In my primary blog, I recently wrote about
detecting traffic over a network connection for malicious activity as
well as the importance of checking log files for any unlawful
activity that an intruder may have made. As anyone should know,
relationships to information security (InfoSec) can be categorized in
two ways: offense and defense. Obviously, one's defenses against
scumbags is going to be far more in-depth than offenses however, it's
important to understand the offensive measures one should at least
consider when working with any network whether connected to an
Internet access point or a closed circuit network (CCN). To review my
previous post regarding network traffic monitoring, look for the
title “
Consequences” in the menu at the right.
Any time a person connects their device to any
network, the assumption should be made that somewhere on that network
is a device monitoring, and possibly harvesting, any information
being sent across that network. The unfortunate truth of this is that
it is far more common than most people would suspect. We take for
granted our connections to communicate with one another that we have
a secure path of communication between us and our recipient when in
fact the truth is far from this. Even if a person is the sole
administrator of the network, this is not a guarantee that at
some point, someone has not compromised that network without us
knowing it. This is why network monitoring and periodic log file
checking is important. Even when we do a complete scan of the entire
network and all nodes on that network, unless the person is on a CCN
with no Internet connection, the possibility is always going to be
there. A person would have to have complete control over a closed
system to insure the security of communication between nodes and this
condition is both rare and unlikely.
Lets take a look at a graphic that can help bring
this point across visually to better understand what's going on. The
first is the average small home network and the second is the average
company network. Of course, any given network can have a variety of
configuration options, these are just basic examples.
Any device on either of these networks could
potentially be monitoring any and all traffic that travels from one
node (device) to another. As the network administrator, it is very
important to monitor the flow of traffic so that any anomalies can be
mitigated such as an infected device siphoning data without the users
knowledge or a device which has been compromised and is being used as
part of a botnet. However, there is a significant difference between
monitoring the flow of data and monitoring the “data” itself. The
ultimate goals here is to insure the integrity of the network and
each node on that network while also allowing for the privacy of the
users depending on circumstances surrounding the network application.
In most cases with a home network, very little is
done to monitor traffic across the lines and security precautions are
left to each user to manage their own devices and communications. The
“last mile” ISP assumes “some” responsibility such as
blocking certain ports, like #25 for example, to help prevent
prominent malicious activity to their subscribers and firewall
software built into modems helps stop lower level malicious intruders
from infecting home networks. Users on the network are left to manage
security on their own devices which typically comes in the form of
firewalls and security software such as Norton or McAfee. These
levels of security do a pretty good job, in most cases, and for the
majority of users the rest is “Plug and Pray”.
Aside from the more modern “Bring Your Own
Device”(BYOD) business model, the company owns all the hardware
provided and actively monitors network activity on the average
business network. From the workstation to exiting the network at the
modem, the company assumes full responsibility for all communications
and security precautions necessary to keep the corrupt out and the
network clean of malware. Companies who have their “act together”
will provide technology agreements to new employees who acknowledge
that there should be “NO” expectation of privacy while using
company owned technology or company owned networks. This has been the
standard for many years with the exception of arguments over
email privacy and the “Work from Home” employee. The more employees
there are, the more obfuscated technology and network security
becomes.
Offensively, what any user wants to insure is that
communications that move to the outside of the local area network
(LAN) are maintained as both secure and private. What this means is
that we want to make sure that no one else on the network is
intercepting or harvesting our communications. It is both possible,
and unfortunately common, for bad actors with network credentials to
act as “
Man In The Middle” of our communications. In such
situations, if an email is sent from one device, it is first
intercepted by someone else on the network, read or possibly
modified, then sent on to the intended recipient. The recipient
replies but that reply is intercepted and read or modified then sent
on. In more advanced situations, a person can even assume the
identity of what would be a trusted individual to try and dupe the
victim into divulging information. This is exactly the situation we
want to take offensive measures against and prevent from happening.
If possible, we even want to catch the corrupt and bring them to
justice as well for those who are capable and so inclined to do so
however, that is beyond the scope of this particular article.
The easiest offensive measure anyone can do is to
start using
The Onion Router (TOR) Browser. The benefit to using this
browser over others is to create an encrypted connection from ones
workspace to the outside world which then “bunny hops” between a
number of servers from differing countries before allowing the user
to explore the Internet to browse. This action provides a level of
security to prevent eavesdropping on browsing activity, another well
known administrative intervention on privacy. If ones workplace
prevents the use of the TOR Browser then we can deduce that browsing
activity is actively being monitored. The downside to using this very
secure browser is the response speed and that some servers will
refuse to connect to hidden activity. Some would argue that only
those who are trying to hide unlawful activity use such technology
while the other side of the coin argues that such technology is used
as a preventative measure against privacy invasion. For those
considering, it is wise to research for ones self then make an
educated decision.
An alternative to using the TOR Browser is to
acquire services from a
VPN provider. VPN services allow for one to
connect their device through a provisioned server located elsewhere
so that all data transmission is encrypted from the user's device to
that server then to proceed on to its intended destination as normal.
This method is becoming more common as people are becoming more aware
that many organizations are choosing to monitor, harvest, and in some
cases MITM user communications for their own self gain. The following
graphic shows how a VPN service works in a simplified manner.
VPN services are actually pretty cheap in
comparison to the advantages they provide. By using such services,
anytime a person is in a remote location that requires access through
an unknown network, one can almost guarantee a significantly improved
level of privacy and security from their network activity. The image
above shows a simplified version of this. The laptop establishes an
encrypted connection between itself and the VPN server and then
access the Internet from that remote location. Any device between the
laptop and the server which may try to monitor or intercept data only
sees encrypted streams which are indecipherable and appear as a
garbled mess. In most cases, less than $10 a month for a subscription
fee will provide a more than adequate secure connection.
For the more technology inclined, or those who
utilize their own servers such as from companies like
DigitalOcean,
Rackspace, or
Amazon, one can simply establish a port forwarding
connection between their device and their remote server. This
technique is essentially the same as subscribing to a service but
requires a little more technical “know how” to establish the same
level of connection. While requiring a bit more wok from the user,
the cost can be reduced to as little as $6 a month or less to rent a
remote server instance suitable for the task. Many people who utilize
this level of secure communications often use their home devices as
way points for their communications when out and about. In
establishing this type of way point, one must consider the
implications of possible security breaches to their home devices as
their ability to connect remotely also includes the potential for a
malicious individual to break in. In any case, one must always weigh
their threat level with caution and examine all positive and negative
possibilities.
Aside from establishing a secure connection to
transmit data across, one can also focus on the security of the data
itself. At this point, we begin to consider applying technologies
that can insure our communications arrive at their destination
undefiled, and in tact, from our device to our recipients. It is at
this point we would have to include some level of encryption or
digital signature which can be verified by the recipient as good or
valid. This level of security requires active participation from both
parties. While it's entirely possible to digitally sign
communications at the user end and still have that communication be
read at the recipient end without validation, doing so negates the
security advantage of the applied technologies. In my years of
experience with encrypted communications, I have found that an
extremely small percentage of the general public is knowledgeable or
capable of applying such security technologies and thus one should
not assume a recipients compliance to verify against such protocols
regardless of application.
Lets consider a few scenarios in which encrypted
communication can and should be applied by default as well as the
benefits and pitfalls of applying such technologies. Applying
technologies such as
GnuPG to encrypt ones communication prior to
being sent across any network is as easy as installing a program then
following step-by-step instructions. Decades ago, this was a lengthy
and complicated task that only a very small few who worked at the
highest security levels would consider applying. However, in light of
recent events and thanks to developers, applying such security
technologies has advanced to a level of ease that even young school
children can master and apply. The following are only a couple of
examples where encryption of communications or applying a verifiable
digital signature can be beneficial to the average user who
understands and is aware of the pitfalls associated with insecure
networks.
The average public school actively monitors all
communications across their networks. They look for signs of
harassment, illegal activity, emotionally troubled students, and
academic integrity (cheating). In an “ideal” world, this would be
the extent to which monitoring of communications would be active to
insure the integrity of the administration and the student body.
However, network administrators are human just like anyone else and
are just as prone to corruption as anyone else. We must always
remember that “hard access is full access” and a corrupt
administrator (even in a public school) can access most forms of data
at varying levels as well as cover their tracks from supervisors if
necessary. Suppose a “good friend” of one of the schools network
administrators has trouble with their boyfriend who cheated on her
and wants to get “even”? Suppose a corrupt administrator wants
the position as an instructor that pays better? What if a failing
student absolutely “needs” to pass a certain class or a corrupt
instructor is passing students who in all reality shouldn't be? The
list of possibilities can go on for a long time. What can we do to
protect ourselves from corruption at the network administration level
in a public school?
One could potentially change to a different
school. This may be an option for some, but in many cases, changing
schools is not an option as the next closest school may be too far
away. Maybe file a complaint with the school? This may be an option
but don't count on the complaint getting too far unless one has
undeniable, conclusive evidence to support their claim. Public school
network administrators are part of a labor union. The labor unions
assign individuals to act as defense attorneys to protect jobs, even
in the case of corruption. The best one could expect from a complaint
might be a slap on the wrist to the administrator unless the
collected evidence is compelling enough to elicit real legal action
by way of attorney. One must also consider that the corruption may go
as high as the school president in some cases. It's unfortunate and
may seem the “odds are against” but taking offensive precautions
can help prevent such atrocities.
One simple precaution a person can take is to
digitally sign communications used in public schools. Digitally
signing can at least certify that any communication from ones device
was in fact originated from that person and delivered across the
network to its recipient unmodified from its original form. Any
individual with the public key of the author can verify the integrity
of the communication. Should the verification process fail, then
evidence shows conclusively that the communication has been tampered
with sometime during transmission. Digitally signing, and not fully
encrypting, allows “plain text” communications to be stored and
potentially reviewed should any problems arise that would require
review of communications between two parties. Only digitally signed
communications can be considered as trustworthy since unsigned
communications are, for all intensive purposes, suspect of forgery.
One should also be wary of digital communication platforms provided
that do not provide a means of digitally signing communications. Many
public school administrations pass on providing these securities as
they are “options” to their adopted platforms to which they feel
the added technology and expense are unnecessary. In essence, it
tilts the security in favor of possible corruption within the system.
Another scenario includes communications between
government entities and contractors. Competing contractors, corrupt
employees, foreign governments, or possibly even ISP personnel could
potentially intercept communications between two points.
Communications could be modified to tilt in a competitor's favor or
for the financial gain of said entities. In such a scenario, fully
encrypted communications would be more beneficial. Remember the news
article of the cell carrier employee who monitored the US President's
instant messaging contacts? Realistically, there is little one can do
to protect their personal or business interests against such
corruption other than taking offensive precautions with our
information to insure private communication with their intended
recipient. In comparison, ones digital communications are like
sending a message through the mail on either a post card or in a
security envelop. The choice is ultimately up to the sender to the
degree that they determine what their security needs are and what
their proposed threat level is.
Ultimately each company or individual must decide
for themselves what level of communication security is appropriate
for them. There is an old saying within the technology field that
states “security and simplicity are not good bedfellows”. The
greater level of offensive security is always going to mean a
decrease in user simplicity and one must always give way for the
other. Often, ignorance to the possibility gives way to simplicity
until a person actually experiences the ramifications associated with
not applying the necessary level of security. In most cases, and with
most people, it's a “live and learn” scenario. Just the “thought”
of the scenarios proposed are enough to make a person's stomach turn
and more times than not we have to have faith that these types of
things are not happening. The unfortunate truth is that they
happen more frequently than many would want to admit or even think
about.
For further reading and understanding of applying
digitally signed or encrypted communications, read the following blog
post or research “the benefits of digitally signing or encrypting”.
http://roguehorse-how-to.blogspot.com/2015/01/basic-security.html
