http://x700.blogspot.com/
Quelle: Microsoft Technet
Microsoft führt seinen eigenen Compliance Manager nicht mehr weiter, verweist aber auf andere, neue Tools:
http://www.theverge.com/2014/4/14/5613928/fbi-facial-recognition-database-will-contain-52-million-images-by-2015
39 Mio. mehr als noch 2013
The German BKA used the Rasterfahndung-technique in the 1970's to search for RAF terrorists.
Basically it is to brainstorm for descriptive attributes that fit the wanted person. And then use all available information sources, like phone books or customer lists, that help filter out persons that match.
1979 the BKA in fact knew, that the terrorist were living in a rented appartement under false name, somewhere near Frankfurt.
Also they assumed that they have to pay the electricity bill in hard cash (anonymous).
As 18'000 bills were payed by hard cash, the investigators started shrinking the list by removing persons that really exist in other. So if one of the names also exists in an other register, it most possibly isn't a suspicious person and can be removed from the list. Following registers were used:
- car owners
- registered residents
- pensionists
- social welfare benefit receivers
- property owners
- fire insurance owners
- public health care owners
Till there remained only 2 persons!
use it for:
- anonymous websurfing
- publishing illegal websites inside tor (Drugs, hacker, weapon)
To allow investigations against one single person - a US court forced Lavabit (secure email) to hand out its main private security key.
This allows to read the encrypted mails of the person in concern. But it also allows to read all mails of all customers!!
Technically it has to be like this, that only one main key exists. The fact that investigators then could read all mails of the other 400'000 customers, forced the owner of Lavabit to shutdown the cloud service, as privay could no longer be guaranteed.
It is likely that such a scenario could hit any cloud service user!
source: heise.de
Darknet: places in the internet, where you get illegal things or services
Often they hide behind services like Tor.
Current important darknet places are:
- The Green Machine
- Hidden Market
- StolenPal
- Silk Road (shutdown 2013) => http://www.bmreloaded.com/ ; https://www.sheepmarketplace.com/; http://deepbay4xr3sw2va.onion/
also see Wiki: http://de.wikipedia.org/wiki/Darknet#Weblinks; null-byte
If you are a European company and some of your data gets stolen, whats the price you have to pay?
- average cost per single costumer data record in 2012 is about 150€ (2008: 112€)
- loss of reputation
- value for the theft (depending on Quality):
- full record (person name, address, credit card number, retention, security number = 1.5 - 3 $
- full paypal account information = 1000 $ or 10% of the available account money
- in average a company lost 24'000 records per incident and lost 4% of its costumers
- risks:
- in Germany a company has to tell the authority when data has been stolen, otherwise the responsible person can be fined with up to 300'000 €
- data theft in Germany can be punished with up to 3 years of jail
source: die Welt
There are 2 common ways to encrypt your mails:
- open-PGP, asymmetric, hier RFC4880, open source tools
- S/MIME, asymmetric, hierarchic key management (CA), X.509, available in most commercial mail products
Since Snowden, it is often said that the central key management properties (CA) for S/MIME based encryption could very possibly be undercut by NSA or others (to sign or send mails in your name). And it is uncertain if commercial S/MIME based products do not have backdoors.
So, if you decide to go with PGP, you need to know an easy way of sharing and trusting the needed keys:
Facts about PGP:
- messages are encrypted by using a one-time symmetric session key
- session key is exchanged thru asymmetric encryption
- use 2048 bit key (safe till ~2019) or 4096 bit key
- possibility to add expiration to keys (also after creation)
- a (changable passphrase) protects your key usage
- every participant gets a public (share it) and a private key (never give it to anyone, store it at home, safe)
- revocation is possible by self issuing a revocation certificate
- fingerprint: is a 40 character hex number that identifies you (crypto hash of your personal informations and the key-ID)
- your public key needs to be certified, this can be done by any PGP participant (WoT, Web of Trust)
- after certification, you can publish your public key
share keys:
- on a keyserver (SKS based): http://pgp.mit.edu/; http://sks-keyservers.net
- as email footer
- on your website
trust keys:
- function of your PGP software
get keys of others:
- search: http://sks-keyservers.net, http://www.rubin.ch/pgp/searchkey.html
- send mail with subject "get name@server.com" to pgp-public-keys@keys.pgp.net
sources: c't 22 7.10.2013 and lifehacker and web!
Um auch seine Gmail Mails bequem mit dem sicheren PGP zu verschlüssen, braucht man Google Chrome und die Erweiterung Mailvelope, mit welcher man Schlüssel verwalten kann.
Mailvelope fügt in das Fenster zum verfassen der Mails einen Button ein, mit welchem man die Mailtexte verschlüsseln kann. Bei erhaltenen Mails, welche verschlüsselt sind, kann man diese ebenfalls mittels eines Buttons im Webfrontend entschlüsseln.
Solltest Du noch kein eigenes Schlüsselpaar haben, kannst Du dieses in Mailvelope gleich miterzeugen.
Das folgende Video zeigt, wie man nun Gmail und Mailvelope nutzt:
Der bekannte IT Security Spezialist hat diese Woche in Lausanne Klartext geredet:
Was die NSA kann:
- Metadaten über uns alle sammeln, ohne dass wir es merken - "ihr seid Freiwild"
- Metadaten enthalten zwar direkt keine eigentlich Information, sind aber ähnlich wie Telefonbucheinträge Verweise um auf diese zugreifen zu können
- Datenverkehr über die belgische Telekom wurde von der NSA abgehört
- NSA hat Hintertüren in kryptographische Mechanismen wie zum Beispiel Bitlocker von Microsoft eingebaut
- Gegenmassnahmen: IETF und ITU sollten sollten nicht zu offen mit der NSA zusammenarbeiten, weniger Daten über die USA routen, Opensource Software fördern, ökonomischen Druck auf US Firmen ausüben
Government:
https://isc.sans.edu/ - "Internet Weather"
http://ics-cert.us-cert.gov/ (A)- Industrial Control Systems Cyber Emergency Response Team
http://www.enisa.europa.eu/ - Europe
https://www.bsi.bund.de/DE/Home/home_node.html - Germany
http://www.melani.admin.ch/ - Switzerland
http://dsd.gov.au/ - Australia (top 4 mitigation strategies)
http://www.nerc.com/Pages/default.aspx - North American Energy Cooperation
Companies / Groups:
http://www.welivesecurity.com/
http://www.ccc.de/
http://www.heise.de/security/
http://www.isssource.com
Conferences:
http://www.defcon.org/
http://events.ccc.de/congress/?language=en
https://www.isss.ch/index.php
Threatcheck:
https://www.virustotal.com/de/
So far almost any biometric device handles the captured data by its own way.
This means even if two manufacturers use the same sensor and the same algorithm, they most probably use different data formats. This a disadvantage for propagation of a technology.
But it is a advantage for you as a user. Because all your biometric attributes are unique. So far only companies that asked for your biometrics got it, but as soon there will be standards, also such data can be copied and traded. And everyone knowing your digital fingerprint pattern can identify you from them without you r knowledge. So you can no longer hide. And much worse, because it is biometrics you can't change any attribute like a password (think of changing iris pattern or face geometry - impossible).
Efforts for biomtetric standards:
- FIDO Fast identity online (Google, Paypal, Lenovo)
- IREX (by nist.org) iris scan
types of biometrics:
- fingerprint
- face geometry
- voice
- iris and retina
- hand venes
- palm geometry$
- signature
- brain waves
As long, as no one is able to hack it: http://istouchidhackedyet.com/
The iPhone 5s is the proof, that fingerprint can save a device.
(At least as long as no one knows your keycode, that will be requested if 5 times a wrong finger was used to unlock)
TouchID facts:
- Sensor (capacitive, 500 ppi, orientationless, 170 microns thin)
- TouchID was developped by AuthenTec that was bought by Apple
- the fingerprints are stored locally by the os (inside A7 processor)
- the stored data is encrypted
- unlock the screen by 4 digit code or fingerprint, because both ways are possible, you don't gain security
- it's not a fingerpint picture that gets stored, the device calculates a signature (or pattern) out of it, because this can be better stored and compared.
- a second source (2) tells, that instead of a pattern only a hash will be stored in the device. This sounds strange. The same finger will for sure be captured always slightly different. Then attributes of the captured fingerprint are taken to create a pattern. The pattern could then be hashed. Hash algorithm are collission resistent one way functions. A hash can not be reverted to original data (the pattern). So the only way to be accepted would be to create 2 100% identical hashes. This sounds impossible! Biometrics works by pattern matching and not by hash comparisation. Maybe the author of the referenced article missunderstood the system!
- by long pressing the button, Siri is activated and can be asked for phone numbers or appointments!!
- NSA has access to sensible data of iOS devices (If they need your data, they most probably get it, even it is not stored in a cloud)
- fingerprints are biometrics that can be easily fooled
- the safety you get is not worth giving biometric data like your fingerprint
- fingerprints can be stolen (copied) without your notice (from a glass, while you sleep), they are not a secret
Pattern matching:
Pattern matching is how all biometric devices work. Pictures can not be compared other ways.
Pattern matching is like counting similiar values from 2 lists, and if enough (ex. 70%) are similiar, patterns are supposed to be equal!)
open questions:
- is the living check accurate (pulse, temperature, glove with artificial fingerprint)?
- The only statement found regarding this questions so far is:
"why 1984 won't be 1984" ?
In 1984, Apple introduced the apple macintosh computer for everyones home use, this was in a time were only big companies could afford "even bigger" computers, sold by companies like IBM or digital. 1984 is the same year, George Orwell used to describe the totalitarian supervision nation that dictates everything down to privacy.
- our good friends really spy on us, everyone, the whole world
- there is war, even we suppose living in freedom
- it is evident, rumors are now proven, their computers really spy at us
- its worse than "1984"
- the united states are sitting in the tower of the panopticum
- no one knows, who is good or bad, because we don't really know who is part of it (maybe Google, Apple, ...)
- and finally if the US are doing it, why should others not (Russia, Israel, China, ...)
My blog is worth $1,129.08.
How much is your blog worth?
