BolehVPN: Freedom Through Security

Since the 25th of April, Verizon has been sharing all its phone call data with the NSA by virtue of a secret court order that authorizes the following information to be handed over on an ongoing daily basis.:

• the numbers of both parties
• location data
• call duration
• unique identifiers
• time of all calls.

It is however silent on the contents of the conversation itself. This order is very unusual given that it covers all calls and not of a specific person. Furthermore, the order also specifies that Verizon is prohibited from disclosing the fact that it was giving out this information or the existence of such an order. Only through a UK newspaper, the Guardian, was the existence and contents of the order revealed.

Read more:

Guardian

Full Court Ruling

0 0 0 0

So yesterday, the New York Times and the BBC both reported that the ‘internet’ was slowed down due to a massive DDoS attack…

1. NYTimes
2. BBC

Similarly, CloudFlare, the company hired to mitigate the DDoS had this alarming post about the attack.

While the DDoS attack did indeed happen, the effects of it affecting the very infrastructure of the internet is at best…hyperbole.

Gizmodo took a good look at it and the argument it makes that this is overblown marketing for CloudFlare is pretty convincing.

Renesys, a global company which devotes the entirety of its time to monitoring the status of the internet, had this to say:

We believe that the DDOS attack potentially had severe impacts on the websites it was directed at, however, according to our data, the Internet as a whole did not experience a wide spread disruption.

Just to put it in perspective the traffic estimates for the DDOS attack were as high as 300 Gbps at the target. That would easily overwhelm the average hosting center, but not a core component of the Internet. For example, DECIX, the German Internet exchange in Frankfurt, regularly handles 2.5 Tbps at peak on any given day:

http://www.de-cix.net/about/statistics/

While it may have severely affected the websites it was targeted at, the global Internet as a whole was not impacted by this localized incident.

A spokesperson for NTT, one of the backbone operators of the Internet further confirmed this finding:

I’m afraid that we don’t have anything we can share that substantiates global effects. I’m sure you read the same 300gbps figure that I did, and while that’s a massive amount of bandwidth to a single enterprise or service provider, data on global capacities from sources like TeleGeography show lit capacities in the tbps range in most all regions of the world. I side with you questioning if it shook the global internet.

Goes to prove that even the big boys can get it wrong. This doesn’t mean that CloudFlare isn’t good at what they do, they probably are, but exaggerating attacks like these are unethical and tarnish what is otherwise a pretty solid achievement by CloudFlare. This also doesn’t meant that DDoS attacks aren’t damaging, they are! BolehVPN in fact is the frequent target of these for whatever reasons. Just…stick to the facts guys and leave the hyperbole to the tabloids.

0 0 0 0

Is Internet Privacy dead?

Bruce Schneier, a renowned security expert thinks so in his article.

But does that mean that we shouldn’t take steps to protect ourselves? Instead of giving up and saying “Oh, internet privacy is dead,” there are concrete steps that can be taken to restore a level of privacy.

The first step is to create user awareness on internet privacy, which is already happening and to create demand for products with internet privacy features built-in. For instance, features such as privacy modes in browsers, which was previously unheard of is now a standard feature in most major browsers.

It’s not all doom and gloom. The current internet privacy situation was created by the rapid proliferation of social media and search engines but internet privacy is making a comeback. SOPA was defeated due to a large public outcry.  Instagram was forced to clarify its privacy policies, Facebook introducing more fine-tuned privacy controls and Google being subject to EU data regulators just to name a few instances.

There’s also a difference in privacy for example, I don’t mind people knowing my name or my occupation. I don’t mind people knowing that I like KFC or Android phones. This information when combined together may build a profile of who I am, but they aren’t things that I would personally mind people knowing (of course there are some people who would). But I do mind people reading my e-mails, knowing my surfing habits or intercepting or censoring my communications. For the latter sort of privacy, there are VPNs, anonymous e-mails, PGP encryption and a whole bunch of tools that you can use and for the average Joe, these tools are good enough to protect the most private parts of your life.

In reality, there’s no such thing as absolute privacy. In Malaysia, we have our identity card numbers and voter registrations which can tell a lot of things about us. We pay taxes, take loans, we use credit cards all which require an immense amount of disclosure of information. The same goes for the internet except that unlike taxes and identity cards, you have the CHOICE on the internet whether to take the effort to maintain privacy. Don’t want the public knowing about your kids? Well don’t post go and post pictures of your kids or restrict it to a closed group! Don’t want your ISP to track your internet usage? Well use a VPN or TOR! It is in most cases a CHOICE to disclose information whether realized or not and that’s where user education comes in.

Also see 4 Internet Privacy laws you should know about.

0 0 0 0

Anti-p2p groups or those with malicious intent often monitor torrent sites and harvest IP addresses. VPNs and proxies do protect against these but there are those that use blocklists with the false sense of security that they are safe.

What are Blocklists?

Block-lists are basically just a huge list of IPs that purportedly belong to anti p2p outfits or spammers. The most popular one used is i-Blocklist and used in conjunction with software such as PeerBlock or PeerGuardian to prevent you establishing connections to these IPs.

How effective are Blocklists?

Unfortunately, according to a new paper titled “The Unbearable Lightness of Monitoring: Direct Monitoring in BitTorrent,” researchers from the University of Birmingham found that 31% of the IP addresses of monitoring companies were not blocked on these block-lists. Their findings were summarized as follows: “BitTorrent users should therefore not rely solely on such speculative blocklists to protect their privacy.”

Basically if you’re willing to take the slight performance hit, blocklists do offer some protection but should be used with other protection mechanisms such as VPNs.

However, the way I see it, blocklists and VPNs are much like condoms to put it crudely. You’re not going to use a condom that fails once every 3 times and in this case as you’ll be establishing hundreds of connections, the chances of hitting an IP that is not blocked by the blocklist go up exponentially and therefore the protection afforded by a blocklist is very minimal. This seems to run contrary a previously published paper in 2007 based on a different set of blocklists (PeerGuardian, BlueTack and TrustyFiles) which came to the following findings:

1. 5 blocklist ranges encountered during the experiments contribute to nearly 94% of all the blocklist hits.
2. Most blocklisted IPs belong to government or corporate organizations.
3. Very few blocklisted IPs belong directly to content providers such as record labels.

We can only assume that anti-p2p organizations have adapted their techniques and blocklists aren’t as effective as they used to be. BolehVPN did at one point early in our business, actually did try such blocklists and found them to be miserably inaccurate often blocking legitimate traffic and not preventing notices from reaching us.

This is especially important for U.S. Internet subscribers as the six-strikes anti-piracy scheme will be rolled out later this year. The Center for Copyright Information has yet to announce the names of the companies that will do the “spying” for the six-strikes system, and when they do it will be interesting to see what data gathering methods they use.

Source: TorrentFreak

0 0 0 0

ThePirateBay is one of, if not the, biggest and most well known public torrent tracker on the internet. Naturally, it’s been the target of many attacks both through the courtroom and through the internet. Recently, researchers have published data about the uploaders of ThePirateBay, revealing which ISPs upload the most to ThePirateBay and also the alleged locations of the top 100 uploaders.

These researchers, from a coalition of universities in Oregon, Germany and Spain, recorded a detailed log of TPB users who uploaded files, including their IP addresses. This log has been made public, and a tool called MyProbe (Monitoring, Identifying & Profiling Bittorrent Publishers) has been released to the public. MyProbe helps anyone search the released data for IPs and locations attached to a single account. Using this tool, anyone can search by top publishers, ISPs, countries, or find details about any uploader they choose.

This data collected was to investigate the ‘fake torrent’ phenomenon, and the researchers have no intention of using it for anything other than research. The fact that this data was so readily available is something all users should take note of, especially if you use a public tracker like TPB and upload or seed back torrents (which puts you at a greater risk of getting slapped with a wider distribution charge by any litigation happy anti-p2p organizations).

0 0 0 0