[How to] GPG and Signing Data

GNU Privacy Guard (GPG) uses public and private keys to secure communications (public-key cryptography). Many people use it to encrypt their email or other documents. An email encrypted with a user's public key can then only be decrypted with the same user's private key. This provides end-to-end encryption of the message, meaning that it is impractical for anyone that is listening in on the conversation to get the message in transit.

This is, of course, good and bad. For example, Google and other email providers use email text to gain intelligence about the user, sell user information and do better ad targeting. This revenue stream keeps these services free, but users pay for it in terms of 'sold' privacy. Email using end-to-end encryption cannot be analyzed for useful marketing information. Because of this, these providers don't want to make it easy for mass encryption.

On the other hand, criminals also use Cloud-based email services. Making encryption somewhat difficult means that sloppy criminals are less likely to use encryption. If so, they may be easier to detect and catch.

Related Book: Lucas, Michael. PGP & GPG: Email for the Practical Paranoid. No Starch Press. 2006.

Whether you are paranoid and want all your emails encrypted (good luck), or you are trying to implement a personal or business data classification policy, GPG can help with encryption requirements.

Beyond encryption, GPG is useful for signing data. This is not exactly a signature that you would put on a document. Instead it is a signature that verifies that the data is correct. The video below describes how to sign data.

Signing data lets your contacts know that the data has not been modified from the time it left your possession. Signing is NOT encryption. Everyone could see the contents. Singing just allows your contact to know the data came from you, and it is in it's original state.

Read More

Cybersecurity and Challenges to Democracy

South Korea’s democracy can only be described as... developing. In the late 1970s, after the assassination of Military Dictator Park Chung-hee (who Koreans often refer to as ‘President Park’), slow but relatively steady progress in terms of democracy was made in South Korea. This despite the fact that the North Korean threat, and communism in general, was a topic constantly abused to allow the government to gain more power.

Recent incidents, however, have prompted a vie for power within the South Korean government that will have serious consequences for South Korea’s democracy going forward. In the recent weeks North Korea has been saber rattling per usual, to which South Koreans are generally unaffected. One issue with this situation, however, is that the recent cyber attacks on South Korean banking and broadcasting systems are also being attributed to North Korea without, at the time of this writing, any verifiable proof that North Korea carried out the attacks. South Korea currently has IP addresses tracing back to various countries, and attack patterns that are “similar” to those used by North Korea in the past. At best, the evidence is unsubstantial. However, the South Korean National Intelligence Service (NIS) (think C.I.A. on steroids) has formally released a statement claiming North Korean involvement, which, of course, no one can confirm or deny.

This statement comes days after the exceedingly toned-down proposal of the South Korean “National Cyber Terror Prevention Act”. This act, in essence, gives the NIS, or NIS-controlled groups, full power to create, vote on and enforce anti-cyber terror policies through the creation of an NIS-lead “cyber control tower”. Ironically, the act itself was proposed by the very members of Congress who are responsible for keeping the NIS in check. The most interesting aspect of the act, however, is the definition of cyber terror. Cyber terror, according to the act, can potentially be almost anything.

Consider that the NIS was created during the time of a military dictatorship with the express intention of fighting communism. Because of that, the NIS effectively reports to no authority save for the president. The NIS has, in the past, attempted to push anti-terrorism acts that would allow them even more power with little checks on how that power is used and abused. However, when discussing physical terrorism, many experts can, and have, resisted such a push. Cyber terrorism, however, is extremely vague. So much so that even experts in the field do not agree on its definition and how it should be handled. This is a problem most countries are currently facing that is related to the lack definition of terms like cyber crime, cyber war and cyber terrorism. Because of the lack of definition, government agencies all over the world are attempting to create jurisdiction around whatever term they choose, generally focusing on which term will bring the most power and budget benefits rather than which term correctly describes the situation.

South Korea is an extreme example of how agencies can combine fear with vague terms to expand their power. Of course, this is all made possible because the South Korean people allow it to happen, normally through complacency and cultural restrictions. However, regardless of culture, similar situations are happening in most countries right now. While a centralized all-knowing government ‘cyber control tower’ may have some benefits, it simply won’t stop cyber crime/terror/war. Further, what benefit such an over-powered group could contribute to a democratic society is completely undermined that group’s ability to abuse such power.

The reality is, cyber crime/terrorism/war is largely made possible by the public, and just like ‘traditional crime’ will never be completely stopped. The general public (globally) appear to have little interest in securing themselves, and they are about to give up what little freedom they have so their governments can ineffectively protect the people from themselves. Anyone who chooses to use technology should take responsibility for themselves, get informed and start implementing basic cyber security practices. If the people start securing themselves, the majority of digital crimes can be drastically reduced, and it won’t cost anyone hard-earned freedoms to do it.

[PDF]

Read More

Social Media and Intelligence Gathering

As seen on DigitalFIRE

Online social media has changed the way many people, businesses and even governments interact with each other. Because of Twitter’s popularity and its ability to broadcast small pieces of information to a large number of people, it is an effective form of mass communication. However, ease in communication that allows the public to freely communicate anything they wish can be used for both benefit and harm in a number of ways.

For example, in 2011 panic ensued as parents in Veracruz, Mexico rushed to pick up their children from school amongst reports of gang-related kidnapping and shootings [1]. During this time, it was reported that panic led to an increased number of car accidents and denial of service on emergency response numbers [2]. The panic, however, was based on (plausible) claims from two people who posted about the false gang-related activity on Twitter, which later went ‘viral’.

In 2012 a teen gained worldwide notoriety by asking her followers on Twitter to call the police, claiming someone broke into her home [3]. Her case was later determined to be a runaway attempt, but was not discovered before reaching the number 2 most popular worldwide topic on Twitter for that time-period [4].

And in the 2008 terrorist attacks in Mumbai, India, claims emerged that the terrorists were monitoring social media outlets to extract operational intelligence to avoid police and potentially locate more victims [5][6].

These, and other similar cases, are not necessarily new. Abuse of emergency response numbers for non-emergencies are relatively common [7][8], and are even sometimes used as a way to attempt to distract police [9][10]. But just like emergency response numbers, social media can also be used to help in many situations.

For example, many law enforcement agencies, and even some communities themselves, have been creating and advocating the use of social networks to create a ‘virtual neighborhood watch’ that can consist of crime alerts from law enforcement and the public alike [11][12][13].

Even though social media was potentially used by the 2008 Mumbai terrorists, it was also used during the attacks by the public to report the news before traditional media outlets, warn of dangerous locations, communicate to loved ones, and even help organize support services such as blood donation [14][15]. This type of public emergency coordination was again demonstrated during the 2011 Mumbai bombings, where social media was used to track the bombings as well as organize support services for victims [16].

The negative aspects of online social media have prompted some countries to consider shutting down communication infrastructure services when they can be used against the public or state [17][18], with one extreme example being the 2011 Egyptian Internet outage during riots against the government in an attempt by the government to suppress information and disrupt public coordination [19]. However, some experts believe that the benefits of social media far outweigh any potential abuse. For example, Schneier [20] claims that “[t]errorist attacks are very rare, and it is almost always a bad trade-off to deny society the benefits of a communications technology just because the bad guys might use it too”.

How social media will continue to shape the public, governments and even crime remains to be seen. However, from a law enforcement perspective, the ability to communicate with and inform a large number of citizens at a time can be invaluable during a crisis. Further, intelligence about crime and criminals can often be gained via online social media sites such as Twitter. Again, gained intelligence can be used for positive or negative purposes depending on the perspective, but nevertheless, many users and criminals are constantly producing a stream of publically accessible data that may help investigations.

While the content of postings should normally be considered hearsay and treated with caution, analysis of the produced meta-data may provide some potentially relevant information for investigations. Several related online social networking security awareness campaigns have been created to raise awareness for the amount of personal information people are – normally unwittingly – posting.

One such site, “ICanStalkU.com” (I can stalk you), pulled Geo-Tagging information from the meta-data of pictures posted on TwitPic.com. This Geo-Tagging information was then used to plot the user’s current location in real-time, and could potentially be used to track the current location and movements of a suspect, or help to place them at or near a location at the time of an incident. A more advanced, stand-alone program called “Creepy” [21] also uses the same Geo-Tagging information from many more social media outlets.

Another similar site that claims to raise awareness about over-sharing, is “PleaseRobMe.com”, which uses Twitter, Foursuare or Gowalla check-ins with associated times to attempt to report if the user is home or not. Similar location-tagging features now exist on many social media sites, and could potentially be used to gain intelligence about a particular user.

While location information may be relevant, perhaps an investigator needs to plan when an operation should take place. For this, the site “SleepingTime.org” may provide an analyst with the best time to find the user at home or away. SleepingTime.org uses a user’s Twitter account activity and time zone to estimate when the user is most likely to be asleep based on the time they normally do not have any twitter activity.

And finally, online social media is about social networks. Paterva’s Maltego [22] is a more advanced web mining application that can work with social network data, among others, to generate communication networks and conduct entity link analysis.

These are just some of the tools and potential intelligence that can be extracted from public sources for many users. Even without specific tools, publically available information about a particular user can oftentimes be mined with very little skill or time investment.

Because of social networking sites such as Twitter, a large amount of potentially valuable information can be provided to – and found about – the public, businesses, Law Enforcement, governments, and even criminals. Communication technologies can benefit the world; however, the same communication channels could also be abused. With the large amount of data being generated at present, and ability to easily communicate with a large population in near real-time, Law Enforcement should embrace social media outlets to more effectively share information, and also to receive intelligence that can help in the protection and prevention of crime.

Originally posted in the Virtual Forum Against Cybercrime Newsletter, Issue 16 [PDF]

1. Miglierini, Julian. (2011) “Mexico Twitter terrorism chargers cause uproar.” BBC News. http://www.bbc.co.uk/news/world-latin-america-14800200.
2. (2011) “2 Mexicans face 30 years in prison for tweets that caused panic in violence-wracked city.” NY Daily News. http://articles.nydailynews.com/2011-09-04/news/30136979_1_tweet-panic-private-schools.
3. Murphy, Samantha. (2012) “Police: Teenage Girl’s Viral Tweet Was Kidnapping Hoax.” http://mashable.com/2012/10/01/teenage-girl-tweet-kidnapping/.
4. http://www.twee.co/topics/helpfindkara
5. (2008) “Terrorists turn technology into weapon of war in Mumbai.” http://www.couriermail.com.au/news/world-old/terrorists-and-technology/story-e6freop6-1111118178210.
6. Oh, Onook, Manish Agrawal, H. Raghav Rao. (2011) “Information control and terrorism: Tracking the Mumbai terrorist attack through twitter”. Information Systems Frontiers. Vol. 13. Issue 1. P. 33-43. Springer.
7. Nichols, Mike. (2008) “False 911 calls are alarmingly common.” Journal Sentinel Inc. http://www.jsonline.com/news/29432374.html.
8. Esposito, Richard, Christina Ng. (2012) “Police: Angry Ex-Girlfriend Triggered US Airways Bomb Hoax.” ABC News. http://abcnews.go.com/US/police-angry-girlfriend-triggered-us-airways-bomb-hoax/story?id=17170280#.UHu9A2lrZ3J.
9. FitzPatrick, Lauren. (2011) “Man pleads guild to making fake 911 call to try to help buddy.” Sun-Times Media, LLC. http://www.suntimes.com/news/6734423-418/man-pleads-guilty-to-making-fake-911-call-to-try-to-help-buddy.html.
10. (2012) “Smugglers Use Fake 911 Calls to Distract Police.” http://www.krgv.com/news/smugglers-use-fake-911-calls-to-distract-police/.
11. Catone, Josh. (2009) “Virtual Neighborhood Watch: How Social Media is Making Cities Safer.” http://mashable.com/2009/10/01/social-media-public-safety/.
12. Johnson, Kirk. (2012) “Hey, @SeattlePD: What’s the Latest?.” New York Times. http://www.nytimes.com/2012/10/02/us/seattle-police-department-uses-twitter-to-report-crime.html.
13. Barr, Meghan. (2009) “Neighbors Twitter, blog to keep criminals at bay.” NBC News. http://www.msnbc.msn.com/id/32372082/ns/technology_and_science-security/t/neighbors-twitter-blog-keep-criminals-bay/#.UHt5kGlrZ3J.
14. Beaumont, Claudine. (2008) “Mumbai attacks: Twitter and Flickr used to break news.” Telegraph Media Group Limited. http://www.telegraph.co.uk/news/worldnews/asia/india/3530640/Mumbai-attacks-Twitter-and-Flickr-used-to-break-news-Bombay-India.html.
15. Stelter, Brian, Noam Cohen. (2008) “Citizen Journalists Provided Glimpses of Mumbai Attacks.” New York Times. http://www.nytimes.com/2008/11/30/world/asia/30twitter.html.
16. Ribeiro, John. (2011) “Mumbai Uses Internet, Twitter to Cope with Terror Blasts.” IDG Consumer & SMB. http://www.pcworld.com/article/235672/article.html.
17. (2011) “British Government Considering Social Media Ban. Was China Right?” http://technode.com/2011/08/15/british-government-considering-social-media-ban-was-china-right/.
18. Phillip, Joji Thomas, Soma Banerjee. (2012) “Government for state-specific ban on social media, asks ISPs to build embedded technology.” Bennett, Coleman & Co. Ltd. http://articles.economictimes.indiatimes.com/2012-09-08/news/33696582_1_home-ministry-websites-social-media.
19. Bates, Theunis. (2011) “Protesters Left in the Dark as Egypt Blocks Internet.” http://www.aolnews.com/2011/01/28/protesters-left-in-the-dark-as-egypt-blocks-internet-cell-phone/
20. Schneier, Bruce. (2009) “Helping the Terrorists.” http://www.schneier.com/blog/archives/2009/01/helping_the_ter.html
21. http://ilektrojohn.github.com/creepy/
22. http://paterva.com/web6/

Read More