Anonionman

Ghost server

Security ideje: #1 (‘Ghost server’)

SSH se moze zastiti skoro potpuno od izlozenosti internetu ukoliko postavite u podesavanjima da SSH server slusa na lokalnoj adresi. Sta? Kako? Zasto? Ideja je jednostavna:

  1. Napraviti VPN kao sto je Wireguard (UDP) – ovo je naglaseno zato sto nmap skenom se ne moze utvrditi da li je na nekom UDP portu zaista neki servis pokrenut ili nije zato sto UDP ne potvrdjuje da je paket stigao, tj. ne odgovara na ping ili poslati paket.
  2. Wireguard klijentima dodeljuje interne/lokalne/privatne IP adrese recimo iz opsega 10.10.10.0/24.
  3. SSH server moze da slusa na 10.10.10.1 internoj IP adresi na portu 22 Na ovaj nacin, korisnici se sa svojih racunara prvo povezu na VPN i njihov racunar dobije adresu unutar 10.10.10.0/24 mreze, recimo 10.10.10.2 i onda se unutar VPN tunela moze povezati na SSH koji je na 10.10.10.1 adresi na portu 22.

Benefiti: Napadac ne moze da skenira SSH i otkrije ga i pokusa ga napasti. Konekcija je dvostruko zasticena. Potrebno je manje napora uloziti oko zastite servera i SSH servisa, nadgledanje logova i azuriranja. VPN tunel cak ne mora biti tzv. Puni tunel, i mozete rutirati samo saobracaj koji je za 10.10.10.0/24 kroz VPN tunel, a ostali saobracaj van tunela kao kada niste povezani na VPN – to je tzv Split-tunnel

Nedostatci: Ukoliko pukne VPN ne moze te povezati na server (osim ako server nije na VPS pa imate WEB emergency konzolu ili IPMI/ILO/IDRAC port ka serveru povezan i podesen).

https://cloud.ibm.com/docs/ssh-keys?topic=ssh-keys-configuring-ssh-to-listen-only-on-a-private-network

##Sta se vidi na klijentu: client wg connwction, network and status

wg client conf

client ping ssh server in WG tunnel and ssh connection to it

##Kako je server konfigurisan:

wg server config

ssh server conf

wg server connections and status

fw status on server

##Nmap scan nmap scan of WG server port

nmap cannot tell the difference between UPD port that has real service running behind, and the one that doesn't. Even more UDP cannot tell if port is open or not, Firewalled or not.

https://signal.org/blog/help-iran-reconnect/

https://www.youtube.com/watch?v=4N9raG2g9zo Just a Signal censorship hype IMO. I am Signal user from 2015. and was following Moxie Marlenspike and his encryption solutions even before there was a Signal app. Moxie was nothing but a hostile to any other fork of his Signal app, did not like forks using his servers, or his Signal branded name in forks like LibreSignal. You can say Moxie did not liked idea of others being able to use his technology in other ways. Some forks were even better than Signal, and were working without GooglePlayServices even before Signal. And if that is the case, Moxie want only him running Signal infrastructure it is kind of tasteless of him, mildly speaking, asking people to host proxies for him when Country censor Signal. Signal was using domain-fronting to combat censorship, so they should go with similar approach now. I see no point in helping Signal if they are not serious about their infrastructure issues and how in that aspect they are not different that What'sApp or Facebook Messenger. And just as reminder they had an world-wide outage at the same time as their competitor in past. 1. Telegram and Signal 2018 2. []() From Privacy and Anonymity point of view Signal requires phone numbers for phone app usage, but also for Desktop, you can only use it if you already have it installed on phone. That is mandatory, not even opt-in or opt-out. And Yes, Signal is somewhat better than What'sApp, Viber or Facebook's Messenger, but only in two categories: it is open-source and it requires and collects less personal information from it's users. If Signal really want to fight censorship, it should make phone number registration optional, and users to run and register on other servers, in other words be federated like XMPP/Jabber, or email.

In the past Signal used technique called domain fronting to combat censorship in other countries 5 years ago. link

So in stead of outsourcing Signal services they chose to use services like Amazon and Google in their advantage to combat censorship. So, this tactic is rather ironic since Amazon and Google censored Parler in 2021 in US. So why is Signal hoping for any better and haven't they learned that the only way of surviving big-tech censorship or country wide censorship is trough collective effort on network level like in case of decentralized, distributed, federated or P2P platforms and protocols.

Some of those examples can be: 1.Briar 2.XMPP/Jabber 3.Jami 4.IRC

All of them supporting encryption both on network layer SSL/TLS and on message layer E2EE like OTR/GPG/Omemo.

And same goes for other chat platforms like Wire, Telegram or Threema.

[UPDATE1]: Other people are saying actually the same as me about Signal and Censorship problem and how Decentralization could change that. https://mastodon.social/web/statuses/105682606045005528

But this situation can be also interpreted as benchmark for Signal and other chat platforms and we can now see what platforms perform better in difficult situation.

Like never ending cat-and-mouse like game with CryptoWars there is ever present push by the governments to criminalize online anonymity. In most cases there is some pretext like war on terrorism or preventing online bulling and child pornography. However, on the other side those could easily be just a cover stories by governments intended to increase surveillance and control over it’s citizens. We already have increased number of countries requesting ID for buying SIM cards (prepaid), increased number of cameras in cities, and increased censorship and deplatforming on social media. All of those indicate increasing authoritarianism government control in cyber realm, but with what results to justify it?

How many terrorist attacks are prevented by GCHQ and NSA surveillance programs for more than decade now? I have a feeling that if they did they would not stop talking about it, as they want to show how efficient they are.

Every citizen has a right to privacy in physical world as well as in digital one, that is why you do have window rolls and curtains on your windows and doors in your home.

Anonymity and privacy in digital world are also essential for journalists and activists as they need them to protect their sources and hold people in power accountable before public. Without possibility for online anonymity there wouldn’t be a way for people to have leaks of information on government corruption and war crimes. We wouldn’t have Edward (Joseph) Snowden, Chelsea (Bradley Edward) Manning, Wikileaks and Julian Assange.

And there are also another ways to fight terrorism, trough following money, guns, explosives and drugs being bought and sold in real world. In other words basic investigation techniques. Having mandatory education, training and psychological tests before person can buy weapons may also help reducing the risk of domestic terrorism.

And for online malicious groups like terrorists and pedophiles, the law enforcement is already doing infiltration, which was resulting in arrests for majority of publicly known cases. Breaking or weakening encryption wouldn’t influence the success rate as those malicious groups will eventually make OpSec mistakes and get caught by watchful eye of government. Just remember the case of SilkRoad and Ross Ulbricht. And majority of social networks do not have End-to-End encryption for direct messaging or chats so there is really no need for anything to be done, as they are already not privacy friendly by design towards their users. This is the current situation that enables companies operating those social networks and their platform to easily be complicit with governments request for user's private data. Perfect example of this are Facebook and Twitter.

And it is not just the government who want more power by more control and surveillance, but those big tech companies also do not want it's users to have private and encrypted chats and communication since that data is very valuable in data mining and profiling every user, so they can sell that data to others and better serve you ads. Facebook especially put an extra effort every time someone invented new way of encrypting their chats so Facebook cannot read it: 1. crypter, 2. otron, 3. xmpp+OTR.

Problem of online bulling on social networks does not have anything to do with anonymity, since companies control the accounts and can suspend, censor, flag or ban anyone who violates their Terms of Service, as they are already doing policing over their platforms. In any case, anonymous or not, bad actors and violators of ToS are going to face a consequence of account suspension or removal, but without anonymity far more people would be scared to report of government misconduct, or misconduct of people in the ruling and ones in high and influential positions.

And this is not a new idea, in 2007 South Korea wanted to prevent further online bulling and introduced so called Real-name system

Online Anonymity: pro @ contra

Like never ending cat-and-mouse like game with CryptoWars (in Serbian: part 1, part 2, part 3, part 4), there is ever present push by the governments to criminalize online anonymity. In most cases there is some pretext like war on terrorism or preventing online bulling and child pornography. However, on the other side those could easily be just a cover stories by governments intended to increase surveillance and control over it’s citizens. We already have increased number of countries requesting ID for buying SIM cards (prepaid), increased number of cameras in cities, and increased censorship and deplatforming on social media. All of those indicate increasing authoritarianism government control in cyber realm, but with what results to justify it?

How many terrorist attacks are prevented by GCHQ and NSA surveillance programs for more than decade now? I have a feeling that if they did they would not stop talking about it, as they want to show how efficient they are.

Every citizen has a right to privacy in physical world as well as in digital one, that is why you do have window rolls and curtains on your windows and doors in your home.

Anonymity and privacy in digital world are also essential for journalists and activists as they need them to protect their sources and hold people in power accountable before public. Without possibility for online anonymity there wouldn’t be a way for people to have leaks of information on government corruption and war crimes. We wouldn’t have Edward (Joseph) Snowden, Chelsea (Bradley Edward) Manning, Wikileaks and Julian Assange.

And there is also another ways to fight terrorism, trough following money, guns, explosives and drugs being bought and sold in real world. Having mandatory education, training and psychological tests before person can buy weapons.

And for online malicious groups like terrorists and pedophiles, the law enforcement is already doing infiltration, which was resulting arrests in majority of publicly known cases. Breaking or weakening encryption wouldn’t influence the success rate as those malicious groups will eventually make OpSec mistakes and get caught by watchful eye of government. And majority of social networks do not have End-to-End encryption for direct messaging or chats so there is really no need for anything to be done, as they are already not privacy friendly by design towards their users.

Problem of online bulling on social networks does not have anything to do with anonymity, since companies control the accounts and can suspend, censor, flag or ban anyone who violates their Terms of Service, as they are already doing policing over their platforms. In any case, anonymous or not, bad actors and violators of ToS are going to face a consequence of account suspension or removal, but without anonymity far more people would be scared to report of government misconduct, or misconduct of people in the ruling and ones in high and influential positions.