5 ms·

Posting from Iran, Im really worried about the current security status. Iran's opposition mostly exists on internet these days and its very seriously flawed. M

Posting from Iran, Im really worried about the current security status. Iran's opposition mostly exists on internet these days and its very seriously flawed. Man In The Middle attacks are increasing and users usually ignore error messages about them. (Firefox throws an error dialog but it has an 'I understand the risks' button. People just ignore the error). Also, last year many Iranian FriendFeed users were arrested and the goverment knew about all their private discussions on FriendFeed. (FriendFeed has been censored since the beggining. But it suddenly became uncensored for a day or two. On the other hand, FriendFeed generates an 'auth' key for each user and lets him see his RSS feed using that key. And puts the auth key in every page: goverment probably collected auth keys and used it to read discussions of people they arrested) Goverments using internet to spy on their civilians is not a myth. Anonymity, trusting the cloud and related issues seem far more important when you suddenly find out a friend of yours has been arrested and his location and charges is unknown.

cookiecaper 15y ago
Under such conditions it is obviously unsafe to trust any private communications on the open internet (including sites that use SSL to encrypt data on the wire). You should ONLY use systems that ensure your content is encrypted for a key that YOU (not your browser) explicitly trust. This means using GnuPG and exchanging keys in a reliable offline medium with anyone with whom you want to communicate, basically. Alternatively, you can use i2p and i2p outproxies, but i2p may be vulnerable to similar poisoning attacks if the government had an interest in perpetrating them. That said, it's probably much safer to use an i2p outproxy for your browsing anyway, and definitely much safer to use eepsites.
- emilsedgh 15y ago
  How could one technical individual protect himself is one thing, having a secure-by-design communication channel is another thing. Whole country is being spied like that and most people dont even know/care about it. They just want to use Facebook or some 'cool' service.
  - pnathan 15y ago
    If you want to dork with Facebook and see pictures of your neighbor's cat, that's fine, but in my opinion, it's not worth the risk (if any), and it's useless to want/expect meaningful security. I don't even know if seeing pictures of cats is a problem in Iran. :-) If you want to communicate with other people securely, then, in my opinion, then everyone in that communications group needs to consider learning information security and operational security, and then applying it. It's not simple, it's not easy, but if you want to be secure, you're going to have to plan to be serious.
    - mkr-hn 15y ago
      It's a catch 22 when it comes to repressive regimes. You've swapped keys and are communicating with all your friends on a perfectly secure network. Now you and your friends are in jail on charges of conspiracy. The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel.
      - pnathan 15y ago
        I assure you, I don't pretend to have a guide to security in this sort of situation. But I am utterly certain that you have to take it seriously. edit: You refer to something that is either steganography or something in that class of communication.
      - icebraining 15y ago
        >The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel. That's steganography, and there are some open source programs for that. Steghide[1], for example, can hide encrypted data in JPEG images. [1]: http://steghide.sourceforge.net/ http://steghide.sourceforge.net/
        _sh 15y ago
        An alternative to steganography is 'chaffing and winnowing'. Ronald Rivest describes the technique in this paper: http://people.csail.mit.edu/rivest/Chaffing.txt http://people.csail.mit.edu/rivest/Chaffing.txt
JoshTriplett 15y ago
If you expect that you would only get targeted if you actively communicate about things your government doesn't like, but not just because you use a VPN or similar, then you should get a VPN in a country somewhat less likely to cause you problems. If you expect that the use of secure encryption at all would get you disappeared, you're screwed. And the previous situation can turn into this one on a whim. Either way, the long-term solution does not involve technology; it involves emigration.
- reinhardt 15y ago
  And longer term, revolution.
  - VladRussian 15y ago
    They all look so similar : http://www.toptenz.net/top-10-most-notable-national-revolutions.php http://www.toptenz.net/top-10-most-notable-national-revoluti... yet some of them are (as of 17:25 PST 08/29/2011 AD) classified as "bad" and some as "good"
- zuppy 15y ago
  I don't know how is in Iran, but I can tell you how it was in Romania before 1989 (and I guess that's pretty close to what is happening there). It was close to impossible to emigrate legally, they would use anything to stop you. They would make you lose your job (or even do that to members of your family), they would interrogate you and members of your family (and don't think about any human rights). A friend of my father was shot on the spot when they saw he was using a boat to cross the Danube to Yugoslavia. It's not that simple to escape, especially with your family. You're living in a different world. Edit: spelling
  - JoshTriplett 15y ago
    I certainly would assume the same holds true, yes; I didn't intend to imply otherwise. It still seems like the right long-term solution, just a very difficult one.
mrb 15y ago
"Man In The Middle attacks are increasing and users usually ignore error messages about them" Note that the reported MiTM attack should not result in a popup warning, because the CA certificate used in the MiTM is supposedly technically valid. Does anybody know which browsers include this CA? Browser vendors should consider removing it based on ethical concerns, especially if this MiTM attack is being performed very broadly, at the country level.
- deleted 15y ago
  [deleted]
- mcpherrinm 15y ago
  Mozilla is spinning up new releases to remove the cert. See http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/ http://blog.mozilla.com/security/2011/08/29/fraudulent-googl... Instructions on how to delete it yourself are available at http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-ce...
  - shabble 15y ago
    They really ought to add a search field to that list view.
mypov 15y ago
Azizam, unless you actually know the players involved in every hop of the loop, do not put your precious life in danger. If you are looking to organize, like a smart bache Terani you should go asymmetric on the the goons. Think sneaker nets, etc. I further suggest that you do not put your trust in superficially maintained hostilities between the west and the flea ridden mullahs. Remember those two brothers handed to Iran from US embassy. In one of those Persian Gulf states. They were hanged if you recall. Stenography, never signaling overt use of crypt, etc. are recommended. Qorbanat.
- emilsedgh 15y ago
  Arrested people werent organizing anything. They just had lots of political talks like analyzing Iran's current situation. Goverment isnt trying to spy specific people for specific reasons. They are trying to spy everyone.
  - mypov 15y ago
    http://www.cabinetmagazine.org/issues/40/sherman.php http://www.cabinetmagazine.org/issues/40/sherman.php Communicate in the open free from the molestations of ahrimanan.
dhbanes 15y ago
Since you are posting from Iran, can you verify this certificate is indeed being presented? Also, how are people sure this is being perpetuated by the Iranian government? I'm asking because I see no evidence in the pastebin dumps, yet many people here seem sure the Iranian government is behind this. There was another indecent earlier this year for which Iran was assumed responsible. This turned out to be false (http://www.computerworld.com/s/article/9215245/Solo_Iranian_hacker_takes_credit_for_Comodo_certificate_attack http://www.computerworld.com/s/article/9215245/Solo_Iranian_...)
- emilsedgh 15y ago
  Yes. I can confirm that without using a proxy, DigiNotar's CA is being used. Who might/could do this except for the goverment?
  - dhbanes 15y ago
    Thanks for checking. Could you run the following? Thanks in advance. tracert mail.google.com
    - sepent 15y ago
      I did traceroute google.com/mail.google.com. nothing unusual happened: [1-7 are ISP routers] 8. 78.38.255.89 9. 78.38.245.17 10. 213.248.76.5 11. 80.91.248.94 12. 80.91.253.118 13. 213.155.130.243 14. 213.248.83.94 15. 72.14.238.232 16. 209.85.251.88 17. 209.85.255.234 18. 209.85.255.231 19. 64.233.175.98 I used mtr and the route to google is changing every several seconds, but I thinks it's normal. All I know is that internet blocking happens in LCT [78.38.255.] or KAMYARAN [78.38.245.].
- sepent 15y ago
  I can confirm it, too. My brother works in a company that produces spying software for government. Days ago, he told me he himself has written several programs to spy on yahoo, hotmail and gmail but he thought they couldn't deploy the gmail program because of https. I guess, he should think again. I am scared. My only hope was SSL and I can't trust that anymore?

cookiecaper 15y ago

Under such conditions it is obviously unsafe to trust any private communications on the open internet (including sites that use SSL to encrypt data on the wire). You should ONLY use systems that ensure your content is encrypted for a key that YOU (not your browser) explicitly trust. This means using GnuPG and exchanging keys in a reliable offline medium with anyone with whom you want to communicate, basically. Alternatively, you can use i2p and i2p outproxies, but i2p may be vulnerable to similar poisoning attacks if the government had an interest in perpetrating them. That said, it's probably much safer to use an i2p outproxy for your browsing anyway, and definitely much safer to use eepsites.

emilsedgh 15y ago
How could one technical individual protect himself is one thing, having a secure-by-design communication channel is another thing. Whole country is being spied like that and most people dont even know/care about it. They just want to use Facebook or some 'cool' service.
- pnathan 15y ago
  If you want to dork with Facebook and see pictures of your neighbor's cat, that's fine, but in my opinion, it's not worth the risk (if any), and it's useless to want/expect meaningful security. I don't even know if seeing pictures of cats is a problem in Iran. :-) If you want to communicate with other people securely, then, in my opinion, then everyone in that communications group needs to consider learning information security and operational security, and then applying it. It's not simple, it's not easy, but if you want to be secure, you're going to have to plan to be serious.
  - mkr-hn 15y ago
    It's a catch 22 when it comes to repressive regimes. You've swapped keys and are communicating with all your friends on a perfectly secure network. Now you and your friends are in jail on charges of conspiracy. The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel.
    - pnathan 15y ago
      I assure you, I don't pretend to have a guide to security in this sort of situation. But I am utterly certain that you have to take it seriously. edit: You refer to something that is either steganography or something in that class of communication.
    - icebraining 15y ago
      >The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel. That's steganography, and there are some open source programs for that. Steghide[1], for example, can hide encrypted data in JPEG images. [1]: http://steghide.sourceforge.net/ http://steghide.sourceforge.net/
      - _sh 15y ago
        An alternative to steganography is 'chaffing and winnowing'. Ronald Rivest describes the technique in this paper: http://people.csail.mit.edu/rivest/Chaffing.txt http://people.csail.mit.edu/rivest/Chaffing.txt

JoshTriplett 15y ago

If you expect that you would only get targeted if you actively communicate about things your government doesn't like, but not just because you use a VPN or similar, then you should get a VPN in a country somewhat less likely to cause you problems. If you expect that the use of secure encryption at all would get you disappeared, you're screwed. And the previous situation can turn into this one on a whim. Either way, the long-term solution does not involve technology; it involves emigration.

reinhardt 15y ago
And longer term, revolution.
- VladRussian 15y ago
  They all look so similar : http://www.toptenz.net/top-10-most-notable-national-revolutions.php http://www.toptenz.net/top-10-most-notable-national-revoluti... yet some of them are (as of 17:25 PST 08/29/2011 AD) classified as "bad" and some as "good"
zuppy 15y ago
I don't know how is in Iran, but I can tell you how it was in Romania before 1989 (and I guess that's pretty close to what is happening there). It was close to impossible to emigrate legally, they would use anything to stop you. They would make you lose your job (or even do that to members of your family), they would interrogate you and members of your family (and don't think about any human rights). A friend of my father was shot on the spot when they saw he was using a boat to cross the Danube to Yugoslavia. It's not that simple to escape, especially with your family. You're living in a different world. Edit: spelling
- JoshTriplett 15y ago
  I certainly would assume the same holds true, yes; I didn't intend to imply otherwise. It still seems like the right long-term solution, just a very difficult one.

mrb 15y ago

"Man In The Middle attacks are increasing and users usually ignore error messages about them" Note that the reported MiTM attack should not result in a popup warning, because the CA certificate used in the MiTM is supposedly technically valid. Does anybody know which browsers include this CA? Browser vendors should consider removing it based on ethical concerns, especially if this MiTM attack is being performed very broadly, at the country level.

deleted 15y ago
[deleted]
mcpherrinm 15y ago
Mozilla is spinning up new releases to remove the cert. See http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/ http://blog.mozilla.com/security/2011/08/29/fraudulent-googl... Instructions on how to delete it yourself are available at http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-ce...
- shabble 15y ago
  They really ought to add a search field to that list view.

mypov 15y ago

Azizam, unless you actually know the players involved in every hop of the loop, do not put your precious life in danger. If you are looking to organize, like a smart bache Terani you should go asymmetric on the the goons. Think sneaker nets, etc. I further suggest that you do not put your trust in superficially maintained hostilities between the west and the flea ridden mullahs. Remember those two brothers handed to Iran from US embassy. In one of those Persian Gulf states. They were hanged if you recall. Stenography, never signaling overt use of crypt, etc. are recommended. Qorbanat.

emilsedgh 15y ago
Arrested people werent organizing anything. They just had lots of political talks like analyzing Iran's current situation. Goverment isnt trying to spy specific people for specific reasons. They are trying to spy everyone.
- mypov 15y ago
  http://www.cabinetmagazine.org/issues/40/sherman.php http://www.cabinetmagazine.org/issues/40/sherman.php Communicate in the open free from the molestations of ahrimanan.

dhbanes 15y ago

Since you are posting from Iran, can you verify this certificate is indeed being presented? Also, how are people sure this is being perpetuated by the Iranian government? I'm asking because I see no evidence in the pastebin dumps, yet many people here seem sure the Iranian government is behind this. There was another indecent earlier this year for which Iran was assumed responsible. This turned out to be false (http://www.computerworld.com/s/article/9215245/Solo_Iranian_hacker_takes_credit_for_Comodo_certificate_attack http://www.computerworld.com/s/article/9215245/Solo_Iranian_...)

emilsedgh 15y ago
Yes. I can confirm that without using a proxy, DigiNotar's CA is being used. Who might/could do this except for the goverment?
- dhbanes 15y ago
  Thanks for checking. Could you run the following? Thanks in advance. tracert mail.google.com
  - sepent 15y ago
    I did traceroute google.com/mail.google.com. nothing unusual happened: [1-7 are ISP routers] 8. 78.38.255.89 9. 78.38.245.17 10. 213.248.76.5 11. 80.91.248.94 12. 80.91.253.118 13. 213.155.130.243 14. 213.248.83.94 15. 72.14.238.232 16. 209.85.251.88 17. 209.85.255.234 18. 209.85.255.231 19. 64.233.175.98 I used mtr and the route to google is changing every several seconds, but I thinks it's normal. All I know is that internet blocking happens in LCT [78.38.255.] or KAMYARAN [78.38.245.].
sepent 15y ago
I can confirm it, too. My brother works in a company that produces spying software for government. Days ago, he told me he himself has written several programs to spy on yahoo, hotmail and gmail but he thought they couldn't deploy the gmail program because of https. I guess, he should think again. I am scared. My only hope was SSL and I can't trust that anymore?