INF1466: problem je, ze spousta tech zapnuti vypnuti zpusobuje jen to, ze se informace sice sbiraj, ale nejsou pouzivane ke zpetne vazbe. Maji to udajne i v podminkach pouzivani systemu, ze vypnuti techle ficur neznamena, ze prestavaji udaje sbirat [sam jsem to jeste necet, pac ten system jeste nikde nemam, ale vim, ze se o tom docela dost pise na webu]. Zaroven i znefunkcneni nekterych casti uplne natvrdo jejich odinstallovanim, nezpusobi ocekavane znefunkcneni nektereho sbirani dat... a dal:

QWWERTY:
tam je problem, ze uz zablokovani domen na firewallu udajne zpusobuje nefunkcnost prostredi... [tohle asi jde zkusit uplne snadno proste tim, ze virtualni masine zakazu komunikovat nekam ven na konkretni domeny]

at je to neduveryhodne jak chce, je to presne druh vyzkumu, ktery jsem chtel udelat ja a minimalne to navadi k tomu, co muzeme-te zkusit, takhle ve volnejch chvilkach

ISATAG: zkusim se nad tim zamyslet, jako konecne dycky jim to clovek muze poslat v PDFku, coz je sice pliaga jaxsvin, ale asi stejna jako napsat to v mailivem clientu, udelat screenshot a ten pak poslat... nelibi se mi to principialne, ale asi vim co mas na mysli...
Hezky je do lidi natlacit enigmail nebo nejakou obdobu, pak ani nevedej, ze pouzivaj PGPcko, jenomze se pak dostavame do momentu, kteremu se smeje obrazek v zahlavi...


Jinak zajimavej projekt u nas to taky nekdo dela, mislim ze http://www.iure.org/EN
-- mmchodem, maji spatne nastaveny certifikaty a nezabezpeceny prvky na webu ;]


jop a ten projekt:

New Street-Level Surveillance Project Tracks Spying Technologies Used by Local Law Enforcement | Electronic Frontier Foundation
https://www.eff.org/...w-street-level-surveillance-project-tracks-spying-technologies-used-local-law

OVERDRIVE: coz o to, ja s pgp problem nemam ale skoro nikdo to nepouziva v mem okoli. Uz se mi parkrat stalo ze mi nekdo upravoval pracovni email na ktery odpovidal vice adresatu, tak hledam zpusob jak to zatrhnout. To jen na vysvetlenou.. Jestli se mi nepodari udelat neco jednoducheho v pthonu, tak na ten napad kaslu :)

ISATAG: neznam, ale da se to udelat tak, ze napises text a pak jej screenshotnes a pastnes.... ale takovahle vec asi ne-uplne zajisti nejakou bezpecnost... proc nechces pouzivat PGP? Co je cilem, pred kym ty emaily chranis?

Mam dotaz. Existuje nejaky emailovy klient (idealne addon do thunderbirdu), ktery by mi cely napsany text jednoduchym kliknutim prevedl do jpeg nebo neceho podobneho v tele emailu?
Tj. aby se emaily ode me nedaly dale zpracovavat copy-pastem, menit a updavovat v odpovedi apod. Porebuju neco, kde cilovy clovek nepouziva PGP nebo neco podobneho.

Takovej pop clanek ... ale patri k tematu

Armouring up online: Duncan Campbell's chief techie talks crypto with El Reg • The Register
http://www.theregister.co.uk/2014/12/19/crypto_toolkit_1/

Crypto activists announce vision for Tor exit relay in every library | Ars Technica
http://arstechnica.com/...5/07/crypto-activists-announce-vision-for-tor-exit-relay-in-every-library/

kazdopadne docela zajimavy dighest obcas: https://paper.li/...vacyCamp/1375765369?edition_id=2e996a30-380b-11e5-a22c-0cc47a0d164b#!tag-privacy

OVERDRIVE: Snort, já používal distribuci snorby

A byl jsem na přednášce od Invea-tech a jejich flow-mon, zajímavý, ale ne free pochopitelně.

QWWERTY: Muzes mit vic verzi, zkusil bych dogooglit jak je prepinat na zaklade appky, pripadne bysem asi virtualizoval a hodne ladil firewall

A new freeware version of Netwitness' core product, NetWitness Investigator, was made available today. I was able to get access to it several days ago for a test run. It looks and feels much like Wireshark, but with a lot more capability. The only two issues I found with the tool is that the registration process (required) is a bit quirky but eventually works, and you'll see a noticible drop in computer performance while its running. But considering that this is a sniffer on steroids I suspect that a performance drop is to be expected.

Here are notes from the NetWitness web site:

Product Features:

Captures raw packets live from most wired or wireless interfaces
Imports packets from any open-source, home-grown and commercial packet capture system (e.g. .pcap file import)
License supports 25 simultaneous 1GB captures - far exceeding data manipulation capabilities of packet tools like Wireshark
Real-time, patented layer 7 analytics
– Effectively analyze data starting from application layer entities like users, email, address, files , and actions.
– Infinite, free-form analysis paths
– Content starting points
– Patented port agnostic service identification
Extensive network and application layer filtering (e.g. MAC, IP, User, Keywords, Etc.)
IPv6 support
Full content search, with Regex support
Exports data in .pcap format
Bookmarking & history tracking
Integrated GeoIP for resolving IP addresses to city/county, supporting Google® Earth visualization
NEW! SSL Decryption (with server certificate)
NEW! Interactive time charts, and summary view
NEW! Interactive packet view and decode
NEW! Hash PCAP on Export
NEW! Enhanced content views

Minimum system requirements:
NetWitness recommends the following minimum hardware requirements for NetWitness Investigator:

Windows® XP, 2003 Server, or Vista 32-bit
Single 2Ghz Intel-based processor(Dual-core recommended)
1GB RAM(2GB Recommended)
1 Ethernet Port
Internet Explorer v7+ (IE v6.x may limit some functionality)
Ample data storage for collected data
Note: Linux infrastructure available in commercial versions

The fully functional and licensed free version of NetWitness Investigator is at: http://download.netwitness.com. We are interested in your comments if you've downloaded and tried this software. Please let us know via our contact form.

Marcus H. Sachs
Director, SANS Internet Storm Center

New Tool: NetWitness Investigator - SANS Internet Storm Center
https://isc.sans.edu/forums/diary/New+Tool+NetWitness+Investigator/5351/

heleho, google ma novy pop-up window:

A privacy reminder from Google

To be consistent with data protection laws, we're asking you to take a moment to review key points of Google's Privacy Policy. This isn't about a change we've made – it's just a chance to review the key points below. Click "I agree" to agree to the terms set out below and you will continue to Search; you can also explore other options on this page.
Data we process when you use Google

When you search for a restaurant on Google Maps or watch a video on YouTube, for example, we process information about that activity – including information like the video you watched, device IDs, IP addresses, cookie data and location.
We also process the kind of information described above when you use apps or sites that use Google services like ads, Analytics and the YouTube video player.

Why we process it

We process this data for the purposes described in our policy, including to:

Help our services deliver more useful, customised content such as more relevant search results;
Improve the quality of our services and develop new ones;
Deliver ads based on your interests, including things like searches you've done or videos you've watched on YouTube;
Improve security by protecting against fraud and abuse; and
Conduct analytics and measurement to understand how our services are used.

Combining data

We also combine data among our services and across your devices for these purposes. For example, we use data from trillions of search queries to build spell-correction models that we use across all of our services, and we combine data to alert you and other users to potential security risks.

Tip: If you sign in to your Google Account before agreeing, we'll remember your choice across all of your signed-in devices and browsers.

Mam prosbu, pozivate nejake intrusion detection systemy, scripty, binarky?
Pokud, tak jaky. Docela by me zajimalo, po cem koukat, nemam s tim skoro zadne zkousenosti. Nasel jsem zajimavou vec [firmu]: https://en.wikipedia.org/wiki/Netwitness coz jsou spis forenzi toolly, ale obecne me zajima ruzna forma IDS a forenze... Linky ocenim zvednutym placem ;]

Researchers mount successful attacks against Tor network—and show how to prevent them
http://phys.org/news/2015-07-mount-successful-tor-networkand.html

OVERDRIVE: no .. nejlepsi firemni ntb, kdy Java je nejvetsi bezpecnostni zlo a nemuzu ji updatovat, protoze pod tou novou nechodi firemni tooly :D

btw, doporucuju, kdyz uz mame hromadu 0day-u zejo:

Keep your Firefox healthy with a quick checkup — Mozilla
https://www.mozilla.org/en-US/plugincheck/

Tak jo, zeptej se na specifikaci, a pak si ji gogoogli, zejo.... [sorry, proste jsem se nechtene zeptal driv, nez jsem si nasel primarni zdroj] : http://arxiv.org/pdf/1507.05724v1.pdf