Difference between revisions of "Classes/Logs/2012/September/17/03-04"

Latest revision as of 02:55, 18 September 2012

03:05 <@rorschach> I'm gonna be discussing online anonymity
03:05 <~hatter> ty sir
03:05 <%foo> Apollo: during part 2 we'll open with your question.
03:05 < lighthouse> yes!
03:05 <@rorschach> obligatory disclaimer: don't do anything illegal with this knowledge.
03:05 < lighthouse> haha
03:06 <@rorschach> from a technical side
03:06 < Atlas> rorschach, goes without saying.
03:06 <%foo> jail is bad cuz they take away all your toys
03:06 < Atlas> ^
03:06 <@rorschach> tor is helpful, but most useful in conjuction with proxies and shells
03:07 <@rorschach> my current setup involves chains of all of the above
03:07 <~hatter> go ahead rorschach 
03:07 <@rorschach> you can easily chain tor and shells with socat tunnels
03:07 <@rorschach> I'm going
03:07 <@rorschach> :)
03:07 < lighthouse> you should make a tutorial on that
03:07 -!- dsog [[email protected]] has joined #CSIII
03:07 -!- ptolemy [[email protected]] has joined #CSIII
03:09 <@rorschach> sorry, my internet is derping really hard
03:09 <@rorschach> but anyway
03:09 <@rorschach> socat is really useful
03:09 <@rorschach> it's kind of complicated at first but can be installed from most repos
03:09 <@rorschach> e.g. apt-get install socat
03:10 <@mepholic> ugh
03:10 <@mepholic> any ipv6 nerds itc?
03:10 <@rorschach> so, I'll walk through my setup
03:10 < lighthouse> what about windows?
03:10 <~hatter> mepholic: classes are in schedule
03:10 <~hatter> in session
03:10 <@rorschach> it looks like me -> vps 1 -> tor ->  -> vps 2 -> tor -> world
03:10 -!- dsog [[email protected]] has quit [client exited: leaving]
03:10 <@rorschach> lighthouse: not sure, but you should be ok once you see what I'm doing
03:11 < lighthouse> ok
03:11 <@rorschach> so, I ssh into vps 1
03:11 <@rorschach> which has a socat tunnel listening on a port on the inside
03:11 <@rorschach> socat TCP4-LISTEN:port,fork,bind=localhost SOCKS4A:localhost:address.onion:port,socksport=9050 &
03:12 < lighthouse> um I see smiley faces after LISTEN and onion
03:12 < lighthouse> sorry to interupt, its pidgin being gay
03:12 <%foo> lighthouse: turn off emoticons when in technical channels :-)
03:12 <@rorschach> this transparently routes a connection to a give port
03:13 <@rorschach> TCP4-LISTEN is the listerner
03:13 <@rorschach> the port is the listener's port, it forks and is bound to localhost so it can't be access externally
03:13 <@rorschach> then I have a SOCKS4A listener
03:14 <@rorschach> the first parameter (localhost) tells it the socks proxy it's going to connect to is on localhost
03:14 <@rorschach> then you have address.onion, which is the adderss that you're connecting too (in this case an onion, 
                   but it's not necessary)
03:14 -!- zekiel [[email protected]] has joined #CSIII
03:14 <@rorschach> and then the port number to tunnel to
03:15 -!- dsog [[email protected]] has joined #CSIII
03:15 <@rorschach> socksport is the port number of the socks proxy (9050 for tor)
03:15 -!- adroc [[email protected]] has joined #CSIII
03:16 <@rorschach> now, I have on VPS 2 a tor hidden service SSH
03:16 <@rorschach> when editting /etc/tor/torrc scroll down to the hidden service section and create on, it's pretty 
                   straightforward
03:17 <@rorschach> it's also a good idea to rm /var/log/wtmp this prevents the server from keeping a last log
03:18 <@rorschach> so restart tor
03:18 <@rorschach> you can find the onion hostname in /var/lib/tor/[hiddenservicedirectory]/hostname
03:19 <@rorschach> now, setup the socat listener on VPS 1 with that onion address and try sshing to it (ssh -plistener 
                   user@localhost)
03:19 <@zzzzzZZZZzzz[m3n]> lighthouse, not to knock, pidgin is the worst irc client, and moreover it is the worst irc 
                           client. also tools -> prefferences -> themes -> choose smiley theme 'none'
03:20 -!- dsog [[email protected]] has left #CSIII []
03:20 < lighthouse> yeah, turned it off, thanks 
03:20 <@rorschach> if that works then you can edit /etc/ssh/sshd_config and set ListenAddress to localhost
03:20 -!- dsog [[email protected]] has joined #CSIII
03:20 <@rorschach> then restart your ssh server
03:20 -!- mode/#csiii [+v Atlas] by hatter
03:20 <@rorschach> note: when making changes to Tor, this should NOT be done over a tor hidden service connection, it 
                   won't come back up.
03:21 <@rorschach> ok so now to connect to your vps 2
03:21 < lighthouse> wait can you clarify that lastr part
03:21 <@rorschach> you would (if everything is setup correctly)
03:21 <@rorschach> from your local box
03:21 < lighthouse> about not making changes to Tor
03:21 <@rorschach> which the note?
03:21 < lighthouse> yeah
03:22 <+Atlas> Thank you
03:22 <@mepholic> cocks
03:22 <@rorschach> if you are SSH'd into a tor hidden service, if you restart tor it will stop tor, but it won't start it 
                   again and you'll be disconnected, always have a backup direct connection through your VPS provider
03:22 < lighthouse> lol
03:22 <@mepholic> please excuse me
03:22 <@rorschach> mepholic: shh
03:22 <@rorschach> make sense lighthouse?
03:23 <@rorschach> ok so from your socal box, you 
03:23 < lighthouse> I think so, so you are saying make changes, THEN connect?
03:24 <@rorschach> no, make tor changes over a direct connection
03:24 < lighthouse> ok
03:24 <@rorschach> if possible, if not then this setup isn't recommended
03:24 <@rorschach> (and obviously, connect to the direct connection via tor)
03:24 <@rorschach> ok
03:25 <@rorschach> ssh -L9999:localhost:[socat listener port] -p [vps 1 port] user@vps1
03:25 <@rorschach> this will connect you to vps 1 via SSH and setup a local port forward to the socat listener on port 
                   9999
03:26 <@rorschach> you then, ssh -D9998 -p9999 user@localhost
03:26 -!- sheexy [[email protected]] has joined #CSIII
03:26 <@rorschach> this would connect you to vps 2 and setup a dynamic forward (a socks proxy, like tor) that you can use 
                   for say, your browser
03:26 <@rorschach> or port 9998
03:26 <@rorschach> does this make sense so far?
03:26 <+Atlas> Yep
03:26 -!- lighthouse1 [[email protected]] has joined #CSIII
03:27 -!- lighthouse1 [[email protected]] has quit [client exited: Leaving.]
03:27 < Apollo> I'm curious what the purpose of the second vps inside tor is for. wouldnt this just add another 3 hops 
                inside the tor network, adding to latency without adding any obscurity?
03:28 -!- lighthouse [[email protected]] has quit [Ping timeout]
03:29 <@rorschach> hold on Apollo 
03:29 <@rorschach> ok, now in vps 2
03:30 -!- lighthouse [[email protected]] has joined #CSIII
03:30 <@rorschach> we're going to setup a transparent tor proxy
03:30 <@rorschach> (essentially, a tor vpn)
03:30 <@rorschach> http://pastie.org/pastes/4735625/text?key=13yf67axuisqrgo27rca
03:30 <@rorschach> so in there, I have iptables rules that wil ONLY allow tor traffic and route all traffic through a 
                   transparent tor listener
03:31 <@rorschach> and then in torrc add those lines
03:31 <@rorschach> (again do this inside your vpn provider's shell)
03:32 <@rorschach> so now when you connect to the dynamic forward locally, your connection gets routed through vps 1 -> 
                   tor -> ps 2 -> and tor again
03:32 -!- ptolemy [[email protected]] has quit [client exited: Leaving]
03:32 <@rorschach> automatically
03:32 <@rorschach> this might be overkill, but it works fine for me
03:32 <@rorschach> and it's actually not as solw as you would think
03:32 <@rorschach> depending on the tor nodes you get
03:32 <@rorschach> (browsing will probably be unbearable, but if you're using it for IRC or something you're untraceable)
03:33 <@rorschach> and I use a proxy at the very end of the chain for IRC
03:33 <@rorschach> just because most places ban tor nodes
03:33 <@rorschach> (lol, like wtfux)
03:33 <@rorschach> ok, now you will want to separate your personal from this
03:33 <@rorschach> so don't use this for browsing facebook or something
03:34 <@rorschach> keep everyithng segregated, you could even use vps 1 as your personal proxy (that's what I do)
03:34 <@rorschach> also, in firefox, youc set dns tunneling through about:config
03:34 <@rorschach> scroll down to network.proxy.socks_remote_dns and set to true
03:35 <@rorschach> this is probably way over kill, but you are a total ghost
03:35 <@rorschach> oh, I said that already, derp
03:35 <@rorschach> sorry
03:35 <+rory> thats so cool
03:35 <@rorschach> ok anyway
03:35 <@rorschach> so that's the technical side
03:35 < dsog> rorschach: +1
03:36 <@rorschach> and once everything is configured it's extremely simple to use
03:36 <@rorschach> also, buy your vps over a US based proxy + tor and using a vanilla visa payed for in cash
03:36 <@rorschach> these can be bought at gas stations, duse common sense
03:37 <@rorschach> use*
03:37 <@rorschach> don't go buy your porn with it too or something
03:37 -!- mike is now known as mike__
03:37 <@rorschach> they have to be registered at vanillavisa.com but all they ask for is a zip code and they don't care 
                   what you put in
03:37 -!- mike__ is now known as mike
03:37 <@rorschach> I use their example zip code: 30303
03:38 <@rorschach> also, if something requires a phone to register, you can use pinger.com/tfw/ for a phone number and 
                   texting for free
03:39 -!- williamcll [[email protected]] has joined #CSIII
03:39 < Zalgo> [williamcll] why are you all so nice to me???
03:39 <@rorschach> now, make sure to use nicknames that are not used elsewhere
03:39 < williamcll> what?
03:39 <@rorschach> williamcll: mibbit.. really? you're in the wrong talk
03:39 <@rorschach> or maybe the right one.
03:39 <+rory> ^
03:40 <@rorschach> moving on
03:40 <%foo> ^
03:40 < williamcll> rorschach: well, mirc broke
03:40 <@rorschach> use a nickname that you haven't used before, pick it out of a hat 
03:40 <@rorschach> irssi brah
03:40 <+rory> ^
03:40 <@rorschach> when you're chatting use common sense, don't say I'm going to bed, say you're going to work instead
03:41 <@rorschach> whateer, don't trust anyone
03:41 <@rorschach> just have good opsec that way, you don't need to me to tell you that
03:41 <%foo> I think you do need to emphasize that a bit more
03:41 <@rorschach> also, IRC from vps 2
03:41 <@rorschach> foo: ok
03:41 <@rorschach> don't let anything on to anyone
03:42 < williamcll> rorschach: I will use irssi when I get an amazon kindle
03:42 <@rorschach> (depending on how anonymous you can be, in the case of rorschach, I don't really care, but toher nicks 
                   I might)
03:42 <@rorschach> don't tie your nick to your real name, or a doxed nick
03:42 <@rorschach> it's never too late to disappear and reinvent yourself
03:43 <@rorschach> don't even let on your country or timezone
03:43 <@rorschach> obviously, don't set your vps's time :)
03:43 <@rorschach> is that good foo?
03:44 <%foo> yarp
03:44 <%foo> thanks
03:44 <@rorschach> also, if you're gonna hack
03:44 <@rorschach> don't join a group
03:44 <@rorschach> don't media whore
03:44 <@rorschach> don't twitter
03:44 <@rorschach> don't pastebin
03:44 <@rorschach> don't deface
03:44 <@rorschach> don't draw attention to yourself
03:44 <@rorschach> just do it
03:44 <@rorschach> and don't get caught
03:44 <@rorschach> :)
03:44 <@rorschach> but again, don't do that.
03:45 <@rorschach> don't sign your nick, etc.
03:45 <%foo> don't cause collatoral damage or harm
03:45 <%foo> that draws attention to you
03:45 <@rorschach> I think that about covers it.
03:45 <@rorschach> yup
03:45 <@rorschach> so in review
03:46 <@rorschach> setup a nice proxy chain, you can have your own way, I detailed ONE way to do it
03:46 <@rorschach> use cash-bought vanilla  visas for purchases such as vps
03:46 <@rorschach> don't reuse nicknames
03:46 <@rorschach> and don't talk about shit.
03:47 <@rorschach> and separate personal from anonymous.
03:47 <@rorschach> any questions?
03:47 <@rorschach> also, my proxy setup is so thorough, because I wanted it to be undetectable from both sides
03:47 < dsog> For IRC, you said you use *another* proxy to connect to servers that prevent tor traffic.
03:47 <@rorschach> for personal reasons.
03:47 < dsog> Do you set that up on vps2? or yet another server?
03:48 <@rorschach> but when monitoring my traffic, all you can see is that I am SSH'd into VPS 1
03:48 <+Atlas> Oh, dox alerts.
03:48 <+Atlas> I was really bad about that for a while
03:48 <@rorschach> dsog: I go find a public proxy list, then find one that works / isn't banned and setup a socat tunnel 
                   to it for SSH
03:48 <+Atlas> Using local timestamps, "good night", etc.
03:48 <+Atlas> Don't do that ^
03:48 <@rorschach> Atlas that's not a bad idea either
03:48 < Apollo> Yeah, in the example you used vps 2 was inside tor. why stop there instead of just routing through tor?
03:49 <@rorschach> setup a google alert for your name
03:49 <@rorschach> whenever your name shows up on the net, you'll see it
03:49 <@rorschach> (real and nick) (use separate acconuts for this...)
03:49 <@rorschach> Apollo:
03:50 <@rorschach> IRC looks like: me -> vps 1 -> tor -> vps 2 -> tor -> proxy -> irc
03:50 <%foo> Apollo: tor acts as a mixer and has a tendency to block ports, you also don't want tor to be your exit
03:50 <@rorschach> this allows me to bypass tor bans
03:50 < dsog> rorschach: makes sense. Thanks :)
03:50 <%foo> your exit node becomes the vulnerable host in a tor chain, one of your proxies should run tor to keep the 
             traffic mixed up
03:50 <@rorschach> this offers me multiple layers of encryption and anonymity when I want it 
03:50 <+Atlas> rorschach, are you that thorough with other services or just IRC?
03:51 < Apollo> oh, so the traffic exits tor before hitting vps 2?
03:51 <%foo> but when you maintain long connections (ssh, openvpn) you leave yourself succeptable to traffic analysis
03:51 <@rorschach> Atlas: mostly IRC, but I port scan or whatever from that box and occaisonally browse when I'm being 
                   paranoid, just whatever I want to be parannoid about
03:52 <+Atlas> I didn't want to use the word "paranoid", since one could argue necessity
03:52 <+Atlas> But, yeah, understood
03:52 <@rorschach> and the way it's all setup, I don't have to know the IP address of VPS 2 at all
03:52 <+Atlas> Oh, back to my own fuck-ups, at one point someone did me the courtesy of changing my local time to UTC in 
               a logfile I was going to post.
03:52 <@rorschach> I actually sometimes give people accounts on vps 2, and have it so ONLY root can see the IP
03:52 <+Atlas> rorschach, oh, wow.
03:53 <@rorschach> and they can't even know the tor hostname the way vps 1 is setup
03:53 <@rorschach> ;)
03:54 <@rorschach> any other questions?
03:54 <%foo> another interpretation: me -> vps 1 (with tor non-exit) -> tor network -> vps 2 (tor non-exit + ssh/openvpn 
             hidden service) -> proxy ssh -> irc
03:54 <@rorschach> also, /ignore * ctcp dcc
03:54 <@rorschach> :)
03:54 <%foo> rorschach: ^ similar design to yours, elaborated a bit. 
03:54 <@rorschach> yeah
03:54 <@rorschach> there's lots of ways to do it
03:55 <@rorschach> just gotta find what works for you
03:55 <%foo> it's all about mixing up and masking traffic
03:55 <%foo> making it harder to find the signal in the noise
03:55 <@rorschach> yup
03:55 <@rorschach> I'm not anonymous on here, but when I want to be a ghost, good luck :)
03:55 <%foo> and if you run a tor exit node having good DMCA responses avaialble. 
03:56 -!- williamcll [[email protected]] has quit [client exited: http://www.mibbit.com ajax IRC Client]
03:56 <%foo> ghosting is a good skill to have. 
03:56 <@rorschach> yep
03:56 <@rorschach> important