Silicon Safari Inc – Security Announcements

Tor, an anonymous network framework, is used to secure anonymity, through a process known as “onion routing.” Simply put, Tor is composed of nodes operated by many individuals, in which the traffic from the start point (your computer), travels over an encrypted network in an anonymous way. Each operator of a Tor network node, does not know where the original traffic comes from or where the original traffic is destined to go. The exception, is the exit point- it knows BOTH origin and destination address in order properly route the traffic to and from your computer.

In an normal internet configuration (non-anonymous), traffic is routed through many nodes that are EXPECTED to NOT sniff traffic. Unfortunately, we all know from the US/ATT law suit, this is NOT the case. In the case of ATT, a huge facility was used to add a network shunt to siphon off and inspect all traffic through a major Point of Presence. With Tor, an exit-node’s traffic can be inspected in a similar way, but a normal PC can be used to inspect the traffic. So, if you have a problem with your traffic possibly being sniffed for content, then it is imperative you know this when you use Tor. Anyone, can operate an exit node… any Government, Business or individual…. meaning anyone can sniff the traffic if they setup an exit node.

Makes you think, eh? Tor anonymizes traffic, and protects the content in transit TO THE EXIT POINT, but traffic from the EXIT point to the DESTINATION point is only as good as it would be without Tor. If you don’t use SSL in your transaction to the DESTINATION point, then the traffic is NOT encrypted to the DESTINATION point. ALWAYS USE ENCRYPTION! DEMAND IT FROM YOU PROVIDERS. Myspace, Stickam, etc. all have UNENCRYPTED passwords!

The simple lesson is, Tor does a good job of protecting your anonymity, but there are precautions that you need to take as to maximize its effectiveness. It is important to understand how Tor works, so check out the documentation and FAQ.

Without taking the necessary precautions or used properly, Tor can actually LESSEN your secure posture. As shown above, one great point of concern is knowing that the traffic from the exit-point node to the destination is NOT encrypted. IF you can’t guaranty encrypted username/password traffic (for instance, almost all social network sites), then DO NOT direct that traffic over ANY anonymous network. It is simple to sniff “anonymous network” exit-node traffic and easily harvest unencrypted information and therefore compromise your information.

Remember, ALL unencrypted traffic can be easily inspected so even if your encrypted username/passwords are not compromised, other content can be inspected. Your web-mail provider which may encrypt the username/password traffic, may NOT encrypt the message traffic (most likely!). This means your messages and cookies etc, are exposed to specific inspection. Bad Bad Bad Bad!!!! This shows the necessity for ubiquitous encryption of ALL data!

This article is an example of education and understanding in action, where the lack of it on the good guys part, and the know how on the bad guys part, leads to disastrous results. As a side note, the “bad guy” in this example “is a ‘good guy’ that means well”, but the Swedish authorities didnt view it that way, so the results are also “bad for him” as well… read on and you will understand why.

One of the most important aspects of security is education. Technology can help tremendously in security, but it can’t solve every problem. Unfortunately, there is no silver bullet solution… but there are toolkits- Guardian Angel Linux being one of them. If you outfit yourself with the proper tools, you will be better protected and capable of dealing with problems that arise. Remember though, the security playing field and game is ever changing, so education is key to keeping the bad guys at bay. A fully integrated environment that is simple to use allows use of powerful technologies that guard your valuables, but it is knowledge that allows you to use it all properly.

Social engineering and fraudulent actions continue to penetrate into peoples lives every day. The cyber-villains are continuously pounding at the firewalls and security mechanisms we put in place to protect ourselves. They even use gentle methods like email attachments (which you sometimes happily accept) as well as using exploits in applications, libraries, and websites. The bad guys use sophisticated technology too. They set up traps and scams and just wait for someone to make a mistake. The worst thing a person can do, is get lax in their view of security, but keeping a vigilant posture all the time can be quite tiring. The most common tasks of applying security patches, browser configurations, virus scans, spam filters, encryption, keeping up on news of new scams, are quite time consuming.

Make no mistake about it… every second, of every day, those who wish to do harm, try to overcome your defenses. It is what they do, it is their business and livelihood. Couple education, technology and an active plan to protect yourself. These are the ingredients to help keep your information and possessions safe. Education helps to keep you from doing things that can be exploited, helps you to have a better picture of the dangers and consequences of what negative actions are being planned against you, and helps you to recover in the event of a successful attack against you. Educating yourself about security is key to a safe digital-life experience.

The next few posts will be about Tor and understanding its use. Tor education is very important to understand since it helps to understand anonymous networking in general. Later posts will cover I2P, another similar technology that uses garlic routing.