Help users in Iran reconnect to Signal

Just over a week ago, we announced that Iranian censors had started blocking all Signal traffic in the country. As an interim solution to help people in Iran get connected again, we’ve added support in Signal for a simple TLS proxy that is easy to set up, can be used to bypass the network block, and will securely route traffic to the Signal service.

This new connection method is supported in the latest Signal Android beta release, and will be rolling out to production users in a few days. Our hope is that this will help many people in Iran start sending and receiving messages again while we continue to explore additional censorship circumvention techniques that will work there.

💡Act as a proxy

✳️ If you want to help by running a proxy, to get started you only need the following:

- A server with ports 80 and 443 available.
- A domain name (or subdomain) that points to the server’s IP address.

The proxy is extremely lightweight. An inexpensive and tiny VPS can easily handle hundreds of concurrent users. Here’s how to make it work:

https://signal.org/blog/help-iran-reconnect/

#signal #help #iran #pleaseshare #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Over a Dozen Chrome Extensions Caught Hijacking Google Search Results for Millions.

New details have emerged about a vast network of rogue extensions for Chrome and Edge browsers that were found to hijack clicks to links in search results pages to arbitrary URLs, including phishing sites and ads.

Collectively called "CacheFlow" by Avast, the 28 extensions in question — including Video Downloader for Facebook, Vimeo Video Downloader, Instagram Story Downloader, VK Unblock — made use of a sneaky trick to mask its true purpose: Leverage Cache-Control HTTP header as a covert channel to retrieve commands from an attacker-controlled server.

All the backdoored browser add-ons have been taken down by Google and Microsoft as of December 18, 2020, to prevent more users from downloading them from the official stores.

https://thehackernews.com/2021/02/over-dozen-chrome-extensions-caught.html

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

You should delete your WhatsApp ASAP

WhatsApp has always been a privacy nightmare. Use Signal and Matrix if you care about your privacy and security!

https://www.youtube.com/watch?v=shpiVm1qpnw

#DeleteWhatsApp #privacy #security #video #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Most proprietary toasters are malware

Help me understand this (really).

Why should software be expected to have source code available? Don't get me wrong - I love SQLite and OpenSSL, but it has nothing to do with having access to the source code.

My toaster did not come with specs and design documents so I can change it. Neither did my power drill or car.

The music I listen do doesn't have synthesizer settings available and raw source before mixing. Movies I watch don't come with scripts, budgets, contacts, location licenses, etc.

What is it specifically about software that makes people think the source must be available? Where does this expectation come from?

https://news.ycombinator.com/item?id=26030126

#opensource #software #why
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Project Gemini

Gemini is a new, collaboratively designed internet protocol, which explores the space inbetween gopher and the web, striving to address (perceived) limitations of one while avoiding the (undeniable) pitfalls of the other.

This server hosts the official specification and other documentation for Gemini, as well as offering free personal Geminispace (managed via sftp) for those wanting to play with the protocol. The vast majority of this content is served via Gemini itself, so you'll need a suitable client to access it.

A small amount of the server's content is also available via HTTPS below, or via gopher.

https://gemini.circumlunar.space/

#gemini #internet #protocol #gopher

Spot the Surveillance - How to Identify Police Surveillance at Protests and Large Gatherings

The Electronic Frontier Foundation’s Kurt Opsahl will show you how to identify surveillance technologies that law enforcement may use at protests and other public gathering to spying on people exercising their fundamental rights. Learn how to spot the surveillance so you can advocate effectively for the policies necessary to protect your rights and bring transparency to the police surveillance.

https://media.ccc.de/v/rc3-11406-spot_the_surveillance

⚠️ This Talk was translated into multiple languages (DE / EN). The files available for download contain all languages as separate audio-tracks.

#rc3 #ccc #police #surveillance #spying #protests #demos #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

With updated app details page

Signal's TLS Proxy Failed to be Probing Resistant

Signal Post: https://signal.org/blog/help-iran-reconnect/

Their Repository: https://github.com/signalapp/Signal-TLS-Proxy

Our Original Issue: https://github.com/signalapp/Signal-TLS-Proxy/issues/3

⚠️ this can be very emotional, but truth works like that

So I've studied this with @studentmain and found it problematic about 4 hours ago.
We immediately reported this through a GitHub Issue, with PoC and advice attached, without even sleeping (it's about 4:00 am in local time)
But @moxie-signal (@moxie0) from @signalapp just closed our issue, saying this:

https://github.com/net4people/bbs/issues/60

https://community.signalusers.org/t/tls-proxy-server-unable-to-survive-active-probing-from-internet-surveillance-systems/27282

#signal #issue #proxy #thinkabout #NotNiceSignal
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Telegram makes them nervous. Notice that they specifically point out that restrictions in place in Signal are similar to Whatsapp and therefore prevent the spread of ideas they don't like.

https://www.nytimes.com/2021/02/03/technology/personaltech/telegram-signal-misinformation.html?smtyp=cur&smid=tw-nytimes

A Wikileaks Road Movie | Full Documentary

A Wikileaks Road Movie: Due to the extraordinary circumstances surrounding the arrests of Julian Assange and Chelsea Manning, Sixteen Films and Journeyman Pictures are providing a time-limited free access to the Wikileaks road movie Mediastan. Mediastan is a documentary film directed by Johannes Wahlström and co-produced by Julian Assange, detailing the publication of the very documents for which both Assange and Manning have been incarcerated.

https://www.youtube.com/watch?v=9n0Yu7bYF9E

#wikileaks #roadmovie #mediastan #docu #documentary #assange #manning #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

🚨🚨 Nevada Governor Wants to Allow Tech Companies to Create Their Own Governments

What could possibly go wrong? 🙄

https://wearechange.org/nevada-governor-wants-to-allow-tech-companies-to-create-their-own-governments/

Pentest-Report Mullvad VPN & Servers 11.-12.2020

“Mullvad VPN AB is owned by parent company Amagicom AB. The name Amagicom isderived from the Sumerian word ama-gi – the oldest word for “freedom“ or, literally,“back to mother” in the context of slavery – and the abbreviation for communication.Amagicom stands for “free communication”.”

This document is dedicated to a presentation of a security-centered project carried outby Cure53 for Mullvad. More specifically, the report describes the results of a thoroughand comprehensive penetration test and source code audit against the Mullvad VPNservers, infrastructure and related web applications and other exposed services. Theproject was completed in late 2020

https://cure53.de/pentest-report_mullvad_2021_v1.pdf

#pentest #mullvad #vpn #report #pdf
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Myanmar: New internet blackout “heinous and reckless”

Responding to credible reports of a widespread mobile internet blackout underway in Myanmar, Amnesty International’s Deputy Regional Director for Campaigns, Ming Yu Hah, said:

“To shut down the internet amid a volatile coup, a humanitarian crisis and a health pandemic is a heinous and reckless decision.

“Since the 1 February coup, people in Myanmar have been forced into a situation of abject uncertainty. An expanded internet shutdown will put them at greater risk of more egregious human rights violations at the hands of the military.

“The military must re-establish all telecommunications immediately and stop putting people’s rights in danger. All mobile operators and telecommunications providers in Myanmar must seek urgent clarification from the Myanmar authorities.”

On 6 February, the Myanmar military reportedly ordered telecommunications companies in the country to fully shut down internet and 4G services. According to information received by Amnesty International, the effective blackout will be in operation until Monday 8 February.

An earlier order, on 5 February, instructed telecommunications companies to block access to Twitter and Instagram.
On 4 February, the military had already announced that they were ordering telecoms operators to block access to Facebook until 7 February.

As the 1 February military coup was underway, internet and phone outages were reported in several parts of the country, including in the capital, Nay Pyi Taw, the largest city, Yangon, as well as Shan and Kachin States and the Mandalay and Sagaing regions. Access was later reestablished.

There have also been mobile internet restrictions in conflict-affected areas of Rakhine and Chin States in the country for more than a year. 4G internet access in those areas was reportedly restored late in the evening on 2 February 2021.

Such restrictions pose a real danger to at-risk civilian populations, especially when access to information is so vital during the COVID-19 pandemic – and even more so when the situation on the ground is so tense amid the coup, and in conflict-affected areas.

https://www.amnesty.org/en/latest/news/2021/02/myanmar-new-internet-blackout/

#myanmar #internet #blackout #AmnestyInternational #thinkabout #why #HelpMyanmar
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

The End of the Privacy of Digital Correspondence

The EU wants to have all private chats, messages, and emails automatically searched for suspicious content, generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance through fully automated real-time messaging and chat control and the end of secrecy of digital correspondence.

In 2020 the European Commission proposed “temporary” legislation aimed at allowing the search of all private chats, messages, and emails for illegal depictions of minors and attempted initiation of contacts with minors. This is to allow the providers of Facebook Messenger, Gmail, et al, to scan every message for suspicious text and images. This takes place in a fully automated process and using error-prone “artificial intelligence”. If an algorithm considers a message suspicious, its content and meta-data are disclosed automatically and without human verification to a private US-based organization and from there to national police authorities worldwide. The reported users are not notified.

Some U.S. providers of services such as Gmail and Outlook.com are already performing such automated messaging and chat controls. Through a second piece of legislation, the EU Commission intends to oblige all providers of chat, messaging and e-mail services to deploy this mass surveillance technology.

https://www.patrick-breyer.de/?page_id=594160&lang=en

#eu #privacy #masssurveillance #surveillance #messaging #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

https://nitter.42l.fr/Thomasbcn/status/1356645088697454596

#Google #ios #privacy #release

Supercookie: Browser Fingerprinting via Favicon

Supercookie uses favicons to assign a unique identifier to website visitors.
Unlike traditional tracking methods, this ID can be stored almost persistently and cannot be easily cleared by the user.

The tracking method works even in the browser's incognito mode and is not cleared by flushing the cache, closing the browser or restarting the system, using a VPN or installing AdBlockers.

https://github.com/jonasstrehle/supercookie

#supercookie #browser #tracking
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

More CopperheadOS harassment proof

Wow, I'm late to this, but having a lawyer send a letter to a student's university to try to get them in trouble for open source contributions they made on their own time is very not ok.

https://nitter.nixnet.services/FiloSottile/status/1358231799458103297

#copperheadOS #harassment #proof #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

NewPipe x SponsorBlock

A fork of NewPipe with SponsorBlock functionality.

The implementation is still a bit basic but it generally works pretty well.

💡 How can I get this?

Builds will be uploaded in the Releases section. Please download the APK from the newest release and install it on your device.

💡 Why isn't this in upstream NewPipe?

The developer team behind the official NewPipe decided that they do not want to include this kind of functionality in their app. See https://newpipe.schabi.org/blog/pinned/newpipe-and-online-advertising/ and https://github.com/TeamNewPipe/NewPipe/pull/3205 for more information and discussion.

We obviously disagree but we respect their decision and continue to offer SponsorBlock in NewPipe via this fork.

https://github.com/polymorphicshade/NewPipe#newpipe-x-sponsorblock

#newpipe #sponsorblock

VoltPillager: Researchers Compromise Intel SGX With Hardware-Based Undervolting Attack

Security researchers out of the University of Birmingham have crafted another attack against Intel Software Guard Extensions (SGX) when having physical motherboard access and using their "VoltPillager" hardware device they assembled for about $30 USD.

Two years ago Plundervolt was widely publicized for compromising Intel's SGX security by manipulating the CPU frequency/voltage as able to through software interfaces. By carefully undervolting the Intel CPUs when executing enclave computations they were able to ultimately compromise the integrity of SGX.

The impact of Plundervolt was already limited as typically the software needs root/administrative rights to access the CPU voltage/frequency MSRs or other kernel interfaces for manipulating them. But in response to Plundervolt, motherboard vendors began offering options to allow disabling voltage/frequency interface controls on their systems. Following Plundervolt, security researchers at the University of Birmingham in the UK began exploring a hardware-based attack on SGX.

https://www.phoronix.com/scan.php?page=news_item&px=VoltPillager-HW-Undervolt

#research #VoltPillager #undervolting #attack #intel #sgx
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

If you are still releasing custom ROMs/kernels with permissive, YOU ARE LITERALLY BACKDOORING YOUR USERS!

Remember when I said using SELinux permissive is really bad? Here is a privilege escalation PoC where the only requirement is SELinux permissive. If you are still releasing custom ROMs/kernels with permissive, YOU ARE LITERALLY BACKDOORING YOUR USERS!

https://nitter.nixnet.services/topjohnwu/status/1359054106019565571

https://github.com/vvb2060/Magica

#selinux #backdooring #customrom #topjohnwu #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag