_SOURCE, PIC/PIE. A sandbox/virtual machine can't provide these protections, we need more of them, and we need to adopt them to systems. And systemic audits are always needed. But please understand, even with these hardening, sandboxing/virtual machine is a requirement if higher degree of security is needed, in order to restrict the damage of an exploit if it has happened. Instead of a single point of defense, we need defense in depth. Also, a PDF reader code execution can do everything a user can. Given how our operating systems, applications are designed, there is really no better way to achieve privilege separation and reasonable level of security, especially on the desktop system. Yes, if the applications and operating systems adopt a different approach to security, it will be the elegant the completely solution, but we still need FireFox to browser the web and use a Unix-like system in a foreseeable future, that is what virtualization is coming for. This xkcd comic #1200 elaborates this problem well. Also, an attacker can do a lot of things, as everyone knows, it can implant a rootkit, but what less known is, they can also insert a permanent hardware (firmware-level) malware that almost nobody can detected because it starts before any OS kernels or even bootloaders. And all of these can be done remotely, by software exploits alone. So once you have been hacked, booting from Tails CD could still gives you a compromised system. There is no effectively countermeasures, at least on x86, besides virtualization. You really need to check the "x86 considered harmful" article by a main Qube dev.

>>69 This question has been asked a thousand times on all imageboards, and on Lainchan I think we have seen this question three times. We really need to put a list of recommendation together as FAQ. But I tell you a secret I discovered occasionally: if you want to gather a list of different privacy-focused email services, you can subscribe to [tor-talk] and [tor-dev] mailing list and watch the sender addresses, and you'll find some email services you never heard before even you think you are well-informed. XD

>>82 I don't know... I understand your argument, but I think reinforce my previous one. >restrict the damage of an exploit That's why we need privsep and sandboxing. I do not disagree with the usage of privsep mechanisms, but I do disagree with the estimated 'security' people think virtualization will bring. If you need to restric the damage, don't throw thousands of LOC above the main system. That's why there is capsicum and pledge. >Instead of a single point of defense, we need defense in depth. My point is that, it's not depth. It's an illusion. If you put many lines of code, that can hardly be audited, above everything else, how is this going to help? Using a simples sandbox would be better, or, use better software that is simple enough to spot all the high risk bugs and that has privsep by default. >a PDF reader code execution can do everything a user can That's a issue for the pdf software, isn't it? Just use something better, like mupdf without the JS module and without the networking module, or, for the most paranoid, convert pdf to images then open it. >there is really no better way to achieve privilege separation and reasonable level of security, especially on the desktop system http://man.openbsd.org/pledge.2 >we still need FireFox to browse I, personally, don't. I use Links most of the time (on ion3 wm for tabs). But, I understand what you're trying to say... >And all of these can be done remotely Well, if you find some proof please send it on misc@openbsd.org It is possible to reflash your firmware with malicious code, but not remotely, unless you find some really nasty vulnerability. Also, firmware malware is not the worst. The worst is hardware trojans, that is the manipulation of the microarchtecture itself to defeat some functionality of the processor. That's way worst scenario than firmware or system vulnerability, since no one can verify that (there is some academic tests, but not really). >You really need to check the "x86 considered harmful" article by a main Qube dev. I'll check that, thanks. I can see myself support Qubes in the future if they go with seL4 VM, then that would be some interesting soykaf (even though it would still be susceptible to microcode attacks).

Mod reading: there's any possibility to move the following comments to a new thread on itself? I think that's a interesting topic to be on this thread: >>77 >>78 >>80 >>82 >>85

What are the underlying assumptions that make code exploitation possible? What exactly is happening when one tries to exploit, say, a black box? What kind of systems make this difficult? What languages make certain exploits impossible, how about operating systems and/or machines? I hope to be pointed to papers and books, thank you.

>>92 >What are the underlying assumptions that make code exploitation possible? Programming mistakes, if you want to be brief and general. Though not all programming mistakes leads to code exploits (should be obvious), and not all code exploit comes from programming mistakes (think deliberate backdoor). >What exactly is happening when one tries to exploit, say, a black box? Well, you feed it input and see how it behaves. More precisely, you can in most cases guess what the language the block box is implemented in, and then use that to your advantage. For example, if your looking for an RCE in a website, you can usually see if the website runs PHP, Python, Ruby, or whatever. If it is running PHP, and you want to see if it is vulnerable to unsafe deserialization (one vector from which RCE can be achieved), it makes no sense to send "pickled" (ie. python serialized) code. For a C program its much the same. Say you suspect a C program of being vulnerable to a buffer overflow. You can then input a very long string of A's while running the program in a debugger. You might see that it crashes with something like "invalid instruction 0x41414141", which indicates that your string of A's wrote to the executable part of the program (meaning you could substitute the A's for valid shellcode and gain code execution in that way). >What kind of systems make this difficult? Sandboxing a program mitigates the risk of a successful code exploit. That is why you analyze malware in a virtual machine. >What languages make certain exploits impossible [...] Memory safe languages (Eg. Python, Ruby) doesn't have the memory related exploits that C programs have. However, it is important to note that there's a difference in the design spec of a language, and the implementation. For example Ruby is designed to be memory safe (AFAIK), but its interpreter is usually implemented in C, so the same kinds of bugs might still arise. See for example this guys bug reports https://hackerone.com/raydot?sort_type=latest_disclosable_activity_at&filter=type%3Aall%20from%3Araydot&page=1&range=forever It is also possible to instrument a compiler with control flow analysis for the sake of assuring that the program doesn't go somewhere its not supposed to. Also, most programs are compiled with non-executable stack, so the above probably doesn't work. That still doesn't prevent ROP-based exploits https://en.wikipedia.org/wiki/Return-oriented_programming I'm not aware of a (useful) language that is 100% safe from every kind of known code exploit, in the presence of programming mistakes. >[...] how about operating systems and/or machines? Again, sandboxing helps mitigate the impact of an exploit. Something like Qubes OS might be interesting for you to look at (I think, I'm not that familiar with it). Note that even sandboxes can be broken out of (obviously --- they have also been coded by someone). A fun example is the recent DirtyCOW exploit, which someone showed could be used to escape from a docker container (granted, docker is not a security oriented "sandbox" as far as I'm aware): https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-docker-container-escape/ Your question is very general, so it's hard point you to anywhere concrete.

>>92 >What are the underlying assumptions that make code exploitation possible? Too many. There's a great number of possible ways to exploit a software. For example, buffer overflow happens when you set a cache that's bigger than you actually needed. This makes it possible to retrieve those bits not used from memory and get things like passwords. But there's many, can't cite everything. >What exactly is happening when one tries to exploit, say, a black box? What do you mean by a "black box"? Do you mean an airgapped computer? If that's the case, there's many ways to exploit an airgapped computer, such as from a physical media (usb stick, cd-rom, swapping HD's), from firmware reflashing (BIOS, Wifi firmware), from EM waves generated from this computer (attack called TEMPEST), from power source (power analysis), even from sounds that the computer do (accoustic analysis exploit). >What kind of systems make this difficult? Systems that are designed to be secure by default, such as OpenBSD and seL4. Open source firmware also helps security, such as Coreboot. For side channel attacks: faraday cage (TEMPEST), use battery (power analysis), make fake vibrations (accoustic analysis). >What languages make certain exploits impossible I assume you're talking about programming languages, right? Any language with formal proof and formal verification will make some exploits impossible (if it's proofs are down to assembly - if not, the compiler can introduce bugs). Languages with dependent-types such as Idris and ATS have formal proofs inside the language itself. Languages that is closer to logics also is less prone to exploits, such as Twelf, Lambda-prolog and functional languages, such as SML. >how about operating systems and/or machines? For OS, see above. About machines, for now we have some open hardware with closed ISA, such as Sabrelite (i.MX.6 processor) and some x86 with open firmware (such as Thinkpad's x60, T60 and x200). For real security we'll have to wait for RISC-V and, better, LowRISC. >I hope to be pointed to papers and books, thank you. too tired, just type on searx.me

>>70 Use -c instead -n if you want data from urandom. $ head -c 10 /dev/urandom | base64 will give you 10 bytes from /dev/urandom and base64 encode them.

>>86 There's currently no good way to do this, no. Besides, it's not in good form to start a thread with a message very clearly written as a reply.

>>86 Repost them.

>>118 >>119 ok, I'll repost it, thanks.

>>117 Very good, thanks to refine it.

Is it a good idea to use IPSec within your LAN network if your goal is to achieve integrity and encryption between hosts?

>>205 >Is it a good idea to use IPSec within your LAN network if your goal is to achieve integrity and encryption between hosts? I've never personally set up IPSec but I think it's a good idea if you want to restrict the devices that are allowed to be a part of your LAN and to authenticate them beyond just the MAC address. There's also no reason why you can't use additional encryption over-top of it since IPSec operates at the Internet layer, not the transport layer (i.e. you can use OpenVPN/SSH/etc. with it). I'd say go for it. I'd love to do it but my router is a bit too space-constrained at the moment to support StrongSwan.

I'm probably being too paranoid, but I'm going to be taking my first flight soon and I was thinking of possibly taking my laptop on the trip. How bad are TSA searches of laptops? I've already got whole disk encryption on it.

>>224 If you refuse to decrypt, you don't get in, if you happen to be searched. Unless you're a citizen. https://www.eff.org/wp/digital-privacy-us-border-2017

>>225 I should have mentioned that. I'm a US citizen. I just don't want to be searched and forced to enter a key and refused boarding for the flight I paid for if I don't.

Let's say I do my computing on a disk-less laptop running Tails and I want access to all my files which are stored on a file server at a hidden location, what is your recommendation for a secure and encrypted network filesystem?

>>352 Tahoe-LAFS over Tor.

>>362 Thank you. Tahoe-LAFS looks suitable for my needs.

When do you guys think seL4 will be a full desktop workstation? Is it good using gentoo hardened in the mean time.

>>402 Probably never. But it is possible if someone start to port POSIX to it. In about 15 years or so (if ever happen) I would say. Hardened gentoo is a cluster fuarrrk. Use OpenBSD mean while...

Why is my ipv6 still the same when using a vpn?

Hi Lainons, I've set up an anonymizing middlebox by following this instructions: [1] https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy [2] https://www.howtoforge.com/how-to-set-up-a-tor-middlebox-routing-all-virtualbox-virtual-machine-traffic-over-the-tor-network My goal is to torify network traffic of my Virtualbox machines. It seems to work but I'm afraid that I forgot something that would enable someone to deanonymize my traffic. Below is my configuration. Please tell me if I'm missing something. netfilter-rules.sh # Tor's TransPort TRANS_PORT="9040" # Tor's DNSPort DNS_PORT="5353" # virtual bridge interface INT_IF="vnet0" iptables -F iptables -t nat -F iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports $DNS_PORT iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 5353 -j REDIRECT --to-ports $DNS_PORT iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT # Transproxy leak fix iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "Transproxy state leak blocked: " --log-uid iptables -A OUTPUT -m state --state INVALID -j DROP iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j LOG --log-prefix "Transproxy leak blocked: " --log-uid iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j LOG --log-prefix "Transproxy leak blocked: " --log-uid iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP /etc/dnsmasq.conf port=0 interface=vnet0 except-interface=lo bind-interfaces dhcp-range=172.16.0.2,172.16.0.254,1h dhcp-option=6,172.16.0.1 /etc/network/interfaces # VirtualBox NAT bridge auto vnet0 iface vnet0 inet static address 172.16.0.1 netmask 255.255.255.0 bridge_ports none bridge_maxwait 0 bridge_fd 1 up iptables -t nat -I POSTROUTING -s 172.16.0.0/24 -j MASQUERADE down iptables -t nat -D POSTROUTING -s 172.16.0.0/24 -j MASQUERADE /etc/tor/torrc VirtualAddrNetwork 10.192.0.0/10 AutomapHostsOnResolve 1 TransPort 9040 TransListenAddress 172.16.0.1 DNSPort 5353 DNSListenAddress 172.16.0.1

>>430 You only need the rules for the NAT chain. What's dnsmasq for?

>>430 Transparent Proxies are soykaf. Use an Isolating Proxy instead. https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/IsolatingProxy

I've got an USB hard drive which contained sensible but unencrypted data using the NTFS filesystem. I plan to use the hard drive as an encrypted volume, so I erased everything using shred with 3 iterations. Is it possible to recover data that was on the drive before it got erased? (assuming that an attacker has access to forensic tools and knowledge) I'm thinking of data in broken sectors that couldn't be overwritten by shred.

>>518 If you can't write to a sector to overwrite it, obviously if someone is able to read it then that may be compromising. Destroying the drive is the only way to fix it and this is a great reason to never store unencrypted data. Note that flash drives have a similar problem because they can "retire" blocks of memory and you never know for sure where you're writing to.

Any recommendation for a personal firewall for windows and Linux (yeap, I use both systems)? In the Windows, I use the Tinywall and the GUFW in Linux

What's the worst that can happen if your identity was revealed in tor? I was trying out torsocks for the first time, and the tutorial I followed did not mention any proxy and that wget is not secure over torsocks due to identity reveal through headers. I only foundout about it after I read about it more after all the transactions were done (after an hour rip) What should I do? I'm kind of panicing, I checked my logs, there is nothing, turned off tor and torsocks, but I don't know what to do now? Disconnect and hope my IP changes? I was downloading some txt files off a e magazine website just to be clear it wasn't anything illegal or anything.

>>527 Tor isn't illegal, dude. The worst that could happen is raining when you're trying to dry your clothes, toilet water hitting your butt..i don't know. Either way, research your stuff before actually using them, look for what is actually illegal and what isn't. Tor is just a browser, anonymity is a choice and hopefully one day it will be a right, there's nothing illegal about it, in fact, most journalists use it.

>>528 Yeah I agree with that, but what I mean is like, I think I did it the wrong way, some tutorials showed them using a proxy in addition to connect to an onion site with a socket such as torsocks. And hence wget can be dangerous (as mentioned in this one website: https://www.blackmoreops.com/2015/12/28/ip-spoofing-in-kali-linux-with-torsocks/ ) I mean, it's just text files. I also don't know if I'm vulnerable at the moment since I was downloading stuff for 1 hour straight and if my real IP was revealed, I'm not sure if anyone is going after or something? I mean, thinking about it, what will the site admin will even do about that lol, probably nothing. But if tor works with different nodes and my real IP leaks, that maybe dangerous I guess. Maybe I'm overthinking it?

>>529 Also the fact that I didn't do it in tails or kali, it was my main OS. What logs should I check if I think there is any intrusion? Install some IDS software like suricata? I guess I'll put snort in my to do list to learn this summer.

>>529 You could have watched child pizza all you wanted, nothing would have happened. From what you posted you seem to have only tried to use the tor browser, that isn't illegal, you don't need proxy nor any method of hiding yourself. Tor browser is equivalent to chrome, legally speaking. If you can get arrested for using tor, you can get arrested for using chrome or internet explorer. Nobody will go after you because going after someone implies in work, effort, an IP is not enough to spark anyone's interest, it's not CSI. Chill. And also study, you seem to have some terrible misconceptions about Tor, information security and privacy.

>>531 I guess, I don't know much about it, only how it works and the onions. But after reading that wget isn't safe via torsocks, I was paranoid. I guess what you're saying is wget acts like a tor browser reading these txt files. Though, when I had my laptop server up for about a year hosting some p2p stuff, I was getting some random IPs trying to login as root over and over again. I'm assuming these are bots and not someone trying to specifically attack me. It happens anyway when you port forward your ssh I'm assuming. Thanks.

What are the pros/cons of using TorDNS instead of DNSCrypt? Which is better for security/anonymity?

>>550 DNSCrypt encrypts and authenticates lookups providing privacy and security. TorDNS uses the Tor network to handle lookups which provides privacy and anonymity, but you should never trust that the exit nodes won't do something malicious. I think that DNS lookups over Tor will be handled better in the future though.

VPN noob reporting in and I was messing up with AirVPN today. I followed the main tutorial and it was all fine, then I opened Ipleak and soyfak hit the fan. It said that I was connected to the vpn server, but it also leaked the ip of a TLA direct connected to me (and my own ip as well). As one of the main vpn services out there I'm really concerned. I really don't know if my configuration was right (probably wasn't), but sure it was the main path to connect. Any words on this? I just stopped shaking (I was just testing stuff, but still...)

>>573 When you use a VPN, you get a local IP address for the network on the other end. It's like connecting to a LAN through Internet and then going out again. No doubt the TLA you saw was IANA. Lain u silly.

>>582 Organization: DoD Network Information Center (DNIC)

>>584 If the DOD wanted to scoop up VPN traffic, they would be a little more discrete. The lookup database is probably wrong. What's the IP range?

>>587 I hope you're right. >NetRange 214.0.0.0 - 214.255.255.255 >IP that poped on ipleak 214.10.97.62

Scenario: i want to attach a meterpreter shell to boxA[target] in which i have user credentials for, but boxB[attacker] cannot port forward as i haven't cracked the router, any suggestions lainon? maybe i could use a proxy/ssh tunnel through another machine[boxC], l so something like: boxB ----> boxC ----> boxA How would i achieve this, lainon?

>>650 Good question. It all depends on the network-ability of box C to A and B, but you're spot on. There's a metasploit module to add routing (for box C) or you could use an ssh tunnel.

Someone mentioned this in another thread, > get Equation Group's ETERNALBLUE running > scan your city for open SMB ports > pwn random computer > meterpreter> webcam_list > rinse, repeat I think I can figure out everything besides the city wide port scan. How can someone scan an entire city or area?

>>667 I think by "scan city" they meant to connect to random free or unsecured WiFi APs all around the city, and not literally, "run a scan on your entire city at once"

I've recently been interested in cyber security and all its variants. But I have next to 0 knowledge on programming and the internet itself. I guess I only know half assed knowledge from being around imageboards. I know that there isn't a single easy program to follow, but I would greatly appreciate if lainons could at least tell me a good place to start from.

>>427 Are you sure your VPN provider offers IPv6 compatibility?

>>699 Basic knowledge of either unix or windows is a must have. For stuff like buffer overflows and stuff like that, a systems course would be nice to have. Once you have all of those, watch Adrian Crenshaw videos until your eyes bleed, and you'll basically be a master. For a beginner start with something like "Dirty Red Team Tricks."

>>703 Thanks lainon

>>664 thx anon, i tried to use an ssh tunnel and netcat, i couldn't manage either though. any recommended reading?

>>699 Read up how computers work : https://savannah.nongnu.org/projects/pgubook/ After that i would recommend learning C and how computer networks work. After that i would just pick a book like gray hat hacking 4th edition and go from there see what interests you in infosec. Programming knowledge is pretty much required to understand the basics.

Anyone got a torrent of the entire Vault7?

Somewhat new lurker here, I'm not quite sure if this goes here but I figure its the most appropriate place. I need to intervene for valid reasons the most I can of someone's internet activity, especially(but not limited to) said person's social media and e-mail. With my current entry level noob knowledge I reckon one way of doing this would be to put a keylogger inside the target's laptop and leave it there or make this person log into facebook and whatever else in a computer that will be already prepared to log the keystrokes and send the logs to some random e-mail and whatnot. For the first case It is be necessary to do this as fast as possible, so it would have to be already configured to send the logs to a specific email address, basically something that doesnt need any type of config after putting it in. The second option, although quite easy, is very, very unlikely to happen, and with the first method I can gather more of the info that I need. Some things to consider: Im close to this person. this is not about muh cheating gf/lets fuk this kid up lmao I can create the opportunity to put the keylogger in. There's more people involved in this, so let's say I have a ""team"". We're dealing with someone that doesn't know much about computers, OS is win10 I wanted to ask you guys if I am missing some other way of doing this, and also if I can get some directions in where to get or how to build the keylogger needed for the first case.

>>842 most social media use two step verification so the user may be notified of your login attempt of the machine wasn't authorized

>>814 >what are search engines I'll spoon-feed you this once because I didn't had the files until now and you made me look for it: Torrent: https://file.wikileaks.org/torrent/WikiLeaks-Year-Zero-2017-v1.7z.torrent Passphrase: SplinterItIntoAThousandPiecesAndScatterItIntoTheWinds

>>899 you're welcome lainon Present Day, Present Time! AHAHAHAHAHA!

Hey lains. I don't come here much at all, but i am curious about something. I am using an IPhone 6, IOS 10.xx Within the last few months there have been a number of instances where it was almost as if somebody was controlling my phone remotely, like it would automatically quit out of my application and go to some specific spot in another one. I could see the swipe and scroll animations as if somebody were actually using it in person. This only happened a few times, i was wondering if this is even something that can happen. I mean it was probably a glitch, this used to happen all of the time with my older phones when the touch screen would get fuarrrked. This time however it seemed strangely "human". It will also not let me update the OS. Tried all of the troubleshooting and no dice.

>>938 It's probably just your phone being slow and executing the actions already registered before it started lagging. Never owned an iphone so idk if it's something that happens often but I know my android phone is so slow I can literally pre-tap the screen where I want to go next and just wait lol. tl;dr probably just your phone being slow

>>938 Doesn't the iPhone 6 have a defective screen that messes up touch input? Anyway, back up your data and do a factory reset and if you still can't update take it to an Apple store.

>>959 "Touch Disease" I think they called it. Basically if it got the slightest bit bent the solder would come off of the integrated controller for touch, because they forgot to underflow the solder. Every other major phone out there has the underflow, but apple didn't do it. The bad part was when people came in to the apple store, they refused to acknowledge the issue and asked you to buy a brand new iphone

>>226 don't be stupid. make a bootable windows partition with some basic stuff and keep the encrypted personal partition behind grub with a timeout of zero or something. if you were really smart about it, you wouldn't bring your laptop, or at the very least you would keep only a base install on it and keep your personal data elsewhere.

I'm trying to hack into Sedna from vulnhub. I manage to find a vuln and get me a meterpreter shell, but I am having trouble escalating privilege. Meterpreter shell is php so I don't have access to the post modules, I also tried looking through the configs and pass-the-hash is windows. pls halp.... https://www.vulnhub.com/entry/hackfest2016-sedna,181/

I'm becoming paranoid so i want to make a USB with an encrypted partition for files and another with Tails live mounted on it. How do i do this? I use Ubuntu 16.04, I already know how to install Tails but i have no idea on how to create an encrypted partition.

>>1043 Use the Tails Installer. It will create a persistent volume for you, which is a LUKS encrypted container in a separate partition on the same USB device. https://tails.boum.org/doc/first_steps/persistence/index.en.html

>>1045 Thanks for the hint! Is it secure? I heard that there are methods to evade USB software encryption

>>1047 AFAIK that only applies to "built-in" encryption and not LUKS/dm-crypt.

I have a question on Tor bridges (non-indexed entrance nodes). Does regularly changing bridges improve or reduce my anonymity in any way? I thought it would be wise to change them every n days to thwart traffic analyzing nodes.

>>1060 Someone monitoring those bridges wouldn't be able to see your traffic, but they would be able to see when you were using tor and when you weren't. Switching bridges often would help mitigate that I think

Hello everyone, I'm here because I didn't find any way to solve this, and I'm really concerned about spreading this in other places, since gambling is illegal in my country, and I this could put me in trouble. This is the only place that I trust to share. I've had physical access to jackpots machines, and I was able to figure out some things, like the kind of database(XML), and how they store their info/system, that is a flashcard connected to an IDE port(pic related), but i can't copy the content of the system that manages the XML, I tried using dd to copy bit per bit to another usb stick, but when i try to open at my laptop it says that is in a incompatible format, and when I try to boot, it fails. After that I tried to open the original flashcard in my computer, there was two folders, DB(within all xml), and ms-root, that was empty, I even searched for hidden files, but i got no success. After that I tried to use dd again but to compile the flashcard to file.exe, .iso, .swf... Only the .iso compiled, and I've made a bootable drive, with no success again. Does anyone here can tell me how to proceed properly? Sorry for my bad english, I'm not a native speaker. If needed I can provide more information or pictures.

>>1078 try running `file` on the iso and see if it actually is an ISO. If not, try running `fdisk -l filename` on it and see if it's actually a .img file in disguise

How do I make it so users connecting to my OpenWrt network are taken to a simple html splash page? Nodogsplash etc. seem overkill.

In combination with Tor, how do you use public wi-fi the right way when doing super secret stuff? It's often suggested but I the last thing I want is for people in public to see all the secrets on my screen. And if traffic can be traced back even through Tor, I don't want camera evidence that it was me doing it. What am I missing?

>>1080 I have already tried to boot, but didn't work. When I tried fdisk -l, I got the output is on the pic. I don't think that it corrupted while copying, I don't know whats is going on.

>>1087 those machines only run on very specific hardware, you cant boot them on a laptop anyway

>>1083 Randomize your Mac Address with macchanger or macchiato. Point your DNS to localhost (127.0.0.1) and then add TorDNS on your /etc/tor/torrc. This will make Tor not leak DNS connection. Don't use javascript and cookie. Protect physically: use a tape on camera and keep on a local without cameras. Watch out the shoulder surfers, keep yourself close to a wall or something.

>>1094 Actually they don't, not here. They run in general hardware based device, to avoid authorities tracking what they buy. It's basically an old computer.

I'm dumb, how do I run Perl scripts from lighttpd? Whenever I point to them I jsut downloaded a blank pl file. And when I try a Perl .cgi I just get a blank screen.

>>1099 Did you chmod +x thatperl.cgi and set a hashbang to point at you peel binary?

>>1100 Sure did, no luck.

>>1099 Anything in /var/log/lighttpd/error.log? And can you pastebin your lighttpd.conf?

So i recently found a s3 bucket which has "open" access and is able to be accessed. Is there anything major I could do with this? Anyone with any experience when dealing with s3 buckets?

I would like to learn how to "hack", as well as just in general learn more about networks. My goal is more to understand networking on an intutive level and as a side effect be able to hack however it seems the latter would lead to the former. I have this book about building a network security testing lab, cant remember title but I primarily got it for its info on packet sniffing and what not. But id like some more. My main questions are: 1. What is some good interactive material with excersizes and the like on getting a more intuitive understanding of networks. Im aware of hack this site and what not but id like to be guided a bit more, I think that will be good once I know more to fill in gaps and test myself. Something like a book or youtube series thats good at keeping my interest and providimg "try this" sort of material. 2. How long will it take before im not a master of net sec but know enough to sort of start guiding myself a bit more and figuring things out? 3. I have a spare tower I would like to be able to access and run commands on from any of my laptops or my other tower. Many of these run windows, and im not quite sure how that would work (being able to run a unix command line on a server from a windows user). I just in general dont know much about servers and would like more info.

>>1137 I think that you're going about this the wrong way. It's wonderful that you're interested in the subject, and I'm happy to hear that you have some focus, but the major problem is that coming onto a site like this and posting that you want to be teh leet haxors (even if you didn't come across as a complete ass hat) will get you smacked. Try to learn stuff through opensec http://opensecuritytraining.info/ And go from there. (assuming you already have the basics down.)

i remember seeing a video on pre-nuke lainchan of some russian/polish guy demonstrating that windows 10 sends screenshots to a microsoft IP during installation, does anyone still have it? can't find it anywhere else

>>1157 It was bullsoykaf. He ran a full packet capture through a file called "rsa decryptor.exe" and it just created an image with the same name as the packet capture. You need a key for RSA decryption and I doubt microsoft just leaves it laying around, plus "rsa decryptor.exe" could be anything, it could just be a script that does nothing but copies an existing file from another folder in. On top of that, that was the windows 10 preview build, which also had all kinds of extra tracking and log sending stuff that was stripped out of the final release

>>1172 i see, thanks for clarifying

X200 libreboot with gentoo hardened, how secure am I? How good does my opsec have to be?

>>1269 Hide that behind a tor isolating proxy and you're good. Whonix, PORTAL, or make your own out of a <insert fruit here> pi.

>>3 I unfortunately do not know any resources since I am still learning, but a /pdf/ thread would be truly amazing

>>1310 reminder to open pdf files in a container with no internet access. Firejail works quite well.

>>1269 https://grsecurity.net/passing_the_baton.php Hardened Gentoo may not be that secure in the future.

anyone have a guide for lockijng down windows 10 and chrome?

How would one go on with using Tor for normal use ? Like on a workstation with Qubes or Subgraph or would a self build setup be better?

>>1355 What is wrong with the regular Tor Browser? If you are worried about leaks then you can configure your firewall to only allow outbound traffic through Tor. Or run Tor Browser under a different User and deny that User all network connections except to the local Tor daemon socks5 port. Or run Tor Browser in an isolated Linux network namespace with the Tor daemon running on the outside but the socks5 port accepting connections from the network namespace. If you're interested I can share specific commands to get this working but this whole post is an assumption and I may be barking up the wrong tree.

>>1357 I think that should do it yea, if you'd like to share that would be cool :)

Here is an example of how to set up iptables to block everything except Tor https://www.torservers.net/wiki/setup/allowonlytor If you look through the Tails repository, you will see that they use the same approach. Personally I prefer the namespaces option. Here is how I do it with Firejail: # Create a network Bridge sudo brctl addbr br-tbb # Give it an IP address with a different network prefix to your machine's # main IP address. i.e. if your local IP address is 192.168.0.X then give the # bridge something like 10.0.1.X sudo ifconfig br-tbb 10.0.1.1 netmask 255.255.255.0 # Create a torrc file telling Tor to listen on your Bridge's IP address cat > torrc << EOF User tor PIDFile /var/run/tor/tor.pid Log notice stderr DataDirectory /var/lib/tor/data SOCKSPort 10.0.1.1:9150 RunAsDaemon 1 EOF # Run Tor with our new torrc tor -f torrc # Then by running Firejail with `--net=br-tbb`, anything inside the jail will # not be able to make any network connections except to 10.0.1.1:9150 firejail --private="/path/to/tor-browser_en-US/Browser/" --net=br-tbb LD_LIBRARY_PATH=. ./firefox # You then need to manually configure Tor Browser to use the SOCKS5 proxy # 10.0.1.1:9150 instead of the default 127.0.0.1:9150. # # Note that even if you tell Tor to listen on 127.0.0.1:9150, Tor Browser # inside the jail will not be able to connect because it is running under a # different network namespace. That is why we need the network bridge. Be warned, there is some annoying bubble wrap you need to tear off of Tor Browser in order to get either this or the firewall thing to work (don't worry, Tails does it too). Tor Browser comes with a bundled Tor binary and a Firefox extension called Tor Launcher which will quit the browser if it detects that the bundled Tor binary isn't running. Unfortunately we need Tor to listen on a non-default IP address and run *outside* the jail we put Tor Browser in. If you are going the firewall route, you need the Tor daemon to run under its own user id. The solution is simple, delete Tor Launcher: rm tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/extensions/tor-launcher@torproject.org.xpi I'm sorry if there is some mistake or omission which prevents this working as is but hopefully you get the idea and get adapt what is here to your own environment.

Say a person had an encrypted SD card which they wanted to hide. Those things would easily fit in discreet places like the gap between a wall and skirting-board. If somebody wanted to find that SD card, would they have to find it manually (which would obviously make it unlikely for them to find it) or do there exist detectors for such things?

>>1370 That's a good question. I do remember this being mentioned at a conference talk or maybe Paul's Security Weekly. It was something about hiding an sd card in a box of cornflakes and law enforcement using sniffer dogs to find it. This is not at all reliable information but it might serve as a hint.

>>1372 Interesting, I never imagined dogs had such a good sense of smell I suppose most LEAs don't have access to SD card-sniffing dogs though, probably only for high profile cases.

>>1372 They detect electronic stuff, presumably the chemicals used for coating PCBs and things of that nature. If your bedroom is full of hardware and you get raided, I suspect a dog would have a very hard time detecting an SD card hidden behind the base board or inside your monitor.

>>1364 i'm getting >Error: the software is not supported for /31 networks when i try to run firejail --net=br-tbb firefox it works without firejail though.

>>1435 I'll get back to you this evening.

>>37 Not sure how nobody's mentioned 2600: The Hacker Quarterly yet. Been in print since 1984 and is sold at every Barnes and Nobles

>>1435 >sudo ifconfig br-tbb 10.0.1.1 netmask 255.255.255.0 Did you change the netmask for the bridge? Looking at the firejail source code it wants space for at least 4 IP addresses. uint32_t range = ~br->mask + 1; // the number of potential addresses // this software is not supported for /31 networks if (range < 4) { fprintf(stderr, "Error: the software is not supported for /31 networks\n"); exit(1); } netmask 255.255.255.0 should give you more than enough. Check what ifconfig says about your bridge.

>>1137 >3. I have a spare tower I would like to be able to access and run commands on from any of my laptops or my other tower. Many of these run windows, and im not quite sure how that would work (being able to run a unix command line on a server from a windows user). I just in general dont know much about servers and would like more info. Just set up SSH on your tower, then use an SSH client like PuTTy on your windows machines to log into it. See: https://wiki.archlinux.org/index.php/Secure_Shell to set up the SSH server (instructions may vary if you're not using Arch or a derivative of it, but the Arch wiki will still generally be worth a read - and this is generally true of anything Linux related). You'll also want to go into your router's control panel and set up a static ip address for the tower. Google "[your router] control panel" to figure out how. If you want to access the SSH server outside of your LAN, then 1. DON'T USE A soykafTY PASSWORD and 2. Set up port forwarding. Again, google "[your router] port forwarding" >>1370 >>1372 >>1374 >Less commonly known is that there are currently three dogs in the U.S. who have been specially trained to sniff out electronic devices such as thumb drives, SD cards, and even external hard drives. This unique skill is especially useful when authorities are hunting for data stored on devices that may have been purposefully hidden to avoid detection. > >... > >During a controlled demonstration , Bear was able to find a hard drive stashed between couch cushions, an iPad in a backpack, a micro SD card tucked away in a wine rack, a flash drive in a magazine holder and other items. http://bgr.com/2015/07/13/electronics-sniffing-dog/ I would imagine the same approaches that people use to hide drugs from dogs would also work. This spurs a question that I'm curious as to Lains' opinion on: what would be more suspicious: an encrypted hard drive that's plainly available, such as one in your main computer, or a hidden, encrypted SD card? I would say that by hiding the SD card, you're going to arouse more suspicion than just having an encrypted drive. A benefit of the SD card, I suppose, is being able to say, "I encrypted that and hid it so long ago that I don't remember the password," whereas with an encrypted drive, you enter the password so often it's not feasible to forget it. That should, however, only matter if you're in a place where LEA can force you to give up your password.

>>1444 looks like im a dumbass. yeah the netmask was set wrong.

How do you disapear from all the bot nets that you use to use

>>1502 I second this polite sage

What are the most secure methods of IM or group IM? Is OTR still the good stuff?

>>1502 I never used them in the first place. >>1629 Signal is good and also normal person-friendly. OTR is still good, tox is okay.

I use Panopticlick as a reference. I use Chromium with Tor. My issue is fingerprinting: the field HTTP_ACCEPT Headers makes my browser trackable. How do I change that ?

>>1790 Using Tor with Chromium already makes you very unique. Even if Panopticlick doesn't notice, any human with a brain will. If you are worried about fingerprinting then you should use the actual Tor Browser. How come you're not?

What are some good utilities for intrusion detection? What are some good utilities for logging connections made to my server? I've been manually doing this using iftop and doing whois on some connections and noticed I'm getting a lot of connections from Asia. What are some good utilities for detecting failed logons? It seems faillog isn't actually recording failed attempts and my audit/auth logs aren't showing failed login attempts either. Maybe just bad configuration? I just really want to see what the hell these IPs are trying to do (seems like port scan).

Any books on practical web-fingerprinting? Like, zombie cookies, shadow useds profiles, html5-canvas fingerprinting etc.

>>1806 Snort or a SIEM but requires quite some configuration since you will get lots of unrelated crap

What do lainons think of the security of SELinux/Apparmor + QEMU/KVM or LXC/LXD? Are simple containers similarly safe, or are VMs (virtual machines) notably better? Assumed of course is the ineligibility of simply installing the software of the system root (bad idea) or "trusting" user-separation and ACL to be sufficient for ~/.local binary installation.

>>1856 SELinux + QEMU/KVM is the way to go probably.

The GPG plugin for squirrelmail seems to have been broken by recent updates to Squirrelmail. Does anybody know another way to get gpg working with the web client so that my users won't whine about having to ssh in to encrypt things?

does anyone have a practical method of OS fingerprint evasion for modern linux kernels? 802.1x security in the commercial sphere is largely predicated on fingerprinting in order to enforce 'profiles' but I feel this is just a parlour trick that can/should be avoided.

>>1932 I don't really understand what these "profiles" you are trying to avoid are but OS fingerprinting is based on the way TCP/IP stacks do things slightly differently. http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting

I remember some news articles about an effort to write an SJW-free implementation of the TOR Browser but i can't remember the name. Lain, can you help me please? I don't trust the people at torproject.org anymore.

You're probably looking for the rotor project: https://github.com/IndependentOnion/rotor-browser >Latest commit 7605461 Sep 23, 2016 heh.

>>1956 Yes! It really was Rotor. Thank you. It's too bad that it isn't updated anymore though.

>>1955 There were a few rage forks last year when Jacob was kicked out of the Tor inner circle for being a literal violent-non-consensual-dick-in-vagina-rapist. I don't think any of them are still functional though, they were just people throwing their toys out of the pram. >TOR Quickest way to show everyone you don't actually know anything about Tor.

from a technological standpoint, (arguably the only standpoint we should care about) why do we care? tor was developed to evade censorship. ostensibly this means even the censorship of the projects developers. Once i start seeing active commits from dissenting devs, ill consider alternatives imperative due to SJW chicanery. However... TOR as a darknet has been at 'days numbered' status for years now. i2p is a far better network for privacy. it polices its own content, which i suppose to some may be considered SJW, but if we need to discuss the topical content of SJW lets not hide behind anonymity toolkits and move this thread to /hum/. to get this thread back on topic, tor is a garbage anonymity solution thats sent more people to prison than it has protected. we dont need something for SJW's, we just need something thats better. SJW is myopic.

Sage for off-topic. >>1969 How is i2p better for privacy? And how would it "police" its content? Is Tor still any good as an out-proxy?

>>1961 >There were a few rage forks last year when Jacob was kicked out of the Tor inner circle for being a literal violent-non-consensual-dick-in-vagina-rapist. There are absolutely NO proofs for Appelbaum being a rapist. It is more likely that he was kicked out because he was aware of torproject's infiltration by Antifa. http://www.zeit.de/kultur/2016-08/jacob-appelbaum-rape-sexual-abuse-allegations I would sage my post if it wasn't a sticky thread.

>>1969 >tor is a garbage anonymity solution thats sent more people to prison than it has protected. Tor is just a victim of its own success. Once it went mainstream and media started harping on the drugs and pedos angle there was immense pressure on law enforcement to do something, and they did. But the reason people are going to prison is largely down to opsec and insecure 3rd party software (firefox, windows, media players, pdf readers). I guarantee you that the exact same thing will happen to i2p if it ever gets as popular as Tor. Doesn't imply anything about the merits of either network. Freenet is also worth noting as it is obscure and unpopular but still got ripped to shreds by law enforcement because it actually is insecure.

>>1976 Rape is the official reason he was kicked out. If you've ever had a conversation with him you'd know what an egotistical jackass he is. I imagine there may be any number of unofficial reasons they wanted him gone. >It is more likely that he was kicked out because he was aware of torproject's infiltration by Antifa. This sounds like something you pulled out of your ass.(Argue in good faith and avoid spilling soykaf.)

Say I have an existing youtube (google) presence with subscriptions, playlists etc. that I use on one machine and that I'd like to use it on another (logged in) while keeping the fingerprints of each machine independent, i.e. Google doesn't recognize that both machines could represent a single person. Are there any services that allow one to achieve this? e.g. log in on machine #2 over VPN, using a feed system (?) to get subscription feed to a proxy service that I can access on machine #2 etc.

>>1979 >This sounds like something you pulled out of your ass. >I'm willfully oblivious of recent events.

>>1999 if tor is "infiltrated" by antifa you should should have evidence.

>>1999 You are saying all the people and political groups who voluntarily contribute to a free speech tool happen to hate Nazis? Seriously, what the fuarrrk do you expect? Personally I think it was unprofessional for the Tor project to voice any kind of political opinion but it's not surprising. They do need to protect their precarious public image and sources of funding. After everyone started losing their minds over the Daily Stormer they probably started getting emails asking why they weren't doing anything like GoDaddy/CloudFlare/Google. It was an easy PR win by making a meaningless gesture against a group they doesn't really believe in free speech tools like Tor anyway.

>>1979 >(Argue in good faith and avoid spilling soykaf.) Fine. >torproject's infiltration by Antifa. The fact that Tor volunteers selfselect to be pro free-speech and anti-censorship is not an indication that the group called Antifa has any significant control over the project. Free speech is literally the point of Tor. >he was aware of If this was true on any level why has he not mentioned it? It is definitely better than being accused of sexual assault. >It is more likely that he was kicked out because >likely Considering he was very publicly accused of sexual assault and the stated reason for his dismissal is the sexual assault allegations there is no explanation "more likely". Especially not some baseless statement you have no evidence for.

>>1997 Have you considered using virtual machines?

What is the best way to route host traffic through a tials vm?

>>2102 most likely iptables

So I've been wondering this for a while now- when you upload an image to an imageboard or really anywhere, is it possible for the server to determine the folder path the file came from? Like, does it fetch the file from your machine or do you send the file as its own entity? Because if it were the former I could see that being a huge security risk..

>>2125 Only the image data is sent in a POST method. Use Wireshark or Firefox network profiler (ctrl+shift+Q) to verify this for yourself.

I have two backups: a flash drive that is always on my person, at least once per week, and another flash drive that is always at home, which is updated monthly. My connection is slow and my laptop freezes when I try to compress and encrypt lots of files at once, so I don't have an off-site backup Is that a bad setup? Transferring everything to flash drives feels pretty slow, and I often postpone the backups because of this, should I buy and set up a NAS server? Also, are there disadvantages/dangers in using a USB flash drive rather than an external hard drive? I only have around 20 GB of data I don't want to lose

>>2373 There isn't necessarily anything wrong with using USB flash drives for backup storage, but in my experience flash drives often fail with absolutely no warning. If you're already keeping a second flash drive at home, perhaps think about adding a traditional external HDD to the mix.

>>2373 Also, I'd like to add that you should encrypt whatever drive you choose to use to store your backups.

>>2373 Don't use USB's , By something like a SSD. They are small and compact and harder to be damaged, throw them in a backpack and they'll be fine. Fast encryption and data transfer.

>>2378 I've got to agree with you there, plenty of times I've ran into a corrupt USB Flash drive.

>>2660 Hey, thanks. That's actually a great idea. My USB flash drives always fail and without a doubt it's always when I have urgent/important work on it.

It should be noted that flash storage like usbsticks, cellphones, and ssd's is inherently less secure than tradition hdd's. That's because there's no way to be absolutely sure you've wiped flash storage 100%. Writing random data to "100%" of the "whole drive" doesn't necessarily work reliably, as it does on a hdd. If you do use flash storage, at least make sure that everything stored on it is encrypted.

msata drive + usb enclosure best option

>>2681 This. Always encrypt from day one so that none of your data was ever stored on cleartext. 'cleartext' - is that the right term?

>>2681 BTW, It doesn't mean destruction of data is impossible. If you overwrite the SSD with random data, 3 times, combined with ATA Secure Erase command to reset it later, in most scenarios, 80%-90% of the data can be destroyed. Practically it is extremely hard to recover anything. Encrypting the drive from day one is the best, in case you didn't, destroy the data using this method and encrypt it.

>>2681 >ssd's is inherently less secure than tradition hdd's. That's because there's no way to be absolutely sure you've wiped flash storage 100%. Writing random data to "100%" of the "whole drive" doesn't necessarily work reliably, as it does on a hdd. Why is that exactly?

>>2734 ssds don't handle writes well because they have to zero a whole "page" (they call them pages for ssds, not sectors, no idea why) there are also failures after many writes to the same area to make up for this, the ssd has extra space that isn't visible to the outside system, and rotates through what space is being used to keep wear even when you write, your new data may not be written to the same location as the previous disk address, due to this wear evening this means that on a 120G drive, there's probably about 128G of actual space, and so if you write 120G of stuff, there may be 8G of old data laying around

>>2738 Sector is a part of circle in geometry terms. Magnetic disks are circular, flash storage isn't.

>>2738 That makes sense. Thanks.

How do I protect my computer and laptop from being hacked or compromised whether physically or remotely? Also, how do I prevent information about my family members being leaked or used?

>>2771 >How do I protect my computer and laptop from being hacked or compromised whether physically or remotely? - find a decent isp if one exists in your area - use secure firmware on your own router - keep all incoming ports closed on your router - use an ethernet cable instead of wifi - if you use wifi, don't use wep, use wpa2 with a strong password, and don't leave the default factory passwords unchanged - use strong passwords on all user accounts, especially root/admin accounts - don't let software run with root/admin privileges if avoidable - don't use root/admin accounts unless necessary - install a firewall on your os and close all incoming ports - use TLS (httpS instead of http) - install Tor and/or a trustworthy VPN and learn how to use them - don't click anything on the internet you aren't sure of - don't click suspicious email links or open unknown attachments - if on windows, use a good anti-virus/anti-malware program and keep it updated - don't install any software you aren't sure of - don't view unknown .pdf, .doc or other media files that can execute malware - don't let anybody insert a usbstick, cd, or any other media into your computer - don't let anyone use your computer Also, how do I prevent information about my family members being leaked or used? - maintain a small internet footprint: no facebook/google/twitter/ms/snapchat/pinterest or any other unnecessary accounts - don't put any real information about yourself or your family on the internet - always use a fake name, birth date, address, phone #, etc whenever possible - don't store personal or sensitive information on your computer if avoidable - if unavoidable, encrypt it with LUKS or GPG and use strong passwords - if you have to do personal/sensitive work on the internet, use encrypted connections and encrypted data - teach your family basic operational security ('opsec'). - don't let your kids use the internet alone in their rooms - if you sell your computer, wipe the hard drives first

>>19 On regular Android (not sure about your case) you can install Afwall+, a firewall that blocks communication, both incoming and outgoing, of all system and user apps. You can whitelist apps you trust. If you want to see what's being blocked in real time, you can set it to show a toast (pop-up) each time. The setting is in the enable logs section. Or you can just read the log later. I seem to remember the kernel being blocked the most when I was experimenting with it.

>>71 When you use both Tor and a VPN, started in either order, Tor is wrapped in the VPN by default. Your ISP will see only that you're using a VPN. Your exit node will be the current Tor exit note.

Hi Lains. I would like to know - when you deploy a new VPS, what security steps do you take?

>>2811 I set the vps up with Debian and do the following: ## ssh into the vps ssh root@12.34.56.78 <password> ## change the root password passwd ## disable "recommends" packages: su edit /etc/apt/apt.conf.d/99synaptic, change "true" to "0" then: cat > /etc/apt/apt.conf.d/01norecommend << EOF APT::Install-Recommends "0"; APT::Install-Suggests "0"; EOF ## configure package management via tor: su apt-get install tor apt-transport-tor cd /etc/apt cp sources.list sources.list.original edit /etc/apt/sources.list... deb tor+http://vwakviie2ienjx6t.onion/debian stretch main contrib non-free deb tor+http://vwakviie2ienjx6t.onion/debian stretch-updates main contrib non-free deb tor+http://sgvtcaew4bxjd7ln.onion/debian-security stretch/updates main contrib non-free deb tor+http://vwakviie2ienjx6t.onion/debian stretch-backports main contrib non-free ## replace systemd: apt install systemd-shim sysvinit-core systemd-sysv- ## install sudo and restrict root access: su apt-get install sudo usermod -a -G sudo <me> groupadd wheel usermod -a -G wheel <me> usermod -a -G wheel root edit /etc/pam.d/su uncomment: #auth required pam_wheel.so ## install and configure ufw firewall: apt-get install ufw ufw disable ufw default deny incoming ufw default allow outgoing ufw allow ssh ufw enable ## make a user with no access to root: adduser <username> (don't add user to wheel/sudo groups) ## disable ssh root login: ssh <me>@12.34.56.78 su edit /etc/ssh/sshd_config set: PermitRootLogin no service restart sshd ## configure ssh key login: ssh-keygen -t rsa <enter an encryption password> cp -r ~/.ssh </somewhere/very/secure/> ssh-copy-id <me>@12.34.56.78 ssh <me>@12.34.56.78 su edit /etc/ssh/sshd_config set: PubkeyAuthentication yes set: RSAAuthentication yes exit ssh <me>@12.34.56.78 (test ssh key login) set: PasswordAuthentication no ## (optional) configure dns via tor: sudo apt-get install dnsutils dnsmasq ## append to /etc/tor/torrc: DNSPort 9053 AutomapHostsOnResolve 1 AutomapHostsSuffixes .exit,.onion ## test tor dns: service tor restart dig @localhost -p 9053 www.google.com ## append to /etc/dnsmasq.conf: no-resolv server=127.0.0.1#9053 listen-address=127.0.0.1 ## append to /etc/dhcp/dhclient.conf: supersede domain-name-servers 127.0.0.1, 127.0.0.1; --- fin

>>2812 Interesting What I would add is setting up unattended security upgrades, so if there's a critical update to tor or the kernel or something while you're asleep it'll automatically update.

>>2817 Agreed. And some people like to use fail2ban, and/or a non-standard ssh port. Port 22 gets pounded on a lot by skiddies, but the smarter ones give up when they notice there's no password authentication.

what is the meaning of a 0.0.0.0 ip device on a home network?

>>2848 >what is the meaning of a 0.0.0.0 ip device on a home network? https://en.wikipedia.org/wiki/0.0.0.0 >In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address >In the context of servers, 0.0.0.0 means "all IPv4 addresses on the local machine". >In the context of routing, 0.0.0.0 usually means the default route, i.e. the route which leads to "the rest of" the internet instead of somewhere on the local network.

Hi guys, i hope this is simple question. In router web admin i discover my raspberry pi how dnsmasq[1234]: vendor id = "dhcpcd-6.7.1:Linux-4.9.41 ...and some more information about my device" How i can change it? Want look like a MSFT 5.0 for example. ddg say about dhcpd vendor class identifier, but I could not find how change its.

>>2861 You are correct it is called the vendor class identifier. Changing it depends on what dhcp client you use. Read the man pages. For dhcpcd you can use the -i switch to change it. -i, --vendorclassid vendorclassid Override the DHCPv4 vendorclassid field sent. The default is dhcpcd-<version>:<os>:<machine>:<platform>. For example dhcpcd-5.5.6:NetBSD-6.99.5:i386:i386 If not set then none is sent. Some badly configured DHCP servers reject unknown vendorclassids. To work around it, try and impersonate Windows by using the MSFT vendorclassid. Also be aware that dhcpcd will cache your MAC address from the first time it is started and resend it on every subsequent request (so spoofing your MAC address later won't work). Delete the /etc/dhcpcd.duid file to removed the cached MAC address..

Just looking for recommendations for a beginner lockpick set. Amazon is full of stuff and who knows what's good and what's crap.

>>2866 If you're in the EU this site is worth a look https://www.ukbumpkeys.com/ That's where I get my stuff. SouthOrd would be my go-to brand. I got a nice 22 piece set to start off with and it's worked out well. The set I got had a good mix of tension tools, picks, and rakes. Also, if you're in the EU make sure you get picks that are 'Slimline' go they can fit in smaller EU locks.

>>2862 Thanks! -i not work but i commented all settings in /etc/dhcpd.conf and add vendorclassid MSFT it works. https://klamp.works/2016/04/29/dhcp.html . Oh, look like a spyware in dhcp client in raspberry pi and with dhcp server in usb lte modem...

Excuse me, I would like to ask if there are any books that dedicate themselves to the use of Blackarch and it's tools in particular. All I have seen by far were those that use Kali. If there do happen to be any, please post them for this poor script kiddie.

>>2882 Probably not. The reason Kali/Backtrack has books is because it is a commercially backed product. BlackArch is just small time community project. It might only be 1 guy. They are both just Linux distros with some preinstalled tools and configuration options. It's the tools you want to learn, not the distro.

>>2885 Oh. That says quite a bit actually. Thank you, sir!

Is using a computer connected over ethernet to a wifi bridgemode router more secure (i.e against packed sniffing) than plain wifi?

>>2812 Any idea why I don't get a connection when using dns through tor? I'm new to this stuff sorry.

>>2985 >Any idea why I don't get a connection when using dns through tor? Yes. Tor only works with TCP and DNS is primarily UDP. When you use the Tor socks5 proxy for web browsing, the Tor exit node will do the DNS resolution for you. I don't understand exactly what you are trying to do so I cannot say anything more specific.

>>2985 This is how I set up Tor DNS on Debian Stretch. YMMV. ## configure tor dns: sudo apt install tor dnsutils dnsmasq ## append to /etc/tor/torrc: DNSPort 9053 AutomapHostsOnResolve 1 AutomapHostsSuffixes .exit,.onion ## test tor dns: service tor restart dig @localhost -p 9053 www.google.com ## append to /etc/dnsmasq.conf: no-resolv server=127.0.0.1#9053 listen-address=127.0.0.1 ## append to /etc/dhcp/dhclient.conf: supersede domain-name-servers 127.0.0.1, 127.0.0.1;

This might be slightly out of the scope of a simple question, but: I'm not in netsec, but would like to be. I currently work as a developer doing C#, and my company has recently introduced a personal training budget. What are the best things to spend it on to move more into netsec and become a penetration tester or something similar. Sorry if this isn't an appropriate question or if I've missed something obvious.

>>3023 How big is the training budget? If you have the cash (a little under 1k plus a huge time investment (you MUST put in about four hours per day consistantly)) the best crash course into infosec is Penetration Testing with Kali from Offensive Security. After taking the course you can take the OSCP, probably the most difficult 'entry level' certification available. They teach you everything you need to know to conduct a penetration test from the ground up (you have an advantage because you know how to program, and presumably know networking). The course and exam are live-fire penetration tests in their lab environment. You are graded based on a penetration test report submitted to them at the end of the exam. You get 24 hours to root five machines in their environment. The OSCP is for life and Offsec certs are the most respected among technical security professionals. https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/ If that doesn't work for you, stay away from SANS and maybe look at ISACA exams (The CISA, specifically) or the CompTIA CSA+ or CASP. These should enable you to get a job as something like an SOC analyst. Stay away from EC|Council (scam), ISC^2 (direct experience requirement), SANS (insanely expensive) Getting a classic hacker job (security researcher, pentester) is a lot harder. Open source and community interaction/contribution is a HUGE deal. You're a C#/Microsoft guy? Look at starting out in your own space. Learn about the security implications of .NET and C# soykaf, and write about what you learn. This might be a good place to start? I don't know, I'm not a .NET guy. https://www.owasp.org/index.php/.NET_Penetration_Testing

>>3047 Thanks lain, the training budget should be enough to cover that and then some. Four hours a day however might be tricky, since I'm working a full time job on top of it, but I guess nothing comes easy. Thanks again for the advice.

>>3047 >Stay away from EC|Council (scam) What's wrong with them? I hear a lot of good things about them. Are their courses soykaf?

How do different Operating Systems/Hard Drives/Partitions interact with eachother? I want to get into Linux and use it as my main OS but I also want to keep a windows install on another hardrive or partition so I can use things that aren't available on Linux. Will Windows be able to read and/or write to my Linux harddrive? I want to use Linux because it's more secure but if Windows can read and/or write to it anyway what's the point? I have a friend that disconnects his windows whenever he isn't using it but that's a pain and I don't wanna have to do that

>>3072 I'll give an example of my computer: I have one hard drive with some partitions. I have an ext4-formatted partition on the HD that has my root direction of linux (/) on it. Another ntfs-formatted partition has windows (C:/) on it. I additionally have an ext4-formatted "Library" partition that has general-use files. These partitions are like virtual divisions of the hard drive. Since I have GRUB installed, the computer gives me the option to boot into either Windows or Linux. On either one I have my Library partition automount and thus share files such as music, code, or documents. Look into "dual-booting" which is installing windows and linux along-side each other. I hope you get it working since Linux is a joy to work with.

>>3072 >I want to use Linux because it's more secure No. That is not a good enough reason. It's not even a reason it's a myth. Good people are going to waste their time helping you and then when you finally have Linux installed you will be "wah wah I can't vidya its all different i don leik it wahwah" and be back to Windows on day 2. Just save everyone the time and go away. This shouldn't be on /sec/ anyway.

>>3072 Of course it does. Your solution then is to encrypt your Linux partition. Google it. Now on the security of Linux. It's a myth. Of course there is much more viruses / exploits ... targeting Windows. Of course Linux doesn't track you bla bla bla.. But Linux is not a magical solution. Because the security comes from your habits. The security also come with simplicity. Try to *design* your computer routine. And to make it simpler again and again. For example, you say "I want to maintain a certain online presence but I'm not interested in social medias." Then you could choose to stick with IRC and imageboards. It's cool you can do both through Tor and they use simple protocols. Things tend to get complicated with the growth of complexity. For example you might want to download a ton of stuff via torrent each day. You'll think of using a VPN but then already you'll look at how it works, you won't understand exactly when your connection is secure or not, you'll have to trust your provider... So you can try to *simplify* the process.

Let's say Lain has managed to get her hands on the personal USB drive of someone. Let's also say Lain wishes to gain access to a particular account belonging to the owner of this USB drive. How does Lain go about creating a keylogger that autoruns upon the insertion of the USB? Also, is there a way to disguise/hide the program on the USB, or stop it from being deleted?

>>3088 You *need* to know which OS your target is using. Stuxnet spread using USB devices targeting Windows. That might be something for you to research. If you are in a position to trick the target into using a different USB device then consider a usb rubber ducky style attack.

>>3091 Target OS would be OSX. Rubber ducky could potentially be an option as long as it would fit into the case of the original USB.

What type of 2fa should I set up for my home email server? I don't like google authenticator because botnet, and I'd rather avoid anything that requires a smartphone (like Authy) at all, but sms isn't secure. I don't want to buy a hardware dongle, both because of cost and an inability to make backups. Requiring access to a key that gets sent by email to log in to my email is stupid for obvious reasons. Are there any others you guys like? Is there a mitigating factor to one of these that I'm missing?

Hypothetically speaking: which one's harder to explain? A drive with a bunch of files with the same creation date, or a clean drive with a very recent os installation date?

>>3104 I'd say the first. A clean drive with a fresh OS install is pretty much "Bought this new and installed my favorite OS of choice on it." Also, if this drive is older and has been already used, simply deleting all files won't eradicate them, they'll still be extractable, you'd have to fully overwrite them to do so. The first is harder to explain as there is a limit to what's trustworthy. Maybe you wanted to completely eradicate some files you had on that drive? Because just deleting something isn't enough, you know, you gotta overwrite it a lot of times. Also, you didn't clarify what kind of files were used. If it was music, images, videos, documents etc. it wouldn't be all that suspicious, but if it is random nonsense it'll be harder to explain.

>>3076 >"I want to use Linux because it's more secure" >No. That is not a good enough reason. It's not even a reason it's a myth. >>3081 >Now on the security of Linux. >It's a myth. Public service notice: This person very obviously doesn't have the faintest idea what s/he's talking about and shouldn't be giving anyone advice.

>>3107 >Public service notice: This person very obviously doesn't have the faintest idea what s/he's talking about and shouldn't be giving anyone advice. I am >>3076 and the only advice I gave was to stop wasting the time of kind strangers on the internet by asking them to commit more time and effort to your problem than you are yourself. I suppose you don't know much about Linux security. Here is something for you to read. https://grsecurity.net/~spender/interview_notes.txt If you want some actual advice then learn how to secure the OS you have instead of switching to a different one that is supposedly more secure but definitely won't be if you don't know what you're doing. Especially not Linux.

>>3112 I've learned enough about Linux and Linux security over the 20 years I've been using to recognize a pretentious n00b on an imageboard, son. This board is for adults. Grow up.(Argue in good faith.)

>>3115 >Always argue in good faith and avoid using personal attacks. >You should always elaborate on your opinions rather than just spilling the soykaf. Here are a few of the salient points that the article in >>3112 raises about Linux (in)security. >I see security as being more of a nuisance for the upstream kernel developers...their approach seems to be in line with the feeling of it being a nuisance: when a vulnerability appears and they discover it or it's reported to them, they'll fix it and simply move on. Note also Linus's instance on treating all security holes the same way as regular bugs. >Linus doesn’t take security seriously; it’s yet another concern in his mind, and he’s surrounded himself with people who share those views http://www.washingtonpost.com/sf/business/2015/11/05/net-of-insecurity-the-kernel-of-the-argument/ >What leads from this claim is that everyone should be running the very latest version of Linux, as that's the only way to ensure you have all the fixes, security or not. Unfortunately, the latest versions of Linux also come with the most vulnerabilities, usually introduced in newer code as their development model for the past several years has resulted in rapid inclusion of experimental code of a period of two months, after which it's declared "stable." Kernel devs also refuse to mention security fixes in their commit messages so ba ckporting patches to old kernels is also very hit and miss. >There's no real leadership in Linux as far as security goes from within the kernel community itself. Microsoft can force their employees to take training on secure coding practices and common bug classes. Something like that has never happened for Linux And don't forget Linus's absolute refusal to admit anything to do with Pax and GRsec into the mainline kernel. If Linux is so secure it should be easy for you with your 20 years experience to prove a dumb kid like me wrong right?

>>3072 If you have newer hardware, try looking into Qubes or virtualization with IOMMU. There is no need to dualboot in current year. Remember, however, not all Linuces are "secure". Arch isn't by default, for example. Same goes for software. I'd consider calculator with network capabilities a malware, but apparently Gnome devs don't. >>3081 >encrypt your Linux partition And keep the bootloader on separate drive like flash or sd card. Because you are still giving read-write access to a non-encrypted partition if you blindly skip-next through LUKS setup. An untrusted system can easily evilmaid you if you don't take said precautions. >>3088 No OS autoruns executables from flash drives in current year. People don't run unknown executables they just found on their flash drives either. There are basically 2 ways for you: >Write an exploit in form of conventional media file like picture, video or document which escalates privileges upon playing. There are plenty of examples of such fuarrrkups in past, look them up. >Write an exploit for mass storage driver and put it into the controller firmware, BadUSB style. >>3091 >rubber ducky style attack People don't sit under root and will probably notice terminal window popping out of nowhere failing to execute bash commands >>3093 >as long as it would fit into the case of the original USB As long as your rubber ducky will have the same drive capacity, volume name and OSX allows new plugged keyboards to have input rights >>3099 What factors are you talking about? Think of it. This system is needed when you give a service to unknown users and wish to defend them from their own stupidity. 2-factoring yourself into your own server is useless. A self-signed TLS certificate you import into every device that accesses mail and a password would be sufficient. Hardware dongle usually does those features anyways. >>3107 >s/he >assuming non-masculine gender on anonymous imageboards h-hi there, reddit >>3115 >This board is for adults. I think, you've got the wrong door, gramps. Teh slashdot is two blocks down :) Still, what's the fuss with all the "insecure lineks" rant in this thread? Is agent FUD getting overhours this month again? GNU/Linux is free software and it means people who develop it, as well as users have ll the right and ability to audit the code themselves, to chose from different kernel modules and software running in userland, without having to trust an unknown team of Indianos who write code for food in Microsoft/Apple sweatshops. You have the the tighter feedback with software developers and repository maintainers than in proprietary OSes, there is no need in stupid tech support forums with inane answers when you can submit patches directly to Linuse's inbox and publicly insult Poetthering in mailing lists. Isnt't that cool? A free system is as secure as User wishes it to be, not a marketing team somewhere in Seattle.

>>3128 >What factors are you talking about? Well, a password is something I know, so ideally something I have, like a public key or a constantly-changing token would be the other one. >This system is needed when you give a service to unknown users and wish to defend them from their own stupidity. 2-factoring yourself into your own server is useless. It would be nice to say that I had enough faith in my own intelligence that I was sure I would never accidentally give away a password, but it would be lying. The point of 2FA is to plan for failures in your opsec. Everyone screws up eventually, so you need to have a plan for when that happens. My plan is 2FA and changing my password every couple months. > A self-signed TLS certificate you import into every device that accesses mail and a password would be sufficient. The certs identify my server to my client, but I still want two ways to identify my client to the server, in case I ever leak a password, which can happen any number of ways.

>>3131 What possible attack vectors do you see? MITM in between? Use certificate pinning in your browser/client. Forward secrecy? TLS has it. Password bruteforce strength? Fail2ban and master password rotation. Using untrusted device? Don't. Or make 1-time passwords and a free CA certificate for these situations. Something like, you login from trusted machine with self-signed root cert and trusted account password, download set of server-generated passwords, remember them. When you log from untrusted machine, you receive CA-signed certificate and enter a one-time password, get limited access to send/receive. When you log out, the password expires. >in case I ever leak a password, which can happen any number of ways. Do not enter your password if you are not sure if device isn't compromised. Well, even "tokens" and google auth won't save you at this moment. Oh, should I say you can encrypt your plaintext mails with RSA on the server? Speaking of certificates, did Lainchan's just got expired?

>>3128 >GNU/Linux is free software ... without having to trust an unknown team of Indianos who write code for food in Microsoft/Apple sweatshops Because those are the only 3 operating systems. >Write an exploit for mass storage driver and put it into the controller firmware, BadUSB style. Speaking of which, Linux is pretty damn insecure. http://www.openwall.com/lists/oss-security/2017/11/06/8 >Linuces The word you are looking for is distro. There is only 1 Linux kernel.

>>3134 Thanks once again for your input, Agent Fud. We of the Linux community treasure it highly and memorize every word.

>>3137 I'm not the one who brought up USB. It was just a good opportunity to demonstrate how ridiculously easy it is to find bugs in on OS like Linux which is not engineered for security or quality. If you have any evidence to the contrary please share it. So far the response from the Linux fanboys in this thread has been pathetic.

>bsd-user comes to this thread and starts larping on how cool his fbi-backdoored os is

>>3128 >GNU/Linux is free software and it means people who develop it, as well as users have ll the right and ability to audit the code themselves, There are all all fine points as to why open source can be more secure than closed source. But Linux is not the only open source OS. It's like saying metal is stronger than wood therefor a safe made from aluminum foil is secure. This is flawed reasoning. >>3140 No one said anything about bsd. This is about Linux. Linux is not a secure OS (see >>3112 >>3118 >>3134). Prove me wrong. I understand the cognitive dissonance hurts but we're here to talk about facts not worship internet myths and memes

>>427 check if your vpn provider supports ipv6 in the first place. If not, you can just disable it

Not sure if this is the right place to ask. Anyone else suffering from online paranoia? I'm constantly feeling as if I'm being watched while online. I browse the web with properly configured browser that respects my freedoms, always on a paid VPN located outside 14 eyes, on a operating system that respects my freedoms. I use good OpSec practices, and never log onto accounts I use while on a VPN outside it. Yet I feel as if everything I'm doing, such as writing this message, is being watched and judged by LEA, NSA, etc.., even though I know it's impossible. Using Tor Browser with security slider on the highest setting doesn't help either, I feel that all the relays are compromised and I'm constantly being used Timing Attacks against. I know it's just irrational paranoia, but it's really annoying. Is there a way to get this feeling go away?

>>3133 >Using untrusted device? Don't That's trusting that I'm never, ever, going to make a mistake about which devices can be trusted. >Or make 1-time passwords and a free CA certificate for these situations. Something like, you login from trusted machine with self-signed root cert and trusted account password, download set of server-generated passwords, remember them. That's actually a good solution that I might implement, so thank you. >Do not enter your password if you are not sure if device isn't compromised. I don't think anybody can ever really be sure their device isn't compromised. There's a level of steps I'm willing to take to prevent using a compromised device, but at the end of the day, I'm buying hardware at least from somebody else, and that might always have exploits (though I'm sure we all try to avoid buying from people who've been shown to do that). In my current use-case, I'm also using software written by other people, so even though it is FOSS, there's a chance of bad actors temporarily slipping in a supply-chain attack, and there's always zero days. Any of these could lead to a strong password being revealed without my knowledge weeks before it's time to change it. The point is that eventually, everybody's opsec fails. No matter how well I might write out opsec rules in a Lainchan post, I will eventually forget to follow one, and I want a plan for that failure. >Well, even "tokens" and google auth won't save you at this moment. If somebody grabs a TOTP or a U2F-generated key-signed challenge from an untrusted device, they won't be able to use it to login at any other time. >Oh, should I say you can encrypt your plaintext mails with RSA on the server? I was planning to just store them in a LUKS folder encrypted with AES, but that might be a worthwhile addition. Thanks. >Speaking of certificates, did Lainchan's just got expired? Not that I noticed? Maybe check your system clock?

>>3134 >The word you are looking for is distro. There is only 1 Linux kernel. But what if there's more than one of Linus Torvalds?

>>3133 >Speaking of certificates, did Lainchan's just got expired? Yes. It was only for a few hours.

Is there a linux utility that will monitor and filter http traffic for me? I already spent the time to code my own simple http filtering tool but I want to know what else is out there. I want something that will inspect http packet payload and drop/frorward information on to my second filter based on rules or anomoly, this is a little more than what snort can do.

>>3166 Bro will monitor it and keep track of a list of urls visited, some statistics about that. Filtering is more complicated, but I think you can do it with bro you just have to write your own ruleset http://www.r00tsec.com/2014/06/tools-bro-open-source-network-traffic.html

Hey Lain, could you give me some advice? I want to make a bitcoin transaction, it doesn't need to be absolutely hidden, but it should be hard to trace back and I also don't want it tied to my main wallet. I thought of using a fresh wallet on a phone or a clean laptop, hooking it up to someones wi-fi and simply "uninstall" it, after using. What do you think, will this be good, or is there, perhaps a better solution?

>>3190 tails live usb with persistent storage would be a good place to start.

>>3190 All bitcoin transactions are public by design. So getting BTC into your "throw-away" wallet is the challenge. You can try something like localbitcoins.com to buy BTC in person for cash. That will raise the bar very high for someone who wants to track you. What >>3191 said is cool, use Tails. Definitely not a smartphone.

>>3191 >>3199 Thanks, to both of you, locabitcoins.com isn't really established in my country, but I have a person I trust, which will provide me with them. Tails seems like a pretty good Idea, I'm going to check that. You really helped me out.

Any suggestions for fun CTFs with some sort of narrative or contextualization? Already did the overthewire CTFs if that helps at all.

All these cryptography apps for android, are they compatible with any decryption software or do they use a proprietary file format? Cause i see they all have a specific name at the end of the file (.fcc, .eslock) even if they all use AES in theory. If i store files encrypted with these applications on a cloud, will i be able to decrypt them from my pc then?

>>3229 Probably not. Projects like Truecrypt/Veracrypt and LUKS include special headers to ensure compatibility with different applications. If you only want single file encryption then OpenPGP is a standard format for encrypting files which is guaranteed to be compatible with different tools (Gnu Privacy Guard for the desktop), so look for an app that supports that.

has anyone heard of freenom world? It's some anti ad dns service, good, bad? http://www.freenom.link/en/index.html?lang=en

Bad. Don't mess with Freenom or any of their services. I find it ironic how they claim to have a DNS service that stops ads (which it simply doesn't, by the way), while they throw ads over the also "free" domains they give once you start gaining traffic. If you want a good DNS service that comes with a lot of other nifty goodies, use OpenNic. It's fast, open, has a small community, and functions as a nifty little darknet, giving you access to some special TLDs, including Namecoin and Emericoin ones. https://www.opennic.org/

>>3338 >DNS that stops ads Yeah no, it doesn't work like that. >>3339 I've never heard of OpenNic. I'll try it, thanks lain

Does OP understand how this "ads blocking" works? I can explain. Let's say, you visit a website filled with ads. Your browser parses the web page source before rendering and visits embedded links for shlomo.advert.net123.com to receive banners from. An ad-blocking DNS server simply drops resolutions to all known advertising domains returning 127.0.0.1, so it might or might not have shlomo.advert.net123.com in it's database, you never fully know which ads they block or allow. The third-party DNS server is not something you have control of. You can have a filtering proxy or dnsmasq server running on your router, home server or VPS, or PiHole which is basically the same, or even copy adblock lists to your hosts file. But in my opinion, it is not reliable to offload such thing to third party server since installing uBlock Origin with cosmetic filters with constantly updating lists is much more intuitive for end user.

>>3344 my bad, I miss read it, it doesn't block it, it claims to stop ISP tracking for ads.

>>1364 I want to force all kali tools only work using tor. Will this do it? Or only in browser?

>>3351 It is possible to setup iptable rules to transparently forward everything over Tor but I don't like this approach so I didn't post it in >>1364. I prefer to know which applications are going over Tor and anything I don't know about can fail and die. Tor comes with a torify script, which will force any application you want to go through Tor. https://linux.die.net/man/1/torify There is also an application called Proxychains which works the same way but lets to add any number of socks4/5 and https proxies into a chain. This is useful because many people simply blacklist Tor exit nodes. With proxychains you can hide your identity through Tor and then hop through an extra socks5/https proxy server to avoid the blacklist. http://manpages.ubuntu.com/manpages/wily/man1/proxychains.1.html Be aware that Tor does not work with UDP so not all Kali tools will work.

>>2 I'm having an issue cracking a handshake file. I'm not sure if I'm being a dumbass or if I'm getting the syntax wrong or what, but here's what I've been inputting: .>crunch 4 4 charset.lst mixalpha-numeric-space | aircrack-ng -e <I put the ESSID here> -w - scan.cap when I execute this line, crunch looks like it's beginning to start, and then Aircrack comes up and immediately spits out "Passphrase not in dictionary. Quitting aircrack-ng..." what the fuarrrk am I doing wrong? Everywhere I've gone it seems like I'm using the right syntax. I've tried swapping some of the aircrack bits around and messing with whether or not to add /root/ to the beginning of the .cap file, but it seems to make no difference. please help im losing sleep over this

>>3352 Thanks, Lain! Proxychains solved my problem! >>3382 Are you sure that you got the handshake deauthing users before trying this? Try do fist the list, than the crack itself, although, "Passphrase not in dictionary" is clear enough, idk, but perhaps that's not the pastern of the password. I was able to do this, but idfk why i'm having a python traceback error, this started after a suddenly stop. Has anyone been though this? root@kali:~# mitmf --hsts --arp --spoof -i wlan0 --target 192.168.0.6 --gateway 192.168.0.1 ███╗ ███╗██╗████████╗███╗ ███╗███████╗ ████╗ ████║██║╚══██╔══╝████╗ ████║██╔════╝ ██╔████╔██║██║ ██║ ██╔████╔██║█████╗ ██║╚██╔╝██║██║ ██║ ██║╚██╔╝██║██╔══╝ ██║ ╚═╝ ██║██║ ██║ ██║ ╚═╝ ██║██║ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ Traceback (most recent call last): File "./mitmf.py", line 81, in <module> settings.Config.populate(options) File "/usr/share/mitmf/core/responder/settings.py", line 72, in populate self.SSL_On_Off = self.toBool(self.config['Responder']['HTTPS']) File "/usr/share/mitmf/core/configwatcher.py", line 28, in config return ConfigObj("./config/mitmf.conf") File "/usr/lib/python2.7/dist-packages/configobj.py", line 1229, in __init__ self._load(infile, configspec) File "/usr/lib/python2.7/dist-packages/configobj.py", line 1318, in _load raise error configobj.DuplicateError: Duplicate keyword name at line 104. root@kali:~#

>>3393 someone on normal person /g/ was able to help me. i was just being a dumbass. shortest accepted wpa2 key is 8 characters, so the program was just automatically closing itself out. thanks though

Hello, Lain. I would like to know, witch hacking gadgets do you use? I was wondering about buying a lan squirrel and a bash bunny, what do you think? Is it a great choise? Lastly, but not less important, how about homemade devices? Shoud you have some project please share with me. I thought about diy rubber duck, but unfortunately I live in a poor country where is very hard to find very specific resources like those models of devices. https://github.com/brandonlw/Psychson/wiki/Known-Supported-Devices What do you recommend?

>>3342 >it doesn't work like that It can. Modifying WIndows' HOSTS file to redirect ad domains to empty ips used to be a popular ad blocking technique, and DNS can easily do the same thing. Simply put: When a page requests a resource from e.g. "doubleclick.net" (or any other ad provider), your computer must ask the DNS server for doubleclick.net's IP address. If it gives you a fake one, you will be unable to connect to the doubleclick servers and will not download the ad content.

I just realised I had a DNS leak. Does this mean my internet history from months back has been completely fukking transparent to my ISP despite using a VPN? I feel sick.

There are tonnes of security-focused operating systems nowadays. What I'm wondering though, is weather using some obscure OS like FreeBSD or AmigaOS could subvert whatever tactics might be used to de-anonamize you. My logic here is that nobody would bother with developing tactics to compromise users of obscure OS's. Nothing more than a VPN would be necessary, right? Probably wrong It's sort of like that old cliche that Macs can't get viruses. The reason for that of course not being that they're inherently safer, but that fewer people use them.

>>3560 https://en.wikipedia.org/wiki/Security_through_obscurity

>>3560 >subvert whatever tactics might be used to de-anonamize you. Attacks against Tor like traffic correlation work the same no matter what OS you are using. >Nothing more than a VPN would be necessary, right? The anonymity properties of a VPN has nothing to do with what OS you run. >My logic here is that nobody would bother with developing tactics to compromise users of obscure OS's. This is a double edged sword because if there are fewer blackhats looking for bugs there are also fewer whitehats getting bugs fixed. It could just as easily be the case that obscure software is easier to attack because all the low hanging fruit is still there. See Linus's Law. >AmigaOS This is too old, it won't have any modern security features like aslr or maybe even a non executable stack. >FreeBSD This is not an "obscure" OS. The whole of Netflix runs on this soykaf.

>>3560 >is weather using some obscure Os like FreeBSD Weather uses FreeBSD? That explains why it never snows when I want it to. Jokes aside, the answer to your question is not really. Your OS doesn't help to anonymize you. A person behind 7 proxies from Windows has the same level of anonymity as one behind 7 proxies running Linux. A person behind one VPN only has as much anonymity as that VPN can provide. If a malicious actor gets a hand on your VPN's logs, it's not going to matter whether or not you're running TempleOS or FreeDos or whatever. Your IP is there. Where operating system plays a role is when people attempt to exploit your system to deanonymize you. For example, when the feds deanonymized Tor users by running malicious javascript that exploited their browsers and phoned home to an FBI server with their real IP address. This attack was targeted towards Windows users, so everyone else was safe. You obviously want to run a more secure OS, but not necessarily obscure. OpenBSD isn't obscure, but is fairly secure. MS Dos is obscure (now) but entirely insecure. My personal recommendation is to build your opsec around the idea that your system will be compromised at some point. Hackers and the feds can buy exploits for virtually any system. You may as well assume your system is going to be exploited at some point.

>>3557 >I just realised I had a DNS leak. Does this mean my internet history from months back has been completely fukking transparent to my ISP despite using a VPN? I feel sick. Just the domains you've requested. Your ISP isn't going to know which lainchan boards you visit, or even how often you visit the website, since your computer caches the IP addresses of the sites.

>>3557 Such is pain of using proprietary init system instead of proper DNS resolver. >>3560 BSD family OSes are not as "obscure" as you think they are. And they share common vulnerabilities with NSA-backdoored networking equipment or even general purpose UNIX-compatible systems. What you need is a dedicated firewall appliance, basically a virtual/physical computer that will do one thing: route your packets to VPN or Tor and nothing else, it shouldn't even have SSH daemon of any sorts, the management will happen through serial console, therefore it will be protected against collateral damage most software exploits rely on. You will have to update the system manually though. By burning a new filesystem on read-only flash memory. Indeed, some obscure browsers or operating systems might not be vulnerable to new malware, but by using non-standard web browser you already mark yourself as suspicious and therefore an easy target for targeted attack. I however doubt that your Amiga will catch chinese cryptolocker the moment after you plug in Ethernet cord, and doing simplistic non-fingerprintable stuff over Tor like IRC/email/xmpp chatting would be fun and hacksey.

>>3563 >>3564 >>3566 Yeah, I shouldn't have used BSD as an example, I know. I should have been a bit clearer in my question; I know of the weaknesses of Tor, what I'm referring to is malicious script which would 'phone home' as one reply put it. But in this case I appreciate >>3566 pointing out that you'd just stick out and be more susceptible to a targeted attack.

Hello, Laions. Happy new year. Does anyone here have already flashed some router using tftp? I bought a TP-LINK archer C20 v1, and I'm trying to install openwrt on it, but looks like flashing directly via UI will brick the router. So I need to do it via tfpt as the page says: https://wiki.openwrt.org/toh/tp-link/tp-link_archer_c20_1 I have tried to start the tftp using the ip .66 on eth0, but always timeout the connection, I also tried to send directly to the router ip end .1, but no success, I also found this support page that didn't helped me so much, but some guy said that models c20i and c50 are similar to this one, but I'm afraid to brick this router. What shoud I do?

>>3572 Stupid question but do you actually have another machine plugged in over ethernet, with the correct IP address and running the tftp daemon? Run wireshark on it to get a perspective from the other side.

>>3581 I have tried with wan connect and only lan, but I got the same result. But as I saw on openwrt wiki, they say to use the host with ip 192.168.0.66, plug lan port to host, start tftp server and reset wps, so it will try to download the firmware from this server. So I guess internet connection is not needed to do this, am I wrong?

>>3588 Can you check if your tftp server is reachable? Do you have another computer for that?

>>3591 Sorry it took me so long to reply, I've never used tftp and I'm kind lost, I think maybe I was running tftp as a client instead a server, or the opposite idk... I'll try to test it from another computer, but can you just correct me please, if am I wrong? I was running: #setting ip ifconfig eth0 192.168.0.66 netmask 255.255.255.0 #cp file to tfpf cp ArcherC20V1_tp_recovery.bin /var/lib/tftpboot #starting the server as says in the wiki tftp 192.168.0.66 binary rexmt 1 timeout 60 trace Packet tracing on. tftp> put ArcherC20V1_tp_recovery.bin After that I hold reset/wps button for 10s and wait, but tpft don't send any file, just timeout. I'll keep trying, thank you lain.

>>3610 >#starting the server as says in the wiki >tftp 192.168.0.66 Are you sure? This looks like connecting as a client. You need to run a tftp server. It will serve a directory (you tell it which directory in a configuration file), and you need to make sure your firmware is inside this directory. That's it. This `tftp put` thing is wrong, Unless the other device is running the tftp server. In which case the `tftp put` thing to correct but you need to connect to the IP address of the device and make sure your IP address is different (at the moment both are .66)

>>3611 Thank you I think that's the problem, I'll look to config file, but which command should I use to start tftp server using the ip 192.168.0.66. Looks like this router try to get updates from this address.

>>3617 Hey lainon, you can host a FTP server directly on your machine or running a VM. You can pretty much find any guide with a quick google search. https://askubuntu.com/questions/201505/how-do-i-install-and-run-a-tftp-server adjust to your OS/Distro change the values for the one you need Good luck! o/

Are Infosec/cyber degrees complete memes even if they're NSA/DHS designated soykafting centers of excellence? Programming, Linux, networking, etc., are touched upon. I'd be attending while working full time, and do have some classes to transfer in. The curriculum is $199 per credit hour for all the major courses . Link: http://cyberinstitute.kennesaw.edu/academics/bs-cybersecurity_emajor.php

>>3628 >>3628 Thank you lain, i'm up to my eyes in work, as soon as I have some time I'll try it again. I report back what happened.

About dual booting: I'm fine as long as I keep my linux partition(s) encrypted, right? Or are there some possible security risks involved still.

>>3686 A secondary untrusted operating system can perforom an evil maid (modify the unencrypted bootloader). Therefore, keep the botloader on a separate flash drive and check the encrypted partition on every boot for possible changes.

I'm looking to get a new android phone... Want something that can be rooted, hopefully a custom OS, nothing too fancy really just a nice little device to have in in my pocket for general tasks... The whole smartphone market is overbloated and unnecessary and idk where to start, but I really need a new phone.. Any lains have some input/advice on what to get? Maybe somewhere to look? Trying to dive into this makes my head hurt, I just want a phone that does what it should.

>>3792 Look at the LineageOS and (defunct)CyanogenMod compatibility listings. Basically what you want is an unlocked bootloader, which will let you write anything to the filesystem to boot it without any signature verification. Google devices (anything "Nexus") are good for this. If you want non-Android Linux then look at postmarketOS. >general tasks... If this includes wifi shenanigans be aware that most phone and tablet wifi chips don't support monitor mode.

How do smaller companies defend themselves from getting huge bills from their CDN providers in case of a DDOS? I'd imagine receiving a huge ton of requests could get expensive quickly. It's something I've been wondering about, I mean imagine if you could bankrupt someone simply by using a GET request loop.

>>3852 Isn't ddos protection charged at a flat price? Like, the hoster/CDN defines what is DDoS and what isn't and then balances it upon their own network. Well, if some of those requests are processed as valid, then an attacker is highly motivated already and it/s not a price charges you should worry about.

>>3853 The ASICs that they route your traffic through during a ddos are very expensive to run, so they typically don't route your traffic through them all the time. When the provider detects a ddos (or you call them and yell angrily about your site being down), they switch them on. However, some DDoS mitigation providers leave them on all the time, so those are much more expensive. However, cloudflare will provide DDoS mitigation to all of their customers right now because they want to test their mitigation system

how secure is wikipedia? its possible to get user privileges without intervention of sysops? Im a simple user without flags (patroller, reversor, etc), and I want to know if its possible to: get access of other account, watch the ip from a register user.

>>3883 I don't think attacking wikipedia is the way to go. If you are targeting a specific person then luring them onto a site you control with a direct message or something might be the most effective route. From there you can try to get their credentials with phishing, gather information about their browsing activity with beef or exploit a code execution vulnerability in their system to get deeper access.