Crypto activists announce vision for Tor exit relay in every library | Ars Technica
http://arstechnica.com/...5/07/crypto-activists-announce-vision-for-tor-exit-relay-in-every-library/

kazdopadne docela zajimavy dighest obcas: https://paper.li/...vacyCamp/1375765369?edition_id=2e996a30-380b-11e5-a22c-0cc47a0d164b#!tag-privacy

OVERDRIVE: Snort, já používal distribuci snorby

A byl jsem na přednášce od Invea-tech a jejich flow-mon, zajímavý, ale ne free pochopitelně.

QWWERTY: Muzes mit vic verzi, zkusil bych dogooglit jak je prepinat na zaklade appky, pripadne bysem asi virtualizoval a hodne ladil firewall

A new freeware version of Netwitness' core product, NetWitness Investigator, was made available today. I was able to get access to it several days ago for a test run. It looks and feels much like Wireshark, but with a lot more capability. The only two issues I found with the tool is that the registration process (required) is a bit quirky but eventually works, and you'll see a noticible drop in computer performance while its running. But considering that this is a sniffer on steroids I suspect that a performance drop is to be expected.

Here are notes from the NetWitness web site:

Product Features:

Captures raw packets live from most wired or wireless interfaces
Imports packets from any open-source, home-grown and commercial packet capture system (e.g. .pcap file import)
License supports 25 simultaneous 1GB captures - far exceeding data manipulation capabilities of packet tools like Wireshark
Real-time, patented layer 7 analytics
– Effectively analyze data starting from application layer entities like users, email, address, files , and actions.
– Infinite, free-form analysis paths
– Content starting points
– Patented port agnostic service identification
Extensive network and application layer filtering (e.g. MAC, IP, User, Keywords, Etc.)
IPv6 support
Full content search, with Regex support
Exports data in .pcap format
Bookmarking & history tracking
Integrated GeoIP for resolving IP addresses to city/county, supporting Google® Earth visualization
NEW! SSL Decryption (with server certificate)
NEW! Interactive time charts, and summary view
NEW! Interactive packet view and decode
NEW! Hash PCAP on Export
NEW! Enhanced content views

Minimum system requirements:
NetWitness recommends the following minimum hardware requirements for NetWitness Investigator:

Windows® XP, 2003 Server, or Vista 32-bit
Single 2Ghz Intel-based processor(Dual-core recommended)
1GB RAM(2GB Recommended)
1 Ethernet Port
Internet Explorer v7+ (IE v6.x may limit some functionality)
Ample data storage for collected data
Note: Linux infrastructure available in commercial versions

The fully functional and licensed free version of NetWitness Investigator is at: http://download.netwitness.com. We are interested in your comments if you've downloaded and tried this software. Please let us know via our contact form.

Marcus H. Sachs
Director, SANS Internet Storm Center

New Tool: NetWitness Investigator - SANS Internet Storm Center
https://isc.sans.edu/forums/diary/New+Tool+NetWitness+Investigator/5351/

heleho, google ma novy pop-up window:

A privacy reminder from Google

To be consistent with data protection laws, we're asking you to take a moment to review key points of Google's Privacy Policy. This isn't about a change we've made – it's just a chance to review the key points below. Click "I agree" to agree to the terms set out below and you will continue to Search; you can also explore other options on this page.
Data we process when you use Google

When you search for a restaurant on Google Maps or watch a video on YouTube, for example, we process information about that activity – including information like the video you watched, device IDs, IP addresses, cookie data and location.
We also process the kind of information described above when you use apps or sites that use Google services like ads, Analytics and the YouTube video player.

Why we process it

We process this data for the purposes described in our policy, including to:

Help our services deliver more useful, customised content such as more relevant search results;
Improve the quality of our services and develop new ones;
Deliver ads based on your interests, including things like searches you've done or videos you've watched on YouTube;
Improve security by protecting against fraud and abuse; and
Conduct analytics and measurement to understand how our services are used.

Combining data

We also combine data among our services and across your devices for these purposes. For example, we use data from trillions of search queries to build spell-correction models that we use across all of our services, and we combine data to alert you and other users to potential security risks.

Tip: If you sign in to your Google Account before agreeing, we'll remember your choice across all of your signed-in devices and browsers.

Mam prosbu, pozivate nejake intrusion detection systemy, scripty, binarky?
Pokud, tak jaky. Docela by me zajimalo, po cem koukat, nemam s tim skoro zadne zkousenosti. Nasel jsem zajimavou vec [firmu]: https://en.wikipedia.org/wiki/Netwitness coz jsou spis forenzi toolly, ale obecne me zajima ruzna forma IDS a forenze... Linky ocenim zvednutym placem ;]

Researchers mount successful attacks against Tor network—and show how to prevent them
http://phys.org/news/2015-07-mount-successful-tor-networkand.html

OVERDRIVE: no .. nejlepsi firemni ntb, kdy Java je nejvetsi bezpecnostni zlo a nemuzu ji updatovat, protoze pod tou novou nechodi firemni tooly :D

btw, doporucuju, kdyz uz mame hromadu 0day-u zejo:

Keep your Firefox healthy with a quick checkup — Mozilla
https://www.mozilla.org/en-US/plugincheck/

Tak jo, zeptej se na specifikaci, a pak si ji gogoogli, zejo.... [sorry, proste jsem se nechtene zeptal driv, nez jsem si nasel primarni zdroj] : http://arxiv.org/pdf/1507.05724v1.pdf

Predpokladam, ze lokalni osazenstvo zaznamenalo TOR v podani HORNET zejo?
Uz to je nekde nejak popsane podrobne [specifikace], pripadne existuje uz nejaka aplikace?

Researchers claim they’ve developed a better, faster #Tor

http://t.co/5uDpSzdj55

#hornet #security #privacy #toReadMore

msm1267 writes: Two Belgian security researchers from the University of Leuven have driven new nails into the coffin of the RC4 encryption algorithm. A published paper, expected to be delivered at the upcoming USENIX Security Symposium next month in Washington, D.C., describes new attacks against RC4 that allow an attacker to capture a victim's cookie and decrypt it in a much shorter amount of time than was previously possible. The paper "All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," written by Mathy Vanhoef and Frank Piessens, explains the discovery of new biases in the algorithm that led to attacks breaking encryption on websites running TLS with RC4, as well as the WPA-TKIP, the Wi-Fi Protected Access Temporal Key Integrity Protocol.

links @ http://it.slashdot.org/...15/07/17/019235/new-rc4-encryption-attacks-reduces-plaintext-recovery-time

NSA releases Linux-based open source infosec tool - Security - News - iTnews.com.au
http://www.itnews.com.au/News/406509,nsa-releases-linux-based-open-source-infosec-tool.aspx

Earthquake Retrofit writes: The NSA's systems integrity management platform — SIMP — was released to the code repository GitHub over the weekend. NSA said it released the tool to avoid duplication after US government departments and other groups tried to replicate the product in order to meet compliance requirements set by US Defence and intelligence bodies. "By releasing SIMP, the agency seeks to reduce duplication of effort and promote greater collaboration within the community: the wheel would not have to be reinvented for every organisation," the NSA said in a release.

Tady je chyba "alternative chains" rozebrana vcelku polopaticky

OpenSSL CVE-2015-1793: Separating Fact from Hype
http://blog.trendmicro.com/...security-intelligence/openssl-cve-2015-1793-separating-fact-from-hype/

Ha tak jsem dostal hlasku, ze TextSecure existuje i pro iOS devices:

Signal - Private Messenger on the App Store on iTunes
https://itunes.apple.com/us/app/signal-private-messenger/id874139669?mt=8

NYX: genialni, prese a jasne. poznavam sve prakticke poznatky z ruznych trainigu v kazde vete toho textu...

MMchodem loukam, ze textSecure uz uplne opustilo SMS.
Nejdriv jsem z toho byl VELMI rozcarovany a pak jsem to pochopil. Metadata a statisticka analyza jsou svine...

Od te doby co mam [dopln pejorativum k closed source resenim] jablecnej telefon, tak s TextSecure mam vcelku smulu

PEPAK:

ten mailinglist si promysli. typicka situace: chces, aby existovalo nejake jadro lidi, kteri o necem rozhoduji, ti se bavi sifrovane a pak jeden z nich odejde, a uz dal do skupiny nema patrit. jak se vyresi distribuce tohohle stavu? jak vyresis treba to, ze do mailinglistu nekdo pribude, a bude potrebovat celou historii [typicky odesel jeden ze reditelu a novy po nem potrebuje prebrat celou komunikaci]?
tech problemu je tam cela rada, kdyz se pokusis na neco takoveho napsat specifikaci, zjistis, ze to bohuzel do vsech dusledku vlastne nejde udelat rozume, bezpecne a funkcne.
Da se to vyresit prave expiracemi a revokacemi, subklici a master keyem, ale dobry reseni to neni.

AD expirace: dobre reseni to rozhodne je: treba me se ted stalo, ze jsem zmenil valnou cast sveho zivota, nejaky cas jsem nemel sve servery [vlastne je nemam ani ted], propadly mi domeny, nekolik mesicu jsem vicemene nebyl na netu... defacto vsechny kontakty uvedene ve starem klici uz nemaji smysl. Expirace to vyresila za me, proste jsem nebyl dostupny, za tu dobu klice propadly.
Ja navic zmenil vetsinu zarizeni, takze ac klice samozrejme mam, nejsem schopen snadno obnovit celou jejich infrastrukturu : nacpat je do vsech telefonu, do vsech ruznych mailovych klientu na vsech ruznych mistech, zmenit jejich kontakty [promazat defacto vsechny sub-keye a zmenit kontakt v master key]....

Takovy klic chces bud revokovat, nebo chces aby propadnul, kdyz nemas moznost jej revokovat.
Clovek, ktery prepise cely obsah sveho klice je nekdo jiny, nez ten, kdo klic vyrvarel, a jako takovy by mu mel byt treba u daneho klice RADIKALNE zmenen status na WOT.

Dalsi vec, proc je expirace dobra je ... a ted nevim jak se to jmenuje... proste to, ze stare zpravy nesdili s novejma klice, coz vede k mensi pravdepodobnosti nejakeho leaku, prolomeni atd.

OVERDRIVE: ja teda enigmail mam defaultne v thunderbirdu. //gentoo distro

co se tyce principu private/public key, to uz se nevysvetluje na klasice vsech klasik.. Alici a Bobovi?

Alice and Bob - Wikipedia, the free encyclopedia
https://en.wikipedia.org/wiki/Alice_and_Bob