Snowden: “I Used Free And Open Source Software Like Debian And TOR. I Didn’t Trust Microsoft”
NSA whistleblower Edward Snowden is known to be a long-time
advocate of free and open source software. Speaking at an event via
video conferencing, he said that transparency of free software convinced
him to use TOR, Tails, and Debian, that helped him to expose the
secrets of American government.
At
the Free Software Foundation’s LibrePlanet2016 conference on Saturday,
NSA whistleblower Edward Snowden participated in a discussion regarding
free software and security. He joined the talk via video conferencing
from Russia.Edward Snowden told that he was able to disclose
the secrets of American government and its projects of mass surveillance
using free software. The event was being held in an MIT lecture hall
and this statement drew a wide round of applause.
Praising the likes of Debian, Tails, and TOR, he said — “What happened in 2013 couldn’t have happened without free software.” It’s a no hidden fact the free and open source software
is used by the activists and journalists to ensure that any government
isn’t actively tracking them. In this modern age, the free and open
source software have become an important player. Its openness and
transparency allow a user to look at the code and policies to ensure the
privacy.
I
didn’t use Microsoft machines when I was in my operational phase,
because I couldn’t trust them. Not because I knew that there was a
particular back door or anything like that, but because I couldn’t be
sure
— Snowden said.Talking more, Snowden cited the example of the current battle between Apple and FBI.
He said that it’s an example of a corporation trying to stand up for
its users. However, citizens should not have to rely on companies. You can watch the complete keynote at LibrePlanet.
Here’s a look at the top 11 Hollywood films which show hacking at its best
The last few years has seen hackers taken a liking for Hollywood with them appearing in almost every robbery or mystery movie. Let’s take a look at the top 10 hacking movies of all time.
#1 Algorithm (2014)
The new film ‘Algorithm‘ tracks the travails of Will, who is a freelance computer hacker who “breaks into a top-secret government contractor and downloads all their recently developed programs.” You can see the full movie below.
#2 WarGames (1983)
The film features David Lightman (Broderick), a young high school student hacker who accidentally hacks into a military supercomputer and starts the countdown to World War III.
#3 Hackers (1995)
This cult classic got a lot of things right, especially the way they showed kids using technology to create their own community. In Hackers, Angelina Jolie and Jonny Lee Miller portray two youthful and hip hackers. Miller portrays a hacker who got caught as a very young child (11) after crashing thousands of computers and has been sentenced to zero computer access until his 18th birthday.
If you want to know how hackers use their social engineering skills to get sensitive details related to your hardware, this movie will not disappoint you.
#4 The Matrix (1999)
This is one of the greatest science fiction movie. The movie depicts a dystopian future in which reality as perceived by most humans is actually a simulated reality called “the Matrix”, created by sentient machines to subdue the human population, while their bodies’ heat and electrical activity are used as an energy source.
A character named “Neo”, who is a computer Hacker, learns this truth and is drawn into a rebellion against the machines, which involves other people who have been freed from the “dream world”. The Matrix franchise is a trilogy movie series.
#5 Takedown (2000)
This movie is based on famous computer U.S. hacker Kevin David Mitnick. Based upon the book and written by his nemesis, Tsutomu Shimomura, the story tends to glorify Shimomura. Mitnick operated in the 1980s and ’90s and eventually went to prison for a couple of years. Now, he is a highly paid IT security consultant, speaker, and writer.
#6 The Italian Job (2003)
Although the MINI Coopers are really the stars of The Italian Job (a remake of the 1969 film of the same name), Seth Green plays Lyle, a hacker among a group of elite thieves, who is able to manipulate traffic signals, among other devices, that make this grand theft possible.
#7 Live free or die hard (2007)
Live Free or Die Hard (also known as Die Hard 4 and released as Die Hard 4.0 outside North America) is a 2007 American action film, and the fourth installment in the Die Hard film series depicts a scenario where a hacker played by Timothy Olyphant (of Justified fame) takes down nearly the entire U.S. infrastructure in an attempt to transfer trillions of dollars from the Federal Reserve to his account.
This movie shows how a blackhat hackers operate.
#8 Blackhat (2015)
Blackhat is newly released movie by Chris Hemsworth. In this movie hackers hack Chinese nuclear power plant to start nuclear reaction. Simultaneously, they also hack the stock exchange and steal million of dollars from bank.
This movie shows how a black hat hackers threaten governments.
#9 Untraceable (2008)
This film involves a serial killer who rigs contraptions that kill his victims based on the number of hits received by a website KillWithMe.com that features a live streaming video of the victim.
Millions of people log on, hastening the victims’ deaths.
#10 Eagle Eye (2008)
In this movie, two people get a call from an unknown number by a woman. They get a task on phone that if they don’t follow the phone call they would die. This movie displays supercomputer hack on all networks and military networks.
This is just an amazing movie on how artificial intelligence computer hack our real life for bad motives.
#11 Fifth Estate (2013)
The Fifth Estate is an unauthorized account of Julian Assange and WikiLeaks. Cumberbatch plays a believable Assange as a egotistical, idealist that is out to change the world. Few Americans know that Assange is a famous (or infamous) hacker in his native country of Australia. He broke into the Pentagon, Citibank, NASA, and Stanford University, among other facilities, before being caught.
When you read the headlines like “FBI is forcing Apple to create a backdoor in their products”, what you are really reading is that the FBI is forcing iPhone-maker to use the “pre-existing software update backdoor” present in iPhones. Surprisingly, a backdoor already exists in most software in the form of system updates and the US government is looking to exploit the same.
The story of FBI vs Apple has been making the headlines since the shooting attacks in California in last the December. After FBI’s request, Apple refused to create a software backdoor to allow the law enforcement agency to crack an iPhone of one of the shooters. Apple CEO Tim Cook has justified his decision on multiple occasions and even tagged backdoors as the “software equivalent of cancer”.
But, few of us know that most software already has a backdoor present in them in the form of system updates. Well, give me a moment and let me reframe my words — Most software already has a backdoor in the form of “malicious software update”. In a recent article, Ars has described this issue in detail and listed out various ways by which your government can gain the backdoor access.
By ‘malicious system update’, we are talking about the inauthentic version of the system software that fools your computer and makes it do things that you don’t want to do. Let me introduce you to another term — a ‘targeted malicious software update’ is something that is sent to a particular target’s device, making it hard for anyone to notice it. To perform these malicious intrusions, the attacker needs to fulfill two conditions —
The attacker should be in a position to send the updates
The attacker should be in a position to convince the user that the update is authentic
The third and the most deadly villain of this story is ‘total system compromise’. As the name suggests, an attacker is able to control the device remotely and obtain any kind of data or encryption keys.
These problems exist in almost every software update system. Probably, the software makers thought that they would be able to protect their software against such attacks as they have the authority to push the system updates. Well, they forgot about the scenario where government knocks their doors and demands for a backdoor.
You must have read in our previous articles that FBI is asking Apple to create a backdoor in their products. By this statement, what Apple really means that FBI is forcing it to use the pre-existing software update backdoor present in iPhones. Explaining it further, Ars writes:
Is it reasonable to describe these single points of failure as backdoors? I think many people might argue that industry-standard systems for ensuring software update authenticity do not qualify as backdoors, perhaps because their existence is not secret or hidden in any way. But in the present Apple case where they are themselves using the word “backdoor,” abusing their cryptographic single point of failure is precisely what the FBI is demanding.
I hope that the demands made by the US government acts as a warning to the technology companies and they look for better and secure ways to push updates to their users. Apple has already started to make its iPhone unhackable, but what about the others?
It was the sad Christmas day for gamers all around the world!! A lot of people get new PlayStations and Xboxes on Christmas, but this Christmas they bought the game, popped it into the console for online gaming, and what they found? Oh Crap! I can't log on.
It was the notorious hacker group "Lizard Squad" who claimed the responsibility for taking down PlayStation Network, saying it has made unavailable both networks with apparent Distributed Denial of Service (DDoS) attacks — intentionally overloading servers by sending a flood of bogus web traffic, which made logging into thePlayStation Network and Xbox Live difficult for most users.
Now Anonymous has declared war against Lizard Group, warning that "now you are all going down." Recently, in response to Lizard Squad launching DDoS attacks on the Tor network, the international activist group Anonymous has leaked the personal details of one of the group's alleged members, warning the hacker collective "Lizard Squad" to "stand down" and stop attacking Tor.
Earlier after the big outage for both Xbox Live and Playstation Network services, both Sony and Microsoft acknowledged the problem, saying that their security teams were working to resolve the issue and get the networks back online.
"We are aware some users are unable to sign into Xbox Live. Our teams are working to resolve the issue. Visit xbox.com/support for status updates," said Sean McCarthy, general manager of Microsoft's Xbox Product Services in a statement to CNN. "We don't share info on the root cause of specific issues."
"We are aware that there have been issues reported with PSN," tweeted Sony's Ask PlayStation account on Christmas Eve. "Thanks for your patience as we investigate."
Giving pause to the attacks on PSN and Xbox live, Lizard Squad said in a tweet that "All your onions are belong to us," referring to Tor's onion logo, and later tweeted that the Tor network is only used by "hackers, miscreants and pedophiles."
TheTor Project released a statementabout the attacks, saying "we don't expect any anonymity or performance effects based on what we've seen so far." It said the attackers attempted a "Sybil attack" where "the attackers have signed up many new relays in hopes of becoming a large fraction of the network."
"But even though they are running thousands of new relays, their relays currently make up less than 1% of the Tor network by capacity," it added. "We are working now to remove these relays from the network before they become a threat, and we don't expect any anonymity or performance effects based on what we've seen so far." So hopefully this gets nipped in the trollish bud before anonymity is affected." Anonymous group warned Lizard Squad in a tweet, saying "People need that service because of corrupt governments." Later, the group confirmed that it was tracking down members of Lizard Squad. However, the details revealed by the group are yet not confirmed to be legitimate, Anonymous tweeted a link which appears to contain the personal details, including full name, address, phone numbers and passwords, of one of the supposed members behind Lizard Squad.
The group posted a screenshot that appears to be a text conversation between one of its members and one of the members behind Lizard Squad, in which the Lizard Squad member ask the Anonymous' member to stop the attacks against them and for their family to be left alone, but Anonymous said in a tweet that they'll not stop.
Whereas, a member of Lizard Squad has claimed that the conversation between Anonymous member and Lizard Squad member is fake.
The group also posted a couple of videos to YouTube in which it -- in its typical dramatic style -- attacked Lizard Squad.
Security expert Brian Krebs has analyzed the Lizard Stresser, an attack tool created by the so-called Lizard Squad hacker collective and touted as a test for webmins who needed to see what happens to their services under duress. His discovery? The network of attack computers actually consists of insecure and compromised home routers.
This is the network used to take down the Playstation Network and Xbox Liveover the Christmas holiday. With the assistance of a group of security researchers, Krebs found that the Lizard Squad was in control of a large botnet made of hacked routers and other commercial servers.
The malicious code that converts vulnerable systems into stresser bots is a variation on a piece of rather crude malware first documented in November by Russian security firm Dr. Web, but the malware itself appears to date back to early 2014 (Google’s Chrome browser should auto-translate that page; for others, a Google-translated copy of the Dr. Web writeup is here).
The botnet is not made entirely of home routers; some of the infected hosts appear to be commercial routers at universities and companies, and there are undoubtedly other devices involved. The preponderance of routers represented in the botnet probably has to do with the way that the botnet spreads and scans for new potential hosts. But there is no reason the malware couldn’t spread to a wide range of devices powered by the Linux operating system, including desktop servers and Internet-connected cameras.
He also makes some excellent recommendations to ensure router security including changing the default password – a no-brainer – and using OpenDNS to prevent malicious web calls to your router.
This means the Squad, which called the Xbox and Sony hacks a marketing stunt, is essentially selling access to hacked machines as a service.
In short, hundreds, even thousands, of compromised routers are being used to attack servers around the world for good or ill, a bit of news that should give us pause. If anything, we should probably all pay it forward and secure our less tech-savvy friends’ routers for them in preparation for further malware attacks in the same vein.
Deep Web (also called the dark net, Deepnet, Invisible Web, or Hidden Web) is that portion of World Wide Web content that is not indexed by standard search engines. (This is in contrast with the portion that is indexed by standard search engines, known as the Surface Web.)
It should not be confused with the dark Internet, the computers that can no longer be reached via the Internet, or with a Darknet distributed filesharing network, which could be classified as a smaller part of the Deep Web. Some prosecutors and government agencies think that the Deep Web is a heaven for serious criminality.
Mike Bergman, founder of BrightPlanet and credited with coining the phrase, said that searching on the Internet today can be compared to dragging a net across the surface of the ocean: a great deal may be caught in the net, but there is a wealth of information that is deep and therefore missed. Most of the Web's information is buried far down on dynamically generated sites, and standard search engines do not find it. Traditional search engines cannot see or retrieve content in the deep Web—those pages do not exist until they are created dynamically as the result of a specific search. As of 2001, the deep Web was several orders of magnitude larger than the surface Web.
Size
Bright Planet, a web-services company, describes the size of the Deep Web in this way:
It is impossible to measure or put estimates onto the size of the deep web because the majority of the information is hidden or locked inside databases. Early estimates suggested that the deep web is 4,000 to 5,000 times larger than the surface web. However, since more information and sites are always being added, it can be assumed that the deep web is growing exponentially at a rate that cannot be quantified. Estimates based on extrapolations from a study done at University of California, Berkeley in 2001 speculate that the deep web consists of about 7.5 petabytes. More accurate estimates are available for the number of resources in the deep Web: research of He et al. detected around 300,000 deep web sites in the entire Web in 2004,and, according to Shestakov, around 14,000 deep web sites existed in the Russian part of the Web in 2006.
Naming
Bergman, in a seminal paper on the deep Web published in The Journal of Electronic Publishing, mentioned that Jill Ellsworth used the term invisible Web in 1994 to refer towebsites that were not registered with any search engine. Bergman cited a January 1996 article by Frank Garcia:
It would be a site that's possibly reasonably designed, but they didn't bother to register it with any of the search engines. So, no one can find them! You're hidden. I call that the invisible Web.
Another early use of the term Invisible Web was by Bruce Mount and Matthew B. Koll of Personal Library Software, in a description of the @1 deep Web tool found in a December 1996 press release.
The first use of the specific term Deep Web, now generally accepted, occurred in the aforementioned 2001 Bergman study.
Just Below the Surface
As we've already noted, there are millions upon millions of sub-pages strewn throughout millions of domains. There are internal pages with no external links, such as internal.howstuffworks.com, which are used for site maintenance purposes. There are unpublished or unlisted blog posts, picture galleries, file directories, and untold amounts of content that search engines just can't see.
Here's just one example. There are many independent newspaper Web sites online, and sometimes, search engines index a few of the articles on those sites. That's particularly true for major news stories that receive a lot of media attention. A quick Google search will undoubtedly unveil many dozens of articles on, for example, World Cup soccer teams.
But if you're looking for a more obscure story, you may have to go directly to a specific newspaper site and then browse or search content to find what you're looking for. This is especially true as a news story ages. The older the story, the more likely it's stored only on the newspaper's archive, which isn't visible on the surface Web. Subsequently, that story may not appear readily in search engines -- so it counts as part of the deep Web.
Deep resources
Deep Web resources may be classified into one or more of the following categories:
Dynamic content: dynamic pages which are returned in response to a submitted query or accessed only through a form, especially if open-domain input elements (such as text fields) are used; such fields are hard to navigate without domain knowledge.
Unlinked content: pages which are not linked to by other pages, which may prevent Web crawling programs from accessing the content. This content is referred to as pages without backlinks (or inlinks).
Private Web: sites that require registration and login (password-protected resources).
Contextual Web: pages with content varying for different access contexts (e.g., ranges of client IP addresses or previous navigation sequence).
Limited access content: sites that limit access to their pages in a technical way (e.g., using the Robots Exclusion Standard or CAPTCHAs, or no-store directive which prohibit search engines from browsing them and creating cached copies.)
Scripted content: pages that are only accessible through links produced by JavaScript as well as content dynamically downloaded from Web servers via Flash or Ajaxsolutions.
Non-HTML/text content: textual content encoded in multimedia (image or video) files or specific file formats not handled by search engines.
Accessing The Deep Web
While it is not always possible to discover a specific web server's external IP address, theoretically almost any site can be accessed via its IP address, regardless of whether or not it has been indexed.
Certain content is intentionally hidden from the regular internet, accessible only with special software, such as Tor. Tor allows users to access websites using the .onion host suffix anonymously, hiding their IP address. Other such software includes I2P and Freenet.
In 2008, in order to facilitate user access and search engine indexing of hidden services using the .onion suffix, Aaron Swartz designed Tor2web, a proxy application able to provide access to Tor hidden services by means of common web browsers.
Deep Web links appear as a random string of letters followed by the .onion TLD. For example, http://xmh57jrzrnw6insl followed by .onion, links to TORCH, the Tor search engine web page.
To discover content on the Web, search engines use web crawlers that follow hyperlinks through known protocol virtual port numbers. This technique is ideal for discovering resources on the surface Web but is often ineffective at finding Deep Web resources. For example, these crawlers do not attempt to find dynamic pages that are the result of database queries due to the indeterminate number of queries that are possible. It has been noted that this can be (partially) overcome by providing links to query results, but this could unintentionally inflate the popularity for a member of the deep Web.
DeepPeep, Intute, Deep Web Technologies, Scirus, and Ahmia.fi are a few search engines that have accessed the Deep Web. Intute ran out of funding and is now a temporary static archive as of July, 2011. Scirus retired near the end of January, 2013.
Crawling the Deep Web
Researchers have been exploring how the Deep Web can be crawled in an automatic fashion, including content that can be accessed only by special software such as Tor. In 2001, Sriram Raghavan and Hector Garcia-Molina (Stanford Computer Science Department, Stanford University) presented an architectural model for a hidden-Web crawler that used key terms provided by users or collected from the query interfaces to query a Web form and crawl the Deep Web resources. Alexandros Ntoulas, Petros Zerfos, and Junghoo Cho of UCLA created a hidden-Web crawler that automatically generated meaningful queries to issue against search forms. Several form query languages (e.g., DEQUEL) have been proposed that, besides issuing a query, also allow to extract structured data from result pages. Another effort is DeepPeep, a project of the University of Utah sponsored by the National Science Foundation, which gathered hidden-Web sources (Web forms) in different domains based on novel focused crawler techniques.
Commercial search engines have begun exploring alternative methods to crawl the deep Web. The Sitemap Protocol (first developed, and introduced by Google in 2005) andmod oai are mechanisms that allow search engines and other interested parties to discover deep Web resources on particular Web servers. Both mechanisms allow Web servers to advertise the URLs that are accessible on them, thereby allowing automatic discovery of resources that are not directly linked to the surface Web. Google's deep Web surfacing system pre-computes submissions for each HTML form and adds the resulting HTML pages into the Google search engine index. The surfaced results account for a thousand queries per second to deep Web content. In this system, the pre-computation of submissions is done using three algorithms:
selecting input values for text search inputs that accept keywords,
identifying inputs which accept only values of a specific type (e.g., date), and
selecting a small number of input combinations that generate URLs suitable for inclusion into the Web search index.
Classifying Resources
Automatically determining if a Web resource is a member of the surface Web or the deep Web is difficult. If a resource is indexed by a search engine, it is not necessarily a member of the surface Web, because the resource could have been found using another method (e.g., the Sitemap Protocol, mod_oai, OAIster) instead of traditional crawling. If a search engine provides a backlink for a resource, one may assume that the resource is in the surface Web. Unfortunately, search engines do not always provide all backlinks to resources. Furthermore, a resource may reside in the surface Web even though it has yet to be found by a search engine.
Most of the work of classifying search results has been in categorizing the surface Web by topic. For classification of deep Web resources, Ipeirotis et al] presented an algorithm that classifies a deep Web site into the category that generates the largest number of hits for some carefully selected, topically-focused queries. Deep Web directories under development include OAIster at the University of Michigan, Intute at the University of Manchester, Infomine at the University of California at Riverside, and DirectSearch (by Gary Price). This classification poses a challenge while searching the deep Web whereby two levels of categorization are required. The first level is to categorize sites into vertical topics (e.g., health, travel, automobiles) and sub-topics according to the nature of the content underlying their databases.
The more difficult challenge is to categorize and map the information extracted from multiple deep Web sources according to end-user needs. Deep Web search reports cannot display URLs like traditional search reports. End users expect their search tools to not only find what they are looking for special, but to be intuitive and user-friendly. In order to be meaningful, the search reports have to offer some depth to the nature of content that underlie the sources or else the end-user will be lost in the sea of URLs that do not indicate what content lies beneath them. The format in which search results are to be presented varies widely by the particular topic of the search and the type of content being exposed. The challenge is to find and map similar data elements from multiple disparate sources so that search results may be exposed in a unified format on the search report irrespective of their source.
A group of hackers from Indonesia managed to spoil the plain search page of Google Indonesia with additional content.
On October 5, the outfit, going by the name of “MadLeets,” posted proof that the deed was real on their Facebook page. The image provided is accompanied by a link to Zone-H, a website dedicated to hosting defaced pages.
The once simple #Google search for #Indonesia turned to black and contained a message from team MadLeets, saying “Security is just an illusion.”
It appears that the hackers hijacked the DNS (domain name system) servers used by Google Indonesia and changed them to ones under their control. DNS is a system responsible for translating the IP address of an online location to human-readable format (website address).
Not all users were able to access the defaced web page, which, for some time, could not be used to run Google searches. Indonesia Telkom, one of the largest telecommunications service company in the country, denied allegations (via Google Translate) that hackers breached their systems to update the DNS servers pointing to Google search.
Some time after the hijack, the hackers added a search field on the page under their control to allow users to look for information indexed by Google.
Google Indonesia confirmed the attack and said that all issues had been solved and that its other services had not been affected. It seems that hackers had no malicious intention and they only wanted to show what they could do.
Tor is a free software program that you load onto your computer (like a browser) that hides your IP address every time you send or request data on the Internet. The process is layered with heavy-duty encryption, which means your data is layered with privacy protection.
Then there’s the route your data takes as it travels to its destination: Tor will bounce your Internet requests and data through a vast and extensive network of relays (servers) around the world. That data path is never the same, because Tor uses up to 5,000 Tor relays to send your data request. Think of it as a huge network of “hidden” servers that will keep your online identity (meaning your IP address) and your location invisible.
Tor has extreme value because it can work with your website browser, remote log-in applications and even with instant-messaging software. Tor is registered as a nonprofit company, so they run mainly on donations and reliance on the hope that people will become a relay to their network.
Uses of Tor
By using Tor, websites will no longer be able to track the physical location of your IP address or what you have been looking at online…and neither will any interested organizations that may want to monitor someone’s Internet activity—meaning law enforcement or government security agencies. Tor is like a proxy on steroids.
Tor is slower than a regular Internet connection. However, the Tor developers have been doing a lot of hard work to make the Tor network faster. And it is faster today than ever before. One of the best things that can be done to speed up the Tor network is to create more relays. If you would like to contribute to making the Tor network faster, you can check out our Tor Challenge
Is Tor secure?
Security and anonymity go hand in hand on the Internet. As an online anonymizer, Tor was designed to be secure.
However, documents leaked by former National Security Agency (NSA) contractor Edward Snowden show that the NSA has tried to crack, infiltrate or weaken any encryption that the agency does not itself control.
In light of this news, nearly all independent encryption and online communication services have become suspect, including Tor.
India’s premier investigating agency, the Central Bureau of Investigation (CBI) arrested a man for stealing product keys of various Microsoft products and selling them to the unsusupecting customers for a ungainly profit. CBI issued a statement saying that they had arrested a person named D.Prabhu. D.Prabhu is not linked to any hacker groups and is a private individual. CBI says that he was doing the about stealing for his personal profit.
A CBI spokesperson said: “The complaint was lodged by Microsoft. The agency took up the investigation as the alleged offence has larger ramifications.” According to the official, the quantum of loss suffered by Microsoft is yet to be quantified as the thief sold keys of various Microsoft products.
According to CBI, a case has been registered on the allegations that Microsoft Volume License Service Centre (VLSC) agreements in respect of different overseas and Indian customers of the Microsoft were unauthorisedly being accessed aka hacked for the purpose of stealing product keys of different Microsoft products.
CBI also said that searches made at Prabhu’s premises yielded substantial evidence about the theft including recovery of hard disks, a router, a numbers of Microsoft product kits and other documents. The CBI has also frozen the bank account of the accused used to collect the sale amount. The accused was Friday produced before a local court here and the agency obtained transit remand.
