Data Privacy Day: 2014 Edition

It's once again January 28th, which means it's once again Data Privacy Day! This is a great day to read up on privacy matters, check your privacy settings on various websites, see what web and mobile apps are doing, etc. Below various relevant links along with my own articles from last year's Data Privacy Day.

• MyPermissions has shortcuts to the permission and privacy settings for many popular web apps. They also have a mobile app for alerting you of when new apps are getting info from your account.
• It's a great day to visit the Electronic Frontier Foundation and read up on the latest privacy concerns and what you can do to protect yourself. The last year saw huge violations of privacy by various government and non-government organizations. The EFF is all of our friends in fighting for our privacy.
• Android 4.3 users had the option to more easily review app permissions and selectively allow them via App Ops. Unfortunately if you're running 4.4.2 you can't any longer (hopefully the feature gets re-added in the near future)
• Google released an official Device Manager for Android that allows you to locate, lock, and wipe your lost phone. Less third-party apps is always a good thing and it's free. Losing your phone is a huge potential privacy problem.
• Facebook privacy settings are always changing, and facebook is still a big part of many people's online presence. Lifehacker has a great writeup on Facebook Privacy.
• A comprehensive guide to passwords by me.
• Most of us have a smartphone, and it usually holds a lot of personal info. Keep it safe.
• Keeping things private on the web is no easy feat, but here's my guide on it.
• Keep private information secure by encrypting it.
• If your network is compromised, everything you do on it is potentially compromised too. Here's how to keep safe on networks.

Remember to spread the word about Data Privacy Day. Awareness is step #1 and the more people aware of Data Privacy Day, the bigger of a success it can be and the better off everyone can be.

Read More

OpenVPN Server on Windows

UPDATE: Every once and a while someone will reach out to me about this and ask about if I have any plans to update it. I no longer use Windows as my primary OS (switched to Linux) and no longer use OpenVPN either. The below guide may have issues, especially on Windows 10, which I don't use.

OpenVPN is a wonderful VPN system, but it's not so simple to set up on Windows. When I first created this how-to, there wasn't a real cohesive and precise instruction set on how to get an OpenVPN server working on Windows where Windows clients could have all traffic go through the VPN (the alternative is where only directed traffic goes through the VPN: Split tunneling). I prefer all my traffic going through a VPN when connected, less likely for information to leak out.

NOTES:
 1. Throughout this guide I will use two words: over and over again: server and client1. Feel free to modify these, but be sure to modify them EVERYWHERE they are repeated. To help you out I bolded and italicized them everywhere you should change them (except in the config files, they need to be changed in those as well)

 2. Everywhere you see quotation marks, it is to signify what you should type (which would be the stuff inside the quotation marks), DO NOT TYPE THE QUOATATION MARKS UNLESS OTHERWISE SPECIFIED!

 3. I know this seems long, but it really isn't, I just broke everything down into as basic of steps as I could and explain everything as thoroughly as I can. In the end, it pays off, you have a secure multi-client VPN offering that definitely beats PPTP in terms of security and robustness.

 4. A relatively common practice with OpenVPN is to configure it to use TCP port 443, as this is the port normally associated with HTTPS, so even the most most draconian of firewalls won't block it. I don't cover this, instead cover OpenVPN using the default port of 1194 UDP. Changing it is simple, just edit the server and client configuration files to use proto tcp and port 443. Make sure to also change your forwarded port and firewall rules to match as well.

 5. This guide uses the 192.168.137.0/24 block for the OpenVPN network. This is the default for Internet Connection Sharing (a needed utility to get Internet through OpenVPN on Windows) for Windows 7, which is why I chose it (it should also be the default for Windows Vista, though I cannot test this) On Windows XP, ICS uses 192.168.0.0/24 by default, which isn't very useful for a VPN (as it's a popular subnet and would lead to conflicts in various situations). If you wish to change the subnet for OpenVPN, you must change it in the config file for the server as well as for ICS. This can be done through a registry setting. In HKLM\System\CurrentControlSet\services\SharedAccess\Parameters you will need to change ScopeAddress and ScopeAddressBackup to the first IP address in the range you wish to use. I am not certain if Windows XP can change it or not, but it's worth a shot. Here is a registry file of the 192.168.137.1 ICS configuration, change the network numbers and run it to change to a different subnet (or do it manually). You can also find it on PasteBin.

 6. You will also need to know your public IP address or set up a Dynamic DNS service. This can be done by visiting http://www.whatismyip.com/ on your server. Better is to set up no-ip on your server and use their free dynamic dns service (as it'll work even if your home IP changes). You will need to do this for PPTP VPN servers and SSH servers. I will mention this again when we get to the client configuration file.

Pre-Install

This guide assumes two things: You've properly set up a static IP for the will-be server and you have configured any firewall on the will-be server correctly. I will do a quick run-down of how to do this on Windows Vista/7 with Windows Firewall (which are the same in this matter).

Static IP: Windows XP/Vista/7

Windows Firewall setup:

1. run wf.msc
2. Click Inbound rules on the left panel, and on the right panel click "New Rule..."
3. Select Port for the rule type and click next. Image of steps 2-3 
4. Select UDP and enter in port 1194 and click next
5. Select Allow the connection and click next
6. Select which networks to allow the rule, to be safe, allow for all and click next
7. Name the rule "openvpn in" (without quotes) and click finish.

Install Process

1. Download OpenVPN onto the will-be OpenVPN server and run the installer (as administrator if you are using Windows Vista/7)
2. . When you get to the "Install Location" part of the setup, I highly recommend installing it to C:\OpenVPN rather than the default install path. Especially on Vista/7 as this will save you headaches. Proceed to finish the install
3. Navigate to the installation folder (C:\OpenVPN if you followed my advice), then enter the config folder (C:\OpenVPN\config).
4. Here, create a file server.ovpn. It should look like this:  http://pastebin.com/wU0MeHKL
   
   About the server.ovpn configuration file:
   
   You can modify the port number to any number you want, just remember what you set it to. Same for proto (short for protocol) you can change that to tcp, just remember you did so (udp will give you better performance, but may be blocked on some draconian networks)
   
   Line 5 is one that may need changing. First, you need to keep "server" as server (it's a configuration line dictating the VPN server IP range). Later on we'll enable Internet Connection Sharing and you may need to change 192.168.137.0 to match any IP address being forced on you by Internet Connection Sharing (for me this was 192.168.137.0/24 but it may be different for you) I'll remind you of this when we get to Server Configuration.
   
   You need to specify the DNS servers, I chose OpenDNS as it makes it easy to test if the tunnel is being used without running something like Wireshark (which is nice), but any DNS server will do.
5. Open up the command line (As administrator on Vista/7)
6. type "cd C:\OpenVPN\easy-rsa" (without quotes, everywhere you see quotes from now on, it's to signify what you should type) and hit enter
7. type "init-config" and hit enter
8. navigate to C:\OpenVPN\easy-rsa in explorer if you haven't already. find the vars.bat file, right-click it and edit it
9. Edits to make to vars.bat:
   
   Mandatory: change HOME path from "%programfiles%\OpenVPN\easy-rsa" to "C:\OpenVPN\easy-rsa" (if you don't do this you will get an error complaining about unable to write random state)
   
   You also need to fill (found near the bottom of the file):
   
   set KEY_COUNTRY=
   set KEY_PROVINCE=
   set KEY_CITY=
   set KEY_ORG=
   set KEY_EMAIL=
   
   Technically, any value will do, including the default ones, but I suggest filling them in with your information
   
   You also need to set KEY_NAME and KEY_OU . I usually set name to my name and OU to VPNers just because it's simple.
   
   -------- DO NOT CHANGE KEY_CN, IT NEEDS TO BE CONFIGURED ON A PER-RUN BASIS ----------
10. Save vars.bat and return to the command line (reopen it as administrator and navigate back to C:\OpenVPN\easy-rsa if you closed it)
11. type "vars" and hit enter
12. type "clean-all" and hit enter (it's normal for this to kick up an error, it just means the folder "keys" didn't exist before it was ran)
13. type "build-ca" and hit enter. This will start the creation process for the ca.crt file. You will be prompted for various things. The default values are fine until you get to COMMON NAME
14. WHEN YOU GET TO Common Name enter in "server"
15. "build-key-server server"
16. Leave the password blank unless you want to read OpenVPN documentation. same for company name
17. answer "y" to signing and committing to the certificates.
18. type "build-dh" and hit enter
19. copy ca.crt, server.crt, server.key, and dh1024.pem from the keys folder in easy-rsa to C:\OpenVPN\config
20.  type "build-key client1" and hit enter
21. WHEN YOU GET TO Common Name enter in "client1"
22. Leave the password blank unless you want to read OpenVPN documentation. same for company name
23. answer "y" to signing and committing to the certificates.
24. Install OpenVPN on the client computer EXACTLY the same as on the server (ok, it doesn't really need to be exactly the same, I'm just too lazy to tell you what you do and don't need)
25. copy ca.crt, client1.crt, and client1.key from the server's keys folder to the client computer's OpenVPN config folder (C:\OpenVPN\config if you installed it like I said)
26. in the config folder on the client, you will need to create a client1.ovpn file. It should look like this:  http://pastebin.com/42ekkJtL

About the client configuration file:

You need to use the same protocol as you specified on the server configuration file.

On line 5, for remote, you need to specify the PUBLIC IP address of the server OR the DNS entry for it. Refer to Note #6 for this information. After the ip address or DNS listing, specify the port. This needs to be the same port as in the server configuration file.

Almost done! Just have some configuration left on the server to go.

Server Configuration

1. On the server open up services (run services.msc). Find OpenVPN, right-click it and go to properties. Set it to automatic and start it.
2.  Still on the server in services, find Routing and Remote Access (shorthand: RRAS). Set it to automatic and start it. NOTE: At least in a couple of my goes with this, enabling RRAS made my network indicator in the notifications tray signify I had no connection -- I Still had a connection despite being told otherwise. It only happened on a few of my computers, so it may or may not happen to you (if it does, see if you can access any website. If you can there's no problem)
3. You will need to modify a registry entry, so open up regedit and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters. In there change IPEnableRouter to 1 (defualt is 0).
   IPEnableRouter.reg file download | PasteBin
4. You may need to reboot before the registry change takes effect
5. Still on the server, go Control Panel->Network and Sharing Center and click on "Change Adapter Settings"
6. If you use my config it is necessary to change the TAP name (as the default name is random). Right-click the adapter that says TAP-Win32(or WIN-64) Adapter and select "Rename". Rename it to "MyTap".
7. Right-click the newly-named MyTap and go to properties. Uncheck IPv6 if it's available (Vista/7 + some XP computers with it configured).
   
   Now we go onto Internet Connection Sharing (ICS) configuration. You may wish to review Note #5 as it covers some details on how to use a different subnet, as well as the "Some Things Very Important To Note" section for possible issues. A reminder is my guide assumes you are using 192.168.137.0/24, which is not the case on Windows XP. Edit as appropriate.
8. This part is not necessary if you have checked the registry entry for ICS and made sure it is correct for your needs, but is a useful way to double-check as you'll get a warning popup. While still having the MyTap Properties open, Select IPv4 and click properties. Give it a static IP of 192.168.137.1 with a 255.255.255.0 subnet mask.
9. Right-click your LAN adapter (the one you gave a static IP in step zero) and go to Properties. Go to the sharing tab (advanced on Windows XP) and check "Allow other computers to connect through this computer's Internet Connection"
10. If there is a drop-down list you can select from, select MyTap. If not, don't worry: that just means you have no other adapters to share with other than MyTap. Image of Steps 9+10
11. Uncheck the lower box titled "Allow other network users to control or disable the shared Internet Connection" if it is checked.
12. Click OK. If you did optional step 8 for Server Configuration, you'll get a popup that says something about how MyTap will be set to 192.168.137.1. If yours said a different IP address, you will need to modify server.ovpn to use that subnet (same first 3 sets of numbers, last one a zero) and restart the OpenVPN service, alternatively you can set the ICS network range in your registry. Run this registry file to use the guide's 192.168.137.1 (Pastebin) or configure it manually using regedit and navigating to HKLM\System\CurrentControlSet\services\SharedAccess\Parameters and editing ScopeAddress and ScopeAddressBackup to use the desired IP address range (you specify the first IP address in the range). You can check to make sure that the IP address for MyTap is correct by running ipconfig /all in the command line and making sure it matches that in your server.ovpn config file.

Now you just need to port forward for OpenVPN so you can access it over the Internet.

Client Configuration

1. Still on the client, go Control Panel->Network and Sharing Center and click on "Change Adapter Settings"
2.  If you use my config it is necessary to change the TAP name (as the default name is random). Right-click the adapter that says TAP-Win32(or WIN-64) Adapter and select "Rename". Rename it to "MyTap".
3. You can try out OpenVPN now on your LAN to make sure all is working. Just change your client1.ovpn to connect to your server's LAN ip address (NOT the address you set for MyTAP on the server, but the static IP you set for the LAN adapter).
4. Launch OpenVPN GUI (as Administrator on Vista/7). A tray Icon should appear for OpenVPN (a little red-monitored computer with a globe). Right-click it and select "Connect"
5. A window like this will appear. After a few seconds to a minute, you should hopefully connect and be assigned an IP address. To verify traffic is going through the tunnel, assuming you used OpenDNS, you can test it simply using an OpenDNS check.

I know it's been a lot of work, but it's worth it. You now have a secure basic VPN setup More robust than Microsoft's default PPTP offering as well as allowing multiple clients. You can improve the security by looking into ta.key, maxclients, client filtering, choosing the cipher, and password authentication. You'll need to go elsewhere to learn how to do these, or I may cover them in a future post. Finally, there are a few things you should know

Some Things Very Important To Note

• If you have issues with resolving DNS, uncomment register-dns from the client file.
• On some networks with a short dhcp timeout, your client may have issues with getting a new address lease due to OpenVPN sending the request through the VPN. Disconnecting from OpenVPN and running "ipconfig /release" followed by "ipconfig /renew" in the command prompt will solve the issue (until it times out again).
• Internet Connection Sharing (ICS) is a tricky one, but I've gotten it mostly figured out through the SharedAccess registry options. You can read up on configuring ICS here. On Windows XP it uses 192.168.0.1 by default and I've yet to verify if that can be changed.
• Strictly speaking, the subnetting you are giving your OpenVPN server may not be absolutely correct. This doesn't matter for a handful (3) clients, but it may stop you from having too many clients. This appears to either be related to the version of Windows used, related to the NIC used, or related to whether the NIC used is a wireless NIC and cannot be changed. You should get subnet mask of 255.255.255.0, but may get less (lowest I got was 255.255.255.252 -- 3 clients + the server would max that out). When the OpenVPN client should pull the correct information when it connects, so as long as you don't exceed the limit, it's not an issue. Slightly related is the below:
• I don't know if this was because my virtual machine is crashy, but I noticed that the MyTap adapter would randomly change to using APIPA (Automatic Private IP-Adressing) and therefore having the 169.254.0.0/16 block. It's simple enough to fix. NOTE: This happens when RRAS runs into an issue and the DHCP server fails, to fix this issue, follow the below 3 steps:

First, disable sharing on the LAN adapter.

Second, reset the MyTap to use a static IPv4 address (IP and default gateway the same, in my case 192.168.137.1).

Third, re-enable sharing on the LAN adapter for MyTap.

• I suggest disabling sleep/hibernation on the server (I mean, if the server isn't online when you need to connect, it's kinda useless) anyway. And whenever you reboot for updates, just check to make sure the MyTap properly has the first IP address in the block your OpenVPN server gives.
• I've yet to find a way to get the OpenVPN network to be identified by anything less than a Public Network on Windows 7. It doesn't make much of a big deal unless you want to access network shares on the OpenVPN server (which may not be possible since Windows may block sharing since it's a public network). NOTE: This is due to OpenVPN's network not having a default gateway. Some steps on potential workarounds can be found on the Internet.

Read More

Data Privacy Day Prep Part 5: Network Security

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 5; it's about Network Security. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

An important definition:

•  Man-in-the-Middle attack: Any attack wherein someone intercepts data you receive and send to someone else by acting as a relay ("in the middle"). This can be done in numerous ways (arp and DNS poisoning being two common methods, though many other methods exist) but the end effect is the same: your information and communication is compromised. Your passwords can be stolen and your sessions hijacked. This threat is an increasingly common problem on wireless networks, and can even affect mobile telecommunication networks (for around $500 and enough know-how is the current going rate, FYI).

Networks

Your local network is an important point of security. A properly set up one will allow easy sharing and collaboration while simultaneously keeping out those who would intrude on it from the outside. This section will cover your local network, your local computer, and how to protect your computer and privacy when on public networks.

Your Wired Network

For a wired network, you don't have as much to worry about. Make sure not to use the DMZ your router allows: this is a black hole for security and offers nothing over properly forwarded ports. Any forwarded port should have a distinct purpose, otherwise don't forward them. Disable remote/WAN administration (might be buried in there somewhere). Make sure to keep the router nice and updated with any new firmware releases (better yet, use custom firmware like DD-WRT, OpenWRT, or Tomato), as they patch various security flaws. Next you should change the username/password for logging into your router. Finally make sure your router firewall is enabled; it's one of the nicest features they have. While not necessary, disabling UPnP can add a little more security by closing any vulnerabilities it may have that are unpatched and keeping rogue software for dynamically forwarding ports. Being careful is simpler and more friendly, though.

Your Wireless Network

Wireless networks are another thing. On top of all the above, you NEED to be using WPA2 with AES. Nothing else is secure!!!! Well, nothing you can reasonably implement, at least. This checklist is pretty good; the only two things I disagree with are using MAC filtering and disabling SSID broadcasting. If someone knows how to crack a WEP key, they can easily find out how to spoof a MAC address or uncover an invisible network. Both also come with significant disadvantages while offering no real security. As mentioned in that checklist, make your WPA2 key very complex. You don't need to worry about forgetting it: write it down and stick it to your router. If someone is in your house, your WPA2 password isn't going to keep them out of your network. If you want to be secure with your WPA2 key, consider using the same password strategies mentioned in the passwords section.

 But what about your WEP-only devices? I've not tried it yet myself, but here is a guide on how to set up a virtual wireless network for your WEP devices. Other options are to set up a wireless access point with WEP for when you want to use your DS/other WEP-only devices, and just unplug the WAP when not using it. Everything else will be on your normal WPA2 connection.

 A very new happening in attacking WPA/WPA2 networks is to ignore trying to break the WPA/WPA2 encryption and instead have the router give you the password. A common feature included in many modern routers is Wi-Fi Protected Setup (WPS). Unfortunately, this is a weakness as it is a simple (generally hardcoded) PIN that is very easy to brute-force. Lifehacker did a full rundown of this attack vector and the primary tool to abuse it (Reaver), which I suggest you read so you can stop it from happening to you. A redditer created a wonderful spreadsheet of many common household routers and whether they are vulnerable to Reaver and whether you can disable WPS on them (some routers cannot have the feature disabled even if there is an option on the web interface to do so). One thing to immunize yourself against this attack is to flash a custom firmware on the router, such as DD-WRT. Many custom firmwares do not have support for WPS, so it nullifies this vulnerability.

Your Computer (localhost)

Your computer can leak information out of your local network if you are not careful. The browser section covered many of the most common leaks, but if you computer is infected with a keylogger or other malware, data may be leaked and all of your network security can be bypassed. Likewise, on an open network, someone may try to break into your computer over the network. There are a few things you can do to mitigate these risks:

 Keep your Operating System updated. It's easy to fall into the cycle of not getting the latest updates for your OS. These often patch security holes that can be exploited. Along the same lines, keep your software updated, especially major programs and anything that uses the Internet. Along these lines is NOT using an unsupported OS. Windows Vista Home and Ultimate editions reach end of support this year in April, so upgrade before then or it'll only be a matter of time before an unpatched hole allows for unassisted malware installation on your computer due to running an unsupported OS.

 Just as important to keeping your OS updated, is keeping your software updated. Key programs that should be kept updated are your Antivirus/antimalware/firewall solutions, your web browser of choice, your pdf viewer, Java (if installed), Microsoft Office (if installed, can be updated through Windows update), and your media player.

 Use a password! Windows passwords are trivial to overwrite if someone has access to your PC (which is where encryption comes in), but they are VERY useful in keeping other, unwanted people on the network out of your shared folders. You should also, of course, disable shared folders on public wifi networks.

 Install a firewall. Your router has one, but when on open networks like your laptop may often connect to, your router firewall won't be of any help. With Windows Vista/7, the built in firewall is pretty good (and can be improved with Windows7FirewallControl -- which works with Vista/XP as well). The best free one is Comodo's Firewall. the Defense+ feature also is a basic HIPS program (Host-based Intrusion Prevention System) that will stop rogue programs from doing naughty things. This does an excellent job on keeping keyloggers, trojans, and worms from sending data out from your computer (keyloggers can also be effectively nulled with the use of a password manager such as KeePass and LastPass). Lately Comodo has been getting bloated, a good HIPS-based alternative is PrivateFirewall.

 Keep your antivirus/antimalware/antispyware solutions up-to-date and scan as you feel needed. Whther you run full-fledged real-time protection antivirus + antimalware solution, or a free antivirus and something to occaionally scan with like Malwarebytes, it's better to have it on your system now and not need it then need it and not have it. Some malware make it near-impossible to install antimalware programs and/or update them successfully. Instantly being able to do a scan after you think you've been compromised is a very nice thing. The next-best thing is to instantly shut down your computer and use live rescue CDs like Kaspersky offers (there's tons of them). Antivirus/antimalware/antispyware, whether proactive or retroactive, should always be considered your last line of defense.

 Disable file sharing when you don't need it. This is of particular importance when on public wifi. In Windows 7 this is done simply by going Control Panel > Network and Sharing Center > Change Advanced Sharing Settings (left panel item). Expand the Public profile. Turn off Network Discovery (not really necessary, it doesn't offer any real security), Turn off File and Printer Sharing, and Turn off Public Folder Sharing. Save the changes and exit. Next, disable your administrative shares. Disabling shares you don't need is important for those "oops" moments when you connect to a network and accidentally make it a home or work network instead of of a public one.

Shared and Public Computers

Shared and public computers are of particular risk. With shared computers, it's possible someone else using it has unwittingly installed some privacy-invading software or may try to snoop your files. On public computers you never know if there's a keylogger or some other malice acts going on. It's best to do your best to minimize your risks on these computers. With shared computers, you should verify that other user accounts cannot access your data by checking folder permissions and make sure other accounts don't have read (or execute) access. Another thing you can do is set up email alerts for whenever someone logs in to your computer. It may be handy if you think someone is snooping around. I personally prefer blat for sending emails from the command line on Windows, though sendemail is fine too. SendEmail is also available for Mac OS X and Linux, and the instructions given there will mostly apply, but you'll need to create a shell script to run them on those platforms and set it to run at start-up. An alternative program for Linux and Mac OS X is ssmtp, which I find a bit simpler than sendemail. Here are some instructions on ssmtp's basic set up and some Mac OS X instructions.

 Public computers are especially scary because there's so much unknown about them. The best bet is to reboot into Linux if possible. It's not always possible with public computers, but when it is it'll provide you the best option. A privacy and security-minded Linux distro is Tails. Of course, booting into Linux isn't always possible on public PCs (being able to do it is actually a really bad sign) so instead you may have to make due with some portable apps. I'd recommend avoid using passwords when possible, and using only accounts with two-factor authentication otherwise. Definitely use a portable version of your web browser of choice all tricked out with your favorite privacy plugins. Only save stuff to the usb stick and only run stuff from it. Pretend every program on the computer is a poisonous snake trying to eat your mouse (pointer). Besides that, there isn't much you can do besides following some good practices.

Foreign (public) Wireless Networks

Foreign, public wireless networks are a war zone, especially the open ones. Ones properly protected and configured with 802.1x (aka, WPA2 Enterprise) can be safe networks, but assume that any 802.1x network is poorly configured and multiple people have the same key you do and can see your traffic. Man-in-the-Middle attacks happen with more and more frequency, and the skill required to initiate them is at an all-time low (can be done with just a smartphone). There are two primary technologies you can use to secure your roaming on such networks: SSH Tunnels and Virtual Private Networks (VPNs).

 NOTES:

 1. For all server installs, you will need to know the pubic IP of your server. This can be done by visiting http://www.whatismyip.com/ on your server. Better is to set up no-ip on your server (the computer running SSH or your VPN) and use their free dynamic dns service (it'll work even if your home IP changes). No-ip is so simple, it hardly warrants directions, but no-ip provides them for a simple setup anyway. You will need to do this for PPTP VPN servers and SSH servers.

 2. You will also need to set a static IP for your server. This is simple enough

Static IP - Mac OS X

Static IP - Linux (various)

Static IP - Windows XP/Vista/7

 3. A simple tool to use to see if an ARP poisoning attack is happening on the public wifi is DecaffeinatID. It keeps track of the default gateway MAC address and will alert you if it changes.

SSH Tunnels

An SSH tunnel is a simple, yet effective way to protect your web browsing (and select other traffic) while on public wifi when properly configured and relatively simple to set up. Setting up an ssh server is simple on Mac OS X and Linux; windows is simple after installing a program. Your tunnel will be a SOCKS proxy, and Firefox with QuickProxy makes switching to that proxy simple to secure your web browsing traffic (I recommend using Firefox because of QuickProxy, and also because Firefox can be configured to send DNS requests through the tunnel, something I've yet to find out how to do in Opera or Chrome).

 NOTE: You may wish to get email alerts whenever someone logs in via SSH to your server. It's simple to do. These instructions apply to openssh, so should work for both Linux (assuming OpenSSH is your SSH Server) and Mac OS X. If you use my recommended program of BitVise for Windows, you'll have an option to run a program after successful logins, so you'd just create a batch file that uses either sendemail or blat to send the email.

 First, you need access to an SSH server to log into and create the tunnel. This computer needs to be located at home and always on.

 Mac OS X: Enable Remote Login for Mac OS X

 You will then need to forward port 22 from your Mac on your router so you can access the ssh while on the go. Locate your router on PortForward and follow the instructions for SSH.

 Linux: Simply install OpenSSH (or your SSH server of choice). Your distro should have sufficient instructions on how to activate key-based authentication and disable keyboard authentication in their documentation. It won't be any different than the instructions for Mac OS X if you use OpenSSH. Then likewise forward port 22 from your Linux PC on your router so you can access the ssh while on the go. Locate your router on PortForward and follow the instructions for SSH.

 Windows: Windows lacks a built-in SSH server, though there is a very good free (for personal use) SSH Server provided by BitVise. It offers very fine-grained controls, public key authentication, virtual users, jailing, and everything else you could want in an SSH server. If you have any questions, feel free to ask me as I'm very familiar with BitVise's SSH server. Don't forget to forward your port, though.
 

 I HIGHLY suggest setting up key-based authentication for SSH to prevent brute-force attacks on your SSH server. Then just disable keyboard-authentication. (the instructions are for PuTTY as it's fairly cross-platform and allows for me to just post a single set of instructions. Feel free to use any client you wish, though).

Now that your server is configured, time to configure your client (probably your laptop). I will do my instructions through PuTTY (for simplicity once again) so download and install putty. On Mac OS X, you will need to use MacPorts to get putty

 Launch Putty. Type the dynamic DNS (or IP) address into the Hostname/IP box. Looks like this

 Under Connections in SSH, select tunnels. Change Enter in 7070 for the destination (technically any port will do, I just always use 7070 because it's easy for me to remember), set it as Dynamic and Auto. Click the Add button. Looks like this.

 It isn't absolutely necessary, but I highly suggest saving this configuration, which requires going back to the session panel. Enter some title in the "saved sessions" box (like sockstunnel) and hit Save. Now in the future you will just have to select sockstunnel and click load.

 Now click the open button. A window that looks like a command prompt will open up and ask for your username, so enter it. If using keyboard authentication, enter your password. If using key-based authentication with a passphrase, enter your passphrase (the earlier linked howtoforge guide for key-based logins with putty explained how to load a key into putty). Leave this window open.

 Now we configure Firefox. Download QuickProxy as this makes things simpler (you'll be able to switch to your proxy with the click of a button).

 In Firefox go Tools>Options. Go to Advanced. In Advanced, go to the Network tab. Under "Connections" click the settings button. Select "Manual Proxy Settings". Enter a SOCKS Host of 127.0.0.1 and a port of 7070. It should look like this. Change back to "No Proxy" and OK out of all open windows.

 One more thing needs to be changed: go to about:config. Enter in socks as your filter. Change network.proxy.socks_remote_dns to true. Should look like this.

 Now Firefox can be configured to use the proxy (when logged into the SSH server in putty) by just hitting the QuickProxy button.

 When you're done using your SSH tunnel, disable the proxy by once again clicking the QuickProxy button and type "logout" ("exit" if it's a BitVise server running on Windows) into the putty terminal window to end the session. 

 

PPTP VPN

 Windows has a basic VPN built-in that used the Point-to-Point Tunneling Protocol. It is limited in that you can only have one remote connection, it uses your Windows password (so it must be strong), and it won't work when the CLIENT is behind old or improperly configured routers. From a security standpoint, PPTP has been broken, and can be broken by someone proficient with the right tools, but from a average user standpoint, people getting their MitM on are going after easy fish, and short of someone coming after you in particular, PPTP should be sufficiently secure. Also in its favor: it's simple to set up.

 Server configuration:

 NOTE: both guides also include information on port forwarding for PPTP, which involces port forwarding TCP 1723 and enabling PPTP Passthrough -- this second part is important because PPTP uses a non-TCP/UDP protocol: GRE. You may have to look around a bit to find where PPTP Passthrough is on your router (GRE is also the reason why PPTP won't work when the client is behind some old routers, as they drop the GRE packet before it leaves the network).

 1. PPTP Server on Windows XP

 2. PPTP Server on Windows 7 (Vista is almost identical)

 Client configuration:

 3. PPTP client on Windows XP

 4. PPTP client on Windows 7 (Vista is almost identical)

 5. PPTP client on Mac OS X

 6. PPTP client on Linux (GNOME)

Make sure to always test that your PPTP VPN tunnel is being used as the default gateway. This is default behavior for Windows clients.

Hamachi VPN with Privoxy and ProXPN Free

Finally, the last option is to use Hamachi VPN and Privoxy. It's a cross-platform solution and Lifehacker has a write-up on how to do it here.

 A managed, simple, free VPN service is ProXPN Free. Note that you are using their service, so they are your exit point. To me, this is less ideal as you do not control the exit point. Also, you have to use their [proprietary] VPN implementation, as the free service does not include PPTP access. Their free service VPN implementation is incompatible with all other VPN clients I know of. Still, for simplicity it wins hands-down and it will protect you from Man-in-the-Middle Attacks on public wifi.

 That's all for this section. By following some of these tips, your public wifi browsing is now secured. and you have much less to worry about.

Read More

Data Privacy Day Prep Part 3: Web Browsing

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 3, it's about web browsing and websites. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

Web Browsing

There's not a single person reading this who doesn't do it. We all are doing it right now, in fact. Web browsing is a part of all of our lives, but without proper care it can be quite dangerous.

 When randomly searching for things, you never know if that next search result is going to contain malware. Your antivirus software may have a rating feature, and your browser may have some protections (as does the search engine itself), but for more information a website reputation tool is needed. There are various ones out there, but the one that I feel does the best job is WOT: Web of Trust. Like any web rating site, it is prone to users downrating, but overall I feel it does a very good job. It does collect information on "you", as to get ratings it needs to know the domains you are looking at. This is true for any web rating service, though, so if you want to have this functionality, you'll have to allow the data be collected. WOT has an extension for Firefox, Google Chrome, IE, Opera, and Safari. Other browsers can use a bookmarklet for the service.

 In recent years, there's been widespread coverage of packet sniffing. The main tool to this end is Firesheep, which can collect password cookies sent over non-secure connections. Firesheep in particular can be countered with Blacksheep, but other tools can do a similar job, such as Wireshark. To combat these other tools, the most effective way is to always establish a secure connection. To that end the Tor Project and EFF have teamed up and made an extension called HTTPS Everywhere for Firefox (NoScript can also do it, but it is a bit more complicated. Here is the FAQ). Similar extensions exist for Chrome (HTTPS Everywhere is in alpha) and Opera also exist, but are not as foolproof.

 Also note two things: Using these plugins is NOT enough to guarantee you are secure, especially on public wifi. In recent months an attack to defeat earlier versions of SSL/TLS has proven successful known as BEAST. To make matters worse, very few browsers support TLS 1.1 and 1.2 (the only two versions not vulnerable to BEAST) and as such few websites use them, making virtually all of HTTPS vulnerable to BEAST. Of course BEAST is rare right now, but there is an older attack possible on wifi known as SSLStrip. SSLStrip does not break HTTPS, but instead acts as a proxy, removing SSL from requested pages. It is a type of Man-in-the-Middle attack. Still, these are really only threats on public wifi (which I'll talk about another day), but just be aware of them.

Cookies and LSOs

Cookies are not necessarily bad, in fact there is a cookie keeping you logged in to this forum right now. However, advertisers often use cookies to track you around the web. Given the usefulness of cookies in general, you probably don't want to outright disable them, however blocking third-party cookies will block practically all advertiser cookies without hindering your web experience.

 One big win happened this year on the tracking cookie front: the introduction of Do Not Track. It's gaining widespread adoption. Enable it if you don't want to be tracked. It's not guaranteed to be honored, but it'll keep the respectable websites from tracking you.

 Firefox: Tools > Options > Privacy > Use Custom Settings for History > Uncheck "Accept third-party cookies"

 Google Chrome: Wrench/Tools icon > Options > Under the Hood > Content Settings > Cookies > Check "Block all third-party cookies without exception"

 Opera: Tools > Preferences > Advanced > Cookies > Select "Accept cookies only from the site I visit"

 Local Shared Objects (LSOs), also known as flash cookies, are a part of Adobe Flash and are becoming an ever-more prevalent way of storing data on your computer as well as tracking your whereabouts. Note that as before, LSOs do have legitimate uses, so don't think that they are all bad. There are a few things that can be done. The one thing that is the same for everyone is to go to Adobe's Online Flash Settings page and delete/disable the storage for various websites. This has one significant advantage over other options: You can set those websites that do use flash cookies to track you to 0kb. That way they can't store data and you don't have to worry about a new one being created. Firefox and Chrome have addons for flash cookies, that being BetterPrivacy for Firefox and Click&Clean for Google Chrome. Both of which can automatically delete LSOs on browser close. Another way to go about this is to block Flash except when needed.

 Firefox: NoScript can block flash perfectly fine. If you are not a fan of NoScript, there is Flashblock (Flashblock and NoScript don't work well together, and since NoScript does what Flashblock does by default, it isn't necessary)

 Google Chrome: FlashBlock is available here as well.

 Opera: Flashblock for Opera -- Even though it doesn't specify Opera 11, it works fine in it.

 One more: The Evercookie. Evercookie is new on the field and is a javascript that creates multiple files through multiple methods to store data on your computer. It is not wide-spread yet, but may be in the future. The only truely effective way to deal with the evercookie is to block the javascript.

 Using an ad-blocking feature, add the following entry: */evercookie.js*

Ad-blockers and Script-blockers

Ad-blocking does more than just remove annoying ads (though that is the most obvious) -- it also adds security. ads are not controlled by the website they are displayed on, and there are many cases of malicious ads infecting users, the most recent example I can remember was not even a year ago on SlickDeals.net. I am all for supporting websites you visit, but when the ads don't run on their own server, you are taking a risk. Thankfully whitelists are fairly popular for ad-blockers, so you can get rid of the annoying/dangerous ones while still supporting your favorite websites. For extra privacy, consider adding the Track-blocking lists from here.

 Script-blocking is similar. Many scripts from domains other than the one you are on can be dangerous or track you.

 Firefox: Does it really need to be said? Adblock Plus! Undeniably the king of Ad-blockers.

 The Previously mentioned NoScript is the add-on of choice for script-blocking.

 Google Chrome: There are two popular ones: AdBlock and the port of Adblock Plus. Pick the one that suits your tastes.

 For Script Blocking it is NotScript, and another option is ScriptNo

 Opera: Opera has a built-in Content Blocker that is best used with the Fan-boy filter list. Right-click any page and select "Block Content" to access the blocker. Hold shift while clicking to block specific items. Both AdBlock and AdBlock Plus also exist on Opera now, if you prefer those.

 Chrome's NotScript was ported to Opera 11 and is available here

URL Unshorteners

With the advent of microblogging, URL Shorteners have grown in popularity. However, just randomly clicking a shortened link is very dangerous, as the site on the other side may be crawling with all sorts of nasty malware. Luckily, there are ways to unshorten a URL.

 Firefox: Long URL Please

 Google Chrome: LongURL

 Opera: Unshorten

 You can also always just use unshort.me for those urls that don't want to unshorten.

Private Browsing and Deleting Browser Data

Private browsing is supported in Firefox, Google Chrome, and Opera. It allows you to browse the web without leaving a trace (not really, but for the most part, yes). It is great for when you occasionally want to browse without leaving a trace, but if you are willing to go futher, you can clear all or at least select browser data every time on close. Why would you want to do this? Your browser cache and cookies are insecure. If someone gains access to your computer and you leave don't clear out your cache and cookies they will be able to gain access to your accounts since you are still logged in. This can be remedied in Firefox, Chrome, and Opera in different ways by deleting your browser data on browser close.

 Firefox: Tools > Options > Privacy > Check "Clear history when Firefox closes". Proceed to click the "Settings" button. Cookies, Cache, and Active logins should definitely be cleared on close. It does mean you'll have to log in to your sites every time, but that is what password managers are for. For extra security clear your Form & Search History and Download history. If extra paranoid and you won't miss it, clear your Browsing history as well. super-paranoid people may also want to consider clearing offline website data and site preferences to not leave a trace behind.

 Google Chrome: Google Chrome only supports deleting cookies on browser close. To enable this go Wrench/Tools icon > Options > Under the Hood > Content Settings > Cookies > Check "Clear Cookies and other site data when I close my browser". You need previously mentioned Click&Clean to completely clear out your private data on browser close. It is an option under the extension options.

 Opera:
 Cache: Tools > Preferences > Advanced > History > On "Disk Cache" check "Empty on exit".
 Cookies: Tools > Preferences > Advanced > Cookies > Check "Delete New Cookies when Exiting Opera"
 Download: opera:config#TransferWindow|KeepEntriesDays and set to "0"
 If feeling extra paranoid: Tools > Preferences > Advanced > History > Set History Addresses to "0" and uncheck "remember content on visited pages" and set opera:config#UserPrefs|SavePasswordProtectedPages to 0

The Remaining stuff: Web domains and Browser Plugins

The single greatest thing you can do to check if you are on a phishing website is to check the domain. Modern web browsers all highlight the actual domain of the site making it all the easier. Doing that alone will greatly lower your risk of being a phishing victim.

 The last thing to talk about is plug-ins. Plug-ins are insecure, to put it simply. They aren't updated automatically with your browser, and it is very easy to miss one that is a security risk. The biggest security risks in general to your computer are: Adobe Flash, Adobe Acrobat/Reader, Java, Silverlight, and Quicktime (a video on the vulnerabilities and flaws of the PDF format). On top of not updating with your browser, these plugins also have a great deal more permissions than your standard browser extension does. Ask yourself if you really need those plugins, and then, even for those you do, think about at least making your addons on-demand (I currently run with Java always disabled, being the least useful in the modern web and one of the most dangerous). Mozilla made a wonderful plug-in checker that is available here, use it often. It works with Firefox, Google Chrome, and Opera. I also highly recommend using an alternative to Adobe Reader. Sumatra PDF is my favorite on Windows (Mac OS X includes it's own great built-in one, and on Linux whichever comes with your desktop environment is probably plenty good). Take a moment to see what plugins you have installed in your browser. This can be done simply by typing about:plugins into your url bar for Firefox/Chrome and opera:plugins for Opera.

 This year saw a huge resurgence in Java attacks, many zero-day exploits happened this year. Ask your self: Do I need Java installed on my computer? If not, UNINSTALL IT. If you do need it on your computer, ask yourself: Do I have any websites that need Java? Most likely you don't, as very few modern websites require Java. I HIGHLY suggest going a step beyond plugins on demand for Java and just plain disabling it in your default browser. If you happen to need it, have a backup browser JUST for Java. It's easy with the plethora of web browsers out there today.

 Firefox: NoScript is the closest thing to plug-ins on demand. If you don't want to block javascript, you can set it up so that only plugins are disabled. To do this Go into the Options for NoScript. Under General, select "Scripts Globally Allowed (dangerous)", then on the "Embeddings" tab, forbid java, flash, silverlight and other plugins, select "Apply these restrictions to whitelisted sites too". Plugins are now effectively on-demand.

 Chrome: Plug-ins on Demand

 Opera: Plug-ins on Demand

 Note that running plugins on demand may break some sites.

Specific Websites

On the various websites we share all sorts of information. These sites generally have various security and privacy settings so you can control who can see that information and how secure your account is.

Webmail

Currently Gmail is set to always use HTTPS for secure email browsing, which is a good thing, but if you changed this yourself you can fix it under the General tab in Settings. Windows Live Mail/Outlook recently added this feature, which you can set by going here. Unfortunately Yahoo! has not added this feature for free users. If using Yahoo! you should request this very important security feature be added, or better yet: switch to Gmail or Windows Live Mail. Likewise if you are still stuck on AOL mail SWITCH NOW!

WLM/Outlook also has a single-use code system for signing in on computers that are not your own. For information on how to set it up, read WLM's FAQ. Gmail does not offer this, but does offer Two-step authentication, which significantly boosts your security. Enabling it is easy, as Google explains how to enable two-step authentication in their blog.

 Google also offers the ability to recover your account via SMS or your smartphone. To add this feature, Go to your Google Account's Password recovery options. Windows Live also offers this feature. Go to Account Overview and under Account Settings there is a line that says "Security Info". Click Manage and you will have the option to enter a phone number for recovery use.

 A Feature unique to Windows Live Mail is Trusted PC. On the plus side it makes password recovery dead-simple from a single PC, the downside is it's useless if you use it on a laptop, and unfortunately you need Windows Live Essentials installed as well as use Internet Explorer, making it out of the realm of possibility for Mac OS X or Linux users.

 Gmail offers the ability to remotely log out of any computer, which can be very useful if you leave yourself logged in somewhere on accident.

 An alternative webmail service is Lavabit which stresses privacy above all else. It doesn't log IPs, it doesn't retain your sent emails past 7 days, and it encrypts everything. Of course it's a big switch.

Facebook

Last year it was Timeline, this year Facebook is introducing Social Search. Lifehacker's guide to Facebook has been updated appropriately.

I was ready to do this big expose on Facebook privacy settings, but then I found out about Lifehacker's always-up-to-date guide to Facebook Privacy. Read it, bookmark it, check it every now and then.

Facebook rolled out HTTPS across the site and it can be found in your Account Settings, I highly recommend enabling it ASAP if it isn't already.

Facebook now can notify you when your account is logged in from a new device. I love services like this, so recommend you enable it to keep tabs on your account.

 Now go to Account Settings to get the last little bit of Privacy and security settings:

 Set up your mobile phone with Facebook, and you can get one-time passwods through SMS for Facebooking anywhere you don't feel 100% safe (like those public wifi networks previously mentioned). In "Account Settings" you can also remotely log out any other active computer connected to your account.

 For the last thing, head over to the "Facebook Ads" tab in your account settings. Set to "No one" both "Allow ads on platform pages to show my information to" and "Show my social actions in Facebook Ads to". With that, your Facebook is now nice and secure.

 Also: be aware that linking to content from your profile IS a leak that can lead to your profile being uncovered. Be aware of this when linking to images you've uploaded to your Facebook account. Likewise be weary of Facebook Connect. If you Facebook login information is compromised, so are these sites. It can also be used to track down your Facebook page if your profile picture is tunneled through FB Connect.

 Be aware of how much information leaks through to Apps when using them. The WSJ did a good writeup on this:

 "The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities."

 Your Facebook ID is always collected, so it isn't fully anonymous, this data is linked directly to you:

 "Defenders of online tracking argue that this kind of surveillance is benign because it is conducted anonymously. In this case, however, the Journal found that one data-gathering firm, RapLeaf Inc., had linked Facebook user ID information obtained from apps to its own database of Internet users, which it sells. RapLeaf also transmitted the Facebook IDs it obtained to a dozen other firms, the Journal found."

Google

Pretty much all of us use it, and it knows a ton about most of us. Thankfully Google does give you some control.

 Google+ users check out this Guide to Google+ Privacy. One thing I really do admire about Google was how up-front they are about the privacy settings for Google+.

Google Privacy Center - Learn it, love it, visit it often. Click on Privacy Tools to get to the settings. The rest is just information. In privacy tools you will see many options.

 Google Dashboard: The important one is Google Dashboard, which will tell you what Google products you are using and what Google knows about you through them. It is a central point of control for all your use of all Google products.

 Ads Preference Manager: this will allow you to control what ads Google will show you. In doing so you tell Google what you like so you get more accurate/relevant ads.

 Data Liberation Front: If you are looking into biting the bullet and leaving Google entirely, head here. This site will tell you how to get any and all your data from all the Google services out so you can switch to different options. It's drastic, but if you are THAT worried about Google, it may be interesting.

 Google Encrypted search: This secures your connection between you and Google for your searches, and in recent months, Google has been rolling it out as default for all logged-in Google users. Google still stores your information, and scroogle is no more. Your best option if you don't like this is to use DuckDuckGo, which has a very fair privacy policy, much less invasive than Google.

 Web History Controls: This is a setting you may have inadvertently enabled. It uses your previous web searches to "help" you in the future as well as potentially storing other web usage information. It doesn't remove your searches from Google's servers, but it may still be useful especially in a multi-user environment.

 Google Analytics Opt-out. You can opt-out of being tracked through Google Analytics. You will need to install a browser extension, and currently only supports Firefox, Google Chrome, and Internet Explorer. This can, of course, also be done through a content blocker.

 Search Personalization Opt-out: If you are using Web History, this is enabled. Instructions on how to disable it when not signed into a Google Account are also explained.

Other sites & Web App Permissions

Microsoft's gotten into the game this year, and now offers a dashboard for your privacy settings and personal info like Google. If you're a big Microsoft/Windows Live/Bing user, you should check it out: https://choice.microsoft.com/Data/?lc=1033

Beyond that, just check out the sites you use and make sure everything seems right according to you. If you use a password manager, figuring out what sites you use and maybe don't visit often is very simple.

 Also, a simple way to check your website's app permissions is with MyPermissions. It's a one-stop link shop for finding out who has permission to your various social network sites. Clean out any apps for all of them you don't need (I checked myself at the beginning of the year, and the only thing I had was an email app for my main gmail account -- an app I still use, so I was 100% clean). Another service is Adjust Your Privacy. There's some overlap between the two, but AdjustYourPrivacy offers some links that MyPermissions lacks (and vice-versa).

Some General Privacy Remarks and Tricks for the Web

If you want to send a note to someone over the Internet, but don't want to leave it around afterwards, a cool tool is Burn Note. You can also recreate this in Google Docs if you prefer that route.

 WikiHow has a pretty cool trick for helping you spot identity theft by making Google play for your side via Search Alerts. Of course, this means giving Google some information on you.

 The EFF released a star rating system for who cares about your privacy. It may surprise you that Google didn't score that bad. THe worst offenders, besides ISPs, were FourSquare, MySpace, Apple, Microsoft, and Yahoo (Skype is now owned by Microsoft, so I didn't list it, but it also scored zero).

Read More

Data Privacy Day Prep Part 2: Smartphones

Data Privacy Day is one of my favorite holidays and falls on this upcoming Monday. Every year, for the days leading up to it, I like to talk and publish reminders about. I normally post this on the Bethesda forums, where I'm quite active, but now that I have a blog, why not also add it on here? Here's part 2, it's about Smartphones. It's long, so maybe read it in chunks. It'll always be here for you to refer to later :P

The goal of Data Privacy Day is to make people more informed about their data and privacy. I hope you find some of this information useful and put it into action. Security and privacy are constantly evolving items, and what cuts it today may not in the future, but this should be a good springboard to boost your security and privacy for Data Privacy Day and the years to come. As always, the level of security you need will differ from others, so you need to figure out what level is good for your needs. Some things, though, are universally applicable to all, such as a good password system. Another thing to remember is that even if you follow the best of security practices, it may not be enough to stay safe if a company who has poor security practices gets hacked (and after the summer of 2011 hacks and the ones that followed in 2012, I think we are all familiar with that).

Smartphones

Do note, that while this section is specifically about smartphones, since most popular tablets on the market are based off of smartphones currently on the market a good chunk of this can be applied to tablets too.

 I'd argue that phones and data privacy and security don't even belong in the same playing field. Phones leak information like a sieve, and smartphones are even worse at it. Many scandals related to various smartphones have occurred in recent years. There was the iPhone location scandal, which lead to general coverage of all the information the main smartphone OSes collect on you, and then it turned out that Windows Phone 7 is as bad as the iPhone was at location leaking (Even though Microsoft went on record during the original iPhone scandal saying WP7 didn't do nearly that much), and then we found out about Carrier IQ potentially collecting all sorts of information on you for pretty much all phones (except Verizon phones), Smartphones were the last to revoke DigiNotar SSL certs and a good many smartphones still have these certs active, and there's nothing you can do about it. This year was also a big year for malware on smartphones. Malware on Android continued to get lots of coverage (though it's not as bad as the coverage made it out to be), and even the iPhone wasn't immune to it. Of course why bother with malware when you can just completely own the phone with one SMS message? Throw in some good old GSM ownage, maybe tracking down and eavesdropping on phone calls, and why not even some CDMA compromising as well as WiMAX ownage just for kicks.

 Ok... I think you get the picture, the sad thing is that the above is not even close to covering all there is when it comes to smartphone (and phones in general) insecurity. Smartphones may be wonderful tools, but they definitely aren't secure. There are some things you can do about this, but the best is probably just turning the phone off when you don't need it.  Really though, there's no way many of you can imagine going back to your life without a smartphone, so at least do your best to bolt down what you can, which is mostly physical security.

Locking your phone

Android: Android 2.2 enabled PIN and password locking, prior to that you could only do a swipe pattern*. How to enable a Password, PIN, or Pattern on Android. Later Face Unlock was introduced in Jelly Bean, but I don't really recommend that.
 *Note: If using a swipe pattern, make sure to have at least one part of the pattern trace over itself. If you do not, someone can tell your pattern by looking at your smudge marks.

 For Apps there are two tools: Smart App Protector and Tasker:

Smart App Protector

Tasker - $5-7 (out of market version is cheaper and recommended for file encryption). How to lock an app with Tasker.

 Why lock an app? Let's say you are letting a friend borrow your phone, but don't want them "accidentally" reading your emails or posting something from your Facebook account. Now you can lend them your phone without watching over their every move like a hawk.

 iOS: with iOS4, full password support came to the iPhone. Instructions on setting up a long passcode on iOS4 -- iPhones not using iOS4 or later: 4-digit Passcode video

 Unfortunately I can't find any tools in the market to lock apps. For jailbroken iPhones it looks like there are a few options for locking down your phone, one promising one is Protecti.

Windows Phone 8: Unfortunately, picture passwords aren't an option, but you can have proper passwords now!. WP7 is still limited to numerical passwords. WP8 Lock Screen FAQ

Password Managment on your Smart Phone

USE ONE! KeePass-compatible, LastPass Premium, or something else, just use one! I already listed them all out in the password section, so just pick one out. Here, I'll make it easy for you: KeePassDroid for Android, 7Pass for Windows Phone 7, and either MiniKeePass (free) or one of the others on iOS. For LastPass users, $12/yr isn't much and then you can use their numerous mobile offerings. DashLane will work with limited features on smartphones for free, but you'll have to pay for all that it offers like LastPass. Don't forget pwsafe (iOS) or PasswdSafe (Android) for the Password Safe fans. I can't begin to tell you how many times I've seen someone open their smartphone's unsecured notes to find a password. Stop it! Please. Your phone is insecure enough as it is without you storing your passwords in plaintext.

Remote Locating/locking/wiping

Your smartphone contains all sorts of juicy information on you. You need to be able to remotely wipe it if you ever lose it.

 Android:

The official offering by Google was made available in 2013. It's the Android Device Manager and allows you to remotely locate, lock, and wipe your Android phone. There are also many alternatives for Android, some of which offer features not found in the official Device Manager by Google. Most notably are text commands and app masking.

Avast! Mobile Security - Free for all. Remote Locate, Lock, and Wipe via either a web portal or text messages.

Lookout - Free or Premium version for $30/yr. Not only does it offer remote finding through the website, but also has an antivirus program (the usefulness of an Antivirus program on Android is highly debatable right now, but the location/wipe feature is undeniably good). The Premium features include the ability to lock your phone until you find it or wipe it clean, as well as even more goodies.

Cerberus anti-theft -- One-time fee of $5 or so bucks. Can be installed as a system app and just as capable as the big boys.

WaveSecure - $19.90/yr. You can track your phone, lock it, and back up/wipe the data.

Where's My Droid - Free for basic features (basic locate, basic remote control, basic lock), $4 for full features (remote wipe)

 iOS:

Find My iPhone -- Free for all thanks to iCloud. You can even have it automatically wipe your device after 10 failed attempts.

 Windows Phone 8:

 Built-in feature through connected Windows live accounts using http://www.windowsphone.com/en-us -- See here for full details

Encrypting Files on your Phone

As already mentioned, your device leaks data like a sieve. Using encryption can help secure your device some (either full-disk encryption or folder encryption)

Android 3.0 and higher support full-disk encryption. Though the option may not be available for old phones that upgraded to Android 4.0+

For file encryption, you can use Tasker. The Android Market version used to not have encyption, but I don't know if this changed or not. To be safe just buy the version on the website and manually install the apk. Instructions on how to encrypt files using Tasker. Another option is Crypt4All Lite. The advantage of Crypt4All is that it's based on AES Crypt, which runs on desktops, so your encrypted files can be used on both your phone and desktop.

iOS: The phones have default built-in hardware encryption, but to make it useful you need to set a passcode. No further options exist on stock devices, however for file-level encryption, AxCrypt can be used. AxCrypt also runs on Windows with a prerelease for Mac OS X and Linux.

 Windows Phone 8: Windows Phone 8 has full device encryption through a variant of BitLocker. Unfortunately it appears to be only be an Enterprise option, as it requires Echange to enable. It also doesn't encrypt removeable storage and I still can't find a tool for file-level encryption.

App Permissions

Be careful what you install. Here is a list of some of the worst offenders of apps that invade your privacy: What they Know. On Android, always pay attention to what permissions an app asks for on install and make sure it makes sense.

 There are ways to restrict app permissions on Android, but they all require root and/or special ROMs/kernels:

 1. PDroid -- Doesn't require root to run (but does to install, the difference being the app itself doesn't need superuser privileges), but is quite an involved setup process and only very specific ROMs are supported.

 2. LBE Privacy Guard -- Requires root. Unfortunately, it's very heavy on the CPU (and therefore battery) and the latest version apparently has issues remembering blocked privileges past a reboot.

 3. CyanogenMod can do it natively but it isn't without issues, so about on-par with LBE Privacy Guard.

 Even for jailbroken iOS, I couldn't find anything to restrict app permissions, the best I found was a jailbroken app that alerts you when other apps try to access your contacts: ContactPrivacy.

Android Specific: Apps to Improve your Security and Privacy

1. DroidWall -- it brings a firewall via iptables to your phone (requires root and doesn't work with all kernels)

 2. Get an AdBlocker. Opera Mobile has it built in and you can get AdBlock Plus for Firefox. This doesn't include Apps though... How to fix this? Well if you're rooted you can use AdAway, which modifies your hosts file to completely block all apps. If you're not rooted, you still have some options, but it's not as feature-rich (though if you're rooted, it is), and the option is AdBlock Plus for Android. Yes, AdBlock Plus exists for Android as a whole so will block ads throughout it. If you're not rooted it'll only work on WiFi( and if you have an old version of Android, it'll require manual configuration).

 3. Incoming calls/texts: Some ROMs have native ways of blocking incoming calls/texts. Others don't. If you want this feature you have a few options. On the rooted end, and very feature-rich is Root Call Blocker, but it seems finicky on which phones it works on. Other options that don't require root are Mr. Number and Call Control.

 4. Use TOR on your phone with Orbot.

 5. Get your Proxy On in Firefox Mobile via ProxyMobile. Note: this plugin is still very much in beta, so you may wish to configure your proxy by hand. This can be done by going to about:config and changing some settings. I'd also recommend changing network.proxy.socks_remote_dns to true. You can also use this with your own SSH server instead of random SOCKS proxies by using SSH Tunnel or ConnectBot (both of which allow creating SSH Tunnels). I personally have configured Firefox manually and use ConnectBot, but that's because I connect to various SSH servers frequently.

 6. Go a step further and use a VPN. Android has built-in support for various VPN protocols like IPSec, L2TP, and PPTP (those are the common ones supported out of the box). VPN settings can usually be found in the network settings. OpenVPN support can be found in various roms like Cyanogen as well as through apps like FeatVPN and OpenVPN for Android.

iOS Specific: Apps to Improve your Security and Privacy

1. Get an Adblocker. Unfortunately the only option I'm aware of requires a jailbreak, and that's AdBlocker

 2. Incoming calls/texts: Once again, jailbreak is needed. It can be done with iBlackList

 3. Use TOR on your phone. This one doesn't require a Jailbreak! A Miracle by any meaure :P Just install the Onion Browser. Unfortunately it doesn't seem like it works out well for most people, so there's a jailbreak option with more success

 4. Set up a VPN on iOS. You can also connect to OpenVPN, but that requires a jailbreak.

Android Specific: Rooting and ROMs (and a bit on jailbreaking for iOS)

To root or not to root is a very good question. There are pros and cons to both. Rooting itself isn't much of a desired thing for your average, though if you are careful with your superuser privileges, it's certainly adds a lot of new capabilities. When flashing ROMs, it's important to make sure that you secure new vulnerabilities you may have gained, such as an ssh server. Same for iOS users: If you jailbreak your device, you now have SSH access that has a default and well-known username and password, so change it. There's been scattered incidents of jailbroken and rooted phones being hacked due to unchanged SSH credentials.

 On to ROMs specifically, I suggest everyone using Android looks into them, especially after your 1 or 2-year warranty is up. The reason? Security patches. Many phones get abandoned and never receive critical android security patches. By running your own ROM you no longer have to wait for slow companies to patch your devices, but rather generally speedy groups of people who want to ship the latest Android in their ROM.

Smartphones: The remaining stuff

Disable Bluetooth when not using it.

 Watch your picture uploads, especially if paranoid. By default the metadata in the picture will include geolocation information that you may not want out there. It's relatively simple to disable by just changing some settings.

Read More