Seguridad digital/Digital Security
- EVALUATION CRITERIA BEFORE PRODUCING NEW DOCUMENTATION
Don't reinvent the wheel (is it duplicating upstream work) Who's the public & what are the objectives (security & technical level) Who's behind it? (long-term project vs one shot, collaboration) Threat modelling (security is a process, not a set of tools) Maintainability (is it updated, open source, update frequency needs, etc.) Translation & translatability (tools, length, language, cultural translation, easiness to provide translation to group, etc.) User feedback & peer review, (criteria: correct, complete, up to date, translated, indicate always the last date the manual has been updated/released) Support, hotlines after reading manuals, if you still have questions Ethical/trans-queer-feminist "approved" manual
- AVAILABLE DOCUMENTATION
Activist security:
http://www.activistsecurity.org/
General security purpose off line for activists
Kit didactico Genero, TIC y Activismo (Spanish and Catalan):
http://www.donestech.net/files/KIT_CAST_5.pdf
Been downloaded a lot, positive feed back a lot of interest from feminists in latin america, should be upated but can address a global audience.
Radical Community Manager - basicly Twitter, Facebook and non-secure communication to reach the mainstream (Spanish):
http://nocionescomunes.wordpress.com/2011/10/10/radical-community-manager-breves-nociones-para-aprender-a-comunicarse-organizarse-y-luchar-en-las-redes-2-0/
Security in a box (Spanish):
https://securityinabox.org/es
Community Focus: Digital Security in Context
https://securityinabox.org/communities
Tools and Tactics for the LGBTI Community in the Arabic region
Tools and Tactics for the LGBTI Community in sub-Saharan Africa
Tools and Tactics for the Environmental Rights Defenders in sub-Saharan Africa
Alternativas por prism-break (Spanish):
https://prism-break.org/#e
Alternativas por tactical tech (English):
https://cooperativa.ecoxarxes.cat/bookmarks/view/230845/quick-guide-to-alternatives
List of guides on security and alternative service providers (Spanish and English):
https://www.riseup.net/es/resources
https://help.riseup.net/en/security/resources
https://help.riseup.net/es/security/resources/radical-servers (eng only)
FLOSS manuals: Bypassing censorship (English, Spanish, and more):
http://www.flossmanuals.net/bypassing-censorship/
http://en.flossmanuals.net/bypassing-es/
FLOSS manuals: Basic Internet Security (English):
http://www.flossmanuals.net/basic-internet-security/
Lilithlela cyberguerrila (English):
https://lilithlela.cyberguerrilla.org/
EFF surveillance toolkit (English):
https://ssd.eff.org/
Versión for printing: https://ssd.eff.org/book/export/html/14
Guide d’autodéfense numérique (French):
https://guide.boum.org/
Tails documentation (English, French, and German):
https://tails.boum.org/doc/
Cryptoparty Handbook (German & English):
http://www.cryptoparty.in/documentation/handbook
Cryptoparty fork (the terms crypto and party are misunderstood):
Privacy Café https://privacycafe.nl/ (Dutch)
Café vie privée https://café-vie-privée.fr/ (French)
Encryption Works (English and Portuguese):
https://pressfreedomfoundation.org/encryption-works
GPG Encryption Guide (English)
http://www.tutonics.com/2012/11/gpg-encryption-guide-part-1.html
5 of the best Free Linux Encryption Tools (English)
http://www.linuxlinks.com/article/2011040308270275/DiskEncryption.html
Partially outdated (TrueCrypt) / mterial ranking options need to be frequently updated
Comparison of disk encryption software (English, Bahasa Indonesia)
http://en.wikipedia.org/wiki/Comparison_of_disk_encryption_software
Not a real reference howto or article, but useful for discovering new encryption methods and tools related to them.
Equalit/Frontline: Digital Security and Privacy for Human Rights Defenders (English)
https://equalit.ie/esecman/index.html
Security Hosting Guide from Equalit.ie
https://learn.equalit.ie/wiki/Choose_a_hosting_provider
Staying Safe: Security Resources for Human Rights Defenders (English):
https://www.newtactics.org/conversation/staying-safe-security-resources-human-rights-defenders
Your Legal Guide to Digital Security for Arab Human Rights Activists (English):
http://globalvoicesonline.org/2013/04/22/your-legal-guide-to-digital-security-for-arab-human-rights-activists/
"Our Right to Safety: Women human rights defenders' holistic approach to protection" (English):
http://protectionline.org/2014/03/13/publication-by-awid-and-whrd-ic-our-right-to-safety-women-human-rights-defenders-holistic-approach-to-protection/
PDF: http://protectionline.org/files/2014/03/our_right_to_safety_en.pdf
Protection Manual for LGBTI Defenders
www.eidhr.eu/files/dmfile/protection-manual-or-lgbti-defenders_en.pdf
Take Back the Tech (English, Spanish, French)
https://www.takebackthetech.net/
https://www.takebackthetech.net/be-safe/privacy
Mobiles phones security manuals
Quema tu móvil (Spanish):
https://quematumovil.pimienta.org/
A practical guide to protecting your identity and security when using mobile phones (many languages including spanish, french, arabic, etc)
https://www.wefightcensorship.org/es/article/proteja-sus-datos-y-anonimato-en-su-telacfono-ma3vilhtml.html
Mobile Phone Security and Android Apps:
http://en.flossmanuals.net/tech-tools-for-activism/mobile-phone-security-and-android-apps/
Use mobile phones securely :
https://techtoolsforactivism.org/content/use-mobile-phones-securely
TextSecure manual: send encrypted SMS/text messages
http://en.flossmanuals.net/basic-internet-security/ch048_tools-secure-textmessaging/
Avoid fake base stations / man in the middle attack with cell tower
https://secupwn.github.io/Android-IMSI-Catcher-Detector/ (english)
Shield for mobile
http://killyourphone.com/
Non-textual formats
Videos Ono robot (Spanish):
https://onorobot.org/languages
Me and my shadow (Spanish):
https://myshadow.org/es
Data Dealer (online game, English):
http://datadealer.com/
EFF panopticlick, IP Check (browser fingerprinting tools, English):
https://panopticlick.eff.org
http://ip-check.info
The Internet (Doesn't) Need Another Security Guide (video, English)
https://www.youtube.com/watch?v=VHgs3YcxzXw
Unlike Us Network - Institute of Network Cultures (organization, Enligsh)
http://networkcultures.org/unlikeus/
Paper books
Information Security for Journalists (English)
http://files.gendo.nl/Books/Information_Security_for_Journalists_v1.01.pdf
Infographics & comics
Email self-defense (English)
https://emailselfdefense.fsf.org/en/infographic
XKCD on PGP (English)
http://www.explainxkcd.com/wiki/index.php/1181:_PGP
http://www.explainxkcd.com/wiki/index.php/897:_Elevator_Inspection
Joy of tech
http://www.geekculture.com/joyoftech/
Tor and HTTPS (English, Spanish, and more):
https://people.torproject.org/~lunar/tor-and-https/en/tor-and-https.svg
https://people.torproject.org/~lunar/tor-and-https/es/tor-and-https.svg
TOOLS/STORIES
=
Harass map (English, Arabic):
http://harassmap.org/en/
Hollaback ending street harassment (multiple languages)
http://www.ihollaback.org/
The Guardian Project :
https://guardianproject.info/apps/
Orbot: Proxy With Tor
Orbot brings the capabilities of Tor to Android. Tor uses Onion Routing to provide access to network services that may be blocked, censored or monitored, while also protecting the identity of the user requesting those resources.
https://guardianproject.info/apps/orbot
Orweb: Private Web Browser
Orweb is a privacy enhanced web browser that supports proxies. When used with Orbot, Orweb protects against network analysis, blocks cookies, keeps no local browsing history, and disables Flash to keep you safe.
https://guardianproject.info/apps/orweb
InformaCam
InformaCam is a plugin for ObscuraCam that allows the user, without much intervention on their own part, to inflate image and video with extra points of data, or metadata. The metadata includes information like the user’s current GPS coordinates, altitude, compass bearing, light meter readings, the signatures of neighboring devices, cell towers, and wifi networks; and serves to shed light on the exact circumstances and contexts under which the digital image was taken
https://guardianproject.info/2012/01/20/introducing-informacam/
Panic Button: How to turn a mobile phone into an alert system for activists
https://panicbutton.io/
http://livewire.amnesty.org/2013/04/15/how-to-turn-a-mobile-phone-into-an-alert-system-for-activists/
Kill Packet
This post explores a hypothetical case where one has volatile data on a remote machine that needs to be removed as fast and as discretely as possible without having to open up a laptop and log in via SSH, an SFTP/FTP browser
http://julianoliver.com/output/log_2013-02-24_19-21
Videre
Effective documentation and exposure are vital factors in the fight against human rights violations. Videre, an international charity founded in 2008, gives local activists the equipment, training and support needed to safely capture compelling video evidence of human rights violations. This captured footage is verified, analysed and then distributed to those who can create change.Videre’s unique approach addresses the lack of reach, security, verification and impact that hampers civil society’s current efforts to expose human rights abuses. We reach out to those groups and individuals that traditional or new media cannot; ensure the security of activists who film violations; verify footage before use; and follow through to ensure effective distribution and measurable impact.
http://www.videreonline.org/
TRANSLATION RESOURCES
=========
https://coati.pimienta.org/: simultaneous interpretation technologies, and manuals for interpretation in events
Translation collectives:
http://guerrillatranslation.com/
http://fr.mondo-lingua.org/
http://translatorswithoutborders.org/
Web-based translation tools and communities:
https://transifex.com/
https://weblate.com/
Type of material
====
Audio, video, text ???
Generic / specific (targetting a global audience vs specific traget group)
Tools and/or methodologies (manual howto or manual state of mind)
PROBLEMS & EXPERIENCES
==========
What is missing? A lot of material is only available in English / Need for cultural translation & fiting lifestyle worlds (not only language)/ Not enough embedded documentation / manuals for mobile phones / more material infographics/videos/audios / Always trouble to find right material for right target groups / like a lot tactical tech/ sensation that people do not read so RTFM does not work / interested in developping tactics and praxis Activists relalated to 15th may movement, not really aware of digital security... need to use mainstream tools like twitter but also needs to learn new tactics to protect privacy / Need for more material for smartphones and mobile phone users https://pad.riseup.net/p/THF_security_documentation_mobiles Need for translation in the sense of embedding and interested in filling the gaps to make steps between need for visibility and invisibilty oscillate Lacking not so much documentation about how to use tools but documentation that embeds contexts and situations of target groups Understanding privacy as a collective value. Maybe you're priviledged and don't need it, but people communicating with you do need or desire it. Broad concepts of information security:
- availability, access control, secrecy - authenticity, identity management, anonymity - reliability, denial-of-service
Problems experiences with cryptoparties / cf also article of asher wolf "hacker community we need to talk?'/ http://inewp.com/dear-hacker-community-we-need-to-talk/ Some participants points at the fact that security has become an issue, more important and central last year for feminist gorups. before we would try to convince them and now they look for us Set of visual icons to label the manual (quickglance to grasp an idea about the manual quality) Specific groups: activists, feminists, artists, immigrants, age groups (younger people are not using email anymore)
SECURITY DOCUMENTATION MOBILES
Main Topics: Cases/Intro, Preparing an action, Promoting an action, during an action
Intro: about mobiles and security
Notes on the notion of security
Which type of operative systems for mobile (degrees of "security" they offer)
Ways to track a mobile phone (agnez checks for dumb phones, gsm tracking)
Tools to prepare and coordinate actions quickly
Instant messaging: Telegram (Marta checks security issues and manuals)
Another instant messaging possibility: Chatsecure with Jabber
To get info: SecureDrop
Proxy for Android: Orbot
Share, Communicate over VIRTUAL PRIVATE NETWORK (VPN)
To avoid using a phone: netbook with Tails
To avoid using your smartphone: Dumbphone/Multifunctional phone/ Burner phone and pre-paid sim card
To avoid fake base stations in GSM/UMTS network
Tools to spread the call for the actions safely
Twitter Proxy
Facebook Proxy
Tor Browser Bundle
Anonymous emailing
Tools to communicate the action
Streaming: Bambuser proxy? any anonymous streaming server?
Reporting: StoryMaker
Creating evidence: InformaCam
Documenting: Mobile Martus
4. Images and illustrations for the previous tools This is a generic manual, if you distribute it locally or translate it, we suggest to add info about the legal situation and the activist context.
MANUALS:
Quema tu móvil (Spanish):
https://quematumovil.pimienta.org/
A practical guide to protecting your identity and security when using mobile phones (many languages including spanish, french, arabic, etc)
https://www.wefightcensorship.org/es/article/proteja-sus-datos-y-anonimato-en-su-telacfono-ma3vilhtml.html
Mobile Phone Security and Android Apps:
http://en.flossmanuals.net/tech-tools-for-activism/mobile-phone-security-and-android-apps/
Use mobile phones securely :
https://techtoolsforactivism.org/content/use-mobile-phones-securely
TextSecure manual: send encrypted SMS/text messages
http://en.flossmanuals.net/basic-internet-security/ch048_tools-secure-textmessaging/
Avoid fake base stations / man in the middle attack with cell tower
https://secupwn.github.io/Android-IMSI-Catcher-Detector/ (english)
1// INTRO: ABOUT MOBILES AND SECURITY 1.1. Notes on security (can be written editing notes from yesterday's session: https://pad.riseup.net/p/THF_security_documentation decide on threat model, the more vulnerable a person the stronger the security measures they need to use don't forget analogue, meeting in real life, sending snail mail, using payphones the weakest link is human. you may have used all the best privay and anonymity techniques for years and a friend or family member can accidently out you by sending you a facebook message: hey i saw you in a photo. https://securityinabox.org/en/chapter-11 https://securityinabox.org/en/chapter_3_1 In mobile phones, information is vulnerable in many ways: each mobile phone provider has full access to all text and voice messages sent via its network. Phone providers in most countries are legally obliged to keep records of all communications. Voice and text communication can also be tapped by third parties in proximity to the mobile phone, using inexpensive equipment. Mobile phones can store all sorts of data: call history, text messages sent and received, address book information, photos, video clips, text files. These data may reveal your network of contacts, and personal information about you and your colleagues. Phones give out information about their location. 1.4. Which type of operative systems for mobile (degrees of "security" they offer)
the OS may well include hidden features enabling better monitoring by the service provider of any particular device.
-Blackberry(Non-open source)
http://en.wikipedia.org/wiki/BlackBerry#Intelligence_agency_access
-Android:
-Cyanogenmod(http://www.theverge.com/2013/12/9/5191778/cyanogenmod-rolls-out-encrypted-text-messaging-by-default-whisper-systems )
-Boeing Black(Probably non-commercial, non-open-source just for US Security)
-iOS
1.3. Ways to track a mobile phone As part of normal operation, every mobile phone automatically and regularly informs the phone service provider where it is at that moment. What's more, many phones nowadays have [GPS]](/en/glossary#GPS) functions, and this precise location information may be embedded in other data such as photos, SMS and internet requests that are sent from the phone. This link provides an in-depth knowledge about how mobile networks and mobile devices are vulnerable to attacks, in our means this is being able to be traceable: https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks It needs simplification to be used by us also. Threat Levels:
-Monitoring your network traffic. It can be a cell tower, a user on your local Wifi, router etc.
-Fake cell towers used by police: "Stingray" http://www.extremetech.com/mobile/184597-stingray-the-fake-cell-phone-tower-cops-and-providers-use-to-track-your-every-move (more reliable source)
- Pratical example of spying (https://www.youtube.com/watch?v=fQSu9cBaojc)
-Service providers may be obligated to give information to police and goverment in some countries??(source)
-Wifi Tapping(needs source)
-Through accessing your physical hardware(It can be both a user that has access to your mobile device or an adversary that has attained to your lost/stolen mobile device)
-Through using malwares, vulnerable application. Also modified versions of legitimate applications and operating systems.
-Untrusted data that send to you via an application that can contain injection vectors.
-Untrusted or weak developed applications that contains security flaws:
-http://www.csoonline.com/article/2134120/mobile-security/manufacturers-building-security-flaws-into-android-smartphones.html
-Super paranoid NSA level stuff:
-http://www.slate.com/blogs/future_tense/2013/07/22/nsa_can_reportedly_track_cellphones_even_when_they_re_turned_off.html
1.2 GSM GSM communication is not tap-proof ! GSM non-secure presentation at ccc december 2010 http://gizmodo.com/5719940/breaking-gsm-security-with-a-15-phone - Whatever assurances have been given about the security of GSM cellphone calls, forget about them now. - GSM is insecure, the more so as more is known about GSM = > ?? maybe GSM security is insignificant for our project as it is clear that GSM is simply not secure//Besides the GSM network there is only Wifi that can be used by mobile phones and they are not very accesible in an event of demonstrations?+1 Metadata tracking Network analysis 2// TOOLS TO PREPARE AND COORDINATE ACTIONS QUICKLY 2.1. Telegram Security issues:
- Multiple devices https://github.com/DrKLO/Telegram/issues/208 - Non-official apps could be a risk (e.g. Webogram is not official) - https://blog.thijsalkema.de/blog/2014/04/02/breaking-half-of-the-telegram-contest/
BUT Telegram is the most popular free software for instant messaging, so we may trust its big community as relatively reliable. But their servers software is still not free. 2.2. Chatsecure with Jabber "Orbot has the ability to transparently torify all of the TCP traffic on your Android device when it has the correct permissions and system libraries" https://www.torproject.org/docs/android.html.en https://play.google.com/store/apps/details?id=org.torproject.android&hl=es 2.3. To get info: SecureDrop 2.4. Proxy for Android: Orbot You need to root your phone. Otherwise, you still can use the following applications prepared to work with Orbot:
- Orweb browser - ChatSecure - DuckDuckGo search engine - Add-on proxy mobile for firefox - Twitter proxy - StoryMaker - Mobile Martus
2.5. VPN It secures your computer's internet connection to guarantee that all of the data you're sending and receiving is encrypted and secured from prying eyes. VPNs to connect remote datacenters, and individuals can use VPNs to get access to network resources when they're not physically on the same LAN (local area network), or as a method for securing and encrypting their communications when they're using an untrusted public network. Getting and dropping sensetive Information (Images, Docs, Videos) from your trusted Data-Center in an untrusted WIFI- Zone. https://we.riseup.net/riseuphelp+en/vpn-howto 2.5. Avoid using a phone: netbook with Tails For Keypersons who are preparing and doing a call for action. Gather physically if possible and use tails from your laptops spreading the first calls. Don't use mobile phones in this stage. Sending out the call for action. Instruct target groups that everyone should use/pass the same "call on action". For communicating decentral (non physical) use an encrypted irc on trusted ISPS. 2.6. Avoid using your phone Dumbphone/Multifunctional phone/ Burner phone and pre-paid sim card. You can also proctect your phone with signal blocking pouches, use the faraday'cage on your phone with RF Shielding Fleece. http://killyourphone.com/ 2.8 To avoid fake base stations in GSM/UMTS network Both law enforcement agencies and criminals use IMSI-Catchers, which are false mobile towers acting between the target mobile phone(s) and the service providers real towers. As such it is considered a Man In the Middle (MITM) attack. The FBI or local police might deploy the device at a protest to obtain a record of everyone who attended with a cell phone. See the talk of Chris Paget called "Practical Cellphone Spying" at defcon 18 for a "how to". The projet called "Android IMSI-CATCHER Detactor " is a Android-based project to detect and avoid fake base stations. Find step by step installation guide at https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/wiki/Installation. 3// TOOLS TO SPREAD THE CALL FOR ACTION SAFELY 3.1. Twitter proxy 3.2. Facebook proxy 3.3. Tor browser bundle 3.4. Anonymous e-mailing 4// TOOLS TO COMMUNICATE THE ACTION 4.1. Streaming 4.2. Reporting: StoryMaker 4.3. Creating evidence: InformaCam 4.4. Documenting: Mobile Martus http://benetech.org/2013/10/02/introducing-mobile-martus-1-0/ 5. Images and illustrations for the previous tools Metadata: https://picup.it/media/pictures/sticker_375x360_Metadata.png
