11/16/12

White Hat Bot-Nets

gAtO wAs - reading Bloomberg BusinessWeek “ The Hacker of Damascus” Karin a 31-year-old doctor had spent the previous months protesting against the government of Damascus, he refuse to give up his friends names.

Before the arrest-/ before the torture/- they found a simple vulnerability thru Skypes they also got into his hard drive and as Karin said they arrested his computers data first them him. So now we see the black hats, spammer, cyber criminal tricks against people from their own governments. Is this the way it’s going to happen, we see the news today about 2 ladies and their General boy toys and WOW -mEoW.

In Georgia detains ministry for using malware to access opposition leaders computers – This is just another example of governments using criminal cyber tactics to gain intelligence from it’s own people.

The Hacker of Damascus – http://www.businessweek.com/articles/2012-11-15/the-hackers-of-damascus

Georgia detains Dozen Interior Ministry “Cyber Spies” http://www.brecorder.com/world/europe/91030-georgia-detains-dozen-interior-ministry-cyber-spies.html

The other side of the cyber struggles in Syria is Anonymous and their role in all this: On the other side, the hacktivist group Anonymous has infiltrated at least 12 Syrian government websites, including that of the Ministry of Defense, and released millions of stolen e-mails.

Cyberspace and it’s tools (weapons) like Facebook, Twitter – can be used by both sides in this evolving landscape of digital warriors. That is why gATo is sadden by how basic normal Internet tools can become killers and liberators. I guess I see the fog of cyberwar thru gATO eYe’S we have only seen defensive cyber tools so far Suxnet and others are only the beginning and the new economies that had no choice but a digital path into their infrastructure need to look at their own security a wee bit more close. DId Huawei (China’s Telecom Giant accused of having backdoor ) sell you those Network infrastructure pieces at a very cheap price -(lowest bidder (or a no-bid)contract) -well guess who is watching you…

SCADA cyber controls security SUCKs = infrastructure things (energy/transportation/communication/water/air) = fix them NOW

Since no Cyber Bill has gone before congress -President Obama after a major election went and signed a-

US secret CYber Law singed by Pres. Obama -Nov 15, 2012

Rather, the directive establishes principles and processes for the use of cyber operations so that cyber tools are integrated with the fully array of national security tools we have at our disposal. It provides a whole-of-government approach consistent with the values that we promote domestically and internationally as we have previously articulated in the International Strategy for Cyberspace.

This directive will establish principles and processes that can enable more effective planning, development, and use of our capabilities. It enables us to be flexible, while also exercising restraint in dealing with the threats we face. It continues to be our policy that we shall undertake the least action necessary to mitigate threats and that we will prioritize network defense and law enforcement as the preferred courses of action. The procedures outlined in this directive are consistent with the U.S. Constitution, including the President’s role as commander in chief, and other applicable law and policies. http://killerapps.foreignpolicy.com/posts/2012/11/14/the_white_houses_secret_cyber_order

So now even 31-year-old doctors need to worry what they do and who they talk to and WHAT they talk about -/ also- in Facebook, Skype or any other web-App- By the way —>These basic vulnerabilities can be found and exploited in any web-app – So this person may of worked at the water plant – or the electric plant what could these White Hat Bots have obtained?? These little White Hat BotNets may go rouge or may be captured this is about virtual digital world with a click of a mouse I GOT YOU!!! -PWN

Will this become the standard? The good and bad guy’s do it NOW- plant a virus suck up your disk / then check it out – BUT “if you got nothing to hide” well it’s OK then — right - gAtO oUt

Ref: http://readwrite.com/2012/11/15/botclouds-how-botnets-now-offer-crime-as-a-service?utm_source=twitterfeed&utm_medium=linkedin&utm_campaign=Feed:+readwriteweb+(ReadWriteWeb)

http://uscyberlabs.com/blog/wp-content/uploads/2012/11/black_bots_-300x168.jpg

10/25/12

The deep Dark Web -Book Release

gATO hApPy -

AVAILABLE @ AMAZON - http://www.amazon.com/dp/B009VN40DU

AVAILABLE @SmashWords website @http://www.smashwords.com/books/view/247146

I learned that I hate WORD: – but it’s the general format for publishing - text boxes- get imbedded and you can’t format to EPUB or .mobi or anything – solution after going lOcO gAtO - was copy and paste into txt editor – save as RTF then copy paste back into a new WORD document and then reformat everything from scratch – and copy over the pictures – as you can tell I had fun-..-ugh mEoW F-F-F-F as much fun as a hairball but if it get’s the message out “FREEDOM OF SPEECH IN CYBERSPACE” then we done our job, anyway I hope you read it - Thank you Pierluigi a best friend a security gAtO ever had - gATO oUt

This Book covers the main aspects of the fabulous and dangerous world of -“The Deep Dark Web” . We are just two cyber specialists Pierluigi Paganini & Richard -gAtO- Amores, with one passion and two souls we wanted to explain the inner working of the deep dark web. We have had a long collaboration in this efforts to document our findings we made infiltrations into the dark places inaccessible to many to give a you the reader a clear vision on the major mystery of the dark hidden web that exist today in the Tor Onion network..

The Web, the Internet, mobile cell devices and social networking has become commonly used words that identify technological components of daily Internet user’s experience in the cyberspace. But how much do we really know about cyberspace? Very, very little, Google / Yahoo / Bing only show us 20% of the Internet the other 80% is hidden to the average user unless you know were to look.

The other 80% of the Internet is what this book is about the “Deep Dark Web”, three words with millions of interpretations, mysterious place on the web, the representation of the hell in the cyberspace but also the last opportunity to preserve freedom of expression from censorship. Authorities and corporation try to discourage the use of this untapped space because they don’t control it. We the people of the free world control this network of Tor -Onion Routers by volunteer around the world.

The Deep Dark Web seems to be full of crooks and cyber criminals, it is the hacker’s paradise, where there are no rule, no law, no identity in what is considered the reign of anonymity, but this is also the reason why many persecuted find refuge and have the opportunity to shout to the world their inconvenient truths.

The Deep Dark Web is a crowded space with no references but in reality it is a mine of information unimaginable, a labyrinth of knowledge in the book we will try to take you by the hand to avoid the traps and pitfalls hopefully illuminating your path in the dark.

Cybercrime, hacktivism, intelligence, cyber warfare are all pieces of this complex puzzle in which we will try to make order, don’t forget that the Deep Dark Web has unbelievable opportunity for business and governments, it represents the largest on-line market where it is possible to sell and acquire everything, and dear reader where there is $money$ you will find also banking, financial speculators and many other sharks.

Do you believe that making money in Deep Web is just a criminal prerogative? Wrong, the authors show you how things works in the hidden economy and which are the future perspectives of is digital currency, the Bitcoin.

This manuscript proposes both faces of the subject, it illustrates the risks but also legitimate use of anonymizing networks such as TOR adopted by journalist to send file reports before governments agents censored his work .

Here are some question we may answers to:

How many person know about the cyber criminals and their ecosystem in the deep web?

How many have provided information on the financial systems behind the “dirty affairs”?

How the law enforcement and governments use Dark Web?

Let’s hold your breath and start the trip in the abyss of knowledge to find answers to the above questions. We hope that with this book you can learn something new about – The Deep Dark Web.

http://uscyberlabs.com/blog/wp-content/uploads/2012/10/cover_thumb.jpg

09/28/12

Tor Command syntax

gAtO wAnT’s – just the simple command syntax -from the OG-OR Roger Dingledine -Nick Mathewson the Tor gods.

href=”http://manpages.ubuntu.com/manpages/hardy/man8/tor.8.html#contenttoc6″>

NAME

       tor - The second-generation onion router

SYNOPSIS

       tor [OPTION value]...

DESCRIPTION

       tor  is  a connection-oriented anonymizing communication service. Users
       choose a source-routed path through a set of  nodes,  and  negotiate  a
       "virtual  circuit"  through  the  network, in which each node knows its
       predecessor and successor, but no  others.  Traffic  flowing  down  the
       circuit is unwrapped by a symmetric key at each node, which reveals the
       downstream node.

       Basically  tor  provides  a  distributed  network  of  servers  ("onion
       routers"). Users bounce their TCP streams -- web traffic, ftp, ssh, etc
       -- around the routers, and recipients, observers, and even the  routers
       themselves have difficulty tracking the source of the stream.

OPTIONS

       -h, -help Display a short help message and exit.

       -f FILE
              FILE   contains   further   "option   value"   pairs.  (Default:
              /etc/tor/torrc)

       --hash-password
              Generates a hashed password for control port access.

       --list-fingerprint
              Generate your keys and output your nickname and fingerprint.

       --verify-config
              Verify the configuration file is valid.

       --nt-service
              --service [install|remove|start|stop]  Manage  the  Tor  Windows
              NT/2000/XP  service.   Current  instructions  can  be  found  at
              http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#WinNTService

       --list-torrc-options
              List all valid options.

       --version
              Display Tor version.

       Other options can be specified either on the command-line (--option
              value),  or  in  the configuration file (option value).  Options
              are case-insensitive.

       BandwidthRate N bytes|KB|MB|GB|TB
              A token bucket limits the average incoming  bandwidth  usage  on
              this  node  to the specified number of bytes per second, and the
              average outgoing bandwidth usage to that same value. (Default: 3
              MB)

       BandwidthBurst N bytes|KB|MB|GB|TB
              Limit the maximum token bucket size (also known as the burst) to
              the given number of bytes in each direction. This  value  should
              be at least twice your BandwidthRate. (Default: 6 MB)

       MaxAdvertisedBandwidth N bytes|KB|MB|GB|TB
              If set, we will not advertise more than this amount of bandwidth
              for our BandwidthRate. Server operators who want to  reduce  the
              number  of clients who ask to build circuits through them (since
              this is proportional to  advertised  bandwidth  rate)  can  thus
              reduce the CPU demands on their server without impacting network
              performance.

       ConnLimit NUM
              The minimum number of file descriptors that must be available to
              the Tor process before it will start. Tor will ask the OS for as
              many file descriptors as the OS will allow (you can find this by
              "ulimit -H -n"). If this number is less than ConnLimit, then Tor
              will refuse to start.

              You probably don’t need to adjust this.  It  has  no  effect  on
              Windows since that platform lacks getrlimit(). (Default: 1000)

       ControlPort Port
              If set, Tor will accept connections on this port and allow those
              connections to control the Tor process  using  the  Tor  Control
              Protocol (described in control-spec.txt).  Note: unless you also
              specify one of  HashedControlPassword  or  CookieAuthentication,
              setting  this  option will cause Tor to allow any process on the
              local host to control it. This option is required for  many  Tor
              controllers; most use the value of 9051.

       ControlListenAddress IP[:PORT]
              Bind  the  controller listener to this address. If you specify a
              port, bind to  this  port  rather  than  the  one  specified  in
              ControlPort.  We  strongly  recommend  that you leave this alone
              unless you know what you’re doing, since giving attackers access
              to   your   control  listener  is  really  dangerous.  (Default:
              127.0.0.1) This directive can be  specified  multiple  times  to
              bind to multiple addresses/ports.

       HashedControlPassword hashed_password
              Don’t  allow any connections on the control port except when the
              other  process  knows  the  password  whose  one-way   hash   is
              hashed_password.   You  can  compute  the  hash of a password by
              running "tor --hash-password password".

       CookieAuthentication 0|1
              If this option is set to 1, don’t allow any connections  on  the
              control  port  except  when  the  connecting  process  knows the
              contents of a file named "control_auth_cookie", which  Tor  will
              create  in  its  data  directory.   This  authentication methods
              should only be used on systems with  good  filesystem  security.
              (Default: 0)

       DataDirectory DIR
              Store working data in DIR (Default: /var/lib/tor)

       DirServer [nickname] [flags] address:port fingerprint
              Use a nonstandard authoritative directory server at the provided
              address and port, with  the  specified  key  fingerprint.   This
              option  can  be  repeated many times, for multiple authoritative
              directory servers.  Flags are separated by spaces, and determine
              what  kind of an authority this directory is.  By default, every
              authority is authoritative for current ("v2")-style directories,
              unless  the  "no-v2"  flag  is  given.   If  the  "v1"  flags is
              provided, Tor will use this server as an authority for old-style
              (v1)  directories  as  well.  (Only directory mirrors care about
              this.)  Tor will use this server  as  an  authority  for  hidden
              service information if the "hs" flag is set, or if the "v1" flag
              is set and the "no-hs" flag is not set.  If a flag "orport=port"
              is  given,  Tor  will  use the given port when opening encrypted
              tunnels to the dirserver.  If no dirserver line  is  given,  Tor
              will  use  the  default directory servers.  NOTE: this option is
              intended for setting up a  private  Tor  network  with  its  own
              directory   authorities.    If   you   use   it,   you  will  be
              distinguishable from other users, because you won’t believe  the
              same authorities they do.

       FetchHidServDescriptors 0|1
              If set to 0, Tor will never fetch any hidden service descriptors
              from the rendezvous directories. This option is only  useful  if
              you’re  using  a Tor controller that handles hidserv fetches for
              you.  (Default: 1)

       FetchServerDescriptors 0|1
              If set to 0, Tor will never fetch any network  status  summaries
              or server descriptors from the directory servers. This option is
              only useful if  you’re  using  a  Tor  controller  that  handles
              directory fetches for you.  (Default: 1)

       FetchUselessDescriptors 0|1
              If  set  to 1, Tor will fetch every non-obsolete descriptor from
              the authorities that it hears about. Otherwise,  it  will  avoid
              fetching  useless  descriptors, for example for routers that are
              not  running.   This  option  is  useful  if  you’re  using  the
              contributed  "exitlist"  script to enumerate Tor nodes that exit
              to certain addresses.  (Default: 0)

       Group GID
              On startup, setgid to this group.

       HttpProxy host[:port]
              Tor will make all its directory requests through this  host:port
              (or  host:80  if  port is not specified), rather than connecting
              directly to any directory servers.

       HttpProxyAuthenticator username:password
              If defined, Tor will use this username:password for  Basic  Http
              proxy authentication, as in RFC 2617. This is currently the only
              form of Http proxy authentication that Tor supports;  feel  free
              to submit a patch if you want it to support others.

       HttpsProxy host[:port]
              Tor  will  make  all  its  OR  (SSL)  connections  through  this
              host:port (or host:443 if  port  is  not  specified),  via  HTTP
              CONNECT  rather  than  connecting  directly to servers.  You may
              want to set FascistFirewall to restrict the  set  of  ports  you
              might  try  to  connect  to,  if  your  Https  proxy only allows
              connecting to certain ports.

       HttpsProxyAuthenticator username:password
              If defined, Tor will use this username:password for Basic  Https
              proxy authentication, as in RFC 2617. This is currently the only
              form of Https proxy authentication that Tor supports; feel  free
              to submit a patch if you want it to support others.

       KeepalivePeriod NUM
              To  keep  firewalls  from  expiring  connections, send a padding
              keepalive cell every NUM seconds on open connections that are in
              use.  If the connection has no open circuits, it will instead be
              closed after NUM seconds of idleness. (Default: 5 minutes)

       Log minSeverity[-maxSeverity] stderr|stdout|syslog
              Send all messages between minSeverity  and  maxSeverity  to  the
              standard  output  stream,  the  standard error stream, or to the
              system log. (The "syslog" value  is  only  supported  on  Unix.)
              Recognized  severity  levels  are debug, info, notice, warn, and
              err.  We advise using "notice" in  most  cases,  since  anything
              more  verbose  may  provide sensitive information to an attacker
              who obtains the logs.  If only one severity level is given,  all
              messages  of  that  level  or  higher will be sent to the listed
              destination.

       Log minSeverity[-maxSeverity] file FILENAME
              As above, but send log messages to  the  listed  filename.   The
              "Log"  option may appear more than once in a configuration file.
              Messages are sent to all the  logs  that  match  their  severity
              level.

       OutboundBindAddress IP
              Make  all  outbound  connections  originate  from the IP address
              specified.  This is only useful when you have  multiple  network
              interfaces,  and  you  want all of Tor’s outgoing connections to
              use a single one.

       PidFile FILE
              On startup, write our PID to FILE.  On  clean  shutdown,  remove
              FILE.

       ProtocolWarnings 0|1
              If  1,  Tor will log with severity ’warn’ various cases of other
              parties not following the Tor specification. Otherwise, they are
              logged with severity ’info’. (Default: 0)

       RunAsDaemon 0|1
              If  1,  Tor  forks and daemonizes to the background. This option
              has no effect on Windows; instead you should use  the  --service
              command-line option. (Default: 0)

       SafeLogging 0|1
              If  1,  Tor  replaces  potentially sensitive strings in the logs
              (e.g. addresses) with the string [scrubbed]. This way  logs  can
              still   be  useful,  but  they  don’t  leave  behind  personally
              identifying information about  what  sites  a  user  might  have
              visited. (Default: 1)

       User UID
              On startup, setuid to this user.

       HardwareAccel 0|1
              If  non-zero,  try  to  use  crypto  hardware  acceleration when
              available. This is untested and probably buggy. (Default: 0)

       AvoidDiskWrites 0|1
              If non-zero, try to write to disk less frequently than we  would
              otherwise.  This is useful when running on flash memory or other
              media that support only a limited number of  writes.   (Default:
              0)

       TunnelDirConns 0|1
              If  non-zero, when a directory server we contact supports it, we
              will build a one-hop circuit and make  an  encrypted  connection
              via its ORPort. (Default: 0)

       PreferTunneledDirConns 0|1
              If  non-zero, we will avoid directory servers that don’t support
              tunneled directory connections, when possible. (Default: 0)

CLIENT OPTIONS

       The following  options  are  useful  only  for  clients  (that  is,  if
       SocksPort is non-zero):

       AllowInvalidNodes entry|exit|middle|introduction|rendezvous|...
              If  some  Tor  servers  are  obviously  not  working  right, the
              directory authorities can manually mark them as invalid, meaning
              that  it’s  not  recommended  you  use  them  for  entry or exit
              positions in your circuits. You can opt  to  use  them  in  some
              circuit  positions,  though. The default is "middle,rendezvous",
              and other choices are not advised.

       CircuitBuildTimeout NUM
              Try for at most NUM  seconds  when  building  circuits.  If  the
              circuit  isn’t  open  in  that time, give up on it.  (Default: 1
              minute.)

       CircuitIdleTimeout NUM
              If we have keept a clean (never used)  circuit  around  for  NUM
              seconds, then close it. This way when the Tor client is entirely
              idle, it can expire all of its circuits, and then expire its TLS
              connections.  Also,  if  we  end up making a circuit that is not
              useful for exiting any of the requests we’re receiving, it won’t
              forever  take up a slot in the circuit list.  (Default: 1 hour.)

       ClientOnly 0|1
              If set to 1, Tor will under no circumstances run  as  a  server.
              The  default  is to run as a client unless ORPort is configured.
              (Usually, you don’t need to set this; Tor  is  pretty  smart  at
              figuring  out whether you are reliable and high-bandwidth enough
              to be a useful server.)  (Default: 0)

       ExcludeNodes nickname,nickname,...
              A list of nodes to never use when building a circuit.

       EntryNodes nickname,nickname,...
              A list of preferred nodes to  use  for  the  first  hop  in  the
              circuit.    These   are   treated  only  as  preferences  unless
              StrictEntryNodes (see below) is also set.

       ExitNodes nickname,nickname,...
              A list of preferred nodes  to  use  for  the  last  hop  in  the
              circuit.    These   are   treated  only  as  preferences  unless
              StrictExitNodes (see below) is also set.

       StrictEntryNodes 0|1
              If 1, Tor will never use  any  nodes  besides  those  listed  in
              "EntryNodes" for the first hop of a circuit.

       StrictExitNodes 0|1
              If  1,  Tor  will  never  use  any nodes besides those listed in
              "ExitNodes" for the last hop of a circuit.

       FascistFirewall 0|1
              If 1, Tor will only create outgoing connections to  ORs  running
              on  ports that your firewall allows (defaults to 80 and 443; see
              FirewallPorts).  This will allow you to  run  Tor  as  a  client
              behind  a firewall with restrictive policies, but will not allow
              you to run as a server behind such a firewall.  This  option  is
              deprecated; use ReachableAddresses instead.

       FirewallPorts PORTS
              A  list  of  ports  that your firewall allows you to connect to.
              Only  used  when  FascistFirewall  is  set.   This   option   is
              deprecated; use ReachableAddresses instead. (Default: 80, 443)

       ReachableAddresses ADDR[/MASK][:PORT]...
              A  comma-separated  list  of  IP  addresses  and ports that your
              firewall allows you to connect to. The  format  is  as  for  the
              addresses  in  ExitPolicy,  except  that  "accept" is understood
              unless  "reject"   is   explicitly   provided.    For   example,
              ’ReachableAddresses  99.0.0.0/8,  reject  18.0.0.0/8:80,  accept
              *:80’ means that your firewall allows connections to  everything
              inside  net  99,  rejects  port  80  connections  to net 18, and
              accepts connections to port  80  otherwise.   (Default:  ’accept
              *:*’.)

       ReachableDirAddresses ADDR[/MASK][:PORT]...
              Like  ReachableAddresses,  a  list  of addresses and ports.  Tor
              will   obey   these   restrictions   when   fetching   directory
              information,  using  standard  HTTP  GET  requests.  If  not set
              explicitly then the value of  ReachableAddresses  is  used.   If
              HttpProxy  is  set  then  these connections will go through that
              proxy.

       ReachableORAddresses ADDR[/MASK][:PORT]...
              Like ReachableAddresses, a list of  addresses  and  ports.   Tor
              will  obey  these restrictions when connecting to Onion Routers,
              using  TLS/SSL.   If  not  set  explicitly  then  the  value  of
              ReachableAddresses  is  used.  If  HttpsProxy  is set then these
              connections will go through that proxy.

              The     separation     between     ReachableORAddresses      and
              ReachableDirAddresses   is   only   interesting   when  you  are
              connecting through proxies (see HttpProxy and HttpsProxy).  Most
              proxies  limit  TLS  connections  (which  Tor uses to connect to
              Onion Routers) to port 443, and some  limit  HTTP  GET  requests
              (which  Tor uses for fetching directory information) to port 80.

       LongLivedPorts PORTS
              A list of ports for services  that  tend  to  have  long-running
              connections  (e.g.  chat  and  interactive shells). Circuits for
              streams that use  these  ports  will  contain  only  high-uptime
              nodes,  to reduce the chance that a node will go down before the
              stream is finished.  (Default: 21, 22, 706,  1863,  5050,  5190,
              5222, 5223, 6667, 6697, 8300)

       MapAddress address newaddress
              When a request for address arrives to Tor, it will rewrite it to
              newaddress before processing it. For example, if you always want
              connections  to  www.indymedia.org  to exit via torserver (where
              torserver is  the  nickname  of  the  server),  use  "MapAddress
              www.indymedia.org www.indymedia.org.torserver.exit".

       NewCircuitPeriod NUM
              Every  NUM  seconds  consider  whether  to  build a new circuit.
              (Default: 30 seconds)

       MaxCircuitDirtiness NUM
              Feel free to reuse a circuit that was first  used  at  most  NUM
              seconds  ago, but never attach a new stream to a circuit that is
              too old.  (Default: 10 minutes)

       EnforceDistinctSubnets 0|1
              If 1, Tor will not put two servers whose IP addresses  are  "too
              close"  on  the same circuit.  Currently, two addresses are "too
              close" if they lie in the same /16 range. (Default: 1)

       RendNodes nickname,nickname,...
              A list of preferred nodes to use for the  rendezvous  point,  if
              possible.

       RendExcludeNodes nickname,nickname,...
              A list of nodes to never use when choosing a rendezvous point.

       SocksPort PORT
              Advertise  this  port  to  listen  for  connections  from Socks-
              speaking applications.  Set this to 0 if you don’t want to allow
              application connections. (Default: 9050)

       SocksListenAddress IP[:PORT]
              Bind  to  this  address  to  listen  for connections from Socks-
              speaking applications. (Default: 127.0.0.1) You can also specify
              a port (e.g. 192.168.0.1:9100).  This directive can be specified
              multiple times to bind to multiple addresses/ports.

       SocksPolicy policy,policy,...
              Set an entrance policy for this server, to limit who can connect
              to  the  Socks  ports.   The policies have the same form as exit
              policies below.

       SocksTimeout NUM
              Let a socks connection wait NUM  seconds  handshaking,  and  NUM
              seconds unattached waiting for an appropriate circuit, before we
              fail it.  (Default: 2 minutes.)

       TestVia nickname,nickname,...
              A list of nodes to prefer for  your  middle  hop  when  building
              testing   circuits.   This   option   is  mainly  for  debugging
              reachability problems.

       TrackHostExits host,.domain,...
              For each value in the  comma  separated  list,  Tor  will  track
              recent connections to hosts that match this value and attempt to
              reuse the same exit node for each. If  the  value  is  prepended
              with  a  ’.’, it is treated as matching an entire domain. If one
              of the values is just a ’.’, it  means  match  everything.  This
              option  is  useful  if you frequently connect to sites that will
              expire all your authentication cookies (ie log you out) if  your
              IP  address  changes.  Note  that  this  option  does  have  the
              disadvantage of making it more clear that  a  given  history  is
              associated  with  a  single user. However, most people who would
              wish to observe this will observe it through  cookies  or  other
              protocol-specific means anyhow.

       TrackHostExitsExpire NUM
              Since exit servers go up and down, it is desirable to expire the
              association between host and exit server after NUM seconds.  The
              default is 1800 seconds (30 minutes).

       UseEntryGuards 0|1
              If  this  option  is  set  to  1,  we pick a few long-term entry
              servers, and try to stick with them.  This is desirable  because
              constantly changing servers increases the odds that an adversary
              who owns some servers will observe a  fraction  of  your  paths.
              (Defaults to 1.)

       NumEntryGuards NUM
              If  UseEntryGuards  is  set to 1, we will try to pick a total of
              NUM routers as long-term entries for our circuits.  (Defaults to
              3.)

       SafeSocks 0|1
              When  this  option  is  enabled,  Tor  will  reject  application
              connections that use unsafe variants of the  socks  protocol  --
              ones that only provide an IP address, meaning the application is
              doing a DNS resolve first.  Specifically, these are  socks4  and
              socks5 when not doing remote DNS.  (Defaults to 0.)

       TestSocks 0|1
              When  this  option  is enabled, Tor will make a notice-level log
              entry for each connection to the Socks port  indicating  whether
              the  request  used  a  safe socks protocol or an unsafe one (see
              above entry on SafeSocks).  This helps to determine  whether  an
              application   using   Tor  is  possibly  leaking  DNS  requests.
              (Default: 0)

       VirtualAddrNetwork Address/bits
              When a controller asks for a virtual (unused) address  with  the
              MAPADDRESS  command,  Tor  picks an unassigned address from this
              range.  (Default: 127.192.0.0/10)

              When providing proxy server service to a  network  of  computers
              using   a  tool  like  dns-proxy-tor,  change  this  address  to
              "10.192.0.0/10"     or     "172.16.0.0/12".      The     default
              VirtualAddrNetwork   address  range  on  a  properly  configured
              machine will route to the loopback interface.  For local use, no
              change to the default VirtualAddrNetwork setting is needed.

       AllowNonRFC953Hostnames 0|1
              When  this  option  is disabled, Tor blocks hostnames containing
              illegal characters (like @ and   rather than sending them to an
              exit  node  to be resolved.  This helps trap accidental attempts
              to resolve URLs and so on.  (Default: 0)

       FastFirstHopPK 0|1
              When this option is enabled and we aren’t running as  a  server,
              Tor  skips  the  public  key  step for the first hop of creating
              circuits.  This is safe  since  we  have  already  used  TLS  to
              authenticate  the  server  and to establish forward-secure keys.
              Turning  this  option  off  makes   circuit   building   slower.
              (Default: 1)

       TransPort PORT
              If  non-zero,  enables  transparent  proxy  support  on PORT (by
              convention, 9040).  Requires OS support for transparent proxies,
              such as BSDs’ pf or Linux’s IPTables.  If you’re planning to use
              Tor as a transparent proxy for a network, you’ll want to examine
              and  change  VirtualAddrNetwork from the default setting. You’ll
              also want to set the TransListenAddress option for  the  network
              you’d like to proxy.  (Default: 0).

       TransListenAddress IP[:PORT]
              Bind   to   this   address   to  listen  for  transparent  proxy
              connections.   (Default:  127.0.0.1).   This   is   useful   for
              exporting a transparent proxy server to an entire network.

       NATDPort PORT
              Allow  old  versions  of  ipfw  (as  included in old versions of
              FreeBSD, etc.) to send connections through Tor  using  the  NATD
              protocol.   This  option  is  only  for  people  who  cannot use
              TransPort.

       NATDListenAddress IP[:PORT]
              Bind to this address to listen for NATD connections.   (Default:
              127.0.0.1).

       SERVER OPTIONS

       The  following  options are useful only for servers (that is, if ORPort
       is non-zero):

       Address address
              The IP or fqdn of this  server  (e.g.  moria.mit.edu).  You  can
              leave this unset, and Tor will guess your IP.

       AssumeReachable 0|1
              This option is used when bootstrapping a new Tor network. If set
              to 1, don’t  do  self-reachability  testing;  just  upload  your
              server descriptor immediately. If AuthoritativeDirectory is also
              set, this  option  instructs  the  dirserver  to  bypass  remote
              reachability  testing  too  and  list  all  connected servers as
              running.

       ContactInfo email_address
              Administrative contact information for server. This  line  might
              get picked up by spam harvesters, so you may want to obscure the
              fact that it’s an email address.

       ExitPolicy policy,policy,...
              Set an exit policy for this server. Each policy is of  the  form
              "accept|reject  ADDR[/MASK][:PORT]".   If  /MASK is omitted then
              this policy just applies to the host given.  Instead of giving a
              host  or  network  you  can  also use "*" to denote the universe
              (0.0.0.0/0).  PORT can be a single port number, an  interval  of
              ports  "FROM_PORT-TO_PORT",  or  "*".   If PORT is omitted, that
              means "*".

              For  example,  "accept  18.7.22.69:*,reject  18.0.0.0/8:*,accept
              *:*"  would  reject  any  traffic  destined  for  MIT except for
              web.mit.edu, and accept anything else.

              To specify  all  internal  and  link-local  networks  (including
              0.0.0.0/8,    169.254.0.0/16,    127.0.0.0/8,    192.168.0.0/16,
              10.0.0.0/8, and 172.16.0.0/12), you can use the "private"  alias
              instead  of an address.  These addresses are rejected by default
              (at the beginning of your exit policy), along with  your  public
              IP  address,  unless  you set the ExitPolicyRejectPrivate config
              option to 0. For example, once you’ve done that, you could allow
              HTTP  to  127.0.0.1  and block all other connections to internal
              networks with  "accept  127.0.0.1:80,reject  private:*",  though
              that  may  also  allow connections to your own computer that are
              addressed to its public (external) IP address. See RFC 1918  and
              RFC 3330 for more details about internal and reserved IP address
              space.

              This directive can be specified multiple times so you don’t have
              to put it all on one line.

              Policies are considered first to last, and the first match wins.
              If you want to _replace_ the default exit policy, end your  exit
              policy  with  either  a  reject *:* or an accept *:*. Otherwise,
              you’re _augmenting_ (prepending to) the default exit policy. The
              default exit policy is:
                   reject *:25
                   reject *:119
                   reject *:135-139
                   reject *:445
                   reject *:465
                   reject *:563
                   reject *:587
                   reject *:1214
                   reject *:4661-4666
                   reject *:6346-6429
                   reject *:6699
                   reject *:6881-6999
                   accept *:*

       ExitPolicyRejectPrivate 0|1
              Reject  all private (local) networks, along with your own public
              IP address, at the beginning of  your  exit  policy.  See  above
              entry on ExitPolicy. (Default: 1)

       MaxOnionsPending NUM
              If  you  have  more  than  this  number of onionskins queued for
              decrypt, reject new ones. (Default: 100)

       MyFamily nickname,nickname,...
              Declare that this Tor server is controlled or administered by  a
              group  or organization identical or similar to that of the other
              named servers.  When two servers both declare that they  are  in
              the  same  ’family’,  Tor  clients will not use them in the same
              circuit.  (Each server only needs to list the other  servers  in
              its  family; it doesn’t need to list itself, but it won’t hurt.)

       Nickname name
              Set the server’s nickname to ’name’. Nicknames must be between 1
              and   19   characters  inclusive,  and  must  contain  only  the
              characters [a-zA-Z0-9].

       NumCPUs num
              How many processes to use at  once  for  decrypting  onionskins.
              (Default: 1)

       ORPort PORT
              Advertise  this  port to listen for connections from Tor clients
              and servers.

       ORListenAddress IP[:PORT]
              Bind to this IP address  to  listen  for  connections  from  Tor
              clients  and  servers.  If you specify a port, bind to this port
              rather than the one specified in ORPort. (Default: 0.0.0.0) This
              directive  can  be  specified multiple times to bind to multiple
              addresses/ports.

       PublishServerDescriptor 0|1
              If set to 0, Tor will act as a server  if  you  have  an  ORPort
              defined,   but  it  will  not  publish  its  descriptor  to  the
              dirservers. This option is useful if  you’re  testing  out  your
              server,  or  if  you’re  using  a  Tor  controller  that handles
              directory publishing for you.  (Default: 1)

       RedirectExit pattern target
              Whenever an outgoing connection tries to connect  to  one  of  a
              given set of addresses, connect to target (an address:port pair)
              instead.  The address pattern is given in the same format as for
              an  exit  policy.   The  address  translation applies after exit
              policies are applied.   Multiple  RedirectExit  options  can  be
              used: once any one has matched successfully, no subsequent rules
              are considered.  You can specify that no redirection  is  to  be
              performed  on  a  given  set  of  addresses by using the special
              target string "pass", which prevents subsequent rules from being
              considered.

       ShutdownWaitLength NUM
              When we get a SIGINT and we’re a server, we begin shutting down:
              we close listeners and start refusing new  circuits.  After  NUM
              seconds,   we   exit.  If  we  get  a  second  SIGINT,  we  exit
              immediately.  (Default: 30 seconds)

       AccountingMax N bytes|KB|MB|GB|TB
              Never send more than the specified number of bytes  in  a  given
              accounting  period,  or  receive  more  than  that number in the
              period.  For example, with AccountingMax set to 1 GB,  a  server
              could  send  900  MB and receive 800 MB and continue running. It
              will only hibernate once one of the two reaches 1 GB.  When  the
              number of bytes is exhausted, Tor will hibernate until some time
              in the next accounting period.   To  prevent  all  servers  from
              waking at the same time, Tor will also wait until a random point
              in each period before waking up.  If  you  have  bandwidth  cost
              issues,  enabling  hibernation  is  preferable  to setting a low
              bandwidth, since it provides users with  a  collection  of  fast
              servers  that are up some of the time, which is more useful than
              a set of slow servers that are always "available".

       AccountingStart day|week|month [day] HH:MM
              Specify how long accounting periods last.  If  month  is  given,
              each accounting period runs from the time HH:MM on the dayth day
              of one month to the same day and time of  the  next.   (The  day
              must  be  between  1 and 28.)  If week is given, each accounting
              period runs from the time HH:MM of the dayth day of one week  to
              the same day and time of the next week, with Monday as day 1 and
              Sunday as day 7.  If day is given, each accounting  period  runs
              from  the  time HH:MM each day to the same time on the next day.
              All times are local, and given in 24-hour  time.   (Defaults  to
              "month 1 0:00".)

       ServerDNSResolvConfFile filename
              Overrides  the  default DNS configuration with the configuration
              in filename.  The file format is the same as the  standard  Unix
              "resolv.conf"  file  (7).  This option, like all other ServerDNS
              options, only affects name  lookup  that  your  server  does  on
              behalf  of clients.  Also, it only takes effect if Tor was built
              with  eventdns  support.   (Defaults  to  use  the  system   DNS
              configuration.)

       ServerDNSSearchDomains 0|1
              If  set  to  1,  then  we will search for addresses in the local
              search domain.  For example, if this  system  is  configured  to
              believe it is in "example.com", and a client tries to connect to
              "www", the client will be connected to "www.example.com".   This
              option  only affects name lookup that your server does on behalf
              of clients, and only takes effect if Tor was build with eventdns
              support.  (Defaults to "0".)

       ServerDNSDetectHijacking 0|1
              When  this  option  is  set  to  1, we will test periodically to
              determine whether our local nameservers have been configured  to
              hijack  failing  DNS  requests (usually to an advertising site).
              If they are, we will attempt to correct this.  This option  only
              affects  name lookup that your server does on behalf of clients,
              and only takes effect if Tor was build  with  eventdns  support.
              (Defaults to "1".)

       ServerDNSTestAddresses address,address,...
              When  we’re  detecting DNS hijacking, make sure that these valid
              addresses aren’t getting redirected.  If they are, then our  DNS
              is  completely  useless,  and  we’ll  reset  our  exit policy to
              "reject *:*".  This option only affects name  lookup  that  your
              server  does  on behalf of clients, and only takes effect if Tor
              was build with eventdns support.  (Defaults to  "www.google.com,
              www.mit.edu, www.yahoo.com, www.slashdot.org".)

       ServerDNSAllowNonRFC953Hostnames 0|1
              When  this  option  is  disabled,  Tor  does  not try to resolve
              hostnames containing illegal characters (like @  and     rather
              than  sending  them  to an exit node to be resolved.  This helps
              trap accidental attempts to resolve URLs and so on.  This option
              only  affects  name  lookup  that  your server does on behalf of
              clients, and only takes effect if Tor was  build  with  eventdns
              support.  (Default: 0)

DIRECTORY SERVER OPTIONS

       The  following  options are useful only for directory servers (that is,
       if DirPort is non-zero):

       AuthoritativeDirectory 0|1
              When this option is set to 1, Tor operates as  an  authoritative
              directory   server.    Instead  of  caching  the  directory,  it
              generates its own list of good servers, signs it, and sends that
              to the clients.  Unless the clients already have you listed as a
              trusted directory, you probably do not want to set this  option.
              Please coordinate with the other admins at tor-ops@freehaven.net
              if you think you should be a directory.

       V1AuthoritativeDirectory 0|1
              When this option is set in addition  to  AuthoritativeDirectory,
              Tor  also generates a version 1 directory (for Tor clients up to
              0.1.0.x).   (As  of  Tor  0.1.1.12  every   (v2)   authoritative
              directory still provides most of the v1 directory functionality,
              even without this option set to 1.  This however is expected  to
              change in the future.)

       VersioningAuthoritativeDirectory 0|1
              When  this  option  is  set  to 1, Tor adds information on which
              versions of Tor are still believed safe for use to the published
              directory.    Each   version  1  authority  is  automatically  a
              versioning authority; version 2 authorities provide this service
              optionally.  See RecommendedVersions, RecommendedClientVersions,
              and RecommendedServerVersions.

       NamingAuthoritativeDirectory 0|1
              When this option is set to 1, then the server advertises that it
              has  opinions  about  nickname-to-fingerprint bindings.  It will
              include these opinions in its published network-status pages, by
              listing  servers  with  the  flag  "Named"  if a correct binding
              between that nickname and fingerprint has been  registered  with
              the  dirserver.   Naming  dirservers  will  refuse  to accept or
              publish descriptors that contradict a registered  binding.   See
              approved-routers in the FILES section below.

       HSAuthoritativeDir 0|1
              When  this  option is set in addition to AuthoritativeDirectory,
              Tor  also  accepts  and  serves  hidden   service   descriptors.
              (Default: 0)

       DirPort PORT
              Advertise the directory service on this port.

       DirListenAddress IP[:PORT]
              Bind  the  directory  service  to this address. If you specify a
              port, bind to  this  port  rather  than  the  one  specified  in
              DirPort.  (Default:  0.0.0.0)  This  directive  can be specified
              multiple times to bind to multiple addresses/ports.

       DirPolicy policy,policy,...
              Set an entrance policy for this server, to limit who can connect
              to the directory ports.  The policies have the same form as exit
              policies above.

       RecommendedVersions STRING
              STRING is a  comma-separated  list  of  Tor  versions  currently
              believed to be safe. The list is included in each directory, and
              nodes which pull down the directory learn whether they  need  to
              upgrade.  This option can appear multiple times: the values from
              multiple lines are spliced together.   When  this  is  set  then
              VersioningAuthoritativeDirectory should be set too.

       RecommendedClientVersions STRING
              STRING  is  a  comma-separated  list  of  Tor versions currently
              believed to be safe for clients to  use.   This  information  is
              included  in version 2 directories.  If this is not set then the
              value of RecommendedVersions is used.  When  this  is  set  then
              VersioningAuthoritativeDirectory should be set too.

       RecommendedServerVersions STRING
              STRING  is  a  comma-separated  list  of  Tor versions currently
              believed to be safe for servers to  use.   This  information  is
              included  in version 2 directories.  If this is not set then the
              value of RecommendedVersions is used.  When  this  is  set  then
              VersioningAuthoritativeDirectory should be set too.

       DirAllowPrivateAddresses 0|1
              If  set  to 1, Tor will accept router descriptors with arbitrary
              "Address" elements. Otherwise, if the address is not an IP or is
              a  private IP, it will reject the router descriptor. Defaults to
              0.

       AuthDirBadExit AddressPattern...
              Authoritative directories only.  A set of address  patterns  for
              servers  that  will be listed as bad exits in any network status
              document this authority  publishes,  if  AuthDirListBadExits  is
              set.

       AuthDirInvalid AddressPattern...
              Authoritative  directories  only.  A set of address patterns for
              servers that will never be listed  as  "valid"  in  any  network
              status document that this authority publishes.

       AuthDirReject AddressPattern...
              Authoritative  directories  only.  A set of address patterns for
              servers that will never be listed at all in any  network  status
              document  that  this  authority  publishes, or accepted as an OR
              address in any descriptor  submitted  for  publication  by  this
              authority.

       AuthDirListBadExits 0|1
              Authoritative directories only.  If set to 1, this directory has
              some opinion about which nodes are  unsuitable  as  exit  nodes.
              (Do  not  set  this  to 1 unless you plan to list nonfunctioning
              exits as bad; otherwise, you are effectively voting in favor  of
              every declared exit as an exit.)

       AuthDirRejectUnlisted 0|1
              Authoritative  directories  only.   If  set  to 1, the directory
              server rejects  all  uploaded  server  descriptors  that  aren’t
              explicitly  listed  in  the  fingerprints  file.  This acts as a
              "panic button" if we get Sybiled. (Default: 0)

HIDDEN SERVICE OPTIONS

       The following options are used to configure a hidden service.

       HiddenServiceDir DIRECTORY
              Store data files for  a  hidden  service  in  DIRECTORY.   Every
              hidden service must have a separate directory.  You may use this
              option multiple times to specify multiple services.

       HiddenServicePort VIRTPORT [TARGET]
              Configure a virtual port VIRTPORT for a hidden service.  You may
              use this option multiple times; each time applies to the service
              using the most recent hiddenservicedir.  By default, this option
              maps  the  virtual  port to the same port on 127.0.0.1.  You may
              override the target port,  address,  or  both  by  specifying  a
              target of addr, port, or addr:port.

       HiddenServiceNodes nickname,nickname,...
              If  possible, use the specified nodes as introduction points for
              the hidden service. If this is left unset, Tor will be smart and
              pick some reasonable ones; most people can leave this unset.

       HiddenServiceExcludeNodes nickname,nickname,...
              Do  not  use  the specified nodes as introduction points for the
              hidden service. In normal use there is no reason to set this.

       PublishHidServDescriptors 0|1
              If set to 0, Tor will run any hidden services you configure, but
              it won’t advertise them to the rendezvous directory. This option
              is only useful if you’re using a  Tor  controller  that  handles
              hidserv publishing for you.  (Default: 1)

       RendPostPeriod N seconds|minutes|hours|days|weeks
              Every  time  the  specified  period  elapses,  Tor  uploads  any
              rendezvous service descriptors to the directory  servers.   This
              information  is also uploaded whenever it changes.  (Default: 20
              minutes)

SIGNALS

       Tor catches the following signals:

       SIGTERM
              Tor will catch this, clean up and sync to disk if necessary, and
              exit.

       SIGINT Tor  clients  behave  as with SIGTERM; but Tor servers will do a
              controlled slow  shutdown,  closing  listeners  and  waiting  30
              seconds  before  exiting.  (The delay can be configured with the
              ShutdownWaitLength config option.)

       SIGHUP The signal instructs Tor to reload its configuration  (including
              closing and reopening logs), fetch a new directory, and kill and
              restart its helper processes if applicable.

       SIGUSR1
              Log statistics about current connections, past connections,  and
              throughput.

       SIGUSR2
              Switch  all  logs  to loglevel debug. You can go back to the old
              loglevels by sending a SIGHUP.

       SIGCHLD
              Tor receives this signal when one of its  helper  processes  has
              exited, so it can clean up.

       SIGPIPE
              Tor catches this signal and ignores it.

       SIGXFSZ
              If  this signal exists on your platform, Tor catches and ignores
              it.

FILES

       /etc/tor/torrc
              The configuration file, which contains "option value" pairs.

       /var/lib/tor/
              The tor process stores keys and other data here.

       DataDirectory/cached-status/*
              The most recently downloaded network status  document  for  each
              authority.  Each file holds one such document; the filenames are
              the hexadecimal  identity  key  fingerprints  of  the  directory
              authorities.

       DataDirectory/cached-routers and cached-routers.new
              These  files  hold downloaded router statuses.  Some routers may
              appear more than  once;  if  so,  the  most  recently  published
              descriptor  is used.  The ".new" file is an append-only journal;
              when it gets too large,  all  entries  are  merged  into  a  new
              cached-routers file.

       DataDirectory/state
              A set of persistent key-value mappings.  These are documented in
              the file.  These include:
            - The current entry guards and their status.
            - The current bandwidth accounting  values  (unused  so  far;  see
            below).
            - When the file was last written
            - What version of Tor generated the state file
            - A short history of bandwidth usage, as produced  in  the  router
            descriptors.

       DataDirectory/bw_accounting
              Used to track bandwidth  accounting  values  (when  the  current
              period  starts  and  ends; how much has been read and written so
              far this period).  This file is obsolete, and the  data  is  now
              stored  in  the  ’state’ file as well.  Only used when bandwidth
              accounting is enabled.

       DataDirectory/control_auth_cookie
              Used for cookie authentication with the controller.  Regenerated
              on  startup.   See control-spec.txt for details.  Only used when
              cookie authentication is enabled.

       DataDirectory/keys/*
              Only used by servers.  Holds identity keys and onion keys.

       DataDirectory/fingerprint
              Only used by servers.  Holds the  fingerprint  of  the  server’s
              identity key.

       DataDirectory/approved-routers
              Only   for   naming   authoritative   directory   servers   (see
              NamingAuthoritativeDirectory).   This  file  lists  nickname  to
              identity bindings.  Each line lists a nickname and a fingerprint
              separated by whitespace.   See  your  fingerprint  file  in  the
              DataDirectory  for  an example line.  If the nickname is !reject
              then descriptors  from  the  given  identity  (fingerprint)  are
              rejected  by this server. If it is !invalid then descriptors are
              accepted but marked in the directory as not valid, that is,  not
              recommended.

       HiddenServiceDirectory/hostname
              The  <base32-encoded-fingerprint>.onion  domain  name  for  this
              hidden service.

       HiddenServiceDirectory/private_key
              The private key for this hidden service.

BUGS

       Plenty, probably. Tor is still in development. Please report them.

AUTHORS

       Roger Dingledine <arma@mit.edu>, Nick Mathewson <nickm@alum.mit.edu>.

http://uscyberlabs.com/blog/wp-content/uploads/2012/09/26_tor_rendezvous-copy-300x145.png

07/11/12

CyberPeace -not- CyberWar

gAtO sEe - In the last couple of days Gen. Keith Alexander has been pushing the Cyber War agenda. -The issues around warfare are very different in cyberspace than in the physical world, and the United States is looking into “alternative strategies,” said Alexander, while not offering further details. In another place he was telling us that the CIA will not use the new cyber laws to spy on our email. Ok so you gonna be a sheep and follow the word of the government. We won’t spy on you.

Alexander said “civil liberties and privacy can work harmoniously with cybersecurity”. Come on General your a nice guy, gAtO met you —/ you have a passion but every time you bring out —/ Oops there went the Power Grid, Oops.. there went the financial sector, scare me, scare me. I know it’s your job to secure our country to protect our nation cyber infrastructure. Don’t trample on our cyber right any more please.

Hay here is a solution for you use a Tor-.onion network-(any anonymized network) to tie your power grid, and/or your financial services. If you can’t close down Silk Road in onion-land your C&C for your power grid and financial services should be invisible to everyone except on a need to know. gAtO just save you 14 trillion in R&D…//

gAtO has not heard one word about Cyber Peace from any responsible government in the world. Everyone is looking for their own cyber posture, their own cyber weapons/ budget/ programs/ money// , but not one has said let’s work together to make it better for peace, guess there is no money in Cyber Peace. Espionage, spying is the job of governments why would they destroy their own tools, weapons and just tweak our cyber-rights a wee bit, for our cyber freedoms and safety, to protect our government and you -lol.

Here is a simple idea crowd-source our problems. The one major resource in cyber-space is number of people that can see the same message. In crowd-source we can give the facts and ask anyone to help solve city budgets, ways to harvest more vegetable/per vertical/ sq.ft. Ask people how would you protect our electric grid // you be surprised by the creative answers you get, OK some may be crazy but…//. It may not be the right solution, but the power of the minds of people collaborating is what this new technology is built for. FaceBook is about ME- Twitter is about the rest of the world- but the new winner is —/ Comments /— have become more important than the article-subject itself because the conversation within in the comments shows social communication and problem solving by the masses.

Let’s change the message to CyberPeace, everyone has a solution, but remember that all your comments are the new gold so watch what you say to that troll on huffpost— gAtO oUt

06/5/12

Iran Cyber Problems -bad antivirus software

Iran Cyber Problems

gAtO mOnItOrEd – Iran Tor-Relays last night they had blocked all public relays so nobody could use the ToR network. Of course as long as you have private unlisted ToR relay people from Iran could still use the ToR network on the Internet. On the other side of Iran’s Cyber Warfare the Flame cyber worm – is still kicking ass and taking names in Iran. U.S and Israel have accepted the role of chief cyber warrior of the Stuxnet, DuQu and Flame. Some of the first cyber weapons ever made and deployed on a covert mission’s. Do you think that this cyber weapons did not use ToR networks to hide their C&C server never to be found??? So here we have a country suppressing ToR communication (and suppressing Flame, DuQu and StuxNet C&C ToR Communication) and being attacked by 2 of the largest countries in the world. gAtO would call this cyber warfare.

cyber war profiteers –> Who stands to make the most business ($$$) in this cyber warfare. We in the west have Norton, McAfee and other’s to protect our computers and business and government computer enterprise systems – but they cannot do business with Iran- We just had Symantec pull out of a deal with China’s Huawei because of a U.S-DOD contracts-/ a friend pointed to eset.com as the number one anti-virus software distributor to Iran./ When the Iranian government want’s to protect their computers they turn to Eset corporation for their enterprise cyber security support and service. So who are they?

Alexa the number one SEO company – http://www.alexa.com/siteinfo/eset.com – shows Iran is their number one customer—. Why? Eset is based out of the Slovak Republic , Bratislava the capital of Slovakia. It’s not silicone valley – I never heard of a high tech center and educated cyber security experts from that side of the world— We know this area more for cyber criminals but now this little company out in the middle of know-where has some interesting customer. Those countries that nobody wants are becoming their cyber customers, and it looks like Eset is a growing business.

Eset – Contact info: – http://www.eset.com/us/about/contact/ – They have offices in Czech Republic, Singapore, Argentina and the U.S.A – —/$#@! – So the company that is providing the anti-virus software for Iran has offices in America, with American business as customers- gAtO don’t like that much that is why I mentioned it.

Anti-virus software controls every aspect of the safety and security of your computer, your anti-virus software has deep ties to your computers. So this little anti-virus company is now a world player. It could also be our allied and work with us.

From a business point of view – First of all I would fire them. If I was the Iranian government, Stuxnet, DuQu and Flame the same MO and my anti-virus software does not catch it -new business but, oh well if Iran fires them who else would step into this position. This show to gAtO that the old weapon dealers have turn to legit, cyber counter weapons dealers/

customers metric’s: Imagine the statistics from Eset on Iranian government sites?

As a security researcher I just don’t like that Eset is in the U.S.A if they get American customers they can maybe sell their stats to Iran. Security companies like anti-virus have a lot of power. Just a simple update and the new spy-ware can get in and turn on your camera or just record your speech in your house or office. I would stay away from Eset anti-virus software solution – just for me gAtO oUt…

Reference:

Iran Top Sites : http://www.alexa.com/topsites/countries;0/IR

Bratislava: http://en.wikipedia.org/wiki/Bratislava

Alexa-Eset – http://www.alexa.com/siteinfo/eset.com

Eset about page - http://www.eset.com/us/about/contact/ .

WhoIs - http://whois.domaintools.com/eset.com

Registrant:

ESET, spol. s r.o.

Peter Pasko

Einsteinova 24 Aupark Tower, 16th Floor

Bratislava, 85101

Phone: +421.232244111

Email: sysadmin@eset.com

Registrar Name….: Register.com

Registrar Whois…: whois.register.com

Registrar Homepage: www.register.com

Domain Name: eset.com

Created on…………..: 2001-04-18

Expires on…………..: 2013-04-18

Administrative Contact:

ESET, spol. s r.o.

Anton Zajac

610 W Ash St, Ste 1900 Suite 1900

San Diego, CA 92101

Phone: +1.6198765404

Email: sysadmin@eset.com

Technical Contact:

ESET, spol. s r.o.

Anton Zajac

610 W Ash St Suite 1900

San Diego, CA 92101

Phone: +1.6198765404

Email: sysadmin@eset.com

DNS Servers:

e.ns.lanechange.info

ns4.lanechange.net

ns2.lanechange.net

ns3.lanechange.net

ns1.lanechange.net

http://uscyberlabs.com/blog/wp-content/uploads/2012/06/eset_traffic.tiff

04/6/12

Supply Chain Cyber Attack

gATO rEaDiNg - 2012 Maindiant “An Evolving Threat” and Trend-Micro LuckyCat ReDux reports. Great reading for any security geek but most important it’s about the business side of the hack. Take the old smash and grab of financial information and split town, process the financial windfall and party like it’s 2999. Now it’s more beneficial for the criminals to stay inside the victims servers and collect intelligence and espionage. Ok let the gAtO break it down for you, not as a criminal that’s easy, as a state actor I would go after AeroSpace, Energy, Shipping, Military Research, Engineering, India and Tibetan Activist… Wait a minute a India, a Tibetan Activist group, oh yeah you know it’s China but this is to be expected from China. Now the new spin is why would they go into a banks and use advanced persistent threats (APTs) hacks, well as gAtO understands it the Chinese have a shit load of MONEY— follow the money is not only an american thing it’s for every player in the world.

We have to look at the data through 3 different set of eye’s (magnifying glass with gAtO’s old EyE’s) but it’s still the same – Your data (ALL- your little company secrets) needs protection.

Here is the Score-Card your Business — versus – Competition, Government, Criminals, Hacktavist, Economic Espionage, Nuisance Hackers. On top of all this 94% of victims were notified by an external entity that they were hacked. If that doesn’t send chills down every board member in every company in the world, nothing does.

Here you are doing your business and let’s be frank some business well they walk a thin line sometimes like dumping medical and radioactive waste on a beach in New Jersey ( I know Snooki lives there) . IS your company maybe polluting the ground water for a 100 mile radius of the plant. This is not the information that they want hackers, or the press to get a hold of. “Remmember Rudolf Murdock News Hacking Empire- hey hack anyone for a buck”

Protect Customer Data yeah companies and governments want to protect it, but their little illegal/legal stuff companies do like hiding the report of the of shore oil well that just blew up and spilled all kinds of stuff all over the Gulf coast. These are the real thing that keep business people up at night worrying about hackers, it’s plain and simple cover your ass and let’s get that no bid government contract after we pay off the senator and we better encrypt that information…..

Hackers come in all flavors but if you look at the LuckyCat crewz these are very unique. Not only real computer scientist but marketing campaign and project management. They dual tier C&C (Command and Control), they use the victims supply chain to move laterally across trusted networks in order to be more invisible. Invisible takes a new trend here these hacker hide their code in plain site, they used older malware as insertion points sometimes and of course social engineering to gain access.

Bottom line these new hackers- they are business-men, -they are governments, -they are commercial criminals, -they are hacktivist or -they are a lone wolf hacker. Companies are finally getting the message. Protect your data, not just your customer’s data, but all your little secrets because if your online– someone is watching you and these can be a 15 year old kid or a Dual Master degree in computer technology that is unemployed or works for a government. Trust but verify takes on a new meaning now -gAtO oUt

lab notes - The report, which is based on hundreds of advanced threat investigations conducted over the past year, includes analysis, statistics and case studies that highlight how advanced and motivated attackers are stealing sensitive intellectual property and financial assets.

Malware Only Tells Half of the Story Organizations’ investments in malware detection and antivirus capabilities, while effective in detecting characteristics associated with common worms, botnets, and drive-by downloads, do little to help defend against targeted intrusions.

The use of these publicly available tools has added some complexity to identifying threat actors because when organizations identify a piece of publicly available malware they often cleanse the file and — in the process — obscure what could be a larger incident.

It’s unclear why banks wouldn’t already be looking for unusual settlement activity and conducting daily monitoring, but there it is. At any rate, “high-risk” merchants generally handle the dicey and vicey types of online commerce, such as Internet gaming, adult Web sites, rogue anti-virus software sales and online pharmacies. Might be a good idea to keep an extra close eye out for these types of unauthorized charges over the next few days

http://uscyberlabs.com/blog/wp-content/uploads/2012/04/lab_image_mignify_glass-300x62.png

10/20/11

Cyber Threat Intelligence Research

Threat Intelligence -

http://www.us-cert.gov/cas/signup.html#other

Predict, Prepare, Prevent -Respond, Investigate

The Cyber Threat - Using Intelligence to Predict and Prevent

Identity and Access Management

people, processes and systems that are used to manage access to enterprise resources – Audit logs of activity such as successful and failed authentication and access attempts should be kept

Data Loss Prevention

monitoring, protecting and verifying the security of data -

Web Security

software/appliance installation or via the cloud by proxying or redirecting web traffic to the cloud provider – Policy rules around the types of web access and the times this is acceptable also can be enforced

E-mail Security

control over inbound and outbound e-mail – Digital signatures enabling identification and non-repudiation – policy-based encryption of e-mails

Security Assessments

security assessments for infrastructure and applications and compliance audits are well defined and supported by multiple standards such as NIST, ISO and CIS

Intrusion Management

real time to stop/prevent an intrusion. The methods of intrusion detection, prevention and response in physical environments

creating new targets for intrusion and raises many questions about the implementation of the same protection in cloud environments.

Security Information and Event Management

systems accept log and event information. This information is then correlated and analyzed to provide real-time reporting

Encryption

manage encryption and decryption, hashing, digital signatures, certificate generation and renewal and key exchange.

Business Continuity and Disaster Recovery

including those caused by natural or man-made disasters or disruptions. Cloud-centric business continuity and disaster recovery

Network Security

In a cloud/virtual environment, network security is likely to be provided by virtual devices alongside traditional physical devices.

Security

consists of security services that allocate access, distribute, monitor and protect the underlying resource services. Architecturally,

Some useful sites –

McAfee threat Intelligence Visualization Tool

- http://www.mcafee.com/us/mcafee-labs/threat-intelligence.aspx

FREE: This Tool is a must have for any Cyber Itelligence Team.

Asides from the custom search for most vulnerabilities it is updated from Computer World, InfoWorld, SANS Internet Storm Center & USCERT all the current activity feeds LIVE & FREE.

Malware Live Feed

Popular Domain – Attacked Live Feed

Popular Applications – Attacked Live Feed

Top Intrusion Attackers – the IP address of the Attackers ***Live Feed

Top Intrusion Attacks – Live Feed

Top Spam Senders – Ip address of spammers -Live Feed

Recent Vulnerabilities – Number of NEW Vulnerabilities (Monthly/Year) Live Feed

Cyber Threat Intelligence Coordinating Group (CTICG)

Since its establishment, the Multi-State Information Sharing and Analysis Center (MS-ISAC) — which serves as the central cyber security resource for our nation’s state, local, territorial and tribal governments — recognized the need for collaboration with physical security partners and actively pursued a collaborative relationship with physical security partners within the states — including homeland security directors and law enforcement–many of whom participate in the MS-ISAC.

http://msisac.cisecurity.org/partners/cticg.cfm

Financial Service Cyber Dashboard

http://www.fsisac.com/ – Financial Service – Information Sharing and Analysis -Center

fsisac alert level

Pasted Graphic 1.tiff Pasted Graphic 2.tiff Current Financial Services Sector Threat Levels:

http://www.isaccouncil.org/

National Vulnerability Database CVSS Scoring

Pasted Graphic 3.tiff

http://nvd.nist.gov/

Pasted Graphic 4.tiff Computer Crime & Intellectual Property Section

United States Department of Justice

cybercrime.gov

Federal Network Security

The Federal Network Security (FNS) Branch collaborates across the federal government to enhance the nation’s cybersecurity posture by:

Identifying common requirements across the federal government
Collaborating with components of the federal enterprise to identify solutions
Implementing policy and technical solutions
Monitoring the effectiveness of implemented solutions

DHS | Federal Network Security

Report Incidents 911 -

Control Systems Security Program (CSSP)

US-CERT: Control Systems – Training

Pasted Graphic 5.tiff http://www.us-cert.gov/control_systems/satool.html

Report Incidents 911 -The Internet Crime Complaint Center (IC3) is a medium through which you can report any cyber-related violations.

Below is a link to their website where you can find details about the organization, as well as instructions about filing a complaint and reporting a crime.

Therefore, if you feel you have been the victim of a cyber crime, please report the incident to IC3.

IC3’s website can be found here: http://www.ic3.gov/default.aspx

Predict, Prepare, Prevent -Respond, Investigate

Sample Leading Practices for a Cyber Threat Intelligence Function

Organization

Resources dedicated toward reviewing and analyzing
emerging threats.
Annual budget for security control upgrades, new
detection tools, and intelligence sources.
Cyber command center

MalwareForensicCapability

Ability to rapidly collect and review forensic
information from devices that are suspect.

AllSourceIntelFusion

Automated, monitored, incremental feeds with aging
algorithm.
Two-way, cross-industry intelligence sharing.
Contingency plans for loss of intelligence sources.

ThreatModeling

Capability to model and analyze the likelihood that an
emerging threat will impact an organization and identify
where the weaknesses are that will be exposed.

ResearchandDevelopment

Threat intelligence teams should work in conjunction with
internal security teams to identify new strategies and
solutions for testing and improving the security posture of

Process

Daily regimen to review and communicate emerging
threat data.
Threat matrix
Scenario planning

PerimeterMonitoring

Network extrusion monitoring
Network conversation recording and reconstruction

MetricsandReporting

Regular cyber bulletin updates.
Threat briefings by line of business / delivery channel
Automated custom alerting based on thresholds

ThreatLifecycleManagement

Case management tools to coordinate cyber incidents
across multiple business areas and suppor organizations.

SupportingCapabilities

Patch management
Configuration management
customer devices and banking applications.

webkit-fake-url://FC1E720F-22D1-4B9F-95BF-750E128125AE/Pasted%20Graphic%202.tiff

10/12/11

Cyber War’s of (1) One and (0) Zero’s | Cyber Attacks Timeline Sept. 2011

Cyber War’s of (1) One and (0) Zero’s.

In the last week so far, hackers hit the NYSE (New York Stock Exchange), and we find out that hackers hit unmanned drones flying covert and military operations around the world. The U.S has resisted all attempts till now to internationalize treaties on cyberspace. Below are some of the major attacks from September alone. USCyberLabs was one of the sites getting hacked via the InMotion attack by Tiger-M@te. Were am I going with all this, well let start with the cyber attacks in September-2011 I outlined them in red on the timeline below, these are all attacks going after governments.

Who knew that “The Arab Spring”, “LulzSec” and “Occupy Wall Street” all have a unify message. Were sick and tired, you had your chance now it’s ours.

Useful Resources for compiling the table include:

Cyber War News (but it looks like it gave up to post reports on Cyber Attacks on 25 September 2011)
~~CNET Hackers Chart~~ (unfortunately it is not up-to-date since 24 August 2011).
DATALOSSdb
Dark Reading
Naked Security
Office Of Inadequate Security (DataBreaches.net)
The Hacker News

My inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.

http://paulsparrows.wordpress.com/2011/10/02/september-2011-cyber-attacks-timeline-part-ii/

Update: On 09/30/2011, Betfair reported a 3.15 million records breach with a total estimated cost of 1.3 billion USD winning the laurel wreath of the most expensive breach of the month.

Date	Author	Description	Organization	Attack
Sep 16		Websites of several Mexican government ministriesAs part of OpIndipendencia, websites of several Mexican government ministries, including Defense and Public Security, are teared down in the same day of the symbolic beginning of Mexico’s independence from Spain.		DDoS
Sep 16	Mikster	Clubmusic.comClubmusic.com, a worldwide dj website. is hacked and the leak dumped on pastebin.		SQLi
Sep 16	Sec Indi Security Team	Official Website of The United States Navy An hacker crew called Sec Indi Security Team Hacker uploads a custom message on the server to warn a WebDav vulnerability.		WebDav Vulnerabilty
Sep 16	?	California State Assembly More than 50 employees of the California State Assemby, including some lawmakers, have been warned that their personal information might have been obtained by a computer hacker.		?
Sep 17	?	Intelligence And National Security Alliance Names and email addresses of hundreds of U.S. intelligence officials have been posted on an anti-secrecy website. On Monday Sep 10 INSA published a major report warning of an urgent need for cyberdefenses. Within a couple of days, in apparent retaliation, INSA’s “secure” computer system was hacked and the entire 3,000-person membership posted on the Cryptome.org website		N/A
Sep 17	?	Fake FBI Anonymous Report A Fake FBI Psychological profile of the Anonymous group is published. Although not a direct cyber attack, this event can be considered an example of psychological hacking and a “sign of the times” of how information and counter information may play a crucial role in hacking.		SQLi?
Sep 18		Texas Police Anonymous/Anti-sec releases a documentcontaining a list of about 3300 members of the Texas Police Association		N/A
Sep 19	?	Mitsubishi Heavy IndustriesMitsubishi Heavy Industries, Japan’s biggest defense contractor, has revealed that it suffered a hacker attack in August that caused some of its networks to be infected by malware. According to the firm, 45 network servers and 38 PCs became infected with malware at ten facilities across Japan. The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles.		APT
Sep 19		City Of Rennes TeaMp0isoN takes responsibly to hack the official website of The City Of Rennes (France) via a tweet. They also publish the reason of hack on the defacement page.		Defacement
Sep 19	?	Hana SK Hana SK Card Co., a South Korean credit card firm, announces that Sep 17, some 200 of its customers’ personal information has been leaked. Total cost of the breach is $42,800.	Hana SK Card	SQLi?
Sep 20	?	Former USSR Region Source report that at least 50 victim organizations ranging from government ministries and agencies, diplomatic missions, research institutions, and commercial entities have been hit in the former Soviet Union region and other countries in an apparent industrial espionage campaign that has been going on at least since August 2010.The advanced persistent threat (APT)-type attacks — dubbed “Lurid” after the Trojan malware family being used in it — has infected some 1,465 computers in 61 countries with more than 300 targeted attacks.		APT
Sep 20	Shad0w	Fox Sports Website Fox Sports website, on of the most visited Websites in the world (rank 590 in Alexa) gets hacked. An Hacker named “Shad0w” releases SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked database info posted on pastebin.Vulnerable link is also posted together admin password hashes.		SQLi?
Sep 22		Core Security Technologies Another security Firm target of hacking: Core Security Technologies is hacked by an hacker called Snc0pe, who defaces some websites belonging to the firm. Mirror of the hack can be seen here.		N/A
Sep 24	?	UKChatterboxPopular IRC service UKChatterbox advises users to change their passwords following a series of hacks which culminated in an attack that may have compromised user details. The password reset follows on from a succession of outages previouslyattributed to maintenance upgrades, back to the start of the summer. In a notice to users, UKChatterbox advises users to change their passwords and not to re-use them on other sites. The number of hacked account is unknown.		N/A
Sep 25		Seven Major Syrian Cities and Government Web Sites The Anonymous unleash a chain of defacement actions against the Syrian Government, hacking and defacing the official sites of seven major Syrian cities, which stayed up in their defaced version for more than 16 hours. The defacement actions kept on the following day in which 11 Syrian Government Sites were defaced as part of the same operation.		Defacement
Sep 25	?	Indira Gandhi International AirportAlthough happened three months ago, it turns out that a ‘technical snag’ hittinh operations at the Indira Gandhi International Airport (IGIA) T3 Terminal was caused by a “malicious code” sent from a remote location to breach the security at the airport.		APT
Sep 26		Inmotion Hosting Server 700,000 websites hosted on InMotion Hosting network are hacked by TiGER-M@TE. The hackers copied over the index.php in many directories (public_html, wp-admin), deleted images directory and added index.php files where not needed. List of all hacked 700,000 sites here.		Defacement
Sep 26		Austrian Police The Austrian Anonymous branch publishes the names and addresses of nearly 25,000 police officials, raising fears for officers’ personal security. An Austrian Interior ministry spokesman said the information came from an “association closely related with the police”. Estimated cost of the breach is around $ 5,400,000.		SQLi?
Sep 26		USA Today Twitter AccountThe USA Today Twitter account is hacked and starts to tweet false messages mentioning the other accounts hacked by the authors of the action: the Script Kiddies (already in the spotlight for hacking the FoxNews Twitter Account at the Eve of 9/11 anniversary)		Account Hacking
Sep 26	?	MySQL.comMySQL.com website is struck by cybercriminals, who hacked their way in to serve up malicious code to visiting computers with a Java exploit that downloaded and executed malicious code on visiting Windows computers. Brian Krebs reportsthat just few days before, he noticed on a Russian underground website that a hacker was offering to sell admin rights to MySQL.com for $3000. MySQL.com receives almost 12 million visitors a month (nearly 400,000 a day).		Java Exploit to install malware
Sep 26		Harvard University In retaliation for the defacements performed by the Anonymous targeting Syria, Syrian Electronic Soldiers deface the website of the prestigious Harvard University. The same group came in the spotlight during July and August for defacing Anonoplus engaging a “de facto” cyberwar against The Anonymous.		Defacement
Sep 26	?	#Occupywallstreet The month of September is characterized by theOccupyWallStreet Operation, started on September, the 17th and still ongoing. Although not directly configurable as an hacking action, it may rely on the support of the Anonymous who “doxed” a senior police who controversially usec pepper spray against a group of female protesters.		N/A
Sep 27		COGEL, Council On Governmental Ethical Law Once again in this month,Snc0pe claims another resounding action. This time the alleged target is the official website of The Council on Governmental Ethics Laws (COGEL). He posts a message onpastebin, along with the database download link.		SQLi?
Sep 28		Tiroler Gebietskrankenkasse (TGKK) AnonAustria in the spotlight again after the resounding hack against Austrian Police. This time the victim is an health insurance firm Tiroler Gebietskrankenkasse (TGKK) whose database of some 600,475 medical records AnonAustria claims to have hacked. The databse includes some celebrities. The total cost of the breach is around $128,500,000.00.		SQLi?
Sep 29	?	SAIC (Science Applications International Corp.) SAIC, one of the Pentagon‘s largest contractors reveals to have discovered a data breach occurred a couple of weeks before, affecting as many as 4.9 million patients who have received care from military facilities in San Antonio since 1992. The breach involved backup computer tapes from an electronic health care record. Some of the information included Social Security numbers, addresses, phone numbers and private health information for patients in 10 states. Statement of the data breach here Estimated cost of the breach is around $ 1 billion.		Car Burglary
Sep 30	?	Laptop Virus RepairAlthough not resounding as the one which targeted MySQL.com, here it is another example of a website infected with malicious code targeting a free antivirus cloud based service.	Laptop Virus Repair	Malicious Code
Sep 30	?	BetfairBetfair reports a leak including not only the payment card details of most of its customers but also “3.15m account usernames with encrypted security questions”, “2.9m usernames with one or more addresses” and “89,744 account usernames with bank account details”. The incident occurred on 14 March 2011 but was announced only 18 months later. Estimated cost of the breach is around $1.3 billion.		?

Reference:

http://newsclick.in/international/wars-21st-century-drones-cyber-wars

http://paulsparrows.wordpress.com/2011/10/02/september-2011-cyber-attacks-timeline-part-ii/

what else —

http://paulsparrows.files.wordpress.com/2011/08/anonymous.png?w=45&h=45

09/25/11

Are Cyber Security and IT Security Different | Information Security – Information Assurance – Computer Security

Are Cyber Security and IT Security the same?

IT teams were the gatekeepers way back when, but now that’s becoming more convoluted. As more and more countries and corporations become digitized into the fold of cyberspace their vulnerabilities increase more and more. As this happens more information is mistakenly made available and this is were it becomes dangerously for some companies and Nations. We all know today Bit and Bytes Can Be As Destructive As Bullets and Bombs. It’s not just the physical ties to cyberspace, it’s information warfare where the real action is taking place. Financial and intellectual warfare can be just as deadly as physical warfare, it can destroy companies, take jobs away and the damage can have repercussion around the world.

Take Facebook and twitter these 2 little toy’s are ransacking corporate security. The way some of these new technology are mixed in the technology landscape, it has given most IT and security folks a headache. No Twitter at work. No Facebook at work. Why not? As the integration of Twitter, Facebook and other web apps come together on a desktop or server it can opens up the door to security, how can corporation be safe. The two biggest surprise cyber hacks were Wikileaks and Stuxnet, both insiders providing a mechanism for dissemination of information and physical destruction on a new level. One was information that can devastate the reputation of a country and the other a trojan virus that took physical control of equipment and destroyed them. What scares me is, it was the Natanz Nuclear facility plant, what if something went wrong and it trigger a nuclear explosion, that’s what makes cyberspace so dangerous today.

So how can and IT department handle IT physical security, cyber security and deal with cyber warfare all in one place. Is the tech-support person that fixes my PC also in charge of deciding what part of my business to protect. Will the tech-support person make business decision on what is needed for business continuity.

Let take a look at security in todays cyber world. The definition of Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction. Information assurance (IA) is the practice of managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes.

How can a typical IT team handle all these requirements under one umbrella?

Let’s talk Security Models- Information Security – Information Assurance – Computer Security. Here are 3 different security frameworks that apply to everyone. They all have the basic components - confidentiality, integrity, availability, accountability and assurance let’s add another layer to this framework Hardware, BIOS, (NOS)Network Operating System, Desktop Operating System (Windows,Mac, Linux) security, Access Control, Commercial Application Security (DB, CRM, SFA), In-house Developed Application (.net, java, c++) Security.

All these component apply to the 3 security models but Information Assurance adds risk assessment to this mix. Add a connection to cyberspace and the transmission of information were you need encryption on both ends, and you can see the complexity and why you need so many levels to secure a network. One weak link in your security solution and your hacked.

This is not a complete list because in some industries like banking and social aware companies you may need to add an intelligence cyber teams. They look at the chatter and look for zero(day) exploits and such, political and hacktivist may come after you for your politics positions, so once again you need to listen to cyber chatter but of a different type. You may need to go after the attackers then you need cyber forensic teams to tell you who the bad guy are and a team to go after the bad guys. Let’s not forget a red team (penetration testers) that test your networks.

As we can see an IT team cannot do everything and a cyber team cannot do everything. You need them both. Someone told me the webmaster handles security, big mistake. Another friend told me we have spam filters on our email system, so were protected. These companies will get hacked soon, they do not have the big picture of all the components and framework of a good security posture. The last and most important is a security mindset for everyone in the company. If a security mindset is established, it’s the first step in being secure. In conclusion IT and Cyber security need many minds and many hands. If you don’t want to get hacked, simple un-connect form cyberspace and you may have a chance, but remember even in a secure network the insider threat they can get you in the end.

http://USCyberLabs.com/blog/

http://cyber.uscyberlabs.com

http://ChinaCyberWarfare.wordpress.com

http://HacktivistBlog.wordpress.com/

http://uscyberlabs.com/blog/wp-content/uploads/2011/09/Network_Attacks_02-300x170.png

09/22/11

Cyber China Spy Threat | Cyber Espionage and Influence

China’s growing spy threat is a great article. It points to everything I have said before.

The top priority of Chinese

• Industrial espionage aimed at defense industry and high tech sectors

• Infiltration of critical infrastructure and military targets

• Nexus of organized cybercrime and terrorist fundraising

• Monitoring and Disrupting Dissidents

We need to understand the Chinese government mindset to understand them, paranoia, saving face and economic these are the 3 pillars of the new communism in China. Let’s start with paranoia. One of China’s prime paranoia, lack of trust of anything not created in China it must have back doors. Look at all the discussion on the Chinese company Huawei, installing back doors in our telecom infrastructure. We did it to them and now they’re paying us back. The Chinese know they are putting backdoors in our electronics because they can, they own our manufacturing. China worked very hard in creating kylin (Unix). They have to use Microsoft because some applications only run on it but it’s too easy to hack and “made in America” didn’t make them happy. This is why Google left; they refuse to give the Chinese the keys to the code.

On the same paranoia crazy train. One of the top priorities of Chinese espionage efforts—foreign and domestic—is monitoring and disrupting dissidents, according to defectors, experts, and official documents.

Anyone who talks bad about China will pay the price, monitoring, I’m currently on there radar (popular posts, referrers and keywords stats on my blogs & sudden twitter followers, say so much) and so is everyone who write about China especially cyber security.

Let’s talk economics. China has been looked at as a source of cheap labor only, they don’t want our breadcrumbs, they want to become leaders not followers and I can’t blame them. As a nation I want to be seen as a leader in Technology, in Finance not the errand boy of the west. (Saving face). The facts are that the last 10 years China has been using it’s money wisely investing in companies around the world (influence), while America has been bombing people all over the world. They create new alliances we destroy our alliance with drone planes. And to top it off they are going after our political elite. According to experts, China uses bribes, blackmail, women, lavish vacations in China, and other means to compromise officials worldwide. I just wrote about this about our current presidential front runner Rick Perry in bed with the Chinese companies – Huawei just opened it’s door in Texas and so did 12 other Chinese corporations, what do you think there doing in the U.S.( http://uscyberlabs.com/blog/2011/09/11/cyber-warfare-rick-perry-mitt-romney-opening-u-s-cyber-infrastructure-china-huawei/).

Sorry I just had to put down these words after reading the article.

Time to get down of the soapbox.

USCyberLabs

Cyber Security Notebook

Category Archives: cyber-command

White Hat Bot-Nets

The deep Dark Web -Book Release

AVAILABLE @ AMAZON - http://www.amazon.com/dp/B009VN40DU

Tor Command syntax

NAME

SYNOPSIS

DESCRIPTION

OPTIONS

CLIENT OPTIONS

DIRECTORY SERVER OPTIONS

HIDDEN SERVICE OPTIONS

SIGNALS

FILES

SEE ALSO

BUGS

AUTHORS

CyberPeace -not- CyberWar

Iran Cyber Problems -bad antivirus software

Cyber Threat Intelligence Research

Threat Intelligence -

Some useful sites –

Cyber War’s of (1) One and (0) Zero’s | Cyber Attacks Timeline Sept. 2011

Are Cyber Security and IT Security Different | Information Security – Information Assurance – Computer Security

Cyber China Spy Threat | Cyber Espionage and Influence

June 2013
M	T	W	T	F	S	S
« May
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30