True Identity vs Anonymous: Evaluating real-life examples

The privacy and dignity of our citizens are being whittled away by sometimes imperceptible steps. Taken individually, each step may be of little consequence. But when viewed as a whole, there begins to emerge a society quite unlike any we have seen, "a society in which government may intrude into the secret regions of a person's life".

Why be Anonymous?
"The right to be let alone is indeed the beginning of all freedom".
1.Everyone has the right to privacy.
2.Anonymous NOT EQUALS Law-breaker.
3.Requires intellect, desire, diligence, and dedication.

Cloak
-Minimally anonymous
-The FBI will find you

Dagger
-Moderately anonymous
-More difficult
-Potentially illegal
-The FBI can find you

Hermit
-Off the grid
-Completely invisible
-Up to you who finds you

Awareness
-Must develop new habits, gets easier over time
-Be discreet when talking to others
-Say as little as possible
-Identity awareness
-Use social engineering
-Look Around!
-Situational awareness
-Look for and avoid surveillance
-Blend in, do not stand out
-Ongoing process

Getting Started In Real Life
-Cancel All Subscriptions
-Forward Mail to a Secondary Address (Third-Party, Scanned Mail Service)
-Expunge legal and credit histories
-Place locks on credit files
-Shred everything

Getting Started Online
-Eliminate online profiles (Friendster, MySpace, Facebook, etc)
-Clean Up Search History
-Nothing in the Cloud (Host Your Own, Encrypt Everything)
-Everything in the Cloud (Host Nothing, Encrypt Everything)
-Format and Reinstall
-Create All New Accounts

Becoming Anonymous
-Change your name
-Alternative ID
-Alter fingerprints
-Sell registered properties
-Terminate all contracts
-Disposable email addresses (Dodgit, Guerilla Mail, Gmail, Hotmail, Yahoo)
-Mail box rentals (Mailboxes, Scanned Mail Service)
-Fake your own death


Shelter
-Single Room Occupancy (Cash rent, Long-term sublet, Shared utilities)
-Unregistered RV
-Commune (Kibbutz, Nudist Colony, Don’t Drink the Kool-Aid)
-Travel Continuously (Couch Surfing, Hostels, Shelters, Public Parks, Squatting)

Making Money
-Jobs that pay cash
-The world's oldest profession (e.g. Porn)
-Day labor
-Service industry
-Graphics and web design

Using Money
-Use Cash
-Classifieds, Cash Auctions
-Gift Cards, use as CCs
-Check Cashing Services
-Digital Money (E-Gold, Paypal Corporate, Internet Bartering)
-Money Orders
-Offshore Accounts
-Sugar Daddy

Transportation
-Public (Buses, Trains)
-Metro
-Cabs & Gypsy Cabs
-Greyhound
-Carpool / Rideshare
-Vehicles w/o Registration (Bicycles, 50cc Scooters)
-Travel in Disguise (Wear hats and glasses, Pre-determine camera locations)
-Avoid frequent mass-transit

Tracking
-Disable GPS devices
-Disable bluetooth
-Turn cell phone off when not in use
-RFID tags (RFID Zapper, Use a shielded wallet)
-Harden computers and smart phones
-Tinfoil hat

Communications
-Telecom (Pay phones, burners, Prepaid LD)
-Internet (Use email lightly, Internet Relay Chat, Usenet / classifieds)
-Encryption (Off the Record, Steganography)
-Phreaking
-Voice over IP (Hosted VoIP, BYO VoIP)

Online
-Public kiosks, local wifi
-Prepaid SIMs for data
-Use a Live CD
-Use tor, anonymous proxies
-Enable safe browsing
-Anonymous searching (startpage, googlesharing, customize google)
-Anonymous remailers
-Netbook + Truecrypt encrypted SSD, USB

Social Interaction
-Use disguises in public
-No long term communities
-Use a proxy
-Avoid people
-Avoid all social networking
-Avoid all publicity

The Rules
-Do not be your identity
-Get rid of your paper trail
-Use cash
-Constantly improve your situational awareness
-Blend in
-Encrypt everything

Social Engineering: A science behind major Corporate Attacks

All social engineering techniques are usually based on specific attributes of human decision-making known as cognitive biases. These biases, sometimes called "bugs in the human hardware," which can be exploited in various combinations to create attack techniques. Source: "Wikipedia".

Social Engineering misdirection takes advantage of the limits of the human mind in order to give the wrong picture and memory. The mind can concentrate on only one thing at a time. The magician uses this to manipulate the "victim's" idea of how the world is supposed to be.

Common Risks From Social Engineering
–Direct users to malware attack
–Trick users into executing malware
–Persuade users into handing the information (data leakage)

Past Recaps:
Nigeria 419 scams, since 1980s
Phishing at AOL users

-AOL's chat rooms have been awash in password-stealing since at least 1994.
-In one three-month period in 1996, AOL cancelled 370,000 accounts for "creditcard fraud, hacking, etc "Washington post".

Other Email Scams Since 90s
Changes In The Social Engineering Attacks

Internet Statistics (1990-2008)
-Online presence1,463,632,361 –Internet users worldwide (June 2008).
-1.3 billion–email users worldwide. 210 billion emails sent per day (2008).
-Web Sites: 186,727,854–in December 2008. 31.5 million added during 2008.

Targeting Users for your Attack?
Using Popular Search Terms
Using celebrities popularity
Cyber attackers use Terrorist tactics
Terrorist cells are increasingly looking at less well-protected "soft" targets where Westerners can be found, such as social and retailvenues, tourist sites and transport networks (rail, road and airports), as illustrated by the attacks in Bali in October 2002,Madrid in March 2004 and Egypt in July 2005.

Business Strategies?

77% of employees have a Facebook account.
2/3rd access during working hours for average 15mins per day.
87% couldn’t define a clear business reason.
1 in 33 built and manage their entire profile at work.
1.47% total lost productivity across entire employee population.

Common issues with social networking

Who are you really communicating with?
–Has their account been compromised?
–Has the provider of the tool/service been compromised?
–Has the content been tampered?
–Does it have an abbreviated URL?

Stopping users getting to the compromised sites
–Content filtering: Needs real time intelligence.

Ensuring users don’t self infect
–Anti-malware solution
–Control what users can execute: User Access Control (Microsoft), Whitelistingtools (apple model - Digitally signed applications, 3rd party whitelisting tools) -Behavioural controls (IPS, FW, etc): Harden OS, Control what can be installed, used, interacted with other resources.
-Data leakage: Education, Data Loss Prevention controls (DRM).

Digital Reputation - Risk Management
Monitoring and controlling Social Networking Usage
-56% of employers admit to monitoring employees to see if accessing on-line social networking sites, amongst others things.
-38% block employees from accessing such websites.
-1/3rd of employers have adopted policies limiting or prohibiting use of such sites during work time.
-6% have terminated employees for utilizing online social networking sites during work.