extreme secure and high availability systems with strong access control

How is it done?

The US intercontinental titan missile system, had to be extremly secure.
But the soldiers on duty also had to be unlock and fire the rocket within minutes if requested!

This was done by:
- two person control
- unlock key in a padlock with 2 locks
- simultaneous actions
- 6 character code lock for fuel lines, from padlock
- code received by radio + code from padlock
- strong perimeter security 

Source: http://www.crypto.com/blog/titans

Rasterfahndung - the mother of NSA prism

The German BKA used the Rasterfahndung-technique in the 1970's to search for RAF terrorists.

Basically it is to brainstorm for descriptive attributes that fit the wanted person. And then use all available information sources, like phone books or customer lists, that help filter out persons that match.

1979 the BKA in fact knew, that the terrorist were living in a rented appartement under false name, somewhere near Frankfurt.
Also they assumed that they have to pay the electricity bill in hard cash (anonymous).
As 18'000 bills were payed by hard cash, the investigators started shrinking the list by removing persons that really exist in other. So if one of the names also exists in an other register, it most possibly isn't a suspicious person and can be removed from the list. Following registers were used:
- car owners
- registered residents
- pensionists
- social welfare benefit receivers
- property owners
- fire insurance owners
- public health care owners

Till there remained only 2 persons!

Limburger Dom Glocken schlagen 13 mal - wie geht das

hmmm:

- entweder über social engineering, weil man jemanden kennt der die Berechtigung hat
oder
- man hat via shodan rinfach Zugriff gefunden und konnte das Passwort raten


link

Dynamic Programming - what is it

Richard Bellman: to hide that he did mathematic research, he invented dynamic programming, and this name sounded cool!

Problems - split to subproblems - solutions then could be easily reused!

basically: results are stored and kept, for the case they will be used again, then they don't need to be calculated again!

Examples:
Fibonacci
shortest path

Why is TOR interesting - Wieso ist Tor interessant?

use it for:
- anonymous websurfing
- publishing illegal websites inside tor (Drugs, hacker, weapon)

since Lavabit - Cloud computing is not safe anymore? - sind Clouds seit Lavabit nicht mehr sicher?

To allow investigations against one single person - a US court forced Lavabit (secure email) to hand out its main private security key.

This allows to read the encrypted mails of the person in concern. But it also allows to read all mails of all customers!!

Technically it has to be like this, that only one main key exists. The fact that investigators then could read all mails of the other 400'000 customers, forced the owner of Lavabit to shutdown the cloud service, as privay could no longer be guaranteed.

It is likely that such a scenario could hit any cloud service user!

source: heise.de

illegal websites - the darknet?

Darknet: places in the internet, where you get illegal things or services

Often they hide behind services like Tor.
Current important darknet places are: 
- The Green Machine
- Hidden Market
- StolenPal
- Silk Road (shutdown 2013) => http://www.bmreloaded.com/ ; https://www.sheepmarketplace.com/; http://deepbay4xr3sw2va.onion/

also see Wiki: http://de.wikipedia.org/wiki/Darknet#Weblinks; null-byte

Whats the value/price of stolen data - Was kosten sie gestohlene Daten; Wert gestohlener Daten

If you are a European company and some of your data gets stolen, whats the price you have to pay?

- average cost per single costumer data record in 2012 is about 150€ (2008: 112€)
- loss of reputation
- value for the theft (depending on Quality):
   - full record (person name, address, credit card number, retention, security number = 1.5 - 3 $
   - full paypal account information = 1000 $ or 10% of the available account money
- in average a company lost 24'000 records per incident and lost 4% of its costumers
- risks:
   - in Germany a company has to tell the authority when data has been stolen, otherwise the responsible person can be fined with up to 300'000 €
   - data theft in Germany can be punished with up to 3 years of jail

source: die Welt

French ministers should now only use a safe french mobile phone

To hide from NSA surveillance, french ministers should use a french manufactured mobile phone, the teoreme manufactured by thales.

sources:

- http://www.sudouest.fr/2011/10/31/c-est-le-nouveau-telephone-portable-de-sarkozy-541360-4778.php

- http://cdn-storage.br.de/MUJIuUOVBwQIb71S/iw11MXTPbXPS/_2rc_H1S/_-QS/_2gy_Akf/130929_1600_Das-Computermagazin_Wird-GTA-5-das-beste-Spiel-ueberhaupt.mp3

Safe encrypted mails with PGP and how to get public key of others - sicher verschlüssselte Mails mit PGP und wie man den öffentlichen Schlüssel von Kommunikationspartnern kommt

There are 2 common ways to encrypt your mails:
 - open-PGP, asymmetric, hier RFC4880, open source tools
 - S/MIME, asymmetric, hierarchic key management (CA), X.509, available in most commercial mail products

Since Snowden, it is often said that the central key management properties (CA) for S/MIME based encryption could very possibly be undercut by NSA or others (to sign or send mails in your name). And it is uncertain if commercial S/MIME based products do not have backdoors.

So, if you decide to go with PGP, you need to know an easy way of sharing and trusting the needed keys:

Facts about PGP:
- messages are encrypted by using a one-time symmetric session key
- session key is exchanged thru asymmetric encryption
- use 2048 bit key (safe till ~2019) or 4096 bit key
- possibility to add expiration to keys (also after creation)
- a (changable passphrase) protects your key usage
- every participant gets a public (share it) and a private key (never give it to anyone, store it at home, safe)
- revocation is possible by self issuing a revocation certificate
- fingerprint: is a 40 character hex number that identifies you (crypto hash of your personal informations and the key-ID)
- your public key needs to be certified, this can be done by any PGP participant (WoT, Web of Trust)

- after certification, you can publish your public key

share keys:
- on a keyserver (SKS based): http://pgp.mit.edu/; http://sks-keyservers.net
- as email footer
- on your website

trust keys:
- function of your PGP software

get keys of others:
- search: http://sks-keyservers.net, http://www.rubin.ch/pgp/searchkey.html 
- send mail with subject "get name@server.com" to pgp-public-keys@keys.pgp.net



sources: c't 22 7.10.2013 and lifehacker and web!

encrypt gmail messages with PGP - Gmails mit PGP verschlüsseln

Um auch seine Gmail Mails bequem mit dem sicheren PGP zu verschlüssen, braucht man Google Chrome und die Erweiterung Mailvelope, mit welcher man Schlüssel verwalten kann.

Mailvelope fügt in das Fenster zum verfassen der Mails einen Button ein, mit welchem man die Mailtexte verschlüsseln kann. Bei erhaltenen Mails, welche verschlüsselt sind, kann man diese ebenfalls mittels eines Buttons im Webfrontend entschlüsseln.

Solltest Du noch kein eigenes Schlüsselpaar haben, kannst Du dieses in Mailvelope gleich miterzeugen.

Das folgende Video zeigt, wie man nun Gmail und Mailvelope nutzt:

Tip: Um  sicher mailen zu können, müssen vorgängig die öffentlichen Schlüssel getausch werden!

Und wie PGP mobil auf meinem Android Smarphone nutzen? Versuche: https://play.google.com/store/apps/details?id=org.thialfihar.android.apg

Bruce Schneier in der Schweiz - Ihr seid Freiwild

Der bekannte IT Security Spezialist hat diese Woche in Lausanne Klartext geredet:

Was die NSA kann:
- Metadaten über uns alle sammeln, ohne dass wir es merken - "ihr seid Freiwild"
- Metadaten enthalten zwar direkt keine eigentlich Information, sind aber ähnlich wie Telefonbucheinträge Verweise um auf diese zugreifen zu können
- Datenverkehr über die belgische Telekom wurde von der NSA abgehört
- NSA hat Hintertüren in kryptographische Mechanismen wie zum Beispiel Bitlocker von Microsoft eingebaut
- Gegenmassnahmen: IETF und ITU sollten sollten nicht zu offen mit der NSA zusammenarbeiten, weniger Daten über die USA routen, Opensource Software fördern, ökonomischen Druck auf US Firmen ausüben