How to encrypt your VoIP calls

Voice over IP calls are not secure

VoIP calls are transmitted over the Internet unencrypted, the data packets can easily be intercepted by a malicious hacker to record the calls and listening in, a simple packet sniffer like WireShark is all that it is needed to eavesdrop on a VoIP call, no high skills are involved.

How to encrypt VoIP calls

1. Use Zfone to add encryption to your VoIP client: Zfone works on top of your unencrypted VoiP software watching for VoiP data packets going in and out of your computer, when it finds them it ciphers the packets encrypting the VoIP call, there is also a man-in-the-middle (MiTM) attack countermeasure by displaying a short authentication string for the user to verbally compare over the phone witht the other end, Zfone is open source software using the ZRTP protocol, there are no backdoors of any kind included.

   Before considering Zfone to secure your VoIP calls have into account that the software must be installed by both callers and Zfone does not work with Skype because Skype uses a closed source protocol not compliant with the standard VoIP protocol.

   

   Zfone VoIP encryption software

2. Use a Virtual Private Network (VPN): A VPN like ibVPN can encrypt all of your internet traffic routing it through it’s encrypted OpeVPN tunnel, this will include all of your VoIP calls. Routing your VoIP calls through a VPN will slightly increase the bandwidth requirement and produce some CPU overhead.

   One benefit of using a VPN is that if your ISP or a corporate firewall is blocking VoIP calls using a VPN for VoIP will get around Internet filters, they won’t even know you are making a call, it will also get around state sponsored surveillance which is normally carried out at ISP level.

   

   Wiretapping VoIP password

3. Use VoiP software with built in encryption: Some VoIP clients like Skype have built-in encryption used to cipher VoIP data packets, if you adopt this solution to secure your phone calls, try to choose voice over IP software compatible with as many other VoIP clients as possible using open source encryption (not Skype) this will make it much harder to introduce a backdoor and it might not require the other end to have the same VoIP client installed for encryption to work.

   VoIP software using encryption: PhonerLite ; TiviPhone ; OctroTalk

Tq http://www.hacker10.com

Quick and easy E-mail encryption using Safester

Review email encryption software Safester

Safester is a free email encryption program using public and private key encryption DSA/Elgamal 2048 bits andAES 256 bits to secure your messages, the program is written using Java, it works in Windows, MAC OS and Linux.

In order to use Safester to send encrypted emails the receiver and the sender both will need to have the software installed, if the receiver doesn’t have an account when he receives an encrypted message a notification from Safester will be sent with an invitation to download the program.

After downloading and installing Safester you will need to create an account, this will create your public and private key encryption keys, the passphrase you use it is not stored in the servers and only known to you, there is no way for Safester to recover your passphrase they do not have access to it and there is no backdoor, you can set up a password recovery email system from inside your account if you want, this is optional.

E-mail encryption software Safester

All of the encrytion is carried out locally in your computer, communications with Safester servers are encrypted, in the unlikely event that someone manages to intercept the transmission you would still be protected because no data ever leaves the computer unencrypted, the messages you send and receive are archived encrypted in Safester servers in Switzerland. The free version of this email encryption service allows for a 20MB of email storage Inbox and email attachments have 512Kb maximum size, there are paid for plans for those who need personalized support, a bigger storage inbox and sending larger attachments.

I found the email client very lean in features, you can compose messages in HTML, there is a built-in spell checker for English and French, vacation auto-responder, proxy settings, address book and message folders, it is enough to get the job done but without bells and whistles.

One of Safester’s best features it is the ability of setting up double authentication using your smart phone and your passphrase to log into your email account, the One Time Authentication system works with the iPhone and Android.

Email encryption Safester advantages

• Easy maintenance free email encryption for newbies (no learning required)

• You can use any email address you like (Hotmail, Yahoo, etc)

• Email client can restrict printing and forwarding of emails

• Email client can be configured to send messages using a proxy

Email encryption Safester disadvantages

• Both, sender and receiver need to have Safester installed

• You are forced to use Safester’s own email client (which is very simple)

• Your need to trust a third party with your security

Safester review conclusion

I you are a geeky person who knows how to use GPG/PGP to encrypt emails, you will be better off using your own software for email encryption (e.g. Enigmail), this way you will not have to rely on a third party to take care of your security and you will be able to use any email client you like for encryption without forcing others to download the same software you have installed.

OpenPGP email encryption program Safester

If you have a company and do not have the time and resources to train your workers in email security and encryption, Safester is for you, anyone who knows how to send an email can use Safester, encryption could not get any easier, the great advantage Safester has over any other email encryption software it is simplicity and easy to use, Safester will save businesses money by not having to spend time on training staff.

Visit Safester homepage

Tq http://www.hacker10.com

Freeware programs for full disk encryption

Why use full disk encryption

If you encrypt your whole hard drive including your operating system you will not have to worry about wiping data, clearing the Internet browser cache, deleting temporary files and encrypting individual files, all you will have to worry about is choosing a strong passphrase that can not be broken using a brute force attack (trying dictionary words).

The only way to access a fully encrypted operating system is by getting access to the computer while it is switched on (decrytped), you will save lots of time if you decide to encrypt your full operating system, it is not difficult and there is free software for that. Windows Vista and 7 come with BitLocker Drive Encryption for full disk encryption but only the more expensive business high end editions do and it has been designed for businesses with few home user features.

Full disk encryption software without backdoor

Truecrypt (Free): It’s wizard driven menu will guide you through the whole encryption process, there are many algorithm choices, if you do not understand what they mean leave all of the default choices on, they are secure enough for everyone. Truecrypt can encrypt external devices, create virtual encrypted drives and create a hidden encrypted operating system, to be used if you are forced to give up the password.

You will find it easy to find support for Truecrypt at computer security forums and Usenet groups as it is one of the most used full disk encryption programs.

Truecrypt encryption algorithm

DiskCryptor (Free): Open source encryption software, it can encrypt partitions that have already data on them, it supports AES, Twofish and Serpent encryption algorithms, allows you to encrypt USB flash drives and external hard disks with automatic mounting, support for key files, option to place the boot loader on an external device.

DiskCryptor full disk encryption

Steganography for dummies

What is steganography?

The word steganography has Greek origins, it means concealed writing, in the digital world steganography (aka steg or stego) consists in hiding data inside data, it is mostly used to hide text inside pictures or sound files butany kind of data can be hidden and any kind of file can be used as a carrier file.

Steganographic software takes advantage of the way binary works where the bits towards the right of a file are the ones with less significance, changing them results in little distortion for the file, an example of this would be changing the red colour of a few pixels on a digital photography for a different tone of red that it is not noticeable to the human eye, since a photography can have millions of pixels slightly changing a thousand of them would be very hard to notice without the the original picture to compare with.

Another use for steganography is digital watermarking, the film industry is known to embed an invisible watermark in their preview films, before release, if one of these copies is leaked and found in a file sharing site they can track down who the person responsible for that copy was. Steganographic software is commonly used in conjunction with encryption, the data is encrypted before hiding it to add an extra layer of security, if the hidden data is ever found it would still be protected by a password.

Steganography advantages over encryption

It does not attract attention: Encrypting a message gives away that there is something of value and this will attract unwanted attention.

Packet sniffing barrier: Encrypted PGP email messages start with a line identifying them as an encrypted PGP message, making it easy for a packet sniffer on an ISP to flag encrypted PGP emails by just scanning for the word PGP or GnuPG, this can not be used against steganography.

Makes Internet surveillance difficult: If someone’s Internet activities are being monitored visiting Flickr and uploading personal family photos with hidden messages will not trigger any alarm but sending encrypted messages and visiting a political discussion forum will.

Difficult to prove it exists: In some countries like the United Kingdom you can be required by the police to provide the password to your encrypted files, refusing to do so carries a prison sentence, if the data has been hidden inside a photograph the police would first have to show beyond reasonable doubt that there is definitely something hidden inside the file.

Methods to detect steganography

Steganalysis is the art of discovering hidden steganographic messages, this science is not perfect, it is possible for steganalysis not to detect steganographic files if the data has been very well concealed and the original file, before data has been hidden within it, is not available for analysis.

Image steganalysis

Steganographic software embeds information in front of the hidden message, this information contains details about the length of the message, compression method, and anything else the developer chooses, after all the data has to be readable at some point, if the software used to hide the information (aka payload) inserts some unique characteristic in the header then it can be proved the file has been tampered with.

A good method to find hidden messages inside pictures is by using an hexadecimal editor and read the image header first bytes, for example a GIF image seen by an hexadecimal editor will always read “47 49 46 38″, it means “GIF” in ASCII code, if a GIF image has been used to hide a message within it when viewed with an hex editor the first identifying bytes will be different from the standard ones.

There are automated tools to detect steganography, one such tool is Stegdetect, capable of detecting messages in jpeg images, after a hidden message has been found a brute force attack can be launched, with dictionary words attempting to guess the password and expose the data.

Highly compressed data like .rar, .mp3 or .jpeg files make it more difficult to hide data inside because they have less “spare” bits available, if you want to make it tough for someone to find your hidden data use an uncompressed carrier file, like .bmp for images and .wav for sound.

How to hide text in pictures and other files

There are various steganography programs available to hide text or files inside photographs, sound files and executable files, you can even hide data inside documents and HTML code, any kind of electronic file can be used to hide data within it.

StegHide: Open source project, it can hide data inside images (.jpeg, .bmp) and audio files (.wav, .au)

MSU StegoVideo: It hides any kind of file inside a video and protects it with a password.

Steganos Privacy Suite (Not free): It hides data inside pictures and sound files and encrypts is with AES256.

Mp3Stego: It encrypts and hides data inside .mp3 files, free program with source code available to look at.

Tq http://www.hacker10.com

How to Encrypt any webmail text message with encipher.it

Encrypt Gmail, Hotmail and Yahoo email

Encipher.it will encrypt and password protect your text messages using symmetric encryption implemented with AES256 and PDBKF2 (Password-Based Key Derivation Function) for key generation, the site itself uses a SSL digital certificate to protect against MITM (Man In The Middle) attacks, the best part is that it works with all services, you can encrypt your webmail messages no matter who your provider is, another possible use is posting of encrypted messages on Usenet or your Facebook account, encryption and decryption is performed in your browser using javascript, no data leaves your browser in plain text. To encrypt the messages you use a bookmarklet that takes you to the encipher.it website, there you will find a box where to enter text, the same box is used for encryption and decryption, when the recipient gets a coded message a one line phrase with a link link tells them where to decrypt it, the bad news is that they will need to know the password too, this should have been transmitted previously through a secure channel, attachments can not be encrypted.

Encipher.it webmail encryption

Encipher.it can be used anywhere, i.e. Internet cafes and libraries, but anything you type in the keyboard of a computer that isn’t yours could easily be recorded, when you use a public computer you should not trust anything on it, if the website were to become too popular it might be easily blocked by an authoritarian regime ISP but that isn’t likely because copycats would then sprout around.

I would only be happy to use this browser based symmetric encryption system if the other part is very lazy about security or doesn’t want to learn about it and the security needs are low. Encrypting text, even with something as simple as ROT13 will leave the average computer users scratching their heads and it will fool email services that scan email messages to introduce contextual advertising on them, like Gmail, for serious security it is better using a public key encryption based system, i.e. PGP, what encipher.it has on its favour is convenience and easy of use.

Visit Encipher.it website

Tq http://www.hacker10.com

How to decrypt a file using GPG/GnuPG

Decrypting a file is just as easy. Simply run this command:

Code:

# gpg --output 
 --decrypt 

Replace

with the name of the file you want to produce, decrypted. Replace with the name of the encrypted file. For example:

Code:

# gpg --output test.txt --decrypt /home/tor/test.txt.gpg

If you only have the the pass phrase (password) you can decrypt using --symmetric

Code:

# gpg --output  --symmetric .gpg

Enjoy ubuntu... ;)

How to encrypt a file using GPG/GnuPG

Encrypting a file is easy, you'll need the name you used above (which I told you to remember). Issue the command below:

Code:

# gpg -e -r  

Which you will need to replace and with valid values. Let us use the name I used, tor, and /home/tor/test.txt as the file name.

Code:

# gpg -e -r tor /home/tor/test.txt

Alternatively you can use the long version of the command:

Code:

# gpg --encrypt --recipient 'tor' /home/tor/test.txt

Here is the file before encryption:

Code:

this is a test

and here is the file after encryption:

Code:

<85>^B^N^CeK^Z^MÂó ?l|[- !S>Ã<91><9f>Mo9âg²ê^?#Y ^XôÃ]ëF$f¿a^WCô^Uqøh"v^]Ã:§`^Nÿ Ã^\Ã

ðïe°¾Ã¹Ã*G/j>^Y<95>½UI<9f>d^F<83>÷@Ã<89>^U;Ã(o^VCAÃHÃ¥?<9c>U~ü<86>w;ZXÃ>§¥ÃL[º² ag^[^[^]        k^HC<8b>^A<98>^P<86>^GFZÃöE<9f>ÿl'+<9b>+3 Ã(Ã<8a>î±ÃÃ86>>             þ^ZÿãWÃ<85>^[^?^K<82>Ã>KÃ4^RZE--xS^E£OlÃÃÃ

FöÃ*<9e>¹».~S{Ãf<855ã>M|M^Hºy¼?^\|S:[Ãì<8b>çl<94>*b}<93>éÃ7K´<92>î¨*Ã>¶!¯ÃC0´D<95>>

D^PÃh<9d>ÃÃöBÃ^U$^_<89>´é^Cô4þÃÃ

CÃ<83>^X©^Tøà       ¶£=<8b>aYüö¢^YóiTut<8e>^^      VA<8a>|Ãâ<95>§S7¢¢ýGO%T*tÃ<81>Ã=ê^]¿/ôCÿÃhKóL^AÃô]?^NÃ=<8e>!Ãþ¼G^MVg>ð<8e>^]<9a>)Ãà Ã<84>»KÃ<96>8ÃÃ^C^Olú÷©       LÃñªÃ^A^VÃ(^E<94>Ã^?mÃþF?Ã<90>qÃ>^^p^@^^

\|9<84>¢6<8d>^VðgäùÃ<8e>µéuÃã<90><8c>^R^X! <9d><90>^\ïñQ<94>yty>F]¹2Ã^XmìK<9d>:kT

GPG will add a ".gpg" to the end of the encrypted file. This leaves the original intact and makes an encrypted copy.

Enjoy ubuntu... ;)

How to use GPG/GnuPG

This guide will show you how to use and setup GPG for file encryption. GPG is an encryption and signing tool for the Linux/Unix operating system. GPG is the main program for the GnuPG system.

Getting Started
To start you need to First run the generation commands:

Code:

# gpg --gen-key

gpg (GnuPG) 1.4.5; Copyright (C) 2006 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Please select what kind of key you want:
  (1) DSA and Elgamal (default)
  (2) DSA (sign only)
  (5) RSA (sign only)

Use the default (1) and press enter.

Code:

DSA keypair will have 1024 bits.
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)

Use the default here, press enter.

Code:

Requested keysize is 2048 bits
Please specify how long the key should be valid.
        0 = key does not expire
       = key expires in n days
     w = key expires in n weeks
     m = key expires in n months
     y = key expires in n years

Again use the default.

Code:

Key does not expire at all
Is this correct? (y/N)

Enter "y" and press enter.

Code:

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
   "Heinrich Heine (Der Dichter) "

Real name:

Type in a name to identify the key. I use my first name for this example I will use "tor". Remember the name you use (used later).

Then enter your email address and comment.

Code:

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?

Press O and then Enter.

Code:

Enter passphrase:

Type a unique passphrase. This is like a password.

Code:

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
++++++++++++++++++++++++++++++.+++++.+++++++++++++++.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.++++++++++.++++++++++.>+++++.................................................................>+++++.<+++++.......................................>+++++.....+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 277 more bytes)

Type some buttons or open another terminal. Now you have a key generated with your first name and should not get that error above.

Enjoy ubuntu... ;)